fix project|use|role-list error
[osm/NBI.git] / osm_nbi / admin_topics.py
index 9ecb61b..7e71459 100644 (file)
@@ -22,7 +22,8 @@ from osm_nbi.validation import user_new_schema, user_edit_schema, project_new_sc
     vim_account_new_schema, vim_account_edit_schema, sdn_new_schema, sdn_edit_schema, \
     wim_account_new_schema, wim_account_edit_schema, roles_new_schema, roles_edit_schema, \
     k8scluster_new_schema, k8scluster_edit_schema, k8srepo_new_schema, k8srepo_edit_schema, \
-    validate_input, ValidationError, is_valid_uuid    # To check that User/Project Names don't look like UUIDs
+    osmrepo_new_schema, osmrepo_edit_schema, \
+    validate_input, ValidationError, is_valid_uuid  # To check that User/Project Names don't look like UUIDs
 from osm_nbi.base_topic import BaseTopic, EngineException
 from osm_nbi.authconn import AuthconnNotFoundException, AuthconnConflictException
 from osm_common.dbbase import deep_update_rfc7396
@@ -324,14 +325,14 @@ class CommonVimWimSdn(BaseTopic):
         # do not remove reference, but order via kafka to delete it
         if session["project_id"] and session["project_id"]:
             other_projects_referencing = next((p for p in db_content["_admin"]["projects_read"]
-                                               if p not in session["project_id"]), None)
+                                               if p not in session["project_id"] and p != "ANY"), None)
 
             # check if there are projects referencing it (apart from ANY, that means, public)....
             if other_projects_referencing:
                 # remove references but not delete
-                update_dict_pull = {"_admin.projects_read.{}".format(p): None for p in session["project_id"]}
-                update_dict_pull.update({"_admin.projects_write.{}".format(p): None for p in session["project_id"]})
-                self.db.set_one(self.topic, filter_q, update_dict=None, pull=update_dict_pull)
+                update_dict_pull = {"_admin.projects_read": session["project_id"],
+                                    "_admin.projects_write": session["project_id"]}
+                self.db.set_one(self.topic, filter_q, update_dict=None, pull_list=update_dict_pull)
                 return None
             else:
                 can_write = next((p for p in db_content["_admin"]["projects_write"] if p == "ANY" or
@@ -397,6 +398,7 @@ class WimAccountTopic(CommonVimWimSdn):
 class SdnTopic(CommonVimWimSdn):
     topic = "sdns"
     topic_msg = "sdn"
+    quota_name = "sdn_controllers"
     schema_new = sdn_new_schema
     schema_edit = sdn_edit_schema
     multiproject = True
@@ -418,8 +420,8 @@ class SdnTopic(CommonVimWimSdn):
         input = super()._validate_input_new(input, force)
         return self._obtain_url(input, True)
 
-    def _validate_input_edit(self, input, force=False):
-        input = super()._validate_input_edit(input, force)
+    def _validate_input_edit(self, input, content, force=False):
+        input = super()._validate_input_edit(input, content, force)
         return self._obtain_url(input, False)
 
 
@@ -471,6 +473,24 @@ class K8sClusterTopic(CommonVimWimSdn):
                 final_content["_admin"][rlist] = []
             final_content["_admin"][rlist] += repos[k]
 
+    def check_conflict_on_del(self, session, _id, db_content):
+        """
+        Check if deletion can be done because of dependencies if it is not force. To override
+        :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
+        :param _id: internal _id
+        :param db_content: The database content of this item _id
+        :return: None if ok or raises EngineException with the conflict
+        """
+        if session["force"]:
+            return
+        # check if used by VNF
+        filter_q = {"kdur.k8s-cluster.id": _id}
+        if session["project_id"]:
+            filter_q["_admin.projects_read.cont"] = session["project_id"]
+        if self.db.get_list("vnfrs", filter_q):
+            raise EngineException("There is at least one VNF using this k8scluster", http_code=HTTPStatus.CONFLICT)
+        super().check_conflict_on_del(session, _id, db_content)
+
 
 class K8sRepoTopic(CommonVimWimSdn):
     topic = "k8srepos"
@@ -502,6 +522,15 @@ class K8sRepoTopic(CommonVimWimSdn):
         return oid
 
 
+class OsmRepoTopic(BaseTopic):
+    topic = "osmrepos"
+    topic_msg = "osmrepos"
+    schema_new = osmrepo_new_schema
+    schema_edit = osmrepo_edit_schema
+    multiproject = True
+    # TODO: Implement user/password
+
+
 class UserTopicAuth(UserTopic):
     # topic = "users"
     # topic_msg = "users"
@@ -655,7 +684,7 @@ class UserTopicAuth(UserTopic):
         Get complete information on an topic
 
         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
-        :param _id: server internal id
+        :param _id: server internal id or username
         :return: dictionary, raise exception if not found.
         """
         # Allow _id to be a name or uuid
@@ -665,9 +694,9 @@ class UserTopicAuth(UserTopic):
         if len(users) == 1:
             return users[0]
         elif len(users) > 1:
-            raise EngineException("Too many users found", HTTPStatus.CONFLICT)
+            raise EngineException("Too many users found for '{}'".format(_id), HTTPStatus.CONFLICT)
         else:
-            raise EngineException("User not found", HTTPStatus.NOT_FOUND)
+            raise EngineException("User '{}' not found".format(_id), HTTPStatus.NOT_FOUND)
 
     def edit(self, session, _id, indata=None, kwargs=None, content=None):
         """
@@ -686,10 +715,9 @@ class UserTopicAuth(UserTopic):
         if kwargs:
             BaseTopic._update_input_with_kwargs(indata, kwargs)
         try:
-            indata = self._validate_input_edit(indata, force=session["force"])
-
             if not content:
                 content = self.show(session, _id)
+            indata = self._validate_input_edit(indata, content, force=session["force"])
             self.check_conflict_on_edit(session, content, indata, _id=_id)
             # self.format_on_edit(content, indata)
 
@@ -784,7 +812,7 @@ class UserTopicAuth(UserTopic):
         except ValidationError as e:
             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
 
-    def list(self, session, filter_q=None):
+    def list(self, session, filter_q=None, api_req=False):
         """
         Get a list of the topic that matches a filter
         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
@@ -954,7 +982,7 @@ class ProjectTopicAuth(ProjectTopic):
         else:
             raise EngineException("Project not found", HTTPStatus.NOT_FOUND)
 
-    def list(self, session, filter_q=None):
+    def list(self, session, filter_q=None, api_req=False):
         """
         Get a list of the topic that matches a filter
 
@@ -1006,10 +1034,9 @@ class ProjectTopicAuth(ProjectTopic):
         if kwargs:
             BaseTopic._update_input_with_kwargs(indata, kwargs)
         try:
-            indata = self._validate_input_edit(indata, force=session["force"])
-
             if not content:
                 content = self.show(session, _id)
+            indata = self._validate_input_edit(indata, content, force=session["force"])
             self.check_conflict_on_edit(session, content, indata, _id=_id)
             self.format_on_edit(content, indata)
 
@@ -1051,9 +1078,9 @@ class RoleTopicAuth(BaseTopic):
             if role_def[-1] == ":":
                 raise ValidationError("Operation cannot end with ':'")
 
-            role_def_matches = [op for op in operations if op.startswith(role_def)]
+            match = next((op for op in operations if op == role_def or op.startswith(role_def + ":")), None)
 
-            if len(role_def_matches) == 0:
+            if not match:
                 raise ValidationError("Invalid permission '{}'".format(role_def))
 
     def _validate_input_new(self, input, force=False):
@@ -1070,7 +1097,7 @@ class RoleTopicAuth(BaseTopic):
 
         return input
 
-    def _validate_input_edit(self, input, force=False):
+    def _validate_input_edit(self, input, content, force=False):
         """
         Validates input user content for updating an entry.
 
@@ -1221,7 +1248,7 @@ class RoleTopicAuth(BaseTopic):
             raise AuthconnConflictException("Found more than one role with filter {}".format(filter_q))
         return roles[0]
 
-    def list(self, session, filter_q=None):
+    def list(self, session, filter_q=None, api_req=False):
         """
         Get a list of the topic that matches a filter
 
@@ -1306,9 +1333,9 @@ class RoleTopicAuth(BaseTopic):
         if kwargs:
             self._update_input_with_kwargs(indata, kwargs)
         try:
-            indata = self._validate_input_edit(indata, force=session["force"])
             if not content:
                 content = self.show(session, _id)
+            indata = self._validate_input_edit(indata, content, force=session["force"])
             deep_update_rfc7396(content, indata)
             self.check_conflict_on_edit(session, content, indata, _id=_id)
             self.format_on_edit(content, indata)