Bases: object
Perform a soft check of a named policy.
This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.
name – Policy name to check
bool indicating if the policy is allowed.
Bases: APIPolicyBase
Bases: APIPolicyBase
Bases: APIPolicyBase
Perform a soft check of a named policy.
This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.
name – Policy name to check
bool indicating if the policy is allowed.
Signal whether the image actually exists or not.
False if the image is only being proposed by a create operation, True if it has already been created.
Bases: APIPolicyBase
Bases: APIPolicyBase
Perform a soft check of a named policy.
This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.
name – Policy name to check
bool indicating if the policy is allowed.
Bases: APIPolicyBase
Check that legacy behavior on create with owner is preserved.
Legacy behavior requires a static check that owner is not inconsistent with the context, unless the caller is an admin. Enforce that here, if needed.
context – A RequestContext
properties – The properties being used to create the image, which may contain an owner
exception.Forbidden if the context is not an admin and owner is set to something other than the context’s project
Replicate the DB-layer admin-or-owner check for the API.
Much of the API code depends on hard-coded admin-or-owner enforcement in the DB or authorization layer, as the policy layer is largely a no-op by default. During blueprint policy-refactor, we are trying to remove as much of that as possible, but in certain places we need to do that (if secure_rbac is not enabled). This transitional helper provides a way to do that enforcement where necessary.
context – A RequestContext
image – An ImageProxy
exception.Forbidden if the context is not the owner or an admin
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.