Coverage for manila/policies/share_snapshot.py: 100%

1# Licensed under the Apache License, Version 2.0 (the "License"); you may 

2# not use this file except in compliance with the License. You may obtain 

3# a copy of the License at 

4# 

5# http://www.apache.org/licenses/LICENSE-2.0 

6# 

7# Unless required by applicable law or agreed to in writing, software 

8# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 

9# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the 

10# License for the specific language governing permissions and limitations 

11# under the License. 

12 

13from oslo_log import versionutils 

14from oslo_policy import policy 

15 

16from manila.policies import base 

17 

18 

19BASE_POLICY_NAME = 'share_snapshot:%s' 

20 

21DEPRECATED_REASON = """ 

22The share snapshot API now supports scope and default roles. 

23""" 

24 

25deprecated_snapshot_get = policy.DeprecatedRule( 

26 name=BASE_POLICY_NAME % 'get_snapshot', 

27 check_str=base.RULE_DEFAULT, 

28 deprecated_reason=DEPRECATED_REASON, 

29 deprecated_since=versionutils.deprecated.WALLABY 

30) 

31deprecated_snapshot_get_all = policy.DeprecatedRule( 

32 name=BASE_POLICY_NAME % 'get_all_snapshots', 

33 check_str=base.RULE_DEFAULT, 

34 deprecated_reason=DEPRECATED_REASON, 

35 deprecated_since=versionutils.deprecated.WALLABY 

36) 

37deprecated_snapshot_force_delete = policy.DeprecatedRule( 

38 name=BASE_POLICY_NAME % 'force_delete', 

39 check_str=base.RULE_ADMIN_API, 

40 deprecated_reason=DEPRECATED_REASON, 

41 deprecated_since=versionutils.deprecated.WALLABY 

42) 

43deprecated_snapshot_manage = policy.DeprecatedRule( 

44 name=BASE_POLICY_NAME % 'manage_snapshot', 

45 check_str=base.RULE_ADMIN_API, 

46 deprecated_reason=DEPRECATED_REASON, 

47 deprecated_since=versionutils.deprecated.WALLABY 

48) 

49deprecated_snapshot_unmanage = policy.DeprecatedRule( 

50 name=BASE_POLICY_NAME % 'unmanage_snapshot', 

51 check_str=base.RULE_ADMIN_API, 

52 deprecated_reason=DEPRECATED_REASON, 

53 deprecated_since=versionutils.deprecated.WALLABY 

54) 

55deprecated_snapshot_reset_status = policy.DeprecatedRule( 

56 name=BASE_POLICY_NAME % 'reset_status', 

57 check_str=base.RULE_ADMIN_API, 

58 deprecated_reason=DEPRECATED_REASON, 

59 deprecated_since=versionutils.deprecated.WALLABY 

60) 

61deprecated_snapshot_access_list = policy.DeprecatedRule( 

62 name=BASE_POLICY_NAME % 'access_list', 

63 check_str=base.RULE_DEFAULT, 

64 deprecated_reason=DEPRECATED_REASON, 

65 deprecated_since=versionutils.deprecated.WALLABY 

66) 

67deprecated_snapshot_allow_access = policy.DeprecatedRule( 

68 name=BASE_POLICY_NAME % 'allow_access', 

69 check_str=base.RULE_DEFAULT, 

70 deprecated_reason=DEPRECATED_REASON, 

71 deprecated_since=versionutils.deprecated.WALLABY 

72) 

73deprecated_snapshot_deny_access = policy.DeprecatedRule( 

74 name=BASE_POLICY_NAME % 'deny_access', 

75 check_str=base.RULE_DEFAULT, 

76 deprecated_reason=DEPRECATED_REASON, 

77 deprecated_since=versionutils.deprecated.WALLABY 

78) 

79deprecated_update_snapshot_metadata = policy.DeprecatedRule( 

80 name=BASE_POLICY_NAME % 'update_metadata', 

81 check_str=base.RULE_DEFAULT, 

82 deprecated_reason=DEPRECATED_REASON, 

83 deprecated_since='ZED' 

84) 

85deprecated_delete_snapshot_metadata = policy.DeprecatedRule( 

86 name=BASE_POLICY_NAME % 'delete_metadata', 

87 check_str=base.RULE_DEFAULT, 

88 deprecated_reason=DEPRECATED_REASON, 

89 deprecated_since='ZED' 

90) 

91deprecated_get_snapshot_metadata = policy.DeprecatedRule( 

92 name=BASE_POLICY_NAME % 'get_metadata', 

93 check_str=base.RULE_DEFAULT, 

94 deprecated_reason=DEPRECATED_REASON, 

95 deprecated_since='ZED' 

96) 

97deprecated_list_snapshots_in_deferred_deletion_states = policy.DeprecatedRule( 

98 name=BASE_POLICY_NAME % 'list_snapshots_in_deferred_deletion_states', 

99 check_str=base.RULE_ADMIN_API, 

100 deprecated_reason=DEPRECATED_REASON, 

101 deprecated_since='2024.1/Caracal' 

102) 

103deprecated_list_all_projects = policy.DeprecatedRule( 

104 name=BASE_POLICY_NAME % 'list_all_projects', 

105 check_str=base.RULE_ADMIN_API, 

106 deprecated_reason=DEPRECATED_REASON, 

107 deprecated_since='2025.1/Epoxy' 

108) 

109 

110share_snapshot_policies = [ 

111 policy.DocumentedRuleDefault( 

112 name=BASE_POLICY_NAME % 'get_snapshot', 

113 check_str=base.ADMIN_OR_PROJECT_READER, 

114 scope_types=['project'], 

115 description="Get share snapshot.", 

116 operations=[ 

117 { 

118 'method': 'GET', 

119 'path': '/snapshots/{snapshot_id}' 

120 } 

121 ], 

122 deprecated_rule=deprecated_snapshot_get 

123 ), 

124 policy.DocumentedRuleDefault( 

125 name=BASE_POLICY_NAME % 'get_all_snapshots', 

126 check_str=base.ADMIN_OR_PROJECT_READER, 

127 scope_types=['project'], 

128 description="Get all share snapshots.", 

129 operations=[ 

130 { 

131 'method': 'GET', 

132 'path': '/snapshots?{query}' 

133 }, 

134 { 

135 'method': 'GET', 

136 'path': '/snapshots/detail?{query}' 

137 } 

138 ], 

139 deprecated_rule=deprecated_snapshot_get_all 

140 ), 

141 policy.DocumentedRuleDefault( 

142 name=BASE_POLICY_NAME % 'list_all_projects', 

143 check_str=base.ADMIN, 

144 scope_types=['project'], 

145 description="List share snapshots by all projects.", 

146 operations=[ 

147 { 

148 'method': 'GET', 

149 'path': '/snapshots?all_tenants=1', 

150 }, 

151 { 

152 'method': 'GET', 

153 'path': '/snapshots/detail?all_tenants=1', 

154 } 

155 ], 

156 deprecated_rule=deprecated_list_all_projects 

157 ), 

158 policy.DocumentedRuleDefault( 

159 name=BASE_POLICY_NAME % 'force_delete', 

160 check_str=base.ADMIN, 

161 scope_types=['project'], 

162 description="Force Delete a share snapshot.", 

163 operations=[ 

164 { 

165 'method': 'DELETE', 

166 'path': '/snapshots/{snapshot_id}' 

167 } 

168 ], 

169 deprecated_rule=deprecated_snapshot_force_delete 

170 ), 

171 policy.DocumentedRuleDefault( 

172 name=BASE_POLICY_NAME % 'manage_snapshot', 

173 check_str=base.ADMIN, 

174 scope_types=['project'], 

175 description="Manage share snapshot.", 

176 operations=[ 

177 { 

178 'method': 'POST', 

179 'path': '/snapshots/manage' 

180 } 

181 ], 

182 deprecated_rule=deprecated_snapshot_manage 

183 ), 

184 policy.DocumentedRuleDefault( 

185 name=BASE_POLICY_NAME % 'unmanage_snapshot', 

186 check_str=base.ADMIN, 

187 scope_types=['project'], 

188 description="Unmanage share snapshot.", 

189 operations=[ 

190 { 

191 'method': 'POST', 

192 'path': '/snapshots/{snapshot_id}/action' 

193 } 

194 ], 

195 deprecated_rule=deprecated_snapshot_unmanage 

196 ), 

197 policy.DocumentedRuleDefault( 

198 name=BASE_POLICY_NAME % 'reset_status', 

199 check_str=base.ADMIN, 

200 scope_types=['project'], 

201 description="Reset status.", 

202 operations=[ 

203 { 

204 'method': 'POST', 

205 'path': '/snapshots/{snapshot_id}/action', 

206 } 

207 ], 

208 deprecated_rule=deprecated_snapshot_reset_status 

209 ), 

210 policy.DocumentedRuleDefault( 

211 name=BASE_POLICY_NAME % 'access_list', 

212 check_str=base.ADMIN_OR_PROJECT_READER, 

213 scope_types=['project'], 

214 description="List access rules of a share snapshot.", 

215 operations=[ 

216 { 

217 'method': 'GET', 

218 'path': '/snapshots/{snapshot_id}/access-list' 

219 } 

220 ], 

221 deprecated_rule=deprecated_snapshot_access_list 

222 ), 

223 policy.DocumentedRuleDefault( 

224 name=BASE_POLICY_NAME % 'allow_access', 

225 check_str=base.ADMIN_OR_PROJECT_MEMBER, 

226 scope_types=['project'], 

227 description="Allow access to a share snapshot.", 

228 operations=[ 

229 { 

230 'method': 'POST', 

231 'path': '/snapshots/{snapshot_id}/action' 

232 } 

233 ], 

234 deprecated_rule=deprecated_snapshot_allow_access 

235 ), 

236 policy.DocumentedRuleDefault( 

237 name=BASE_POLICY_NAME % 'deny_access', 

238 check_str=base.ADMIN_OR_PROJECT_MEMBER, 

239 scope_types=['project'], 

240 description="Deny access to a share snapshot.", 

241 operations=[ 

242 { 

243 'method': 'POST', 

244 'path': '/snapshots/{snapshot_id}/action' 

245 } 

246 ], 

247 deprecated_rule=deprecated_snapshot_deny_access 

248 ), 

249 policy.DocumentedRuleDefault( 

250 name=BASE_POLICY_NAME % 'update_metadata', 

251 check_str=base.ADMIN_OR_PROJECT_MEMBER, 

252 scope_types=['project'], 

253 description="Update snapshot metadata.", 

254 operations=[ 

255 { 

256 'method': 'PUT', 

257 'path': '/snapshots/{snapshot_id}/metadata', 

258 }, 

259 { 

260 'method': 'POST', 

261 'path': '/snapshots/{snapshot_id}/metadata/{key}', 

262 }, 

263 { 

264 'method': 'POST', 

265 'path': '/snapshots/{snapshot_id}/metadata', 

266 }, 

267 ], 

268 deprecated_rule=deprecated_update_snapshot_metadata 

269 ), 

270 policy.DocumentedRuleDefault( 

271 name=BASE_POLICY_NAME % 'delete_metadata', 

272 check_str=base.ADMIN_OR_PROJECT_MEMBER, 

273 scope_types=['project'], 

274 description="Delete snapshot metadata.", 

275 operations=[ 

276 { 

277 'method': 'DELETE', 

278 'path': '/snapshots/{snapshot_id}/metadata/{key}', 

279 } 

280 ], 

281 deprecated_rule=deprecated_delete_snapshot_metadata 

282 ), 

283 policy.DocumentedRuleDefault( 

284 name=BASE_POLICY_NAME % 'get_metadata', 

285 check_str=base.ADMIN_OR_PROJECT_READER, 

286 scope_types=['project'], 

287 description="Get snapshot metadata.", 

288 operations=[ 

289 { 

290 'method': 'GET', 

291 'path': '/snapshots/{snapshot_id}/metadata', 

292 }, 

293 { 

294 'method': 'GET', 

295 'path': '/snapshots/{snapshot_id}/metadata/{key}', 

296 } 

297 ], 

298 deprecated_rule=deprecated_get_snapshot_metadata 

299 ), 

300 policy.DocumentedRuleDefault( 

301 name=BASE_POLICY_NAME % 'list_snapshots_in_deferred_deletion_states', 

302 check_str=base.ADMIN, 

303 scope_types=['project'], 

304 description="List (or get) snapshots whose deletion has been deferred", 

305 operations=[ 

306 { 

307 'method': 'GET', 

308 'path': '/v2/snapshots', 

309 }, 

310 { 

311 'method': 'GET', 

312 'path': '/snapshots/{snapshot_id}' 

313 } 

314 ], 

315 deprecated_rule=deprecated_list_snapshots_in_deferred_deletion_states 

316 ), 

317] 

318 

319 

320def list_rules(): 

321 return share_snapshot_policies