Add missed actions into policy.json

This patch adds following actions into policy.json.

  1. v2.0/fw/firewall_policies/{firewall_policy_id}/insert_rule
  2. v2.0/fw/firewall_policies/{firewall_policy_id}/remove_rule

Closes-Bug: #1439383
Change-Id: I8051a97852f0f1f21bf266c16a477a5e2fd32062

diff --git a/etc/policy.json b/etc/policy.json
index 8a5de9bf308ca97fcdafcb5a60b513e7725302e6..87f6b266897acb5c47292a9bce68c5682e84852f 100644 (file)
--- a/etc/policy.json
+++ b/etc/policy.json
@@ -102,6 +102,9 @@
     "update_firewall_policy": "rule:admin_or_owner",
     "delete_firewall_policy": "rule:admin_or_owner",
 
+    "insert_rule": "rule:admin_or_owner",
+    "remove_rule": "rule:admin_or_owner",
+
     "create_firewall_rule": "",
     "get_firewall_rule": "rule:admin_or_owner or rule:shared_firewalls",
     "update_firewall_rule": "rule:admin_or_owner",

diff --git a/neutron/tests/etc/policy.json b/neutron/tests/etc/policy.json
index 8a5de9bf308ca97fcdafcb5a60b513e7725302e6..87f6b266897acb5c47292a9bce68c5682e84852f 100644 (file)
--- a/neutron/tests/etc/policy.json
+++ b/neutron/tests/etc/policy.json
@@ -102,6 +102,9 @@
     "update_firewall_policy": "rule:admin_or_owner",
     "delete_firewall_policy": "rule:admin_or_owner",
 
+    "insert_rule": "rule:admin_or_owner",
+    "remove_rule": "rule:admin_or_owner",
+
     "create_firewall_rule": "",
     "get_firewall_rule": "rule:admin_or_owner or rule:shared_firewalls",
     "update_firewall_rule": "rule:admin_or_owner",

diff --git a/neutron/tests/unit/test_policy.py b/neutron/tests/unit/test_policy.py
index 63fc16475d4a4d7b38ae6f9795b0afd4b33a3631..5216d8e0b1f7f80991f6bbeea26c550b58493bf2 100644 (file)
--- a/neutron/tests/unit/test_policy.py
+++ b/neutron/tests/unit/test_policy.py
@@ -253,7 +253,10 @@ class NeutronPolicyTestCase(base.BaseTestCase):
             "get_firewall_policy": "rule:admin_or_owner or "
                             "rule:shared",
             "get_firewall_rule": "rule:admin_or_owner or "
-                            "rule:shared"
+                            "rule:shared",
+
+            "insert_rule": "rule:admin_or_owner",
+            "remove_rule": "rule:admin_or_owner",
         }.items())
 
         def remove_fake_resource():
@@ -272,6 +275,26 @@ class NeutronPolicyTestCase(base.BaseTestCase):
         fake_manager_instance = fake_manager.return_value
         fake_manager_instance.plugin = plugin_klass()
 
+    def test_firewall_policy_insert_rule_with_admin_context(self):
+        action = "insert_rule"
+        target = {}
+        result = policy.check(context.get_admin_context(), action, target)
+        self.assertTrue(result)
+
+    def test_firewall_policy_insert_rule_with_owner(self):
+        action = "insert_rule"
+        target = {"tenant_id": "own_tenant"}
+        user_context = context.Context('', "own_tenant", roles=['user'])
+        result = policy.check(user_context, action, target)
+        self.assertTrue(result)
+
+    def test_firewall_policy_remove_rule_without_admin_or_owner(self):
+        action = "remove_rule"
+        target = {"firewall_rule_id": "rule_id", "tenant_id": "tenantA"}
+        user_context = context.Context('', "another_tenant", roles=['user'])
+        result = policy.check(user_context, action, target)
+        self.assertFalse(result)
+
     def _test_action_on_attr(self, context, action, obj, attr, value,
                              exception=None, **kwargs):
         action = "%s_%s" % (action, obj)