1
# vim: tabstop=4 shiftwidth=4 softtabstop=4
3
# Copyright 2010 United States Government as represented by the
4
# Administrator of the National Aeronautics and Space Administration.
7
# Licensed under the Apache License, Version 2.0 (the "License"); you may
8
# not use this file except in compliance with the License. You may obtain
9
# a copy of the License at
11
# http://www.apache.org/licenses/LICENSE-2.0
13
# Unless required by applicable law or agreed to in writing, software
14
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
16
# License for the specific language governing permissions and limitations
23
from nova import context
24
from nova import exception
25
from nova import flags
27
from nova.api import ec2
28
from nova.auth import manager
34
class Context(object):
38
class AccessTestCase(test.TrialTestCase):
40
super(AccessTestCase, self).setUp()
41
um = manager.AuthManager()
42
self.context = context.get_admin_context()
44
self.testadmin = um.create_user('testadmin')
45
self.testpmsys = um.create_user('testpmsys')
46
self.testnet = um.create_user('testnet')
47
self.testsys = um.create_user('testsys')
49
um.add_role('testadmin', 'cloudadmin')
50
um.add_role('testpmsys', 'sysadmin')
51
um.add_role('testnet', 'netadmin')
52
um.add_role('testsys', 'sysadmin')
55
self.project = um.create_project('testproj',
58
['testpmsys', 'testnet', 'testsys'])
59
self.project.add_role(self.testnet, 'netadmin')
60
self.project.add_role(self.testsys, 'sysadmin')
61
#user is set in each test
63
def noopWSGIApp(environ, start_response):
64
start_response('200 OK', [])
67
self.mw = ec2.Authorizer(noopWSGIApp)
68
self.mw.action_roles = {'str': {
69
'_allow_all': ['all'],
71
'_allow_project_manager': ['projectmanager'],
72
'_allow_sys_and_net': ['sysadmin', 'netadmin'],
73
'_allow_sysadmin': ['sysadmin']}}
76
um = manager.AuthManager()
77
# Delete the test project
78
um.delete_project('testproj')
79
# Delete the test user
80
um.delete_user('testadmin')
81
um.delete_user('testpmsys')
82
um.delete_user('testnet')
83
um.delete_user('testsys')
84
super(AccessTestCase, self).tearDown()
86
def response_status(self, user, methodName):
87
ctxt = context.RequestContext(user, self.project)
88
environ = {'ec2.context': ctxt,
89
'ec2.controller': 'some string',
90
'ec2.action': methodName}
91
req = webob.Request.blank('/', environ)
92
resp = req.get_response(self.mw)
93
return resp.status_int
95
def shouldAllow(self, user, methodName):
96
self.assertEqual(200, self.response_status(user, methodName))
98
def shouldDeny(self, user, methodName):
99
self.assertEqual(401, self.response_status(user, methodName))
101
def test_001_allow_all(self):
102
users = [self.testadmin, self.testpmsys, self.testnet, self.testsys]
104
self.shouldAllow(user, '_allow_all')
106
def test_002_allow_none(self):
107
self.shouldAllow(self.testadmin, '_allow_none')
108
users = [self.testpmsys, self.testnet, self.testsys]
110
self.shouldDeny(user, '_allow_none')
112
def test_003_allow_project_manager(self):
113
for user in [self.testadmin, self.testpmsys]:
114
self.shouldAllow(user, '_allow_project_manager')
115
for user in [self.testnet, self.testsys]:
116
self.shouldDeny(user, '_allow_project_manager')
118
def test_004_allow_sys_and_net(self):
119
for user in [self.testadmin, self.testnet, self.testsys]:
120
self.shouldAllow(user, '_allow_sys_and_net')
121
# denied because it doesn't have the per project sysadmin
122
for user in [self.testpmsys]:
123
self.shouldDeny(user, '_allow_sys_and_net')
125
if __name__ == "__main__":
126
# TODO: Implement use_fake as an option
added
removed
nova/tests/access_unittest.py
