1
# vim: tabstop=4 shiftwidth=4 softtabstop=4
3
# Copyright 2010 United States Government as represented by the
4
# Administrator of the National Aeronautics and Space Administration.
7
# Licensed under the Apache License, Version 2.0 (the "License"); you may
8
# not use this file except in compliance with the License. You may obtain
9
# a copy of the License at
11
# http://www.apache.org/licenses/LICENSE-2.0
13
# Unless required by applicable law or agreed to in writing, software
14
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
16
# License for the specific language governing permissions and limitations
22
from nova import context
23
from nova import flags
25
from nova.api import ec2
26
from nova.auth import manager
31
class FakeControllerClass(object):
35
class FakeApiRequest(object):
36
def __init__(self, action):
37
self.controller = FakeControllerClass()
41
class AccessTestCase(test.TestCase):
42
def _env_for(self, ctxt, action):
44
env['ec2.context'] = ctxt
45
env['ec2.request'] = FakeApiRequest(action)
49
super(AccessTestCase, self).setUp()
50
um = manager.AuthManager()
51
self.context = context.get_admin_context()
53
self.testadmin = um.create_user('testadmin')
54
self.testpmsys = um.create_user('testpmsys')
55
self.testnet = um.create_user('testnet')
56
self.testsys = um.create_user('testsys')
58
um.add_role('testadmin', 'cloudadmin')
59
um.add_role('testpmsys', 'sysadmin')
60
um.add_role('testnet', 'netadmin')
61
um.add_role('testsys', 'sysadmin')
64
self.project = um.create_project('testproj',
67
['testpmsys', 'testnet', 'testsys'])
68
self.project.add_role(self.testnet, 'netadmin')
69
self.project.add_role(self.testsys, 'sysadmin')
70
#user is set in each test
72
def noopWSGIApp(environ, start_response):
73
start_response('200 OK', [])
76
self.mw = ec2.Authorizer(noopWSGIApp)
77
self.mw.action_roles = {'FakeControllerClass': {
78
'_allow_all': ['all'],
80
'_allow_project_manager': ['projectmanager'],
81
'_allow_sys_and_net': ['sysadmin', 'netadmin'],
82
'_allow_sysadmin': ['sysadmin']}}
85
um = manager.AuthManager()
86
# Delete the test project
87
um.delete_project('testproj')
88
# Delete the test user
89
um.delete_user('testadmin')
90
um.delete_user('testpmsys')
91
um.delete_user('testnet')
92
um.delete_user('testsys')
93
super(AccessTestCase, self).tearDown()
95
def response_status(self, user, methodName):
96
ctxt = context.RequestContext(user, self.project)
97
environ = self._env_for(ctxt, methodName)
98
req = webob.Request.blank('/', environ)
99
resp = req.get_response(self.mw)
100
return resp.status_int
102
def shouldAllow(self, user, methodName):
103
self.assertEqual(200, self.response_status(user, methodName))
105
def shouldDeny(self, user, methodName):
106
self.assertEqual(401, self.response_status(user, methodName))
108
def test_001_allow_all(self):
109
users = [self.testadmin, self.testpmsys, self.testnet, self.testsys]
111
self.shouldAllow(user, '_allow_all')
113
def test_002_allow_none(self):
114
self.shouldAllow(self.testadmin, '_allow_none')
115
users = [self.testpmsys, self.testnet, self.testsys]
117
self.shouldDeny(user, '_allow_none')
119
def test_003_allow_project_manager(self):
120
for user in [self.testadmin, self.testpmsys]:
121
self.shouldAllow(user, '_allow_project_manager')
122
for user in [self.testnet, self.testsys]:
123
self.shouldDeny(user, '_allow_project_manager')
125
def test_004_allow_sys_and_net(self):
126
for user in [self.testadmin, self.testnet, self.testsys]:
127
self.shouldAllow(user, '_allow_sys_and_net')
128
# denied because it doesn't have the per project sysadmin
129
for user in [self.testpmsys]:
130
self.shouldDeny(user, '_allow_sys_and_net')
132
if __name__ == "__main__":
133
# TODO: Implement use_fake as an option
added
removed
nova/tests/test_access.py
