Merge ~ack/maas:resource-pool-create-rbac-1812238 into maas:master

[Alberto Donato]

LP: #1812238 - users with edit on all pools are allowed to create pools

[MAAS Lander (maas-lander)]

UNIT TESTS
-b resource-pool-create-rbac-1812238 lp:~ack/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: 6629f6e9db7581029e34985af192d94347ac2615

review: Approve

[Björn Tillenius (bjornt)]

+1 with a comment inline.

review: Approve

diff --git a/src/maasserver/api/support.py b/src/maasserver/api/support.py
index b7c22cf..8760fd5 100644
--- a/src/maasserver/api/support.py
+++ b/src/maasserver/api/support.py
@@ -469,7 +469,6 @@ class ModelCollectionOperationsHandler(OperationsHandler,
     def resource_uri(cls, *args, **kwargs):
         return (cls.handler_url_name, [])
 
-    @admin_method
     def create(self, request):
         """POST request.  Create a new instance of the model."""
         form = self.model_form(request.data)
diff --git a/src/maasserver/api/tests/test_resourcepool.py b/src/maasserver/api/tests/test_resourcepool.py
index f9534fe..40feed1 100644
--- a/src/maasserver/api/tests/test_resourcepool.py
+++ b/src/maasserver/api/tests/test_resourcepool.py
@@ -9,17 +9,11 @@ import json
 
 from django.conf import settings
 from maasserver.api import auth
-from maasserver.models import (
-    Config,
-    ResourcePool,
-)
-from maasserver.rbac import (
-    ALL_RESOURCES,
-    FakeRBACClient,
-    rbac,
-)
+from maasserver.models import ResourcePool
+from maasserver.rbac import ALL_RESOURCES
 from maasserver.testing.api import APITestCase
 from maasserver.testing.factory import factory
+from maasserver.testing.fixtures import RBACEnabled
 from maasserver.utils.django_urls import reverse
 from maasserver.utils.orm import reload_object
 
@@ -138,12 +132,9 @@ class TestResourcePoolAPIWithRBAC(APITestCase.ForUser):
     def setUp(self):
         super().setUp()
         self.patch(auth, 'validate_user_external_auth').return_value = True
-        Config.objects.set_config('rbac_url', 'http://rbac.example.com')
-        self.rbac_client = FakeRBACClient()
-        rbac._store.client = self.rbac_client
-        rbac._store.cleared = False  # Prevent re-creation of the client.
-        self.store = self.rbac_client.store
-        self.become_admin()
+        rbac = self.useFixture(RBACEnabled())
+        self.store = rbac.store
+        self.become_non_local()
 
     def test_GET_returns_pool(self):
         pool = factory.make_ResourcePool()
@@ -168,7 +159,6 @@ class TestResourcePoolAPIWithRBAC(APITestCase.ForUser):
         self.assertEqual(response.status_code, http.client.FORBIDDEN)
 
     def test_PUT_updates_pool(self):
-        self.become_admin()
         pool = factory.make_ResourcePool()
         self.store.add_pool(pool)
         self.store.allow(self.user.username, pool, 'edit')
@@ -183,7 +173,6 @@ class TestResourcePoolAPIWithRBAC(APITestCase.ForUser):
         self.assertEqual(pool.description, new_description)
 
     def test_PUT_forbidden(self):
-        self.become_admin()
         pool = factory.make_ResourcePool()
         self.store.add_pool(pool)
         self.store.allow(self.user.username, pool, 'view')
diff --git a/src/maasserver/api/tests/test_resourcepools.py b/src/maasserver/api/tests/test_resourcepools.py
index ee8d3ac..50598b8 100644
--- a/src/maasserver/api/tests/test_resourcepools.py
+++ b/src/maasserver/api/tests/test_resourcepools.py
@@ -10,17 +10,11 @@ import random
 
 from django.conf import settings
 from maasserver.api import auth
-from maasserver.models import (
-    Config,
-    ResourcePool,
-)
-from maasserver.rbac import (
-    ALL_RESOURCES,
-    FakeRBACClient,
-    rbac,
-)
+from maasserver.models import ResourcePool
+from maasserver.rbac import ALL_RESOURCES
 from maasserver.testing.api import APITestCase
 from maasserver.testing.factory import factory
+from maasserver.testing.fixtures import RBACEnabled
 from maasserver.utils.django_urls import reverse
 
 
@@ -74,12 +68,9 @@ class TestResourcePoolsAPIWithRBAC(APITestCase.ForUser):
     def setUp(self):
         super().setUp()
         self.patch(auth, 'validate_user_external_auth').return_value = True
-        Config.objects.set_config('rbac_url', 'http://rbac.example.com')
-        self.rbac_client = FakeRBACClient()
-        rbac._store.client = self.rbac_client
-        rbac._store.cleared = False  # Prevent re-creation of the client.
-        self.store = self.rbac_client.store
-        self.become_admin()
+        rbac = self.useFixture(RBACEnabled())
+        self.store = rbac.store
+        self.become_non_local()
 
     def test_GET_empty_when_no_access(self):
         for _ in range(3):
diff --git a/src/maasserver/api/zones.py b/src/maasserver/api/zones.py
index ae1736d..6d56264 100644
--- a/src/maasserver/api/zones.py
+++ b/src/maasserver/api/zones.py
@@ -9,6 +9,7 @@ __all__ = [
 ]
 
 from maasserver.api.support import (
+    admin_method,
     AnonymousOperationsHandler,
     ModelCollectionOperationsHandler,
     ModelOperationsHandler,
@@ -134,6 +135,7 @@ class ZonesHandler(ModelCollectionOperationsHandler):
     handler_url_name = 'zones_handler'
     api_doc_section_name = 'Zones'
 
+    @admin_method
     def create(self, request):
         """@description Creates a new zone.
         @param (string) "name" [required=true] The new zone's name.