~blake-rouse/maas:fix-pod-rbac

Branch merges

Propose for merging

Merged into maas:master

Alberto Donato (community): Approve on 2018-12-10

MAAS Lander: Approve on 2018-12-07

Diff: 1060 lines (+594/-33)

16 files modified

src/maasserver/api/machines.py (+6/-2)
src/maasserver/api/pods.py (+14/-9)
src/maasserver/api/tests/test_machines.py (+46/-1)
src/maasserver/models/__init__.py (+62/-8)
src/maasserver/models/bmc.py (+66/-1)
src/maasserver/models/resourcepool.py (+4/-2)
src/maasserver/models/tests/test_bmc.py (+114/-1)
src/maasserver/models/tests/test_resourcepool.py (+11/-0)
src/maasserver/permissions.py (+14/-0)
src/maasserver/testing/api.py (+12/-0)
src/maasserver/testing/fixtures.py (+7/-0)
src/maasserver/tests/test_auth.py (+163/-0)
src/maasserver/websockets/handlers/pod.py (+61/-9)
src/maasserver/websockets/handlers/tests/test_pod.py (+8/-0)
src/maasserver/websockets/handlers/tests/test_user.py (+3/-0)
src/maasserver/websockets/handlers/user.py (+3/-0)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related charm recipes

bb2be6c... by Blake Rouse on 2018-12-07

Add tests.

280f4ca... by Blake Rouse on 2018-12-06

Split compose permission into compose and dynamic_compose. Add permission checks to the websocket and API layers.

ee58cf6... by Blake Rouse on 2018-12-06

Add compose permission to the websocket output.

4e19e8d... by Blake Rouse on 2018-12-06

Add a new PodPermission and use it to check permission access to a Pod.

dc6dc01... by Blake Rouse on 2018-12-05

Use the new deploy-machines and view-all permission from RBAC to allow different access levels for the nodes.

deploy-machines allows the user to allocate/deploy/release a machine, but cannot perform admin actions on that machine (eg. adjust interfaces).

view-all allows the user to view all machines in the resource pool even if the machine is owned by a different user (eg. an auditor).

6ba60e0... by Blake Rouse on 2018-11-29

Use new permission checks in the UI to show and hide actions that the authenticated user can perform.

24569c1... by Blake Rouse on 2018-11-27

Add permission information over the websocket.

f972dd1... by Blake Rouse on 2018-11-26

Fix issue where none administrators are presented with the first user system configuration, but cannot update any settings or skip it.

043c6db... by Blake Rouse on 2018-11-21

Reload user before execution of a handler method, removing all the reload_object(user) logic in the websocket handlers. Add view, edit, create, and delete permission checks to the base websocket handler. Add permission checks on the device, machine, and resource pool handlers.

f62b49f... by Blake Rouse on 2018-11-20

Fix the node actions to use permission checks instead of handling the checks internally. Add permission checks to the device and machine forms.

Squashed commit of the following:

commit 44e16161a849baa28eb085ae0fe7cea7abc31c9d
Author: Blake Rouse <email address hidden>
Date: Tue Nov 20 13:33:20 2018 -0500

    Part 2.