ó
À_c@
sá
dZd
dl
mZ
d
dlZd
dlZd
dlZd
dlmZ
d
dlm	Z

d
dlZd
dlm
Z

d
dlmZ
d
dlmZ
d
d	lmZ
d
d
lmZ
d
dlmZ
d
dlmZ
ejjZejd
dddejjdƒ
dedƒ
ƒ
ejddddejjdƒ
dedƒ
ƒ
ejddddejjdƒ
dedƒ
ƒ
gZdef
d„ƒYZi
ed6Zej e
j!deƒ

Z!ej"d d!d"dd#d$e!ƒ
Z#d%„Z$dS(&s0
  CLI interface for nova policy rule commands.
iÿÿÿÿ(
tprint_functionN(
tcfg(
tcommon(
tconfig(
tcontext(
tdb(
t	exception(
t
_(
tpolicies(
tversionsos-rolestmetavars<auth-roles>tdefaulttOS_ROLESthelpsDefaults to env[OS_ROLES].s
os-user-ids<auth-user-id>t
OS_USER_IDsDefaults to env[OS_USER_ID].sos-tenant-ids<auth-tenant-id>tOS_TENANT_IDsDefaults to env[OS_TENANT_ID].tPolicyCommandsc
B
s¢eZ
dZd
ddddgZejdddd	d
ddƒ
ejd
ddddd	ddddjeƒ
ƒ
ddd„ƒ
ƒ
Zd„Z	d„Z
d„ZRS(sCommands for policy rules.t
project_idtuser_idtquota_classtavailability_zonetinstance_ids
--api-nametdesttapi_nameR
s
<API name>R
sDWill return only passing policy rules containing the given API name.s--targettnargst
+ttargets<Target>sœWill return only passing policy rules for the given target. The available targets are %s. When "instance_id" is used, the other targets will be overwritten.t
,cC
sn|jƒ}|
pd
}
|j
||ƒ}|j||
|ƒ}|r\tdj|ƒ
ƒ

dStdƒ

dSdS(sÒ
Prints all passing policy rules for the given user.

        :param api_name: If None, all passing policy rules will be printed,
                         otherwise, only passing policies that contain the
                         given api_name in their names.
        :param target: The target against which the policy rule authorization
                       will be tested. If None, the given user will be
                       considered as the target.
        ts

isNo rules matched or allowedi
N(t_get_contextt_get_targett
_filter_rulestprinttjoin(tselfRRRtallowed_operations((s4/usr/lib/python2.7/dist-packages/dmapi/cmd/policy.pytcheck7s





c

C
s%tj
d
tjdtjdtjƒS(NtrolesRR(tnova_contexttRequestContexttCONFtos_rolest
os_user_idtos_tenant_id(
R"((s4/usr/lib/python2.7/dist-packages/dmapi/cmd/policy.pyRVs
	
	
	
c
C
sº|s
dSi}xQ|D]I}|j
d
ƒ
\}}||jkrVtjd|ƒ
‚
n|||<qW|jdƒ
}|r¶tjƒ}tj	||ƒ}	i|	dd6|	dd6}n|S(sÌ
Processes and validates the CLI given target and adapts it for
        policy authorization.

        :returns: None if the given target is None, otherwise returns a proper
                  authorization target.
        :raises nova.exception.InvalidAttribute: if a key in the given target
            is not an acceptable.
        :raises nova.exception.InstanceNotFound: if 'instance_id' is given, and
            there is no instance match the id.
        t
=tattrRRRN(
tNonetsplitt_ACCEPTABLE_TARGETSRtInvalidAttributetgetR&tget_admin_contextRtinstance_get_by_uuid(
R"RRt
new_targett
ttkeytvalueRt
admin_ctxttinstance((s4/usr/lib/python2.7/dist-packages/dmapi/cmd/policy.pyR\s











cC
sPtj
ƒ}g|D]9}||jkr|
j|j|d
tƒ
r|j^qS(Ntfatal(Rt
list_rulestnametcantFalse(R"RRRt	all_rulestrule((s4/usr/lib/python2.7/dist-packages/dmapi/cmd/policy.pyR{s


N(t__name__t
__module__t__doc__R0t
cmd_commontargsR!R.R$RRR(((s4/usr/lib/python2.7/dist-packages/dmapi/cmd/policy.pyR0s

	


		tpolicyt
categoriestcategoryttitlesCommand categoriessAvailable categoriesthandlercC
sÎtj
tƒ

tjtƒ

tjtjƒ

tj	j
d
krPttj
ƒƒ

dStj	j
dkrstjtƒ

dSy,tjƒ\}}
}||
|Ž}|SWn(tk
rÉ
}
ttdƒ
|ƒ

dSXdS(s4Parse options and call the appropriate class/method.R	isbash-completions	error: %si
N(R(tregister_cli_optstcli_optstregister_cli_opttcategory_optRt
parse_argstsystargvRIR=R R	tversion_string_with_packageREtprint_bash_completiont
CATEGORIESt
get_action_fnt	ExceptionR(tfntfn_argst	fn_kwargstrettex((s4/usr/lib/python2.7/dist-packages/dmapi/cmd/policy.pytmains 














(%RDt
__future__Rt	functoolstosRQtoslo_configR
tnova.cmdRREt	nova.conftnovaRRR&RRt	nova.i18nRRR	tconfR(tListOpttenvironR2tStrOptRMtobjectRRUtpartialtadd_command_parserst
SubCommandOptROR](((s4/usr/lib/python2.7/dist-packages/dmapi/cmd/policy.pyt<module>sP























Q