12
12
import org .zstack .identity .AccountManager ;
13
13
import org .zstack .identity .rbac .CheckIfAccountCanAccessResource ;
14
14
15
+ import java .util .ArrayList ;
15
16
import java .util .Collections ;
17
+ import java .util .List ;
18
+ import java .util .stream .Collectors ;
16
19
17
20
import static org .zstack .core .Platform .argerr ;
18
21
@@ -33,21 +36,37 @@ public APIMessage intercept(APIMessage msg) throws ApiMessageInterceptionExcepti
33
36
34
37
if (msg instanceof APIGetResourceConfigMsg ) {
35
38
validate ((APIGetResourceConfigMsg ) msg );
39
+ } else if (msg instanceof APIGetResourceConfigsMsg ) {
40
+ validate ((APIGetResourceConfigsMsg ) msg );
36
41
}
37
42
return msg ;
38
43
}
39
44
40
45
private void validate (ResourceConfigMessage msg ) {
41
- GlobalConfig gc = gcf .getAllConfig ().get (msg .getIdentity ());
42
- if (gc == null ) {
43
- throw new ApiMessageInterceptionException (argerr ("no global config[category:%s, name:%s] found" ,
44
- msg .getCategory (), msg .getName ()));
46
+ List <String > identities = new ArrayList <>();
47
+
48
+ if (msg .getName () != null ) {
49
+ identities .add (msg .getIdentity (msg .getName ()));
50
+ }
51
+
52
+ if (msg .getNames () != null ) {
53
+ for (String name : msg .getNames ()) {
54
+ identities .add (msg .getIdentity (name ));
55
+ }
45
56
}
46
57
47
- ResourceConfig rc = rcf .getResourceConfig (gc .getIdentity ());
48
- if (rc == null ) {
49
- throw new ApiMessageInterceptionException (argerr ("global config[category:%s, name:%s] cannot bind resource" ,
50
- msg .getCategory (), msg .getName ()));
58
+ for (String identity : identities ) {
59
+ GlobalConfig gc = gcf .getAllConfig ().get (identity );
60
+ if (gc == null ) {
61
+ throw new ApiMessageInterceptionException (argerr ("no global config[category:%s, name:%s] found" ,
62
+ msg .getCategory (), identity ));
63
+ }
64
+
65
+ ResourceConfig rc = rcf .getResourceConfig (gc .getIdentity ());
66
+ if (rc == null ) {
67
+ throw new ApiMessageInterceptionException (argerr ("global config[category:%s, name:%s] cannot bind resource" ,
68
+ msg .getCategory (), identity ));
69
+ }
51
70
}
52
71
}
53
72
@@ -61,4 +80,15 @@ private void validate(APIGetResourceConfigMsg msg) {
61
80
msg .getResourceUuid ()));
62
81
}
63
82
}
83
+
84
+ private void validate (APIGetResourceConfigsMsg msg ) {
85
+ if (acMgr .isAdmin (msg .getSession ())) {
86
+ return ;
87
+ }
88
+
89
+ if (!CheckIfAccountCanAccessResource .check (Collections .singletonList (msg .getResourceUuid ()), msg .getSession ().getAccountUuid ()).isEmpty ()) {
90
+ throw new ApiMessageInterceptionException (argerr ("account has no access to the resource[uuid: %s]" ,
91
+ msg .getResourceUuid ()));
92
+ }
93
+ }
64
94
}
0 commit comments