fix: revert default policy (#20111)

yunionio · Apr 23, 2024 · 003ad67 · 003ad67
1 parent 5084cd1
commit 003ad67
Show file tree

Hide file tree

Showing 6 changed files with 632 additions and 651 deletions.
diff --git a/pkg/cloudid/policy/defaults.go b/pkg/cloudid/policy/defaults.go
@@ -15,6 +15,9 @@
 package policy
 
 import (
+	"yunion.io/x/pkg/util/rbacscope"
+
+	api "yunion.io/x/onecloud/pkg/apis/cloudid"
 	common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/util/rbacutils"
 )
@@ -30,80 +33,78 @@ const (
 
 var (
 	predefinedDefaultPolicies = []rbacutils.SRbacPolicy{
-		/*
-			{
-				Auth:  true,
-				Scope: rbacscope.ScopeSystem,
-				Rules: []rbacutils.SRbacRule{
-					{
-						Service:  api.SERVICE_TYPE,
-						Resource: "cloudpolicies",
-						Action:   PolicyActionList,
-						Result:   rbacutils.Allow,
-					},
-					{
-						Service:  api.SERVICE_TYPE,
-						Resource: "cloudpolicies",
-						Action:   PolicyActionGet,
-						Result:   rbacutils.Allow,
-					},
+		{
+			Auth:  true,
+			Scope: rbacscope.ScopeSystem,
+			Rules: []rbacutils.SRbacRule{
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "cloudpolicies",
+					Action:   PolicyActionList,
+					Result:   rbacutils.Allow,
+				},
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "cloudpolicies",
+					Action:   PolicyActionGet,
+					Result:   rbacutils.Allow,
 				},
 			},
-			{
-				Auth:  true,
-				Scope: rbacscope.ScopeDomain,
-				Rules: []rbacutils.SRbacRule{
-					{
-						Service:  api.SERVICE_TYPE,
-						Resource: "cloudgroups",
-						Action:   PolicyActionList,
-						Result:   rbacutils.Allow,
-					},
-					{
-						Service:  api.SERVICE_TYPE,
-						Resource: "cloudgroups",
-						Action:   PolicyActionGet,
-						Result:   rbacutils.Allow,
-					},
+		},
+		{
+			Auth:  true,
+			Scope: rbacscope.ScopeDomain,
+			Rules: []rbacutils.SRbacRule{
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "cloudgroups",
+					Action:   PolicyActionList,
+					Result:   rbacutils.Allow,
+				},
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "cloudgroups",
+					Action:   PolicyActionGet,
+					Result:   rbacutils.Allow,
 				},
 			},
-			{
-				Auth:  true,
-				Scope: rbacscope.ScopeUser,
-				Rules: []rbacutils.SRbacRule{
-					{
-						Service:  api.SERVICE_TYPE,
-						Resource: "cloudusers",
-						Action:   PolicyActionList,
-						Result:   rbacutils.Allow,
-					},
-					{
-						Service:  api.SERVICE_TYPE,
-						Resource: "cloudusers",
-						Action:   PolicyActionGet,
-						Result:   rbacutils.Allow,
-					},
+		},
+		{
+			Auth:  true,
+			Scope: rbacscope.ScopeUser,
+			Rules: []rbacutils.SRbacRule{
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "cloudusers",
+					Action:   PolicyActionList,
+					Result:   rbacutils.Allow,
+				},
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "cloudusers",
+					Action:   PolicyActionGet,
+					Result:   rbacutils.Allow,
 				},
 			},
-			{
-				Auth:  true,
-				Scope: rbacscope.ScopeUser,
-				Rules: []rbacutils.SRbacRule{
-					{
-						Service:  api.SERVICE_TYPE,
-						Resource: "samlusers",
-						Action:   PolicyActionList,
-						Result:   rbacutils.Allow,
-					},
-					{
-						Service:  api.SERVICE_TYPE,
-						Resource: "samlusers",
-						Action:   PolicyActionGet,
-						Result:   rbacutils.Allow,
-					},
+		},
+		{
+			Auth:  true,
+			Scope: rbacscope.ScopeUser,
+			Rules: []rbacutils.SRbacRule{
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "samlusers",
+					Action:   PolicyActionList,
+					Result:   rbacutils.Allow,
+				},
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "samlusers",
+					Action:   PolicyActionGet,
+					Result:   rbacutils.Allow,
 				},
 			},
-		*/
+		},
 	}
 )