Django-suit, add in Roles for specific classes site, slice, deployment, planetstack...
[plstackapi.git] / planetstack / core / admin.py
index 9c7cc54..730937a 100644 (file)
@@ -11,10 +11,21 @@ from django.contrib.admin.widgets import FilteredSelectMultiple
 from django.contrib.auth.forms import ReadOnlyPasswordHashField
 from django.contrib.auth.signals import user_logged_in
 from django.utils import timezone
+from django.contrib.contenttypes import generic
+from suit.widgets import LinkedSelect
+
 import django_evolution 
 
+class PlStackTabularInline(admin.TabularInline):
+    exclude = ['enacted']
+
+class ReservationInline(PlStackTabularInline):
+    model = Reservation
+    extra = 0
+    suit_classes = 'suit-tab suit-tab-reservations'
+
 
-class ReadonlyTabularInline(admin.TabularInline):
+class ReadonlyTabularInline(PlStackTabularInline):
     can_delete = False
     extra = 0
     editable_fields = []
@@ -30,43 +41,137 @@ class ReadonlyTabularInline(admin.TabularInline):
     def has_add_permission(self, request):
         return False
 
-class SliverInline(admin.TabularInline):
+class UserMembershipInline(generic.GenericTabularInline):
+    model = Member
+    exclude = ['enacted']
+    extra = 1
+    suit_classes = 'suit-tab suit-tab-membership'
+
+    def queryset(self, request):
+        qs = super(UserMembershipInline, self).queryset(request)
+        return qs.filter(user=request.user)
+        
+class MemberInline(generic.GenericTabularInline):
+    model = Member
+    exclude = ['enacted']
+    extra = 1
+    suit_classes = 'suit-tab suit-tab-members'
+
+class TagInline(generic.GenericTabularInline):
+    model = Tag
+    exclude = ['enacted']
+    extra = 0
+    suit_classes = 'suit-tab suit-tab-tags'
+
+class SliverInline(PlStackTabularInline):
     model = Sliver
-    fields = ['ip', 'instance_name', 'slice', 'numberCores', 'image', 'key', 'node', 'deploymentNetwork']
+    fields = ['ip', 'instance_name', 'slice', 'numberCores', 'image', 'node', 'deploymentNetwork']
     extra = 0
     #readonly_fields = ['ip', 'instance_name', 'image']
     readonly_fields = ['ip', 'instance_name']
+    suit_classes = 'suit-tab suit-tab-slivers'
+    
 
-class SiteInline(admin.TabularInline):
+class SiteInline(PlStackTabularInline):
     model = Site
     extra = 0
+    suit_classes = 'suit-tab suit-tab-sites'
 
-class UserInline(admin.TabularInline):
+class UserInline(PlStackTabularInline):
     model = User
     fields = ['email', 'firstname', 'lastname']
     extra = 0
+    suit_classes = 'suit-tab suit-tab-users'
 
-class SliceInline(admin.TabularInline):
+class SliceInline(PlStackTabularInline):
     model = Slice
+    fields = ['name','enabled','description','slice_url']
     extra = 0
+    suit_classes = 'suit-tab suit-tab-slices'
 
-class RoleInline(admin.TabularInline):
+
+class RoleInline(PlStackTabularInline):
     model = Role
     extra = 0 
+    suit_classes = 'suit-tab suit-tab-roles'
 
-class NodeInline(admin.TabularInline):
+class NodeInline(PlStackTabularInline):
     model = Node
     extra = 0
+    suit_classes = 'suit-tab suit-tab-nodes'
 
-class SitePrivilegeInline(admin.TabularInline):
-    model = SitePrivilege
+class SlicePrivilegeInline(PlStackTabularInline):
+    model = SlicePrivilege
+    extra = 0
+    suit_classes = 'suit-tab suit-tab-sliceprivileges'
+
+class DeploymentPrivilegeInline(PlStackTabularInline):
+    model = DeploymentPrivilege
     extra = 0
+    suit_classes = 'suit-tab suit-tab-deploymentprivileges'
 
-class SliceMembershipInline(admin.TabularInline):
-    model = SliceMembership
+class SitePrivilegeInline(PlStackTabularInline):
+    model = SitePrivilege
+    extra = 0
+    suit_classes = 'suit-tab suit-tab-siteprivileges'
+
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name == 'site':
+            if not request.user.is_admin:
+                # only show sites where user is an admin or pi
+                roles = Role.objects.filter(role_type__in=['admin', 'pi'])
+                site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+                login_bases = [site_privilege.site.login_base for site_privilege in site_privileges]
+                sites = Site.objects.filter(login_base__in=login_bases)
+                kwargs['queryset'] = sites
+
+        if db_field.name == 'user':
+            if not request.user.is_admin:
+                # only show users from sites where caller has admin or pi role
+                roles = Role.objects.filter(role_type__in=['admin', 'pi'])
+                site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+                sites = [site_privilege.site for site_privilege in site_privileges]
+                site_privileges = SitePrivilege.objects.filter(site__in=sites)
+                emails = [site_privilege.user.email for site_privilege in site_privileges]
+                users = User.objects.filter(email__in=emails)
+                kwargs['queryset'] = users
+        return super(SitePrivilegeInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
+
+class SitePrivilegeInline(PlStackTabularInline):
+    model = SitePrivilege
+    suit_classes = 'suit-tab suit-tab-siteprivileges'
     extra = 0
+    fields = ('user', 'site','role')
 
-class SliceTagInline(admin.TabularInline):
+class SlicePrivilegeInline(PlStackTabularInline):
+    model = SlicePrivilege
+    suit_classes = 'suit-tab suit-tab-sliceprivileges'
+    extra = 0
+    fields = ('user', 'slice','role')
+
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name == 'slice':
+            if not request.user.is_admin:
+                # only show slices at sites where caller has admin or pi role
+                roles = Role.objects.filter(role_type__in=['admin', 'pi'])
+                site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+                sites = [site_privilege.site for site_privilege in site_privileges]
+                slices = Slice.objects.filter(site__in=sites)
+                kwargs['queryset'] = slices 
+        if db_field.name == 'user':
+            if not request.user.is_admin:
+                # only show users from sites where caller has admin or pi role
+                roles = Role.objects.filter(role_type__in=['admin', 'pi'])
+                site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+                sites = [site_privilege.site for site_privilege in site_privileges]
+                site_privileges = SitePrivilege.objects.filter(site__in=sites)
+                emails = [site_privilege.user.email for site_privilege in site_privileges]   
+                users = User.objects.filter(email__in=emails) 
+                kwargs['queryset'] = list(users)
+
+        return super(SlicePrivilegeInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
+
+class SliceTagInline(PlStackTabularInline):
     model = SliceTag
     extra = 0
 
@@ -80,29 +185,40 @@ class PlainTextWidget(forms.HiddenInput):
 
 class PlanetStackBaseAdmin(admin.ModelAdmin):
     save_on_top = False
-
-class OSModelAdmin(PlanetStackBaseAdmin):
-    """Attach client connection to openstack on delete() and save()"""
-
-    def save_model(self, request, obj, form, change):
-        if request.user.site:
-            auth = request.session.get('auth', {})
-            auth['tenant'] = request.user.site.login_base
-            obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
-        obj.save()
-
-    def delete_model(self, request, obj):
-        if request.user.site:
-            auth = request.session.get('auth', {})
-            auth['tenant'] = request.user.site.login_base
-            obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
-        obj.delete() 
-
-class RoleAdmin(OSModelAdmin):
+    exclude = ['enacted']
+
+#class RoleMemberForm(forms.ModelForm):
+#    request=None
+#    member=forms.ModelChoiceField(queryset=Member.objects.all()) #first get all
+#
+#    def __init__(self,fata=None,files=None,auto_id='id_%s',prefix=None,initial=None,error_class=ErrorList,label_suffix=':',empty_permitted=False,instance=None):
+#        super(RoleMemberForm,self).__init__data,files,auto_id,prefix,initial,error_class,label_suffix,empty_permitted,instance)
+#
+#        self.fields["member"].queryset = member.objects.filter(
+
+class RoleMemberInline (admin.StackedInline):
+    model = Member
+#    form = RoleMemberForm
+    
+    def get_formset(self,request,obj=None, **kwargs):
+        self.form.request=request
+        return super(RoleMemberInline, self).get_formset(request, obj, **kwargs)
+
+class SliceRoleAdmin(PlanetStackBaseAdmin):
+    model = SliceRole
+    pass
+
+class SiteRoleAdmin(PlanetStackBaseAdmin):
+    model = SiteRole
+    pass
+
+class RoleAdmin(PlanetStackBaseAdmin):
     fieldsets = [
-        ('Role', {'fields': ['role_type']})
+        ('Role', {'fields': ['role_type', 'description','content_type'],
+                  'classes':['collapse']})
     ]
-    list_display = ('role_type',)
+    inlines = [ MemberInline,]
+    list_display = ('role_type','description','content_type')
 
 
 class DeploymentAdminForm(forms.ModelForm):
@@ -116,48 +232,30 @@ class DeploymentAdminForm(forms.ModelForm):
     class Meta:
         model = Deployment
 
-    def __init__(self, *args, **kwargs):
-        super(DeploymentAdminForm, self).__init__(*args, **kwargs)
-
-        if self.instance and self.instance.pk:
-            self.fields['sites'].initial = self.instance.sites.all()
-
-    def save(self, commit=True):
-        deploymentNetwork = super(DeploymentAdminForm, self).save(commit=False)
-        if commit:
-            deploymentNetwork.save()
-
-        if deploymentNetwork.pk:
-            deploymentNetwork.sites = self.cleaned_data['sites']
-            self.save_m2m()
-
-        return deploymentNetwork
 
 class DeploymentAdmin(PlanetStackBaseAdmin):
     form = DeploymentAdminForm
-    inlines = [NodeInline,SliverInline]
-
-    def get_formsets(self, request, obj=None):
-        for inline in self.get_inline_instances(request, obj):
-            # hide MyInline in the add view
-            if obj is None:
-                continue
-            # give inline object access to driver and caller
-            auth = request.session.get('auth', {})
-            if request.user.site:
-                auth['tenant'] = request.user.site.login_base
-            inline.model.os_manager = OpenStackManager(auth=auth, caller=request.user)
-            yield inline.get_formset(request, obj)
+    inlines = [MemberInline,NodeInline,SliverInline,TagInline]
+    fieldsets = [
+        (None, {'fields': ['sites'], 'classes':['suit-tab suit-tab-sites']}),]
+    suit_form_tabs =(('sites', 'Sites'),('nodes','Nodes'),('members','Members'),('tags','Tags'))
 
-class SiteAdmin(OSModelAdmin):
+class SiteAdmin(PlanetStackBaseAdmin):
     fieldsets = [
-        (None, {'fields': ['name', 'site_url', 'enabled', 'is_public', 'login_base']}),
-        ('Location', {'fields': ['latitude', 'longitude']}),
-        ('Deployment Networks', {'fields': ['deployments']})
+        (None, {'fields': ['name', 'site_url', 'enabled', 'is_public', 'login_base', 'location'], 'classes':['suit-tab suit-tab-general']}),
+        ('Deployment Networks', {'fields': ['deployments'], 'classes':['suit-tab suit-tab-deployments']}),
     ]
+    suit_form_tabs =(('general', 'Site Details'),
+        ('users','Users'),
+        ('members','Privileges'),
+        ('deployments','Deployments'),
+        ('slices','Slices'),
+        ('nodes','Nodes'), 
+        ('tags','Tags'),
+    )
     list_display = ('name', 'login_base','site_url', 'enabled')
     filter_horizontal = ('deployments',)
-    inlines = [NodeInline, UserInline, SitePrivilegeInline]
+    inlines = [SliceInline,UserInline,TagInline, NodeInline, MemberInline]
     search_fields = ['name']
 
     def queryset(self, request):
@@ -176,64 +274,84 @@ class SiteAdmin(OSModelAdmin):
             # hide MyInline in the add view
             if obj is None:
                 continue
-            # give inline object access to driver and caller
-            auth = request.session.get('auth', {})
-            #auth['tenant'] = request.user.site.login_base
-            inline.model.os_manager = OpenStackManager(auth=auth, caller=request.user)
+            if isinstance(inline, SliceInline):
+                inline.model.caller = request.user
+            yield inline.get_formset(request, obj)
+
+    def get_formsets(self, request, obj=None):
+        for inline in self.get_inline_instances(request, obj):
+            # hide MyInline in the add view
+            if obj is None:
+                continue
+            if isinstance(inline, SliverInline):
+                inline.model.caller = request.user
             yield inline.get_formset(request, obj)
 
 class SitePrivilegeAdmin(PlanetStackBaseAdmin):
     fieldsets = [
-        (None, {'fields': ['user', 'site', 'role']})
+        (None, {'fields': ['user', 'site', 'role'], 'classes':['collapse']})
     ]
     list_display = ('user', 'site', 'role')
 
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name == 'site':
+            if not request.user.is_admin:
+                # only show sites where user is an admin or pi
+                sites = set()
+                for site_privilege in SitePrivilege.objects.filer(user=request.user):
+                    if site_privilege.role.role_type in ['admin', 'pi']:
+                        sites.add(site_privilege.site)
+                kwargs['queryset'] = Site.objects.filter(site__in=list(sites))
+
+        if db_field.name == 'user':
+            if not request.user.is_admin:
+                # only show users from sites where caller has admin or pi role
+                roles = Role.objects.filter(role_type__in=['admin', 'pi'])
+                site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+                sites = [site_privilege.site for site_privilege in site_privileges]
+                site_privileges = SitePrivilege.objects.filter(site__in=sites)
+                emails = [site_privilege.user.email for site_privilege in site_privileges]
+                users = User.objects.filter(email__in=emails)
+                kwargs['queryset'] = users
+
+        return super(SitePrivilegeAdmin, self).formfield_for_foreignkey(db_field, request, **kwargs)
+
     def queryset(self, request):
         # admins can see all privileges. Users can only see privileges at sites
-        # where they have the admin role.
+        # where they have the admin role or pi role.
         qs = super(SitePrivilegeAdmin, self).queryset(request)
         if not request.user.is_admin:
-            roles = request.user.get_roles()
-            tenants = []
-            for (role, tenant_list) in roles:
-                if role == 'admin':
-                    tenants.extend(tenant_list)
-            valid_sites = Sites.objects.filter(login_base__in=tenants)    
-            qs = qs.filter(site__in=valid_sites)
+            roles = Role.objects.filter(role_type__in=['admin', 'pi'])
+            site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+            login_bases = [site_privilege.site.login_base for site_privilege in site_privileges]
+            sites = Site.objects.filter(login_base__in=login_bases)
+            qs = qs.filter(site__in=sites)
         return qs
 
-    def save_model(self, request, obj, form, change):
-        # update openstack connection to use this site/tenant   
-        auth = request.session.get('auth', {})
-        #auth['tenant'] = obj.site.login_base
-        obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
-        obj.save()
+class SliceAdmin(PlanetStackBaseAdmin):
+    fieldsets = [('Slice Details', {'fields': ['name', 'site', 'serviceClass', 'description', 'slice_url'], 'classes':['suit-tab suit-tab-general']}),]
+    list_display = ('name', 'site','serviceClass', 'slice_url')
+    inlines = [SlicePrivilegeInline,SliverInline, TagInline, ReservationInline]
 
-    def delete_model(self, request, obj):
-        # update openstack connection to use this site/tenant   
-        auth = request.session.get('auth', {})
-        #auth['tenant'] = obj.site.login_base
-        obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
-        obj.delete()
 
-class KeyAdmin(OSModelAdmin):
-    fieldsets = [
-        ('Key', {'fields': ['key', 'type', 'blacklisted']})
-    ]
-    list_display = ['key', 'type', 'blacklisted']
-
-    #def queryset(self, request):
-        # admins can see all keys. Users can only see their own key.
-        #if request.user.is_admin:
-        #    qs = super(KeyAdmin, self).queryset(request) 
-        #else:
-        #    qs = Key.objects.filter(user=request.user)
-        #return qs
-
-class SliceAdmin(OSModelAdmin):
-    fields = ['name', 'site', 'serviceClass', 'description', 'slice_url']
-    list_display = ('name', 'site','serviceClass', 'slice_url')
-    inlines = [SliverInline, SliceMembershipInline, SliceTagInline]
+    suit_form_tabs =(('general', 'Slice Details'),
+        ('sliceprivileges','Privileges'),
+        ('slivers','Slivers'),
+        ('tags','Tags'),
+        ('reservations','Reservations'),
+    )
+
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name == 'site':
+            if not request.user.is_admin:
+                # only show sites where user is a pi or admin 
+                roles = Role.objects.filter(role_type__in=['admin', 'pi'])
+                site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+                login_bases = [site_privilege.site.login_base for site_privilege in site_privileges]
+                sites = Site.objects.filter(login_base__in=login_bases)
+                kwargs['queryset'] = sites
+
+        return super(SliceAdmin, self).formfield_for_foreignkey(db_field, request, **kwargs)
 
     def queryset(self, request):
         # admins can see all keys. Users can only see slices they belong to.
@@ -251,10 +369,8 @@ class SliceAdmin(OSModelAdmin):
             # hide MyInline in the add view
             if obj is None:
                 continue
-            # give inline object access to driver and caller
-            auth = request.session.get('auth', {})
-            auth['tenant'] = obj.name       # meed to connect using slice's tenant
-            inline.model.os_manager = OpenStackManager(auth=auth, caller=request.user)
+            if isinstance(inline, SliverInline):
+                inline.model.caller = request.user
             yield inline.get_formset(request, obj)
 
     def get_queryset(self, request):
@@ -262,26 +378,53 @@ class SliceAdmin(OSModelAdmin):
         if request.user.is_superuser:
             return qs
         # users can only see slices at their site
-        return qs.filter(site=request.user.site) 
+        return qs.filter(site=request.user.site)
+
+    def save_model(self, request, obj, form, change):
+        # update openstack connection to use this site/tenant
+        obj.caller = request.user
+        obj.save() 
 
-class SliceMembershipAdmin(PlanetStackBaseAdmin):
+class SlicePrivilegeAdmin(PlanetStackBaseAdmin):
     fieldsets = [
         (None, {'fields': ['user', 'slice', 'role']})
     ]
     list_display = ('user', 'slice', 'role')
 
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name == 'slice':
+            if not request.user.is_admin:
+                # only show slices at sites where caller has admin or pi role
+                roles = Role.objects.filter(role_type__in=['admin', 'pi'])
+                site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+                sites = [site_privilege.site for site_privilege in site_privileges]
+                slices = Slice.objects.filter(site__in=sites)
+                kwargs['queryset'] = slices
+        
+        if db_field.name == 'user':
+            if not request.user.is_admin:
+                # only show users from sites where caller has admin or pi role
+                roles = Role.objects.filter(role_type__in=['admin', 'pi'])
+                site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+                sites = [site_privilege.site for site_privilege in site_privileges]
+                site_privileges = SitePrivilege.objects.filter(site__in=sites)
+                emails = [site_privilege.user.email for site_privilege in site_privileges]
+                users = User.objects.filter(email__in=emails)
+                kwargs['queryset'] = users
+
+        return super(SlicePrivilegeAdmin, self).formfield_for_foreignkey(db_field, request, **kwargs)
+
     def queryset(self, request):
         # admins can see all memberships. Users can only see memberships of
         # slices where they have the admin role.
-        qs = super(SliceMembershipAdmin, self).queryset(request)
+        qs = super(SlicePrivilegeAdmin, self).queryset(request)
         if not request.user.is_admin:
-            roles = request.user.get_roles()
-            tenants = []
-            for (role, tenant_list) in roles:
-                if role == 'admin':
-                    tenants.extend(tenant_list)
-            valid_slices = Slice.objects.filter(name__in=tenants)
-            qs = qs.filter(slice__in=valid_slices)
+            roles = Role.objects.filter(role_type__in=['admin', 'pi'])
+            site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+            login_bases = [site_privilege.site.login_base for site_privilege in site_privileges]
+            sites = Site.objects.filter(login_base__in=login_bases)
+            slices = Slice.objects.filter(site__in=sites)
+            qs = qs.filter(slice__in=slices)
         return qs
 
     def save_model(self, request, obj, form, change):
@@ -299,12 +442,33 @@ class SliceMembershipAdmin(PlanetStackBaseAdmin):
         obj.delete()
 
 
-class ImageAdmin(admin.ModelAdmin):
-    fields = ['image_id', 'name', 'disk_format', 'container_format']
+class ImageAdmin(PlanetStackBaseAdmin):
+
+    fieldsets = [('Image Details', 
+                   {'fields': ['image_id', 'name', 'disk_format', 'container_format'], 
+                    'classes': ['suit-tab suit-tab-general']})
+               ]
+
+    suit_form_tabs =(('general','Image Details'),('slivers','Slivers'))
+
+    inlines = [SliverInline]
+
+class NodeForm(forms.ModelForm):
+    class Meta:
+        widgets = {
+            'site': LinkedSelect,
+            'deployment': LinkedSelect
+        }
 
 class NodeAdmin(admin.ModelAdmin):
+    form = NodeForm
+    exclude = ['enacted']
     list_display = ('name', 'site', 'deployment')
     list_filter = ('deployment',)
+    inlines = [TagInline,SliverInline]
+    fieldsets = [('Node Details', {'fields': ['name','site','deployment'], 'classes':['suit-tab suit-tab-details']})]
+
+    suit_form_tabs =(('details','Node Details'),('slivers','Slivers'),('tags','Tags'))
 
 
 class SliverForm(forms.ModelForm):
@@ -315,14 +479,44 @@ class SliverForm(forms.ModelForm):
         widgets = {
             'ip': PlainTextWidget(),
             'instance_name': PlainTextWidget(),
+            'slice': LinkedSelect,
+            'deploymentNetwork': LinkedSelect,
+            'node': LinkedSelect,
+            'image': LinkedSelect
         }
 
+class ProjectAdmin(admin.ModelAdmin):
+    exclude = ['enacted']
+    inlines = [TagInline]
+
+class MemberAdmin(admin.ModelAdmin):
+    exclude = ['enacted']
+    list_display = ['role', 'rightContent_type', 'content_type', 'content_object',]
+
+class TagAdmin(admin.ModelAdmin):
+    exclude = ['enacted']
+    list_display = ['project', 'name', 'value', 'content_type', 'content_object',]
+
 class SliverAdmin(PlanetStackBaseAdmin):
     form = SliverForm
     fieldsets = [
-        ('Sliver', {'fields': ['ip', 'instance_name', 'slice', 'numberCores', 'image', 'key', 'node', 'deploymentNetwork']})
+        ('Sliver Details', {'fields': ['slice', 'deploymentNetwork', 'node', 'ip', 'instance_name', 'numberCores', 'image', ], 'classes': ['suit-tab suit-tab-general'], })
     ]
-    list_display = ['ip', 'instance_name', 'slice', 'numberCores', 'image', 'key', 'node', 'deploymentNetwork']
+    list_display = ['ip', 'instance_name', 'slice', 'numberCores', 'image', 'node', 'deploymentNetwork']
+
+    suit_form_tabs =(('general', 'Sliver Details'),
+        ('tags','Tags'),
+    )
+
+    inlines = [TagInline]
+
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name == 'slice':
+            if not request.user.is_admin:
+                slices = set([sm.slice.name for sm in SlicePrivilege.objects.filter(user=request.user)]) 
+                kwargs['queryset'] = Slice.objects.filter(name__in=list(slices))
+
+        return super(SliverAdmin, self).formfield_for_foreignkey(db_field, request, **kwargs)
 
     def queryset(self, request):
         # admins can see all slivers. Users can only see slivers of 
@@ -361,6 +555,7 @@ class SliverAdmin(PlanetStackBaseAdmin):
         auth = request.session.get('auth', {})
         auth['tenant'] = obj.slice.name
         obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
+        obj.creator = request.user
         obj.save()
 
     def delete_model(self, request, obj):
@@ -378,7 +573,7 @@ class UserCreationForm(forms.ModelForm):
 
     class Meta:
         model = User
-        fields = ('email', 'firstname', 'lastname', 'phone', 'key', 'site')
+        fields = ('email', 'firstname', 'lastname', 'phone', 'public_key')
 
     def clean_password2(self):
         # Check that the two password entries match
@@ -415,7 +610,7 @@ class UserChangeForm(forms.ModelForm):
         return self.initial["password"]
 
 
-class UserAdmin(UserAdmin, OSModelAdmin):
+class UserAdmin(UserAdmin):
     class Meta:
         app_label = "core"
 
@@ -426,35 +621,53 @@ class UserAdmin(UserAdmin, OSModelAdmin):
     # The fields to be used in displaying the User model.
     # These override the definitions on the base UserAdmin
     # that reference specific fields on auth.User.
-    list_display = ('email', 'site', 'firstname', 'lastname', 'is_admin', 'last_login')
-    list_filter = ('site',)
-    inlines = [SitePrivilegeInline, SliceMembershipInline]
+    list_display = ('email', 'username','firstname', 'lastname', 'is_admin', 'last_login')
+    list_filter = ()
+    inlines = [SlicePrivilegeInline,SitePrivilegeInline,DeploymentPrivilegeInline]
     fieldsets = (
-        (None, {'fields': ('email', 'password', 'site', 'is_admin', 'timezone')}),
-        ('Personal info', {'fields': ('firstname','lastname','phone', 'key')}),
+        ('Login Details', {'fields': ('email', 'username','site','password', 'is_admin', 'public_key'), 'classes':['suit-tab suit-tab-general']}),
+        ('Contact Information', {'fields': ('firstname','lastname','phone', 'timezone'), 'classes':['suit-tab suit-tab-contact']}),
         #('Important dates', {'fields': ('last_login',)}),
     )
     add_fieldsets = (
         (None, {
             'classes': ('wide',),
-            'fields': ('email', 'firstname', 'lastname', 'phone', 'site', 'key','password1', 'password2', 'is_admin')}
+            'fields': ('email', 'username','firstname', 'lastname', 'phone', 'public_key','password1', 'password2')}
         ),
     )
     search_fields = ('email',)
     ordering = ('email',)
     filter_horizontal = ()
 
+    suit_form_tabs =(('general','Login Details'),('contact','Contact Information'),('sliceprivileges','Slice Privileges'),('siteprivileges','Site Privileges'),('deploymentprivileges','Deployment Privileges'))
+
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name == 'site':
+            if not request.user.is_admin:
+                # show sites where caller is an admin or pi 
+                sites = []
+                for site_privilege in SitePrivilege.objects.filer(user=request.user):
+                    if site_privilege.role.role_type in ['admin', 'pi']:
+                        sites.append(site_privilege.site.login_base)  
+                kwargs['queryset'] = Site.objects.filter(login_base__in(list(sites)))
+
+        return super(UserAdmin, self).formfield_for_foreignkey(db_field, request, **kwargs)
+
 class ServiceResourceInline(admin.TabularInline):
+    exclude = ['enacted']
     model = ServiceResource
     extra = 0
 
 class ServiceClassAdmin(admin.ModelAdmin):
+    exclude = ['enacted']
     list_display = ('name', 'commitment', 'membershipFee')
     inlines = [ServiceResourceInline]
 
 class ReservedResourceInline(admin.TabularInline):
+    exclude = ['enacted']
     model = ReservedResource
     extra = 0
+    suit_classes = 'suit-tab suit-tab-reservedresources'
 
     def formfield_for_foreignkey(self, db_field, request=None, **kwargs):
         field = super(ReservedResourceInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
@@ -479,6 +692,9 @@ class ReservedResourceInline(admin.TabularInline):
 class ReservationChangeForm(forms.ModelForm):
     class Meta:
         model = Reservation
+        widgets = {
+            'slice' : LinkedSelect
+        }
 
 class ReservationAddForm(forms.ModelForm):
     slice = forms.ModelChoiceField(queryset=Slice.objects.all(), widget=forms.Select(attrs={"onChange":"document.getElementById('id_refresh').value=1; submit()"}))
@@ -496,6 +712,10 @@ class ReservationAddForm(forms.ModelForm):
 
     class Meta:
         model = Reservation
+        widgets = {
+            'slice' : LinkedSelect
+        }
+
 
 class ReservationAddRefreshForm(ReservationAddForm):
     """ This form is displayed when the Reservation Form receives an update
@@ -521,10 +741,15 @@ class ReservationAddRefreshForm(ReservationAddForm):
         return False
 
 class ReservationAdmin(admin.ModelAdmin):
+    exclude = ['enacted']
+    fieldsets = [('Reservation Details', {'fields': ['startTime', 'duration','slice'], 'classes': ['suit-tab suit-tab-general']})]
     list_display = ('startTime', 'duration')
-    inlines = [ReservedResourceInline]
     form = ReservationAddForm
 
+    suit_form_tabs = (('general','Reservation Details'), ('reservedresources','Reserved Resources'))
+
+    inlines = [ReservedResourceInline]
+
     def add_view(self, request, form_url='', extra_context=None):
         timezone.activate(request.user.timezone)
         request._refresh = False
@@ -550,25 +775,25 @@ class ReservationAdmin(admin.ModelAdmin):
         return super(ReservationAdmin, self).changelist_view(request, extra_context)
 
     def get_form(self, request, obj=None, **kwargs):
-        request._obj_ = obj\r
-        if obj is not None:\r
-            # For changes, set request._slice to the slice already set in the\r
-            # object.\r
-            request._slice = obj.slice\r
-            self.form = ReservationChangeForm\r
-        else:\r
-            if getattr(request, "_refresh", False):\r
-                self.form = ReservationAddRefreshForm\r
-            else:\r
-                self.form = ReservationAddForm\r
-        return super(ReservationAdmin, self).get_form(request, obj, **kwargs)\r
-\r
+        request._obj_ = obj
+        if obj is not None:
+            # For changes, set request._slice to the slice already set in the
+            # object.
+            request._slice = obj.slice
+            self.form = ReservationChangeForm
+        else:
+            if getattr(request, "_refresh", False):
+                self.form = ReservationAddRefreshForm
+            else:
+                self.form = ReservationAddForm
+        return super(ReservationAdmin, self).get_form(request, obj, **kwargs)
+
     def get_readonly_fields(self, request, obj=None):
-        if (obj is not None):\r
-            # Prevent slice from being changed after the reservation has been\r
-            # created.\r
-            return ['slice']\r
-        else:\r
+        if (obj is not None):
+            # Prevent slice from being changed after the reservation has been
+            # created.
+            return ['slice']
+        else:
             return []
 
 # register a signal that caches the user's credentials when they log in
@@ -592,22 +817,27 @@ admin.site.unregister(Evolution)
 
 # When debugging it is often easier to see all the classes, but for regular use 
 # only the top-levels should be displayed
-showAll = False
+showAll = True
 
 admin.site.register(Deployment, DeploymentAdmin)
 admin.site.register(Site, SiteAdmin)
 admin.site.register(Slice, SliceAdmin)
-#admin.site.register(Subnet)
-admin.site.register(Key, KeyAdmin)
-
+admin.site.register(Project, ProjectAdmin)
+admin.site.register(ServiceClass, ServiceClassAdmin)
+admin.site.register(Reservation, ReservationAdmin)
+#admin.site.register(SliceRole, SliceRoleAdmin)
+#admin.site.register(SiteRole, SiteRoleAdmin)
+#admin.site.register(PlanetStackRole)
+#admin.site.register(DeploymentRole)
 
 if showAll:
+    #admin.site.register(PlanetStack)
+    admin.site.register(Tag, TagAdmin)
     admin.site.register(Node, NodeAdmin)
-    admin.site.register(SliceMembership, SliceMembershipAdmin)
-    admin.site.register(SitePrivilege, SitePrivilegeAdmin)
+    #admin.site.register(SlicePrivilege, SlicePrivilegeAdmin)
+    #admin.site.register(SitePrivilege, SitePrivilegeAdmin)
     admin.site.register(Role, RoleAdmin)
+    admin.site.register(Member, MemberAdmin)
     admin.site.register(Sliver, SliverAdmin)
-    admin.site.register(ServiceClass, ServiceClassAdmin)
-    admin.site.register(Reservation, ReservationAdmin)
     admin.site.register(Image, ImageAdmin)