X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=planetstack%2Fcore%2Fadmin.py;h=34a77c06dc8ae1c99238f590cc867cd9a3ab3f01;hb=31e340af19e689e4550759a1228de179370a652a;hp=6fcc3f963ed8f4267550d4de9911590ddecc6dad;hpb=f38f3b0d04decd094983aab02c795c392d47138c;p=plstackapi.git diff --git a/planetstack/core/admin.py b/planetstack/core/admin.py index 6fcc3f9..34a77c0 100644 --- a/planetstack/core/admin.py +++ b/planetstack/core/admin.py @@ -8,15 +8,20 @@ from django import forms from django.utils.safestring import mark_safe from django.contrib.auth.admin import UserAdmin from django.contrib.admin.widgets import FilteredSelectMultiple -from django.contrib.auth.forms import ReadOnlyPasswordHashField +from django.contrib.auth.forms import ReadOnlyPasswordHashField, AdminPasswordChangeForm from django.contrib.auth.signals import user_logged_in from django.utils import timezone from django.contrib.contenttypes import generic from suit.widgets import LinkedSelect from django.core.exceptions import PermissionDenied from django.core.urlresolvers import reverse, NoReverseMatch +from cgi import escape as html_escape import django_evolution +import threading + +# thread locals necessary to work around a django-suit issue +_thread_locals = threading.local() def backend_icon(obj): # backend_status, enacted, updated): #return "%s %s %s" % (str(obj.updated), str(obj.enacted), str(obj.backend_status)) @@ -26,14 +31,14 @@ def backend_icon(obj): # backend_status, enacted, updated): if obj.backend_status == "Provisioning in progress" or obj.backend_status=="": return '' % obj.backend_status else: - return '' % obj.backend_status + return '' % html_escape(obj.backend_status, quote=True) def backend_text(obj): icon = backend_icon(obj) if (obj.enacted is not None) and obj.enacted >= obj.updated: - return "%s %s" % (icon, "successfully enacted") # enacted on %s" % str(obj.enacted)) + return "%s %s" % (icon, "successfully enacted") else: - return "%s %s" % (icon, obj.backend_status) + return "%s %s" % (icon, html_escape(obj.backend_status, quote=True)) class PlainTextWidget(forms.HiddenInput): input_type = 'hidden' @@ -43,7 +48,8 @@ class PlainTextWidget(forms.HiddenInput): value = '' return mark_safe(str(value) + super(PlainTextWidget, self).render(name, value, attrs)) -class ReadOnlyAwareAdmin(admin.ModelAdmin): +class PermissionCheckingAdminMixin(object): + # call save_by_user and delete_by_user instead of save and delete def has_add_permission(self, request, obj=None): return (not self.__user_is_readonly(request)) @@ -53,13 +59,42 @@ class ReadOnlyAwareAdmin(admin.ModelAdmin): def save_model(self, request, obj, form, change): if self.__user_is_readonly(request): + # this 'if' might be redundant if save_by_user is implemented right raise PermissionDenied - #pass - else: - return super(ReadOnlyAwareAdmin, self).save_model(request, obj, form, change) + + obj.caller = request.user + # update openstack connection to use this site/tenant + obj.save_by_user(request.user) + + def delete_model(self, request, obj): + obj.delete_by_user(request.user) + + def save_formset(self, request, form, formset, change): + instances = formset.save(commit=False) + for instance in instances: + instance.save_by_user(request.user) + + # BUG in django 1.7? Objects are not deleted by formset.save if + # commit is False. So let's delete them ourselves. + # + # code from forms/models.py save_existing_objects() + try: + forms_to_delete = formset.deleted_forms + except AttributeError: + forms_to_delete = [] + if formset.initial_forms: + for form in formset.initial_forms: + obj = form.instance + if form in forms_to_delete: + if obj.pk is None: + continue + formset.deleted_objects.append(obj) + obj.delete() + + formset.save_m2m() def get_actions(self,request): - actions = super(ReadOnlyAwareAdmin,self).get_actions(request) + actions = super(PermissionCheckingAdminMixin,self).get_actions(request) if self.__user_is_readonly(request): if 'delete_selected' in actions: @@ -85,13 +120,13 @@ class ReadOnlyAwareAdmin(admin.ModelAdmin): self.inlines = self.inlines_save try: - return super(ReadOnlyAwareAdmin, self).change_view(request, object_id, extra_context=extra_context) + return super(PermissionCheckingAdminMixin, self).change_view(request, object_id, extra_context=extra_context) except PermissionDenied: pass if request.method == 'POST': raise PermissionDenied request.readonly = True - return super(ReadOnlyAwareAdmin, self).change_view(request, object_id, extra_context=extra_context) + return super(PermissionCheckingAdminMixin, self).change_view(request, object_id, extra_context=extra_context) def __user_is_readonly(self, request): return request.user.isReadOnlyUser() @@ -103,6 +138,32 @@ class ReadOnlyAwareAdmin(admin.ModelAdmin): return mark_safe(backend_icon(obj)) backend_status_icon.short_description = "" + def get_form(self, request, obj=None): + # Save obj and request in thread-local storage, so suit_form_tabs can + # use it to determine whether we're in edit or add mode, and can + # determine whether the user is an admin. + _thread_locals.request = request + _thread_locals.obj = obj + return super(PermissionCheckingAdminMixin, self).get_form(request, obj) + + def get_inline_instances(self, request, obj=None): + inlines = super(PermissionCheckingAdminMixin, self).get_inline_instances(request, obj) + + # inlines that should only be shown to an admin user + if request.user.is_admin: + for inline_class in getattr(self, "admin_inlines", []): + inlines.append(inline_class(self.model, self.admin_site)) + + return inlines + +class ReadOnlyAwareAdmin(PermissionCheckingAdminMixin, admin.ModelAdmin): + # Note: Make sure PermissionCheckingAdminMixin is listed before + # admin.ModelAdmin in the class declaration. + + pass + +class PlanetStackBaseAdmin(ReadOnlyAwareAdmin): + save_on_top = False class SingletonAdmin (ReadOnlyAwareAdmin): def has_add_permission(self, request): @@ -115,7 +176,6 @@ class SingletonAdmin (ReadOnlyAwareAdmin): else: return True - class PlStackTabularInline(admin.TabularInline): def __init__(self, *args, **kwargs): super(PlStackTabularInline, self).__init__(*args, **kwargs) @@ -404,23 +464,6 @@ class ImageDeploymentsInline(PlStackTabularInline): fields = ['backend_status_icon', 'image', 'deployment', 'glance_image_id'] readonly_fields = ['backend_status_icon', 'glance_image_id'] -class PlanetStackBaseAdmin(ReadOnlyAwareAdmin): - save_on_top = False - - def save_model(self, request, obj, form, change): - obj.caller = request.user - # update openstack connection to use this site/tenant - obj.save_by_user(request.user) - - def delete_model(self, request, obj): - obj.delete_by_user(request.user) - - def save_formset(self, request, form, formset, change): - instances = formset.save(commit=False) - for instance in instances: - instance.save_by_user(request.user) - formset.save_m2m() - class SliceRoleAdmin(PlanetStackBaseAdmin): model = SliceRole pass @@ -507,10 +550,10 @@ class DeploymentAdminForm(forms.ModelForm): def save(self, commit=True): deployment = super(DeploymentAdminForm, self).save(commit=False) - deployment.flavors = self.cleaned_data['flavors'] - if commit: deployment.save() + # this has to be done after save() if/when a deployment is first created + deployment.flavors = self.cleaned_data['flavors'] if deployment.pk: # save_m2m() doesn't seem to work with 'through' relations. So we @@ -610,15 +653,6 @@ class SiteAdmin(PlanetStackBaseAdmin): def queryset(self, request): return Site.select_by_user(request.user) - def get_formsets(self, request, obj=None): - for inline in self.get_inline_instances(request, obj): - # hide MyInline in the add view - if obj is None: - continue - if isinstance(inline, SliceInline): - inline.model.caller = request.user - yield inline.get_formset(request, obj) - def get_formsets(self, request, obj=None): for inline in self.get_inline_instances(request, obj): # hide MyInline in the add view @@ -703,12 +737,26 @@ class SliceForm(forms.ModelForm): def clean(self): cleaned_data = super(SliceForm, self).clean() name = cleaned_data.get('name') - site_id = cleaned_data.get('site') - site = Slice.objects.get(id=site_id) + site = cleaned_data.get('site') + slice_id = self.instance.id + if not site and slice_id: + site = Slice.objects.get(id=slice_id).site + if (not isinstance(site,Site)): + # previous code indicates 'site' could be a site_id and not a site? + site = Slice.objects.get(id=site.id) if not name.startswith(site.login_base): raise forms.ValidationError('slice name must begin with %s' % site.login_base) return cleaned_data +class SliceDeploymentsInline(PlStackTabularInline): + model = SliceDeployments + extra = 0 + verbose_name = "Slice Deployment" + verbose_name_plural = "Slice Deployments" + suit_classes = 'suit-tab suit-tab-admin-only' + fields = ['backend_status_icon', 'deployment', 'tenant_id'] + readonly_fields = ('backend_status_icon', ) + class SliceAdmin(PlanetStackBaseAdmin): form = SliceForm fieldList = ['backend_status_text', 'site', 'name', 'serviceClass', 'enabled','description', 'service', 'slice_url', 'max_slivers'] @@ -717,16 +765,37 @@ class SliceAdmin(PlanetStackBaseAdmin): list_display = ('backend_status_icon', 'name', 'site','serviceClass', 'slice_url', 'max_slivers') list_display_links = ('backend_status_icon', 'name', ) inlines = [SlicePrivilegeInline,SliverInline, TagInline, ReservationInline,SliceNetworkInline] + admin_inlines = [SliceDeploymentsInline] user_readonly_fields = fieldList - suit_form_tabs =(('general', 'Slice Details'), - ('slicenetworks','Networks'), - ('sliceprivileges','Privileges'), - ('slivers','Slivers'), - ('tags','Tags'), - ('reservations','Reservations'), - ) + @property + def suit_form_tabs(self): + tabs =[('general', 'Slice Details'), + ('slicenetworks','Networks'), + ('sliceprivileges','Privileges'), + ('slivers','Slivers'), + ('tags','Tags'), + ('reservations','Reservations'), + ] + + request=getattr(_thread_locals, "request", None) + if request and request.user.is_admin: + tabs.append( ('admin-only', 'Admin-Only') ) + + return tabs + + def add_view(self, request, form_url='', extra_context=None): + # revert to default read-only fields + self.readonly_fields = ('backend_status_text',) + return super(SliceAdmin, self).add_view(request, form_url, extra_context=extra_context) + + def change_view(self, request, object_id, form_url='', extra_context=None): + print object_id + # cannot change the site of an existing slice so make the site field read only + if object_id: + self.readonly_fields = ('backend_status_text','site') + return super(SliceAdmin, self).change_view(request, object_id, form_url) def render_change_form(self, request, context, add=False, change=False, form_url='', obj=None): deployment_nodes = [] @@ -773,7 +842,6 @@ class SliceAdmin(PlanetStackBaseAdmin): inline.model.caller = request.user yield inline.get_formset(request, obj) - class SlicePrivilegeAdmin(PlanetStackBaseAdmin): fieldsets = [ (None, {'fields': ['backend_status_text', 'user', 'slice', 'role']}) @@ -907,9 +975,9 @@ class SliverAdmin(PlanetStackBaseAdmin): # make some fields read only if we are updating an existing record if obj == None: #self.readonly_fields = ('ip', 'instance_name') - self.readonly_fields = ('backend_status_text') + self.readonly_fields = ('backend_status_text',) else: - self.readonly_fields = ('backend_status_text') + self.readonly_fields = ('backend_status_text',) #self.readonly_fields = ('ip', 'instance_name', 'slice', 'image', 'key') for inline in self.get_inline_instances(request, obj): @@ -986,7 +1054,10 @@ class UserDashboardViewInline(PlStackTabularInline): suit_classes = 'suit-tab suit-tab-dashboards' fields = ['user', 'dashboardView', 'order'] -class UserAdmin(UserAdmin): +class UserAdmin(PermissionCheckingAdminMixin, UserAdmin): + # Note: Make sure PermissionCheckingAdminMixin is listed before + # admin.ModelAdmin in the class declaration. + class Meta: app_label = "core" @@ -1001,7 +1072,7 @@ class UserAdmin(UserAdmin): list_filter = ('site',) inlines = [SlicePrivilegeInline,SitePrivilegeInline,DeploymentPrivilegeInline,UserDashboardViewInline] - fieldListLoginDetails = ['email','site','password','is_active','is_readonly','is_admin','public_key'] + fieldListLoginDetails = ['backend_status_text', 'email','site','password','is_active','is_readonly','is_admin','public_key'] fieldListContactInfo = ['firstname','lastname','phone','timezone'] fieldsets = ( @@ -1013,7 +1084,7 @@ class UserAdmin(UserAdmin): add_fieldsets = ( (None, { 'classes': ('wide',), - 'fields': ('email', 'firstname', 'lastname', 'is_readonly', 'phone', 'public_key','password1', 'password2')} + 'fields': ('email', 'firstname', 'lastname', 'is_readonly', 'phone', 'public_key','password1', 'password2')}, ), ) readonly_fields = ('backend_status_text', ) @@ -1023,12 +1094,17 @@ class UserAdmin(UserAdmin): user_readonly_fields = fieldListLoginDetails + fieldListContactInfo - suit_form_tabs =(('general','Login Details'), - ('contact','Contact Information'), - ('sliceprivileges','Slice Privileges'), - ('siteprivileges','Site Privileges'), - ('deploymentprivileges','Deployment Privileges'), - ('dashboards','Dashboard Views')) + @property + def suit_form_tabs(self): + if getattr(_thread_locals, "obj", None) is None: + return [] + else: + return (('general','Login Details'), + ('contact','Contact Information'), + ('sliceprivileges','Slice Privileges'), + ('siteprivileges','Site Privileges'), + ('deploymentprivileges','Deployment Privileges'), + ('dashboards','Dashboard Views')) def formfield_for_foreignkey(self, db_field, request, **kwargs): if db_field.name == 'site': @@ -1036,62 +1112,9 @@ class UserAdmin(UserAdmin): return super(UserAdmin, self).formfield_for_foreignkey(db_field, request, **kwargs) - def has_add_permission(self, request, obj=None): - return (not self.__user_is_readonly(request)) - - def has_delete_permission(self, request, obj=None): - return (not self.__user_is_readonly(request)) - - def get_actions(self,request): - actions = super(UserAdmin,self).get_actions(request) - - if self.__user_is_readonly(request): - if 'delete_selected' in actions: - del actions['delete_selected'] - - return actions - - def change_view(self,request,object_id, extra_context=None): - - if self.__user_is_readonly(request): - if not hasattr(self, "readonly_save"): - # save the original readonly fields - self.readonly_save = self.readonly_fields - self.inlines_save = self.inlines - if hasattr(self, "user_readonly_fields"): - self.readonly_fields=self.user_readonly_fields - if hasattr(self, "user_readonly_inlines"): - self.inlines = self.user_readonly_inlines - else: - if hasattr(self, "readonly_save"): - # restore the original readonly fields - self.readonly_fields = self.readonly_save - self.inlines = self.inlines_save - - try: - return super(UserAdmin, self).change_view(request, object_id, extra_context=extra_context) - except PermissionDenied: - pass - if request.method == 'POST': - raise PermissionDenied - request.readonly = True - return super(UserAdmin, self).change_view(request, object_id, extra_context=extra_context) - - def __user_is_readonly(self, request): - #groups = [x.name for x in request.user.groups.all() ] - #return "readonly" in groups - return request.user.isReadOnlyUser() - def queryset(self, request): return User.select_by_user(request.user) - def backend_status_text(self, obj): - return mark_safe(backend_text(obj)) - - def backend_status_icon(self, obj): - return mark_safe(backend_icon(obj)) - backend_status_icon.short_description = "" - class DashboardViewAdmin(PlanetStackBaseAdmin): fieldsets = [('Dashboard View Details', {'fields': ['backend_status_text', 'name', 'url'], @@ -1301,12 +1324,22 @@ class NetworkSlicesInline(PlStackTabularInline): fields = ['backend_status_icon', 'network','slice'] readonly_fields = ('backend_status_icon', ) +class NetworkDeploymentsInline(PlStackTabularInline): + model = NetworkDeployments + extra = 0 + verbose_name_plural = "Network Deployments" + verbose_name = "Network Deployment" + suit_classes = 'suit-tab suit-tab-admin-only' + fields = ['backend_status_icon', 'deployment','net_id','subnet_id'] + readonly_fields = ('backend_status_icon', ) + class NetworkAdmin(PlanetStackBaseAdmin): list_display = ("backend_status_icon", "name", "subnet", "ports", "labels") list_display_links = ('backend_status_icon', 'name', ) readonly_fields = ("subnet", ) inlines = [NetworkParameterInline, NetworkSliversInline, NetworkSlicesInline, RouterInline] + admin_inlines = [NetworkDeploymentsInline] fieldsets = [ (None, {'fields': ['backend_status_text', 'name','template','ports','labels','owner','guaranteedBandwidth', 'permitAllSlices','permittedSlices','network_id','router_id','subnet_id','subnet'], 'classes':['suit-tab suit-tab-general']}),] @@ -1314,13 +1347,22 @@ class NetworkAdmin(PlanetStackBaseAdmin): readonly_fields = ('backend_status_text', ) user_readonly_fields = ['name','template','ports','labels','owner','guaranteedBandwidth', 'permitAllSlices','permittedSlices','network_id','router_id','subnet_id','subnet'] - suit_form_tabs =( - ('general','Network Details'), - ('netparams', 'Parameters'), - ('networkslivers','Slivers'), - ('networkslices','Slices'), - ('routers','Routers'), - ) + @property + def suit_form_tabs(self): + tabs=[('general','Network Details'), + ('netparams', 'Parameters'), + ('networkslivers','Slivers'), + ('networkslices','Slices'), + ('routers','Routers'), + ] + + request=getattr(_thread_locals, "request", None) + if request and request.user.is_admin: + tabs.append( ('admin-only', 'Admin-Only') ) + + return tabs + + class NetworkTemplateAdmin(PlanetStackBaseAdmin): list_display = ("backend_status_icon", "name", "guaranteedBandwidth", "visibility") list_display_links = ('backend_status_icon', 'name', )