Add function for addtional account restrict
Resolves
@@ -12,6 +12,10 @@ import org.zstack.header.zql.ZQLExtensionContext;
import org.zstack.zql.ZQLContext;
import org.zstack.zql.ast.ZQLMetadata;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Collectors;
+
public class IdentityZQLExtension implements MarshalZQLASTTreeExtensionPoint, RestrictByExprExtensionPoint {
private static final String ENTITY_NAME = "__ACCOUNT_FILTER__";
private static final String ENTITY_FIELD = "__ACCOUNT_FILTER_FIELD__";
@@ -35,6 +39,10 @@ public class IdentityZQLExtension implements MarshalZQLASTTreeExtensionPoint, Re
node.addRestrictExpr(expr);
}
+ protected List<String> getRestrictAccountUuids(SessionInventory session) {
+ return null;
+ }
+
@Override
public String restrictByExpr(ZQLExtensionContext context, ASTNode.RestrictExpr expr) {
if (!ENTITY_NAME.equals(expr.getEntity()) || !ENTITY_FIELD.equals(expr.getField())) {
@@ -47,22 +55,33 @@ public class IdentityZQLExtension implements MarshalZQLASTTreeExtensionPoint, Re
throw new SkipThisRestrictExprException();
}
- ZQLMetadata.InventoryMetadata src = ZQLMetadata.getInventoryMetadataByName(context.getQueryTargetInventoryName());
+ List<String> restrictAccountUuids = getRestrictAccountUuids(context.getAPISession());
String accountUuid = context.getAPISession().getAccountUuid();
- if (AccountConstant.INITIAL_SYSTEM_ADMIN_UUID.equals(accountUuid)) {
+ if (AccountConstant.INITIAL_SYSTEM_ADMIN_UUID.equals(accountUuid) && restrictAccountUuids == null) {
throw new SkipThisRestrictExprException();
}
+ if (restrictAccountUuids == null) {
+ restrictAccountUuids = new ArrayList<>();
+ }
+
+ restrictAccountUuids.add(context.getAPISession().getAccountUuid());
+
+ ZQLMetadata.InventoryMetadata src = ZQLMetadata.getInventoryMetadataByName(context.getQueryTargetInventoryName());
if (!acntMgr.isResourceHavingAccountReference(src.inventoryAnnotation.mappingVOClass())) {
throw new SkipThisRestrictExprException();
}
String primaryKey = EntityMetadata.getPrimaryKeyField(src.inventoryAnnotation.mappingVOClass()).getName();
+ String accountStr = restrictAccountUuids.stream()
+ .map(uuid -> String.format("'%s'", uuid))
+ .collect(Collectors.joining(","));
+
return String.format("(%s.%s IN (SELECT accountresourcerefvo.resourceUuid FROM AccountResourceRefVO accountresourcerefvo WHERE" +
- " accountresourcerefvo.ownerAccountUuid = '%s' OR (accountresourcerefvo.resourceUuid" +
+ " accountresourcerefvo.ownerAccountUuid in (%s) OR (accountresourcerefvo.resourceUuid" +
" IN (SELECT sharedresourcevo.resourceUuid FROM SharedResourceVO sharedresourcevo WHERE" +
- " sharedresourcevo.receiverAccountUuid = '%s' OR sharedresourcevo.toPublic = 1))))",
- src.simpleInventoryName(), primaryKey, accountUuid, accountUuid);
+ " sharedresourcevo.receiverAccountUuid in (%s) OR sharedresourcevo.toPublic = 1))))",
+ src.simpleInventoryName(), primaryKey, accountStr, accountStr);
}
}
