Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow for non-NamedModelViewsets to be added to the RBAC system. #5500

Open
gerrod3 opened this issue Jun 21, 2024 · 0 comments
Open

Allow for non-NamedModelViewsets to be added to the RBAC system. #5500

gerrod3 opened this issue Jun 21, 2024 · 0 comments
Labels

Comments

@gerrod3
Copy link
Contributor

gerrod3 commented Jun 21, 2024

Currently only NamedModelViewSet (NMV) can be fully added to Pulp's RBAC system. The ability to customize the AccessPolicy, define default roles and use object creation hooks are restricted to NMVs. This is due to the post-migrate hooks at startup that only look through registered NMVs.

post_migrate.connect(
_populate_access_policies,
sender=self,
dispatch_uid="populate_access_policies_identifier",
)
post_migrate.connect(_populate_roles, sender=self, dispatch_uid="populate_roles_identifier")

Also, our permission class AccessPolicyFromDB is expecting NMVs in order to work.

try:
urlpattern = get_view_urlpattern(view)
except AttributeError:
# The view does not define a `urlpattern()` method, e.g. it's not a NamedModelViewset
return None

If we want to add RBAC to non-NMVs (like orphan cleanup #1924), we will need to redesign portions of this system to make it easier to add support without turning every view into a NMV.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants