merged trunk

10 files changed, 130 insertions, 44 deletions

diff --git a/nova/api/openstack/__init__.py b/nova/api/openstack/__init__.py
index e0c1e9d04..3b74fefc9 100644
--- a/nova/api/openstack/__init__.py
+++ b/nova/api/openstack/__init__.py
@@ -68,6 +68,22 @@ class FaultWrapper(base_wsgi.Middleware):
             return faults.Fault(exc)
 
 
+class ProjectMapper(routes.Mapper):
+
+    def resource(self, member_name, collection_name, **kwargs):
+        if not ('parent_resource' in kwargs):
+            kwargs['path_prefix'] = '{project_id}/'
+        else:
+            parent_resource = kwargs['parent_resource']
+            p_collection = parent_resource['collection_name']
+            p_member = parent_resource['member_name']
+            kwargs['path_prefix'] = '{project_id}/%s/:%s_id' % (p_collection,
+                                                               p_member)
+        routes.Mapper.resource(self, member_name,
+                                     collection_name,
+                                     **kwargs)
+
+
 class APIRouter(base_wsgi.Router):
     """
     Routes requests on the OpenStack API to the appropriate controller
@@ -81,10 +97,13 @@ class APIRouter(base_wsgi.Router):
 
     def __init__(self, ext_mgr=None):
         self.server_members = {}
-        mapper = routes.Mapper()
+        mapper = self._mapper()
         self._setup_routes(mapper)
         super(APIRouter, self).__init__(mapper)
 
+    def _mapper(self):
+        return routes.Mapper()
+
     def _setup_routes(self, mapper):
         raise NotImplementedError(_("You must implement _setup_routes."))
 
@@ -174,6 +193,9 @@ class APIRouterV10(APIRouter):
 class APIRouterV11(APIRouter):
     """Define routes specific to OpenStack API V1.1."""
 
+    def _mapper(self):
+        return ProjectMapper()
+
     def _setup_routes(self, mapper):
         self._setup_base_routes(mapper, '1.1')
 
@@ -184,7 +206,7 @@ class APIRouterV11(APIRouter):
                         parent_resource=dict(member_name='image',
                         collection_name='images'))
 
-        mapper.connect("metadata", "/images/{image_id}/metadata",
+        mapper.connect("metadata", "/{project_id}/images/{image_id}/metadata",
                        controller=image_metadata_controller,
                        action='update_all',
                        conditions={"method": ['PUT']})
@@ -196,7 +218,8 @@ class APIRouterV11(APIRouter):
                         parent_resource=dict(member_name='server',
                         collection_name='servers'))
 
-        mapper.connect("metadata", "/servers/{server_id}/metadata",
+        mapper.connect("metadata",
+                       "/{project_id}/servers/{server_id}/metadata",
                        controller=server_metadata_controller,
                        action='update_all',
                        conditions={"method": ['PUT']})
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index d42abe1f8..b6ff1126b 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -28,6 +28,7 @@ from nova import flags
 from nova import log as logging
 from nova import utils
 from nova import wsgi
+from nova.api.openstack import common
 from nova.api.openstack import faults
 
 LOG = logging.getLogger('nova.api.openstack')
@@ -55,16 +56,33 @@ class AuthMiddleware(wsgi.Middleware):
             LOG.warn(msg % locals())
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
-        try:
-            project_id = req.headers["X-Auth-Project-Id"]
-        except KeyError:
-            # FIXME(usrleon): It needed only for compatibility
-            # while osapi clients don't use this header
-            projects = self.auth.get_projects(user_id)
-            if projects:
-                project_id = projects[0].id
-            else:
+        # Get all valid projects for the user
+        projects = self.auth.get_projects(user_id)
+        if not projects:
+            return faults.Fault(webob.exc.HTTPUnauthorized())
+
+        project_id = ""
+        path_parts = req.path.split('/')
+        # TODO(wwolf): this v1.1 check will be temporary as
+        # keystone should be taking this over at some point
+        if len(path_parts) > 1 and path_parts[1] == 'v1.1':
+            project_id = path_parts[2]
+            # Check that the project for project_id exists, and that user
+            # is authorized to use it
+            try:
+                project = self.auth.get_project(project_id)
+            except exception.ProjectNotFound:
+                return faults.Fault(webob.exc.HTTPUnauthorized())
+            if project_id not in [p.id for p in projects]:
                 return faults.Fault(webob.exc.HTTPUnauthorized())
+        else:
+            # As a fallback, set project_id from the headers, which is the v1.0
+            # behavior. As a last resort, be forgiving to the user and set
+            # project_id based on a valid project of theirs.
+            try:
+                project_id = req.headers["X-Auth-Project-Id"]
+            except KeyError:
+                project_id = projects[0].id
 
         is_admin = self.auth.is_admin(user_id)
         req.environ['nova.context'] = context.RequestContext(user_id,
@@ -95,12 +113,19 @@ class AuthMiddleware(wsgi.Middleware):
             LOG.warn(msg)
             return faults.Fault(webob.exc.HTTPUnauthorized(explanation=msg))
 
+        def _get_auth_header(key):
+            """Ensures that the KeyError returned is meaningful."""
+            try:
+                return req.headers[key]
+            except KeyError as ex:
+                raise KeyError(key)
         try:
-            username = req.headers['X-Auth-User']
-            key = req.headers['X-Auth-Key']
+            username = _get_auth_header('X-Auth-User')
+            key = _get_auth_header('X-Auth-Key')
         except KeyError as ex:
-            LOG.warn(_("Could not find %s in request.") % ex)
-            return faults.Fault(webob.exc.HTTPUnauthorized())
+            msg = _("Could not find %s in request.") % ex
+            LOG.warn(msg)
+            return faults.Fault(webob.exc.HTTPUnauthorized(explanation=msg))
 
         token, user = self._authorize_user(username, key, req)
         if user and token:
@@ -149,6 +174,16 @@ class AuthMiddleware(wsgi.Middleware):
         """
         ctxt = context.get_admin_context()
 
+        project_id = req.headers.get('X-Auth-Project-Id')
+        if project_id is None:
+            # If the project_id is not provided in the headers, be forgiving to
+            # the user and set project_id based on a valid project of theirs.
+            user = self.auth.get_user_from_access_key(key)
+            projects = self.auth.get_projects(user.id)
+            if not projects:
+                raise webob.exc.HTTPUnauthorized()
+            project_id = projects[0].id
+
         try:
             user = self.auth.get_user_from_access_key(key)
         except exception.NotFound:
@@ -162,7 +197,10 @@ class AuthMiddleware(wsgi.Middleware):
             token_dict['token_hash'] = token_hash
             token_dict['cdn_management_url'] = ''
             os_url = req.url
-            token_dict['server_management_url'] = os_url
+            token_dict['server_management_url'] = os_url.strip('/')
+            version = common.get_version_from_href(os_url)
+            if version == '1.1':
+                token_dict['server_management_url'] += '/' + project_id
             token_dict['storage_url'] = ''
             token_dict['user_id'] = user.id
             token = self.db.auth_token_create(ctxt, token_dict)
diff --git a/nova/api/openstack/extensions.py b/nova/api/openstack/extensions.py
index bb407a045..efede945f 100644
--- a/nova/api/openstack/extensions.py
+++ b/nova/api/openstack/extensions.py
@@ -29,6 +29,7 @@ from nova import exception
 from nova import flags
 from nova import log as logging
 from nova import wsgi as base_wsgi
+import nova.api.openstack
 from nova.api.openstack import common
 from nova.api.openstack import faults
 from nova.api.openstack import wsgi
@@ -220,12 +221,13 @@ class ExtensionMiddleware(base_wsgi.Middleware):
         for action in ext_mgr.get_actions():
             if not action.collection in action_resources.keys():
                 resource = ActionExtensionResource(application)
-                mapper.connect("/%s/:(id)/action.:(format)" %
+                mapper.connect("/:(project_id)/%s/:(id)/action.:(format)" %
                                 action.collection,
                                 action='action',
                                 controller=resource,
                                 conditions=dict(method=['POST']))
-                mapper.connect("/%s/:(id)/action" % action.collection,
+                mapper.connect("/:(project_id)/%s/:(id)/action" %
+                                action.collection,
                                 action='action',
                                 controller=resource,
                                 conditions=dict(method=['POST']))
@@ -258,7 +260,7 @@ class ExtensionMiddleware(base_wsgi.Middleware):
             ext_mgr = ExtensionManager(FLAGS.osapi_extensions_path)
         self.ext_mgr = ext_mgr
 
-        mapper = routes.Mapper()
+        mapper = nova.api.openstack.ProjectMapper()
 
         serializer = wsgi.ResponseSerializer(
             {'application/xml': ExtensionsXMLSerializer()})
@@ -269,13 +271,17 @@ class ExtensionMiddleware(base_wsgi.Middleware):
             if resource.serializer is None:
                 resource.serializer = serializer
 
-            mapper.resource(resource.collection, resource.collection,
+            kargs = dict(
                 controller=wsgi.Resource(
                     resource.controller, resource.deserializer,
                     resource.serializer),
                 collection=resource.collection_actions,
-                member=resource.member_actions,
-                parent_resource=resource.parent)
+                member=resource.member_actions)
+
+            if resource.parent:
+                kargs['parent_resource'] = resource.parent
+
+            mapper.resource(resource.collection, resource.collection, **kargs)
 
         # extended actions
         action_resources = self._action_ext_resources(application, ext_mgr,
diff --git a/nova/api/openstack/flavors.py b/nova/api/openstack/flavors.py
index b4bda68d4..fd36060da 100644
--- a/nova/api/openstack/flavors.py
+++ b/nova/api/openstack/flavors.py
@@ -72,7 +72,8 @@ class ControllerV11(Controller):
 
     def _get_view_builder(self, req):
         base_url = req.application_url
-        return views.flavors.ViewBuilderV11(base_url)
+        project_id = getattr(req.environ['nova.context'], 'project_id', '')
+        return views.flavors.ViewBuilderV11(base_url, project_id)
 
 
 class FlavorXMLSerializer(wsgi.XMLDictSerializer):
diff --git a/nova/api/openstack/images.py b/nova/api/openstack/images.py
index 0aabb9e56..1c8fc10c9 100644
--- a/nova/api/openstack/images.py
+++ b/nova/api/openstack/images.py
@@ -166,10 +166,11 @@ class ControllerV10(Controller):
 class ControllerV11(Controller):
     """Version 1.1 specific controller logic."""
 
-    def get_builder(self, request):
+    def get_builder(self, req):
         """Property to get the ViewBuilder class we need to use."""
-        base_url = request.application_url
-        return images_view.ViewBuilderV11(base_url)
+        base_url = req.application_url
+        project_id = getattr(req.environ['nova.context'], 'project_id', '')
+        return images_view.ViewBuilderV11(base_url, project_id)
 
     def index(self, req):
         """Return an index listing of images available to the request.
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index 1d1975a1c..553357404 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -650,14 +650,16 @@ class ControllerV11(Controller):
         return common.get_id_from_href(flavor_ref)
 
     def _build_view(self, req, instance, is_detail=False):
+        project_id = getattr(req.environ['nova.context'], 'project_id', '')
         base_url = req.application_url
         flavor_builder = nova.api.openstack.views.flavors.ViewBuilderV11(
-            base_url)
+            base_url, project_id)
         image_builder = nova.api.openstack.views.images.ViewBuilderV11(
-            base_url)
+            base_url, project_id)
         addresses_builder = nova.api.openstack.views.addresses.ViewBuilderV11()
         builder = nova.api.openstack.views.servers.ViewBuilderV11(
-            addresses_builder, flavor_builder, image_builder, base_url)
+            addresses_builder, flavor_builder, image_builder,
+            base_url, project_id)
 
         return builder.build(instance, is_detail=is_detail)
 
diff --git a/nova/api/openstack/views/flavors.py b/nova/api/openstack/views/flavors.py
index 0403ece1b..aea34b424 100644
--- a/nova/api/openstack/views/flavors.py
+++ b/nova/api/openstack/views/flavors.py
@@ -15,6 +15,9 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import os.path
+
+
 from nova.api.openstack import common
 
 
@@ -59,11 +62,12 @@ class ViewBuilder(object):
 class ViewBuilderV11(ViewBuilder):
     """Openstack API v1.1 flavors view builder."""
 
-    def __init__(self, base_url):
+    def __init__(self, base_url, project_id=""):
         """
         :param base_url: url of the root wsgi application
         """
         self.base_url = base_url
+        self.project_id = project_id
 
     def _build_extra(self, flavor_obj):
         flavor_obj["links"] = self._build_links(flavor_obj)
@@ -88,11 +92,10 @@ class ViewBuilderV11(ViewBuilder):
 
     def generate_href(self, flavor_id):
         """Create an url that refers to a specific flavor id."""
-        return "%s/flavors/%s" % (self.base_url, flavor_id)
+        return os.path.join(self.base_url, self.project_id,
+                            "flavors", str(flavor_id))
 
     def generate_bookmark(self, flavor_id):
         """Create an url that refers to a specific flavor id."""
-        return "%s/flavors/%s" % (
-            common.remove_version_from_href(self.base_url),
-            flavor_id,
-        )
+        return os.path.join(common.remove_version_from_href(self.base_url),
+            self.project_id, "flavors", str(flavor_id))
diff --git a/nova/api/openstack/views/images.py b/nova/api/openstack/views/images.py
index 912303d14..21f1b2d3e 100644
--- a/nova/api/openstack/views/images.py
+++ b/nova/api/openstack/views/images.py
@@ -23,9 +23,10 @@ from nova.api.openstack import common
 class ViewBuilder(object):
     """Base class for generating responses to OpenStack API image requests."""
 
-    def __init__(self, base_url):
+    def __init__(self, base_url, project_id=""):
         """Initialize new `ViewBuilder`."""
-        self._url = base_url
+        self.base_url = base_url
+        self.project_id = project_id
 
     def _format_dates(self, image):
         """Update all date fields to ensure standardized formatting."""
@@ -54,7 +55,7 @@ class ViewBuilder(object):
 
     def generate_href(self, image_id):
         """Return an href string pointing to this object."""
-        return os.path.join(self._url, "images", str(image_id))
+        return os.path.join(self.base_url, "images", str(image_id))
 
     def build(self, image_obj, detail=False):
         """Return a standardized image structure for display by the API."""
@@ -117,6 +118,11 @@ class ViewBuilderV11(ViewBuilder):
         except KeyError:
             return
 
+    def generate_href(self, image_id):
+        """Return an href string pointing to this object."""
+        return os.path.join(self.base_url, self.project_id,
+                            "images", str(image_id))
+
     def build(self, image_obj, detail=False):
         """Return a standardized image structure for display by the API."""
         image = ViewBuilder.build(self, image_obj, detail)
@@ -142,5 +148,5 @@ class ViewBuilderV11(ViewBuilder):
 
     def generate_bookmark(self, image_id):
         """Create an url that refers to a specific flavor id."""
-        return os.path.join(common.remove_version_from_href(self._url),
-            "images", str(image_id))
+        return os.path.join(common.remove_version_from_href(self.base_url),
+            self.project_id, "images", str(image_id))
diff --git a/nova/api/openstack/views/servers.py b/nova/api/openstack/views/servers.py
index d2c1b0ba1..465287adc 100644
--- a/nova/api/openstack/views/servers.py
+++ b/nova/api/openstack/views/servers.py
@@ -128,11 +128,12 @@ class ViewBuilderV10(ViewBuilder):
 class ViewBuilderV11(ViewBuilder):
     """Model an Openstack API V1.0 server response."""
     def __init__(self, addresses_builder, flavor_builder, image_builder,
-                 base_url):
+                 base_url, project_id=""):
         ViewBuilder.__init__(self, addresses_builder)
         self.flavor_builder = flavor_builder
         self.image_builder = image_builder
         self.base_url = base_url
+        self.project_id = project_id
 
     def _build_detail(self, inst):
         response = super(ViewBuilderV11, self)._build_detail(inst)
@@ -206,9 +207,10 @@ class ViewBuilderV11(ViewBuilder):
 
     def generate_href(self, server_id):
         """Create an url that refers to a specific server id."""
-        return os.path.join(self.base_url, "servers", str(server_id))
+        return os.path.join(self.base_url, self.project_id,
+                            "servers", str(server_id))
 
     def generate_bookmark(self, server_id):
         """Create an url that refers to a specific flavor id."""
         return os.path.join(common.remove_version_from_href(self.base_url),
-            "servers", str(server_id))
+            self.project_id, "servers", str(server_id))
diff --git a/nova/api/openstack/wsgi.py b/nova/api/openstack/wsgi.py
index 0eb47044e..dc0f1b93e 100644
--- a/nova/api/openstack/wsgi.py
+++ b/nova/api/openstack/wsgi.py
@@ -486,6 +486,10 @@ class Resource(wsgi.Application):
             msg = _("Malformed request body")
             return faults.Fault(webob.exc.HTTPBadRequest(explanation=msg))
 
+        project_id = args.pop("project_id", None)
+        if 'nova.context' in request.environ and project_id:
+            request.environ['nova.context'].project_id = project_id
+
         try:
             action_result = self.dispatch(request, action, args)
         except webob.exc.HTTPException as ex: