merge trunk

26 files changed, 2102 insertions, 289 deletions

diff --git a/nova/api/direct.py b/nova/api/direct.py
index 208b6d086..e5f33cee4 100644
--- a/nova/api/direct.py
+++ b/nova/api/direct.py
@@ -38,6 +38,7 @@ import routes
 import webob
 
 from nova import context
+from nova import exception
 from nova import flags
 from nova import utils
 from nova import wsgi
@@ -187,7 +188,7 @@ class ServiceWrapper(wsgi.Controller):
     def __init__(self, service_handle):
         self.service_handle = service_handle
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         arg_dict = req.environ['wsgiorg.routing_args'][1]
         action = arg_dict['action']
@@ -205,10 +206,53 @@ class ServiceWrapper(wsgi.Controller):
         # NOTE(vish): make sure we have no unicode keys for py2.6.
         params = dict([(str(k), v) for (k, v) in params.iteritems()])
         result = method(context, **params)
-        if type(result) is dict or type(result) is list:
-            return self._serialize(result, req)
-        else:
+        if result is None or type(result) is str or type(result) is unicode:
             return result
+        try:
+            return self._serialize(result, req.best_match_content_type())
+        except:
+            raise exception.Error("returned non-serializable type: %s"
+                                  % result)
+
+
+class Limited(object):
+    __notdoc = """Limit the available methods on a given object.
+
+    (Not a docstring so that the docstring can be conditionally overriden.)
+
+    Useful when defining a public API that only exposes a subset of an
+    internal API.
+
+    Expected usage of this class is to define a subclass that lists the allowed
+    methods in the 'allowed' variable.
+
+    Additionally where appropriate methods can be added or overwritten, for
+    example to provide backwards compatibility.
+
+    The wrapping approach has been chosen so that the wrapped API can maintain
+    its own internal consistency, for example if it calls "self.create" it
+    should get its own create method rather than anything we do here.
+
+    """
+
+    _allowed = None
+
+    def __init__(self, proxy):
+        self._proxy = proxy
+        if not self.__doc__:
+            self.__doc__ = proxy.__doc__
+        if not self._allowed:
+            self._allowed = []
+
+    def __getattr__(self, key):
+        """Only return methods that are named in self._allowed."""
+        if key not in self._allowed:
+            raise AttributeError()
+        return getattr(self._proxy, key)
+
+    def __dir__(self):
+        """Only return methods that are named in self._allowed."""
+        return [x for x in dir(self._proxy) if x in self._allowed]
 
 
 class Proxy(object):
@@ -218,7 +262,7 @@ class Proxy(object):
         self.prefix = prefix
 
     def __do_request(self, path, context, **kwargs):
-        req = webob.Request.blank(path)
+        req = wsgi.Request.blank(path)
         req.method = 'POST'
         req.body = urllib.urlencode({'json': utils.dumps(kwargs)})
         req.environ['openstack.context'] = context
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 5adc2c075..a3c3b25a1 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -31,7 +31,7 @@ from nova import log as logging
 from nova import utils
 from nova import wsgi
 from nova.api.ec2 import apirequest
-from nova.api.ec2 import cloud
+from nova.api.ec2 import ec2utils
 from nova.auth import manager
 
 
@@ -53,7 +53,7 @@ flags.DEFINE_list('lockout_memcached_servers', None,
 class RequestLogging(wsgi.Middleware):
     """Access-Log akin logging for all EC2 API requests."""
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         start = utils.utcnow()
         rv = req.get_response(self.application)
@@ -61,10 +61,13 @@ class RequestLogging(wsgi.Middleware):
         return rv
 
     def log_request_completion(self, response, request, start):
-        controller = request.environ.get('ec2.controller', None)
-        if controller:
-            controller = controller.__class__.__name__
-        action = request.environ.get('ec2.action', None)
+        apireq = request.environ.get('ec2.request', None)
+        if apireq:
+            controller = apireq.controller
+            action = apireq.action
+        else:
+            controller = None
+            action = None
         ctxt = request.environ.get('ec2.context', None)
         delta = utils.utcnow() - start
         seconds = delta.seconds
@@ -75,7 +78,7 @@ class RequestLogging(wsgi.Middleware):
             microseconds,
             request.remote_addr,
             request.method,
-            request.path_info,
+            "%s%s" % (request.script_name, request.path_info),
             controller,
             action,
             response.status_int,
@@ -112,7 +115,7 @@ class Lockout(wsgi.Middleware):
                                   debug=0)
         super(Lockout, self).__init__(application)
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         access_key = str(req.params['AWSAccessKeyId'])
         failures_key = "authfailures-%s" % access_key
@@ -141,7 +144,7 @@ class Authenticate(wsgi.Middleware):
 
     """Authenticate an EC2 request and add 'ec2.context' to WSGI environ."""
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         # Read request signature and access id.
         try:
@@ -190,7 +193,7 @@ class Requestify(wsgi.Middleware):
         super(Requestify, self).__init__(app)
         self.controller = utils.import_class(controller)()
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         non_args = ['Action', 'Signature', 'AWSAccessKeyId', 'SignatureMethod',
                     'SignatureVersion', 'Version', 'Timestamp']
@@ -198,6 +201,12 @@ class Requestify(wsgi.Middleware):
         try:
             # Raise KeyError if omitted
             action = req.params['Action']
+            # Fix bug lp:720157 for older (version 1) clients
+            version = req.params['SignatureVersion']
+            if int(version) == 1:
+                non_args.remove('SignatureMethod')
+                if 'SignatureMethod' in args:
+                    args.pop('SignatureMethod')
             for non_arg in non_args:
                 # Remove, but raise KeyError if omitted
                 args.pop(non_arg)
@@ -269,7 +278,7 @@ class Authorizer(wsgi.Middleware):
             },
         }
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         context = req.environ['ec2.context']
         controller = req.environ['ec2.request'].controller.__class__.__name__
@@ -303,7 +312,7 @@ class Executor(wsgi.Application):
     response, or a 400 upon failure.
     """
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         context = req.environ['ec2.context']
         api_request = req.environ['ec2.request']
@@ -313,13 +322,13 @@ class Executor(wsgi.Application):
         except exception.InstanceNotFound as ex:
             LOG.info(_('InstanceNotFound raised: %s'), unicode(ex),
                      context=context)
-            ec2_id = cloud.id_to_ec2_id(ex.instance_id)
+            ec2_id = ec2utils.id_to_ec2_id(ex.instance_id)
             message = _('Instance %s not found') % ec2_id
             return self._error(req, context, type(ex).__name__, message)
         except exception.VolumeNotFound as ex:
             LOG.info(_('VolumeNotFound raised: %s'), unicode(ex),
                      context=context)
-            ec2_id = cloud.id_to_ec2_id(ex.volume_id, 'vol-%08x')
+            ec2_id = ec2utils.id_to_ec2_id(ex.volume_id, 'vol-%08x')
             message = _('Volume %s not found') % ec2_id
             return self._error(req, context, type(ex).__name__, message)
         except exception.NotFound as ex:
@@ -365,7 +374,7 @@ class Executor(wsgi.Application):
 
 class Versions(wsgi.Application):
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         """Respond to a request for all EC2 versions."""
         # available api versions
diff --git a/nova/api/ec2/admin.py b/nova/api/ec2/admin.py
index e2a05fce1..6a5609d4a 100644
--- a/nova/api/ec2/admin.py
+++ b/nova/api/ec2/admin.py
@@ -28,8 +28,8 @@ from nova import exception
 from nova import flags
 from nova import log as logging
 from nova import utils
+from nova.api.ec2 import ec2utils
 from nova.auth import manager
-from nova.compute import instance_types
 
 
 FLAGS = flags.FLAGS
@@ -61,7 +61,7 @@ def project_dict(project):
 
 def host_dict(host, compute_service, instances, volume_service, volumes, now):
     """Convert a host model object to a result dict"""
-    rv = {'hostanme': host, 'instance_count': len(instances),
+    rv = {'hostname': host, 'instance_count': len(instances),
           'volume_count': len(volumes)}
     if compute_service:
         latest = compute_service['updated_at'] or compute_service['created_at']
@@ -80,8 +80,8 @@ def host_dict(host, compute_service, instances, volume_service, volumes, now):
     return rv
 
 
-def instance_dict(name, inst):
-    return {'name': name,
+def instance_dict(inst):
+    return {'name': inst['name'],
             'memory_mb': inst['memory_mb'],
             'vcpus': inst['vcpus'],
             'disk_gb': inst['local_gb'],
@@ -93,15 +93,18 @@ def vpn_dict(project, vpn_instance):
           'public_ip': project.vpn_ip,
           'public_port': project.vpn_port}
     if vpn_instance:
-        rv['instance_id'] = vpn_instance['ec2_id']
+        rv['instance_id'] = ec2utils.id_to_ec2_id(vpn_instance['id'])
         rv['created_at'] = utils.isotime(vpn_instance['created_at'])
         address = vpn_instance.get('fixed_ip', None)
         if address:
             rv['internal_ip'] = address['address']
-        if utils.vpn_ping(project.vpn_ip, project.vpn_port):
-            rv['state'] = 'running'
+        if project.vpn_ip and project.vpn_port:
+            if utils.vpn_ping(project.vpn_ip, project.vpn_port):
+                rv['state'] = 'running'
+            else:
+                rv['state'] = 'down'
         else:
-            rv['state'] = 'down'
+            rv['state'] = 'down - invalid project vpn config'
     else:
         rv['state'] = 'pending'
     return rv
@@ -115,9 +118,10 @@ class AdminController(object):
     def __str__(self):
         return 'AdminController'
 
-    def describe_instance_types(self, _context, **_kwargs):
-        return {'instanceTypeSet': [instance_dict(n, v) for n, v in
-                                    instance_types.INSTANCE_TYPES.iteritems()]}
+    def describe_instance_types(self, context, **_kwargs):
+        """Returns all active instance types data (vcpus, memory, etc.)"""
+        return {'instanceTypeSet': [instance_dict(v) for v in
+                                   db.instance_type_get_all(context).values()]}
 
     def describe_user(self, _context, name, **_kwargs):
         """Returns user data, including access and secret keys."""
@@ -280,7 +284,7 @@ class AdminController(object):
                                          ", ensure it isn't running, and try "
                                          "again in a few minutes")
             instance = self._vpn_for(context, project)
-        return {'instance_id': instance['ec2_id']}
+        return {'instance_id': ec2utils.id_to_ec2_id(instance['id'])}
 
     def describe_vpns(self, context):
         vpns = []
@@ -300,7 +304,7 @@ class AdminController(object):
             * Volume (up, down, None)
             * Volume Count
         """
-        services = db.service_get_all(context)
+        services = db.service_get_all(context, False)
         now = datetime.datetime.utcnow()
         hosts = []
         rv = []
diff --git a/nova/api/ec2/apirequest.py b/nova/api/ec2/apirequest.py
index 2b1acba5a..d7ad08d2f 100644
--- a/nova/api/ec2/apirequest.py
+++ b/nova/api/ec2/apirequest.py
@@ -52,7 +52,23 @@ def _database_to_isoformat(datetimeobj):
 
 
 def _try_convert(value):
-    """Return a non-string if possible"""
+    """Return a non-string from a string or unicode, if possible.
+
+    ============= =====================================================
+    When value is returns
+    ============= =====================================================
+    zero-length   ''
+    'None'        None
+    'True'        True
+    'False'       False
+    '0', '-0'     0
+    0xN, -0xN     int from hex (postitive) (N is any number)
+    0bN, -0bN     int from binary (positive) (N is any number)
+    *             try conversion to int, float, complex, fallback value
+
+    """
+    if len(value) == 0:
+        return ''
     if value == 'None':
         return None
     if value == 'True':
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index aa9c6824e..6b08f98c2 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -39,7 +39,9 @@ from nova import log as logging
 from nova import network
 from nova import utils
 from nova import volume
+from nova.api.ec2 import ec2utils
 from nova.compute import instance_types
+from nova.image import s3
 
 
 FLAGS = flags.FLAGS
@@ -73,30 +75,19 @@ def _gen_key(context, user_id, key_name):
     return {'private_key': private_key, 'fingerprint': fingerprint}
 
 
-def ec2_id_to_id(ec2_id):
-    """Convert an ec2 ID (i-[base 16 number]) to an instance id (int)"""
-    return int(ec2_id.split('-')[-1], 16)
-
-
-def id_to_ec2_id(instance_id, template='i-%08x'):
-    """Convert an instance ID (int) to an ec2 ID (i-[base 16 number])"""
-    return template % instance_id
-
-
 class CloudController(object):
     """ CloudController provides the critical dispatch between
  inbound API calls through the endpoint and messages
  sent to the other nodes.
 """
     def __init__(self):
-        self.image_service = utils.import_object(FLAGS.image_service)
+        self.image_service = s3.S3ImageService()
         self.network_api = network.API()
         self.volume_api = volume.API()
         self.compute_api = compute.API(
                 network_api=self.network_api,
-                image_service=self.image_service,
                 volume_api=self.volume_api,
-                hostname_factory=id_to_ec2_id)
+                hostname_factory=ec2utils.id_to_ec2_id)
         self.setup()
 
     def __str__(self):
@@ -115,7 +106,7 @@ class CloudController(object):
             start = os.getcwd()
             os.chdir(FLAGS.ca_path)
             # TODO(vish): Do this with M2Crypto instead
-            utils.runthis(_("Generating root CA: %s"), "sh genrootca.sh")
+            utils.runthis(_("Generating root CA: %s"), "sh", "genrootca.sh")
             os.chdir(start)
 
     def _get_mpi_data(self, context, project_id):
@@ -154,11 +145,12 @@ class CloudController(object):
         availability_zone = self._get_availability_zone_by_host(ctxt, host)
         floating_ip = db.instance_get_floating_address(ctxt,
                                                        instance_ref['id'])
-        ec2_id = id_to_ec2_id(instance_ref['id'])
+        ec2_id = ec2utils.id_to_ec2_id(instance_ref['id'])
+        image_ec2_id = self._image_ec2_id(instance_ref['image_id'], 'machine')
         data = {
             'user-data': base64.b64decode(instance_ref['user_data']),
             'meta-data': {
-                'ami-id': instance_ref['image_id'],
+                'ami-id': image_ec2_id,
                 'ami-launch-index': instance_ref['launch_index'],
                 'ami-manifest-path': 'FIXME',
                 'block-device-mapping': {
@@ -173,15 +165,20 @@ class CloudController(object):
                 'instance-type': instance_ref['instance_type'],
                 'local-hostname': hostname,
                 'local-ipv4': address,
-                'kernel-id': instance_ref['kernel_id'],
                 'placement': {'availability-zone': availability_zone},
                 'public-hostname': hostname,
                 'public-ipv4': floating_ip or '',
                 'public-keys': keys,
-                'ramdisk-id': instance_ref['ramdisk_id'],
                 'reservation-id': instance_ref['reservation_id'],
                 'security-groups': '',
                 'mpi': mpi}}
+
+        for image_type in ['kernel', 'ramdisk']:
+            if '%s_id' % image_type in instance_ref:
+                ec2_id = self._image_ec2_id(instance_ref['%s_id' % image_type],
+                                            image_type)
+                data['meta-data']['%s-id' % image_type] = ec2_id
+
         if False:  # TODO(vish): store ancestor ids
             data['ancestor-ami-ids'] = []
         if False:  # TODO(vish): store product codes
@@ -199,7 +196,7 @@ class CloudController(object):
 
     def _describe_availability_zones(self, context, **kwargs):
         ctxt = context.elevated()
-        enabled_services = db.service_get_all(ctxt)
+        enabled_services = db.service_get_all(ctxt, False)
         disabled_services = db.service_get_all(ctxt, True)
         available_zones = []
         for zone in [service.availability_zone for service
@@ -224,7 +221,7 @@ class CloudController(object):
         rv = {'availabilityZoneInfo': [{'zoneName': 'nova',
                                         'zoneState': 'available'}]}
 
-        services = db.service_get_all(context)
+        services = db.service_get_all(context, False)
         now = datetime.datetime.utcnow()
         hosts = []
         for host in [service['host'] for service in services]:
@@ -298,7 +295,7 @@ class CloudController(object):
                     'keyFingerprint': key_pair['fingerprint'],
                 })
 
-        return {'keypairsSet': result}
+        return {'keySet': result}
 
     def create_key_pair(self, context, key_name, **kwargs):
         LOG.audit(_("Create key pair %s"), key_name, context=context)
@@ -525,7 +522,7 @@ class CloudController(object):
             ec2_id = instance_id[0]
         else:
             ec2_id = instance_id
-        instance_id = ec2_id_to_id(ec2_id)
+        instance_id = ec2utils.ec2_id_to_id(ec2_id)
         output = self.compute_api.get_console_output(
                 context, instance_id=instance_id)
         now = datetime.datetime.utcnow()
@@ -535,7 +532,7 @@ class CloudController(object):
 
     def get_ajax_console(self, context, instance_id, **kwargs):
         ec2_id = instance_id[0]
-        instance_id = ec2_id_to_id(ec2_id)
+        instance_id = ec2utils.ec2_id_to_id(ec2_id)
         return self.compute_api.get_ajax_console(context,
                                                  instance_id=instance_id)
 
@@ -549,8 +546,8 @@ class CloudController(object):
         if volume_id:
             volumes = []
             for ec2_id in volume_id:
-                internal_id = ec2_id_to_id(ec2_id)
-                volume = self.volume_api.get(context, internal_id)
+                internal_id = ec2utils.ec2_id_to_id(ec2_id)
+                volume = self.volume_api.get(context, volume_id=internal_id)
                 volumes.append(volume)
         else:
             volumes = self.volume_api.get_all(context)
@@ -562,11 +559,11 @@ class CloudController(object):
         instance_data = None
         if volume.get('instance', None):
             instance_id = volume['instance']['id']
-            instance_ec2_id = id_to_ec2_id(instance_id)
+            instance_ec2_id = ec2utils.id_to_ec2_id(instance_id)
             instance_data = '%s[%s]' % (instance_ec2_id,
                                         volume['instance']['host'])
         v = {}
-        v['volumeId'] = id_to_ec2_id(volume['id'], 'vol-%08x')
+        v['volumeId'] = ec2utils.id_to_ec2_id(volume['id'], 'vol-%08x')
         v['status'] = volume['status']
         v['size'] = volume['size']
         v['availabilityZone'] = volume['availability_zone']
@@ -574,7 +571,7 @@ class CloudController(object):
         if context.is_admin:
             v['status'] = '%s (%s, %s, %s, %s)' % (
                 volume['status'],
-                volume['user_id'],
+                volume['project_id'],
                 volume['host'],
                 instance_data,
                 volume['mountpoint'])
@@ -584,8 +581,7 @@ class CloudController(object):
                                    'device': volume['mountpoint'],
                                    'instanceId': instance_ec2_id,
                                    'status': 'attached',
-                                   'volumeId': id_to_ec2_id(volume['id'],
-                                                            'vol-%08x')}]
+                                   'volumeId': v['volumeId']}]
         else:
             v['attachmentSet'] = [{}]
 
@@ -595,33 +591,37 @@ class CloudController(object):
 
     def create_volume(self, context, size, **kwargs):
         LOG.audit(_("Create volume of %s GB"), size, context=context)
-        volume = self.volume_api.create(context, size,
-                                        kwargs.get('display_name'),
-                                        kwargs.get('display_description'))
+        volume = self.volume_api.create(
+                context,
+                size=size,
+                name=kwargs.get('display_name'),
+                description=kwargs.get('display_description'))
         # TODO(vish): Instance should be None at db layer instead of
         #             trying to lazy load, but for now we turn it into
         #             a dict to avoid an error.
         return {'volumeSet': [self._format_volume(context, dict(volume))]}
 
     def delete_volume(self, context, volume_id, **kwargs):
-        volume_id = ec2_id_to_id(volume_id)
+        volume_id = ec2utils.ec2_id_to_id(volume_id)
         self.volume_api.delete(context, volume_id=volume_id)
         return True
 
     def update_volume(self, context, volume_id, **kwargs):
-        volume_id = ec2_id_to_id(volume_id)
+        volume_id = ec2utils.ec2_id_to_id(volume_id)
         updatable_fields = ['display_name', 'display_description']
         changes = {}
         for field in updatable_fields:
             if field in kwargs:
                 changes[field] = kwargs[field]
         if changes:
-            self.volume_api.update(context, volume_id, kwargs)
+            self.volume_api.update(context,
+                                   volume_id=volume_id,
+                                   fields=changes)
         return True
 
     def attach_volume(self, context, volume_id, instance_id, device, **kwargs):
-        volume_id = ec2_id_to_id(volume_id)
-        instance_id = ec2_id_to_id(instance_id)
+        volume_id = ec2utils.ec2_id_to_id(volume_id)
+        instance_id = ec2utils.ec2_id_to_id(instance_id)
         msg = _("Attach volume %(volume_id)s to instance %(instance_id)s"
                 " at %(device)s") % locals()
         LOG.audit(msg, context=context)
@@ -629,25 +629,25 @@ class CloudController(object):
                                        instance_id=instance_id,
                                        volume_id=volume_id,
                                        device=device)
-        volume = self.volume_api.get(context, volume_id)
+        volume = self.volume_api.get(context, volume_id=volume_id)
         return {'attachTime': volume['attach_time'],
                 'device': volume['mountpoint'],
-                'instanceId': id_to_ec2_id(instance_id),
+                'instanceId': ec2utils.id_to_ec2_id(instance_id),
                 'requestId': context.request_id,
                 'status': volume['attach_status'],
-                'volumeId': id_to_ec2_id(volume_id, 'vol-%08x')}
+                'volumeId': ec2utils.id_to_ec2_id(volume_id, 'vol-%08x')}
 
     def detach_volume(self, context, volume_id, **kwargs):
-        volume_id = ec2_id_to_id(volume_id)
+        volume_id = ec2utils.ec2_id_to_id(volume_id)
         LOG.audit(_("Detach volume %s"), volume_id, context=context)
-        volume = self.volume_api.get(context, volume_id)
+        volume = self.volume_api.get(context, volume_id=volume_id)
         instance = self.compute_api.detach_volume(context, volume_id=volume_id)
         return {'attachTime': volume['attach_time'],
                 'device': volume['mountpoint'],
-                'instanceId': id_to_ec2_id(instance['id']),
+                'instanceId': ec2utils.id_to_ec2_id(instance['id']),
                 'requestId': context.request_id,
                 'status': volume['attach_status'],
-                'volumeId': id_to_ec2_id(volume_id, 'vol-%08x')}
+                'volumeId': ec2utils.id_to_ec2_id(volume_id, 'vol-%08x')}
 
     def _convert_to_set(self, lst, label):
         if lst == None or lst == []:
@@ -681,7 +681,7 @@ class CloudController(object):
         if instance_id:
             instances = []
             for ec2_id in instance_id:
-                internal_id = ec2_id_to_id(ec2_id)
+                internal_id = ec2utils.ec2_id_to_id(ec2_id)
                 instance = self.compute_api.get(context,
                                                 instance_id=internal_id)
                 instances.append(instance)
@@ -693,9 +693,9 @@ class CloudController(object):
                     continue
             i = {}
             instance_id = instance['id']
-            ec2_id = id_to_ec2_id(instance_id)
+            ec2_id = ec2utils.id_to_ec2_id(instance_id)
             i['instanceId'] = ec2_id
-            i['imageId'] = instance['image_id']
+            i['imageId'] = self._image_ec2_id(instance['image_id'])
             i['instanceState'] = {
                 'code': instance['state'],
                 'name': instance['state_description']}
@@ -761,7 +761,7 @@ class CloudController(object):
             if (floating_ip_ref['fixed_ip']
                 and floating_ip_ref['fixed_ip']['instance']):
                 instance_id = floating_ip_ref['fixed_ip']['instance']['id']
-                ec2_id = id_to_ec2_id(instance_id)
+                ec2_id = ec2utils.id_to_ec2_id(instance_id)
             address_rv = {'public_ip': address,
                           'instance_id': ec2_id}
             if context.is_admin:
@@ -778,13 +778,13 @@ class CloudController(object):
 
     def release_address(self, context, public_ip, **kwargs):
         LOG.audit(_("Release address %s"), public_ip, context=context)
-        self.network_api.release_floating_ip(context, public_ip)
+        self.network_api.release_floating_ip(context, address=public_ip)
         return {'releaseResponse': ["Address released."]}
 
     def associate_address(self, context, instance_id, public_ip, **kwargs):
         LOG.audit(_("Associate address %(public_ip)s to"
                 " instance %(instance_id)s") % locals(), context=context)
-        instance_id = ec2_id_to_id(instance_id)
+        instance_id = ec2utils.ec2_id_to_id(instance_id)
         self.compute_api.associate_floating_ip(context,
                                                instance_id=instance_id,
                                                address=public_ip)
@@ -792,18 +792,24 @@ class CloudController(object):
 
     def disassociate_address(self, context, public_ip, **kwargs):
         LOG.audit(_("Disassociate address %s"), public_ip, context=context)
-        self.network_api.disassociate_floating_ip(context, public_ip)
+        self.network_api.disassociate_floating_ip(context, address=public_ip)
         return {'disassociateResponse': ["Address disassociated."]}
 
     def run_instances(self, context, **kwargs):
         max_count = int(kwargs.get('max_count', 1))
+        if kwargs.get('kernel_id'):
+            kernel = self._get_image(context, kwargs['kernel_id'])
+            kwargs['kernel_id'] = kernel['id']
+        if kwargs.get('ramdisk_id'):
+            ramdisk = self._get_image(context, kwargs['ramdisk_id'])
+            kwargs['ramdisk_id'] = ramdisk['id']
         instances = self.compute_api.create(context,
             instance_type=instance_types.get_by_type(
                 kwargs.get('instance_type', None)),
-            image_id=kwargs['image_id'],
+            image_id=self._get_image(context, kwargs['image_id'])['id'],
             min_count=int(kwargs.get('min_count', max_count)),
             max_count=max_count,
-            kernel_id=kwargs.get('kernel_id', None),
+            kernel_id=kwargs.get('kernel_id'),
             ramdisk_id=kwargs.get('ramdisk_id'),
             display_name=kwargs.get('display_name'),
             display_description=kwargs.get('display_description'),
@@ -820,7 +826,7 @@ class CloudController(object):
         instance_id is a kwarg so its name cannot be modified."""
         LOG.debug(_("Going to start terminating instances"))
         for ec2_id in instance_id:
-            instance_id = ec2_id_to_id(ec2_id)
+            instance_id = ec2utils.ec2_id_to_id(ec2_id)
             self.compute_api.delete(context, instance_id=instance_id)
         return True
 
@@ -828,64 +834,103 @@ class CloudController(object):
         """instance_id is a list of instance ids"""
         LOG.audit(_("Reboot instance %r"), instance_id, context=context)
         for ec2_id in instance_id:
-            instance_id = ec2_id_to_id(ec2_id)
+            instance_id = ec2utils.ec2_id_to_id(ec2_id)
             self.compute_api.reboot(context, instance_id=instance_id)
         return True
 
     def rescue_instance(self, context, instance_id, **kwargs):
         """This is an extension to the normal ec2_api"""
-        instance_id = ec2_id_to_id(instance_id)
+        instance_id = ec2utils.ec2_id_to_id(instance_id)
         self.compute_api.rescue(context, instance_id=instance_id)
         return True
 
     def unrescue_instance(self, context, instance_id, **kwargs):
         """This is an extension to the normal ec2_api"""
-        instance_id = ec2_id_to_id(instance_id)
+        instance_id = ec2utils.ec2_id_to_id(instance_id)
         self.compute_api.unrescue(context, instance_id=instance_id)
         return True
 
-    def update_instance(self, context, ec2_id, **kwargs):
+    def update_instance(self, context, instance_id, **kwargs):
         updatable_fields = ['display_name', 'display_description']
         changes = {}
         for field in updatable_fields:
             if field in kwargs:
                 changes[field] = kwargs[field]
         if changes:
-            instance_id = ec2_id_to_id(ec2_id)
+            instance_id = ec2utils.ec2_id_to_id(instance_id)
             self.compute_api.update(context, instance_id=instance_id, **kwargs)
         return True
 
-    def _format_image(self, context, image):
+    _type_prefix_map = {'machine': 'ami',
+                        'kernel': 'aki',
+                        'ramdisk': 'ari'}
+
+    def _image_ec2_id(self, image_id, image_type='machine'):
+        prefix = self._type_prefix_map[image_type]
+        template = prefix + '-%08x'
+        return ec2utils.id_to_ec2_id(int(image_id), template=template)
+
+    def _get_image(self, context, ec2_id):
+        try:
+            internal_id = ec2utils.ec2_id_to_id(ec2_id)
+            return self.image_service.show(context, internal_id)
+        except exception.NotFound:
+            return self.image_service.show_by_name(context, ec2_id)
+
+    def _format_image(self, image):
         """Convert from format defined by BaseImageService to S3 format."""
         i = {}
-        i['imageId'] = image.get('id')
-        i['kernelId'] = image.get('kernel_id')
-        i['ramdiskId'] = image.get('ramdisk_id')
-        i['imageOwnerId'] = image.get('owner_id')
-        i['imageLocation'] = image.get('location')
-        i['imageState'] = image.get('status')
-        i['type'] = image.get('type')
-        i['isPublic'] = image.get('is_public')
-        i['architecture'] = image.get('architecture')
+        image_type = image['properties'].get('type')
+        ec2_id = self._image_ec2_id(image.get('id'), image_type)
+        name = image.get('name')
+        if name:
+            i['imageId'] = "%s (%s)" % (ec2_id, name)
+        else:
+            i['imageId'] = ec2_id
+        kernel_id = image['properties'].get('kernel_id')
+        if kernel_id:
+            i['kernelId'] = self._image_ec2_id(kernel_id, 'kernel')
+        ramdisk_id = image['properties'].get('ramdisk_id')
+        if ramdisk_id:
+            i['ramdiskId'] = self._image_ec2_id(ramdisk_id, 'ramdisk')
+        i['imageOwnerId'] = image['properties'].get('owner_id')
+        i['imageLocation'] = image['properties'].get('image_location')
+        i['imageState'] = image['properties'].get('image_state')
+        i['type'] = image_type
+        i['isPublic'] = str(image['properties'].get('is_public', '')) == 'True'
+        i['architecture'] = image['properties'].get('architecture')
         return i
 
     def describe_images(self, context, image_id=None, **kwargs):
         # NOTE: image_id is a list!
-        images = self.image_service.index(context)
         if image_id:
-            images = filter(lambda x: x['id'] in image_id, images)
-        images = [self._format_image(context, i) for i in images]
+            images = []
+            for ec2_id in image_id:
+                try:
+                    image = self._get_image(context, ec2_id)
+                except exception.NotFound:
+                    raise exception.NotFound(_('Image %s not found') %
+                                             ec2_id)
+                images.append(image)
+        else:
+            images = self.image_service.detail(context)
+        images = [self._format_image(i) for i in images]
         return {'imagesSet': images}
 
     def deregister_image(self, context, image_id, **kwargs):
         LOG.audit(_("De-registering image %s"), image_id, context=context)
-        self.image_service.deregister(context, image_id)
+        image = self._get_image(context, image_id)
+        internal_id = image['id']
+        self.image_service.delete(context, internal_id)
         return {'imageId': image_id}
 
     def register_image(self, context, image_location=None, **kwargs):
         if image_location is None and 'name' in kwargs:
             image_location = kwargs['name']
-        image_id = self.image_service.register(context, image_location)
+        metadata = {'properties': {'image_location': image_location}}
+        image = self.image_service.create(context, metadata)
+        image_id = self._image_ec2_id(image['id'],
+                                      image['properties']['type'])
         msg = _("Registered image %(image_location)s with"
                 " id %(image_id)s") % locals()
         LOG.audit(msg, context=context)
@@ -896,13 +941,11 @@ class CloudController(object):
             raise exception.ApiError(_('attribute not supported: %s')
                                      % attribute)
         try:
-            image = self._format_image(context,
-                                       self.image_service.show(context,
-                                                               image_id))
-        except IndexError:
-            raise exception.ApiError(_('invalid id: %s') % image_id)
-        result = {'image_id': image_id, 'launchPermission': []}
-        if image['isPublic']:
+            image = self._get_image(context, image_id)
+        except exception.NotFound:
+            raise exception.NotFound(_('Image %s not found') % image_id)
+        result = {'imageId': image_id, 'launchPermission': []}
+        if image['properties']['is_public']:
             result['launchPermission'].append({'group': 'all'})
         return result
 
@@ -919,8 +962,18 @@ class CloudController(object):
         if not operation_type in ['add', 'remove']:
             raise exception.ApiError(_('operation_type must be add or remove'))
         LOG.audit(_("Updating image %s publicity"), image_id, context=context)
-        return self.image_service.modify(context, image_id, operation_type)
+
+        try:
+            image = self._get_image(context, image_id)
+        except exception.NotFound:
+            raise exception.NotFound(_('Image %s not found') % image_id)
+        internal_id = image['id']
+        del(image['id'])
+
+        image['properties']['is_public'] = (operation_type == 'add')
+        return self.image_service.update(context, internal_id, image)
 
     def update_image(self, context, image_id, **kwargs):
-        result = self.image_service.update(context, image_id, dict(kwargs))
+        internal_id = ec2utils.ec2_id_to_id(image_id)
+        result = self.image_service.update(context, internal_id, dict(kwargs))
         return result
diff --git a/nova/api/ec2/ec2utils.py b/nova/api/ec2/ec2utils.py
new file mode 100644
index 000000000..3b34f6ea5
--- /dev/null
+++ b/nova/api/ec2/ec2utils.py
@@ -0,0 +1,32 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from nova import exception
+
+
+def ec2_id_to_id(ec2_id):
+    """Convert an ec2 ID (i-[base 16 number]) to an instance id (int)"""
+    try:
+        return int(ec2_id.split('-')[-1], 16)
+    except ValueError:
+        raise exception.NotFound(_("Id %s Not Found") % ec2_id)
+
+
+def id_to_ec2_id(instance_id, template='i-%08x'):
+    """Convert an instance ID (int) to an ec2 ID (i-[base 16 number])"""
+    return template % instance_id
diff --git a/nova/api/ec2/metadatarequesthandler.py b/nova/api/ec2/metadatarequesthandler.py
index 6fb441656..28f99b0ef 100644
--- a/nova/api/ec2/metadatarequesthandler.py
+++ b/nova/api/ec2/metadatarequesthandler.py
@@ -65,7 +65,7 @@ class MetadataRequestHandler(wsgi.Application):
                 data = data[item]
         return data
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         cc = cloud.CloudController()
         remote_address = req.remote_addr
diff --git a/nova/api/openstack/__init__.py b/nova/api/openstack/__init__.py
index b1b38ed2d..0531b3504 100644
--- a/nova/api/openstack/__init__.py
+++ b/nova/api/openstack/__init__.py
@@ -27,13 +27,16 @@ import webob.exc
 from nova import flags
 from nova import log as logging
 from nova import wsgi
+from nova.api.openstack import accounts
 from nova.api.openstack import faults
 from nova.api.openstack import backup_schedules
 from nova.api.openstack import consoles
 from nova.api.openstack import flavors
 from nova.api.openstack import images
+from nova.api.openstack import limits
 from nova.api.openstack import servers
 from nova.api.openstack import shared_ip_groups
+from nova.api.openstack import users
 from nova.api.openstack import zones
 
 
@@ -47,7 +50,7 @@ flags.DEFINE_bool('allow_admin_api',
 class FaultWrapper(wsgi.Middleware):
     """Calls down the middleware stack, making exceptions into faults."""
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         try:
             return req.get_response(self.application)
@@ -68,27 +71,38 @@ class APIRouter(wsgi.Router):
         """Simple paste factory, :class:`nova.wsgi.Router` doesn't have one"""
         return cls()
 
-    def __init__(self):
+    def __init__(self, ext_mgr=None):
+        self.server_members = {}
         mapper = routes.Mapper()
+        self._setup_routes(mapper)
+        super(APIRouter, self).__init__(mapper)
 
-        server_members = {'action': 'POST'}
+    def _setup_routes(self, mapper):
+        server_members = self.server_members
+        server_members['action'] = 'POST'
         if FLAGS.allow_admin_api:
             LOG.debug(_("Including admin operations in API."))
+
             server_members['pause'] = 'POST'
             server_members['unpause'] = 'POST'
-            server_members["diagnostics"] = "GET"
-            server_members["actions"] = "GET"
+            server_members['diagnostics'] = 'GET'
+            server_members['actions'] = 'GET'
             server_members['suspend'] = 'POST'
             server_members['resume'] = 'POST'
+            server_members['rescue'] = 'POST'
+            server_members['unrescue'] = 'POST'
             server_members['reset_network'] = 'POST'
             server_members['inject_network_info'] = 'POST'
 
             mapper.resource("zone", "zones", controller=zones.Controller(),
+                        collection={'detail': 'GET', 'info': 'GET'}),
+
+            mapper.resource("user", "users", controller=users.Controller(),
                         collection={'detail': 'GET'})
 
-        mapper.resource("server", "servers", controller=servers.Controller(),
-                        collection={'detail': 'GET'},
-                        member=server_members)
+            mapper.resource("account", "accounts",
+                            controller=accounts.Controller(),
+                            collection={'detail': 'GET'})
 
         mapper.resource("backup_schedule", "backup_schedule",
                         controller=backup_schedules.Controller(),
@@ -102,23 +116,53 @@ class APIRouter(wsgi.Router):
 
         mapper.resource("image", "images", controller=images.Controller(),
                         collection={'detail': 'GET'})
+
         mapper.resource("flavor", "flavors", controller=flavors.Controller(),
                         collection={'detail': 'GET'})
+
         mapper.resource("shared_ip_group", "shared_ip_groups",
                         collection={'detail': 'GET'},
                         controller=shared_ip_groups.Controller())
 
-        super(APIRouter, self).__init__(mapper)
+        _limits = limits.LimitsController()
+        mapper.resource("limit", "limits", controller=_limits)
+
+
+class APIRouterV10(APIRouter):
+    """Define routes specific to OpenStack API V1.0."""
+
+    def _setup_routes(self, mapper):
+        super(APIRouterV10, self)._setup_routes(mapper)
+        mapper.resource("server", "servers",
+                        controller=servers.ControllerV10(),
+                        collection={'detail': 'GET'},
+                        member=self.server_members)
+
+
+class APIRouterV11(APIRouter):
+    """Define routes specific to OpenStack API V1.1."""
+
+    def _setup_routes(self, mapper):
+        super(APIRouterV11, self)._setup_routes(mapper)
+        mapper.resource("server", "servers",
+                        controller=servers.ControllerV11(),
+                        collection={'detail': 'GET'},
+                        member=self.server_members)
 
 
 class Versions(wsgi.Application):
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         """Respond to a request for all OpenStack API versions."""
         response = {
-                "versions": [
-                    dict(status="CURRENT", id="v1.0")]}
+            "versions": [
+                dict(status="DEPRECATED", id="v1.0"),
+                dict(status="CURRENT", id="v1.1"),
+            ],
+        }
         metadata = {
             "application/xml": {
                 "attributes": dict(version=["status", "id"])}}
-        return wsgi.Serializer(req.environ, metadata).to_content_type(response)
+
+        content_type = req.best_match_content_type()
+        return wsgi.Serializer(metadata).serialize(response, content_type)
diff --git a/nova/api/openstack/accounts.py b/nova/api/openstack/accounts.py
new file mode 100644
index 000000000..86066fa20
--- /dev/null
+++ b/nova/api/openstack/accounts.py
@@ -0,0 +1,86 @@
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import common
+import webob.exc
+
+from nova import exception
+from nova import flags
+from nova import log as logging
+from nova import wsgi
+
+from nova.auth import manager
+from nova.api.openstack import faults
+
+FLAGS = flags.FLAGS
+LOG = logging.getLogger('nova.api.openstack')
+
+
+def _translate_keys(account):
+    return dict(id=account.id,
+                name=account.name,
+                description=account.description,
+                manager=account.project_manager_id)
+
+
+class Controller(wsgi.Controller):
+
+    _serialization_metadata = {
+        'application/xml': {
+            "attributes": {
+                "account": ["id", "name", "description", "manager"]}}}
+
+    def __init__(self):
+        self.manager = manager.AuthManager()
+
+    def _check_admin(self, context):
+        """We cannot depend on the db layer to check for admin access
+           for the auth manager, so we do it here"""
+        if not context.is_admin:
+            raise exception.NotAuthorized(_("Not admin user."))
+
+    def index(self, req):
+        raise faults.Fault(webob.exc.HTTPNotImplemented())
+
+    def detail(self, req):
+        raise faults.Fault(webob.exc.HTTPNotImplemented())
+
+    def show(self, req, id):
+        """Return data about the given account id"""
+        account = self.manager.get_project(id)
+        return dict(account=_translate_keys(account))
+
+    def delete(self, req, id):
+        self._check_admin(req.environ['nova.context'])
+        self.manager.delete_project(id)
+        return {}
+
+    def create(self, req):
+        """We use update with create-or-update semantics
+           because the id comes from an external source"""
+        raise faults.Fault(webob.exc.HTTPNotImplemented())
+
+    def update(self, req, id):
+        """This is really create or update."""
+        self._check_admin(req.environ['nova.context'])
+        env = self._deserialize(req.body, req.get_content_type())
+        description = env['account'].get('description')
+        manager = env['account'].get('manager')
+        try:
+            account = self.manager.get_project(id)
+            self.manager.modify_project(id, manager, description)
+        except exception.NotFound:
+            account = self.manager.create_project(id, manager, description)
+        return dict(account=_translate_keys(account))
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index 6011e6115..f3a9bdeca 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -28,11 +28,13 @@ from nova import context
 from nova import db
 from nova import exception
 from nova import flags
+from nova import log as logging
 from nova import manager
 from nova import utils
 from nova import wsgi
 from nova.api.openstack import faults
 
+LOG = logging.getLogger('nova.api.openstack')
 FLAGS = flags.FLAGS
 
 
@@ -46,18 +48,27 @@ class AuthMiddleware(wsgi.Middleware):
         self.auth = auth.manager.AuthManager()
         super(AuthMiddleware, self).__init__(application)
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         if not self.has_authentication(req):
             return self.authenticate(req)
-
         user = self.get_user_by_authentication(req)
-
+        accounts = self.auth.get_projects(user=user)
         if not user:
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
-        project = self.auth.get_project(FLAGS.default_project)
-        req.environ['nova.context'] = context.RequestContext(user, project)
+        if accounts:
+            #we are punting on this til auth is settled,
+            #and possibly til api v1.1 (mdragon)
+            account = accounts[0]
+        else:
+            return faults.Fault(webob.exc.HTTPUnauthorized())
+
+        if not self.auth.is_admin(user) and \
+           not self.auth.is_project_member(user, account):
+            return faults.Fault(webob.exc.HTTPUnauthorized())
+
+        req.environ['nova.context'] = context.RequestContext(user, account)
         return self.application
 
     def has_authentication(self, req):
@@ -121,18 +132,23 @@ class AuthMiddleware(wsgi.Middleware):
 
         username - string
         key - string API key
-        req - webob.Request object
+        req - wsgi.Request object
         """
         ctxt = context.get_admin_context()
-        user = self.auth.get_user_from_access_key(key)
+
+        try:
+            user = self.auth.get_user_from_access_key(key)
+        except exception.NotFound:
+            user = None
+
         if user and user.name == username:
             token_hash = hashlib.sha1('%s%s%f' % (username, key,
                 time.time())).hexdigest()
             token_dict = {}
             token_dict['token_hash'] = token_hash
             token_dict['cdn_management_url'] = ''
-            # Same as auth url, e.g. http://foo.org:8774/baz/v1.0
-            token_dict['server_management_url'] = req.url
+            os_url = req.url
+            token_dict['server_management_url'] = os_url
             token_dict['storage_url'] = ''
             token_dict['user_id'] = user.id
             token = self.db.auth_token_create(ctxt, token_dict)
diff --git a/nova/api/openstack/common.py b/nova/api/openstack/common.py
index 1dc3767e2..bff050347 100644
--- a/nova/api/openstack/common.py
+++ b/nova/api/openstack/common.py
@@ -15,6 +15,10 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from urlparse import urlparse
+
+import webob
+
 from nova import exception
 
 
@@ -23,22 +27,29 @@ def limited(items, request, max_limit=1000):
     Return a slice of items according to requested offset and limit.
 
     @param items: A sliceable entity
-    @param request: `webob.Request` possibly containing 'offset' and 'limit'
+    @param request: `wsgi.Request` possibly containing 'offset' and 'limit'
                     GET variables. 'offset' is where to start in the list,
                     and 'limit' is the maximum number of items to return. If
                     'limit' is not specified, 0, or > max_limit, we default
-                    to max_limit.
+                    to max_limit. Negative values for either offset or limit
+                    will cause exc.HTTPBadRequest() exceptions to be raised.
     @kwarg max_limit: The maximum number of items to return from 'items'
     """
     try:
         offset = int(request.GET.get('offset', 0))
     except ValueError:
-        offset = 0
+        raise webob.exc.HTTPBadRequest(_('offset param must be an integer'))
 
     try:
         limit = int(request.GET.get('limit', max_limit))
     except ValueError:
-        limit = max_limit
+        raise webob.exc.HTTPBadRequest(_('limit param must be an integer'))
+
+    if limit < 0:
+        raise webob.exc.HTTPBadRequest(_('limit param must be positive'))
+
+    if offset < 0:
+        raise webob.exc.HTTPBadRequest(_('offset param must be positive'))
 
     limit = min(max_limit, limit or max_limit)
     range_end = offset + limit
@@ -65,3 +76,16 @@ def get_image_id_from_image_hash(image_service, context, image_hash):
         if abs(hash(image_id)) == int(image_hash):
             return image_id
     raise exception.NotFound(image_hash)
+
+
+def get_id_from_href(href):
+    """Return the id portion of a url as an int.
+
+    Given: http://www.foo.com/bar/123?q=4
+    Returns: 123
+
+    """
+    try:
+        return int(urlparse(href).path.split('/')[-1])
+    except:
+        raise webob.exc.HTTPBadRequest(_('could not parse id from href'))
diff --git a/nova/api/openstack/consoles.py b/nova/api/openstack/consoles.py
index 9ebdbe710..8c291c2eb 100644
--- a/nova/api/openstack/consoles.py
+++ b/nova/api/openstack/consoles.py
@@ -65,7 +65,7 @@ class Controller(wsgi.Controller):
 
     def create(self, req, server_id):
         """Creates a new console"""
-        #info = self._deserialize(req.body, req)
+        #info = self._deserialize(req.body, req.get_content_type())
         self.console_api.create_console(
                                 req.environ['nova.context'],
                                 int(server_id))
diff --git a/nova/api/openstack/extensions.py b/nova/api/openstack/extensions.py
new file mode 100644
index 000000000..9d98d849a
--- /dev/null
+++ b/nova/api/openstack/extensions.py
@@ -0,0 +1,369 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import imp
+import os
+import sys
+import routes
+import webob.dec
+import webob.exc
+
+from nova import flags
+from nova import log as logging
+from nova import wsgi
+from nova.api.openstack import faults
+
+
+LOG = logging.getLogger('extensions')
+
+
+FLAGS = flags.FLAGS
+
+
+class ActionExtensionController(wsgi.Controller):
+
+    def __init__(self, application):
+
+        self.application = application
+        self.action_handlers = {}
+
+    def add_action(self, action_name, handler):
+        self.action_handlers[action_name] = handler
+
+    def action(self, req, id):
+
+        input_dict = self._deserialize(req.body, req.get_content_type())
+        for action_name, handler in self.action_handlers.iteritems():
+            if action_name in input_dict:
+                return handler(input_dict, req, id)
+        # no action handler found (bump to downstream application)
+        res = self.application
+        return res
+
+
+class ResponseExtensionController(wsgi.Controller):
+
+    def __init__(self, application):
+        self.application = application
+        self.handlers = []
+
+    def add_handler(self, handler):
+        self.handlers.append(handler)
+
+    def process(self, req, *args, **kwargs):
+        res = req.get_response(self.application)
+        content_type = req.best_match_content_type()
+        # currently response handlers are un-ordered
+        for handler in self.handlers:
+            res = handler(res)
+            try:
+                body = res.body
+                headers = res.headers
+            except AttributeError:
+                body = self._serialize(res, content_type)
+                headers = {"Content-Type": content_type}
+            res = webob.Response()
+            res.body = body
+            res.headers = headers
+        return res
+
+
+class ExtensionController(wsgi.Controller):
+
+    def __init__(self, extension_manager):
+        self.extension_manager = extension_manager
+
+    def _translate(self, ext):
+        ext_data = {}
+        ext_data['name'] = ext.get_name()
+        ext_data['alias'] = ext.get_alias()
+        ext_data['description'] = ext.get_description()
+        ext_data['namespace'] = ext.get_namespace()
+        ext_data['updated'] = ext.get_updated()
+        ext_data['links'] = []  # TODO: implement extension links
+        return ext_data
+
+    def index(self, req):
+        extensions = []
+        for alias, ext in self.extension_manager.extensions.iteritems():
+            extensions.append(self._translate(ext))
+        return dict(extensions=extensions)
+
+    def show(self, req, id):
+        # NOTE: the extensions alias is used as the 'id' for show
+        ext = self.extension_manager.extensions[id]
+        return self._translate(ext)
+
+    def delete(self, req, id):
+        raise faults.Fault(exc.HTTPNotFound())
+
+    def create(self, req):
+        raise faults.Fault(exc.HTTPNotFound())
+
+    def delete(self, req, id):
+        raise faults.Fault(exc.HTTPNotFound())
+
+
+class ExtensionMiddleware(wsgi.Middleware):
+    """
+    Extensions middleware that intercepts configured routes for extensions.
+    """
+    @classmethod
+    def factory(cls, global_config, **local_config):
+        """ paste factory """
+        def _factory(app):
+            return cls(app, **local_config)
+        return _factory
+
+    def _action_ext_controllers(self, application, ext_mgr, mapper):
+        """
+        Return a dict of ActionExtensionController objects by collection
+        """
+        action_controllers = {}
+        for action in ext_mgr.get_actions():
+            if not action.collection in action_controllers.keys():
+                controller = ActionExtensionController(application)
+                mapper.connect("/%s/:(id)/action.:(format)" %
+                                action.collection,
+                                action='action',
+                                controller=controller,
+                                conditions=dict(method=['POST']))
+                mapper.connect("/%s/:(id)/action" % action.collection,
+                                action='action',
+                                controller=controller,
+                                conditions=dict(method=['POST']))
+                action_controllers[action.collection] = controller
+
+        return action_controllers
+
+    def _response_ext_controllers(self, application, ext_mgr, mapper):
+        """
+        Return a dict of ResponseExtensionController objects by collection
+        """
+        response_ext_controllers = {}
+        for resp_ext in ext_mgr.get_response_extensions():
+            if not resp_ext.key in response_ext_controllers.keys():
+                controller = ResponseExtensionController(application)
+                mapper.connect(resp_ext.url_route + '.:(format)',
+                                action='process',
+                                controller=controller,
+                                conditions=resp_ext.conditions)
+
+                mapper.connect(resp_ext.url_route,
+                                action='process',
+                                controller=controller,
+                                conditions=resp_ext.conditions)
+                response_ext_controllers[resp_ext.key] = controller
+
+        return response_ext_controllers
+
+    def __init__(self, application, ext_mgr=None):
+
+        if ext_mgr is None:
+            ext_mgr = ExtensionManager(FLAGS.osapi_extensions_path)
+        self.ext_mgr = ext_mgr
+
+        mapper = routes.Mapper()
+
+        # extended resources
+        for resource in ext_mgr.get_resources():
+            LOG.debug(_('Extended resource: %s'),
+                        resource.collection)
+            mapper.resource(resource.collection, resource.collection,
+                            controller=resource.controller,
+                            collection=resource.collection_actions,
+                            member=resource.member_actions,
+                            parent_resource=resource.parent)
+
+        # extended actions
+        action_controllers = self._action_ext_controllers(application, ext_mgr,
+                                                        mapper)
+        for action in ext_mgr.get_actions():
+            LOG.debug(_('Extended action: %s'), action.action_name)
+            controller = action_controllers[action.collection]
+            controller.add_action(action.action_name, action.handler)
+
+        # extended responses
+        resp_controllers = self._response_ext_controllers(application, ext_mgr,
+                                                            mapper)
+        for response_ext in ext_mgr.get_response_extensions():
+            LOG.debug(_('Extended response: %s'), response_ext.key)
+            controller = resp_controllers[response_ext.key]
+            controller.add_handler(response_ext.handler)
+
+        self._router = routes.middleware.RoutesMiddleware(self._dispatch,
+                                                          mapper)
+
+        super(ExtensionMiddleware, self).__init__(application)
+
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def __call__(self, req):
+        """
+        Route the incoming request with router.
+        """
+        req.environ['extended.app'] = self.application
+        return self._router
+
+    @staticmethod
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def _dispatch(req):
+        """
+        Returns the routed WSGI app's response or defers to the extended
+        application.
+        """
+        match = req.environ['wsgiorg.routing_args'][1]
+        if not match:
+            return req.environ['extended.app']
+        app = match['controller']
+        return app
+
+
+class ExtensionManager(object):
+    """
+    Load extensions from the configured extension path.
+    See nova/tests/api/openstack/extensions/foxinsocks.py for an example
+    extension implementation.
+    """
+
+    def __init__(self, path):
+        LOG.audit(_('Initializing extension manager.'))
+
+        self.path = path
+        self.extensions = {}
+        self._load_extensions()
+
+    def get_resources(self):
+        """
+        returns a list of ResourceExtension objects
+        """
+        resources = []
+        resources.append(ResourceExtension('extensions',
+                                            ExtensionController(self)))
+        for alias, ext in self.extensions.iteritems():
+            try:
+                resources.extend(ext.get_resources())
+            except AttributeError:
+                # NOTE: Extension aren't required to have resource extensions
+                pass
+        return resources
+
+    def get_actions(self):
+        """
+        returns a list of ActionExtension objects
+        """
+        actions = []
+        for alias, ext in self.extensions.iteritems():
+            try:
+                actions.extend(ext.get_actions())
+            except AttributeError:
+                # NOTE: Extension aren't required to have action extensions
+                pass
+        return actions
+
+    def get_response_extensions(self):
+        """
+        returns a list of ResponseExtension objects
+        """
+        response_exts = []
+        for alias, ext in self.extensions.iteritems():
+            try:
+                response_exts.extend(ext.get_response_extensions())
+            except AttributeError:
+                # NOTE: Extension aren't required to have response extensions
+                pass
+        return response_exts
+
+    def _check_extension(self, extension):
+        """
+        Checks for required methods in extension objects.
+        """
+        try:
+            LOG.debug(_('Ext name: %s'), extension.get_name())
+            LOG.debug(_('Ext alias: %s'), extension.get_alias())
+            LOG.debug(_('Ext description: %s'), extension.get_description())
+            LOG.debug(_('Ext namespace: %s'), extension.get_namespace())
+            LOG.debug(_('Ext updated: %s'), extension.get_updated())
+        except AttributeError as ex:
+            LOG.exception(_("Exception loading extension: %s"), unicode(ex))
+
+    def _load_extensions(self):
+        """
+        Load extensions from the configured path. The extension name is
+        constructed from the module_name. If your extension module was named
+        widgets.py the extension class within that module should be
+        'Widgets'.
+
+        See nova/tests/api/openstack/extensions/foxinsocks.py for an example
+        extension implementation.
+        """
+        if not os.path.exists(self.path):
+            return
+
+        for f in os.listdir(self.path):
+            LOG.audit(_('Loading extension file: %s'), f)
+            mod_name, file_ext = os.path.splitext(os.path.split(f)[-1])
+            ext_path = os.path.join(self.path, f)
+            if file_ext.lower() == '.py':
+                mod = imp.load_source(mod_name, ext_path)
+                ext_name = mod_name[0].upper() + mod_name[1:]
+                try:
+                    new_ext = getattr(mod, ext_name)()
+                    self._check_extension(new_ext)
+                    self.extensions[new_ext.get_alias()] = new_ext
+                except AttributeError as ex:
+                    LOG.exception(_("Exception loading extension: %s"),
+                                   unicode(ex))
+
+
+class ResponseExtension(object):
+    """
+    ResponseExtension objects can be used to add data to responses from
+    core nova OpenStack API controllers.
+    """
+
+    def __init__(self, method, url_route, handler):
+        self.url_route = url_route
+        self.handler = handler
+        self.conditions = dict(method=[method])
+        self.key = "%s-%s" % (method, url_route)
+
+
+class ActionExtension(object):
+    """
+    ActionExtension objects can be used to add custom actions to core nova
+    nova OpenStack API controllers.
+    """
+
+    def __init__(self, collection, action_name, handler):
+        self.collection = collection
+        self.action_name = action_name
+        self.handler = handler
+
+
+class ResourceExtension(object):
+    """
+    ResourceExtension objects can be used to add top level resources
+    to the OpenStack API in nova.
+    """
+
+    def __init__(self, collection, controller, parent=None,
+                 collection_actions={}, member_actions={}):
+        self.collection = collection
+        self.controller = controller
+        self.parent = parent
+        self.collection_actions = collection_actions
+        self.member_actions = member_actions
diff --git a/nova/api/openstack/faults.py b/nova/api/openstack/faults.py
index 224a7ef0b..0e9c4b26f 100644
--- a/nova/api/openstack/faults.py
+++ b/nova/api/openstack/faults.py
@@ -42,7 +42,7 @@ class Fault(webob.exc.HTTPException):
         """Create a Fault for the given webob.exc.exception."""
         self.wrapped_exc = exception
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         """Generate a WSGI response based on the exception passed to ctor."""
         # Replace the body with fault details.
@@ -57,6 +57,46 @@ class Fault(webob.exc.HTTPException):
             fault_data[fault_name]['retryAfter'] = retry
         # 'code' is an attribute on the fault tag itself
         metadata = {'application/xml': {'attributes': {fault_name: 'code'}}}
-        serializer = wsgi.Serializer(req.environ, metadata)
-        self.wrapped_exc.body = serializer.to_content_type(fault_data)
+        serializer = wsgi.Serializer(metadata)
+        content_type = req.best_match_content_type()
+        self.wrapped_exc.body = serializer.serialize(fault_data, content_type)
+        return self.wrapped_exc
+
+
+class OverLimitFault(webob.exc.HTTPException):
+    """
+    Rate-limited request response.
+    """
+
+    _serialization_metadata = {
+        "application/xml": {
+            "attributes": {
+                "overLimitFault": "code",
+            },
+        },
+    }
+
+    def __init__(self, message, details, retry_time):
+        """
+        Initialize new `OverLimitFault` with relevant information.
+        """
+        self.wrapped_exc = webob.exc.HTTPForbidden()
+        self.content = {
+            "overLimitFault": {
+                "code": self.wrapped_exc.status_int,
+                "message": message,
+                "details": details,
+            },
+        }
+
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def __call__(self, request):
+        """
+        Return the wrapped exception with a serialized body conforming to our
+        error format.
+        """
+        serializer = wsgi.Serializer(self._serialization_metadata)
+        content_type = request.best_match_content_type()
+        content = serializer.serialize(self.content, content_type)
+        self.wrapped_exc.body = content
         return self.wrapped_exc
diff --git a/nova/api/openstack/flavors.py b/nova/api/openstack/flavors.py
index f620d4107..c99b945fb 100644
--- a/nova/api/openstack/flavors.py
+++ b/nova/api/openstack/flavors.py
@@ -17,9 +17,12 @@
 
 from webob import exc
 
+from nova import db
+from nova import context
 from nova.api.openstack import faults
 from nova.api.openstack import common
 from nova.compute import instance_types
+from nova.api.openstack.views import flavors as flavors_views
 from nova import wsgi
 import nova.api.openstack
 
@@ -39,19 +42,24 @@ class Controller(wsgi.Controller):
 
     def detail(self, req):
         """Return all flavors in detail."""
-        items = [self.show(req, id)['flavor'] for id in self._all_ids()]
-        items = common.limited(items, req)
+        items = [self.show(req, id)['flavor'] for id in self._all_ids(req)]
         return dict(flavors=items)
 
     def show(self, req, id):
         """Return data about the given flavor id."""
-        for name, val in instance_types.INSTANCE_TYPES.iteritems():
-            if val['flavorid'] == int(id):
-                item = dict(ram=val['memory_mb'], disk=val['local_gb'],
-                            id=val['flavorid'], name=name)
-                return dict(flavor=item)
-        raise faults.Fault(exc.HTTPNotFound())
-
-    def _all_ids(self):
+        ctxt = req.environ['nova.context']
+        flavor = db.api.instance_type_get_by_flavor_id(ctxt, id)
+        values = {
+            "id": flavor["flavorid"],
+            "name": flavor["name"],
+            "ram": flavor["memory_mb"],
+            "disk": flavor["local_gb"],
+        }
+        return dict(flavor=values)
+
+    def _all_ids(self, req):
         """Return the list of all flavorids."""
-        return [i['flavorid'] for i in instance_types.INSTANCE_TYPES.values()]
+        ctxt = req.environ['nova.context']
+        inst_types = db.api.instance_type_get_all(ctxt)
+        flavor_ids = [inst_types[i]['flavorid'] for i in inst_types.keys()]
+        return sorted(flavor_ids)
diff --git a/nova/api/openstack/images.py b/nova/api/openstack/images.py
index cf85a496f..79852ecc6 100644
--- a/nova/api/openstack/images.py
+++ b/nova/api/openstack/images.py
@@ -15,10 +15,14 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import datetime
+
 from webob import exc
 
 from nova import compute
+from nova import exception
 from nova import flags
+from nova import log
 from nova import utils
 from nova import wsgi
 import nova.api.openstack
@@ -27,6 +31,8 @@ from nova.api.openstack import faults
 import nova.image.service
 
 
+LOG = log.getLogger('nova.api.openstack.images')
+
 FLAGS = flags.FLAGS
 
 
@@ -84,8 +90,6 @@ def _translate_status(item):
         # S3ImageService
         pass
 
-    return item
-
 
 def _filter_keys(item, keys):
     """
@@ -104,6 +108,100 @@ def _convert_image_id_to_hash(image):
         image['id'] = image_id
 
 
+def _translate_s3_like_images(image_metadata):
+    """Work-around for leaky S3ImageService abstraction"""
+    api_metadata = image_metadata.copy()
+    _convert_image_id_to_hash(api_metadata)
+    api_metadata = _translate_keys(api_metadata)
+    _translate_status(api_metadata)
+    return api_metadata
+
+
+def _translate_from_image_service_to_api(image_metadata):
+    """Translate from ImageService to OpenStack API style attribute names
+
+    This involves 4 steps:
+
+        1. Filter out attributes that the OpenStack API doesn't need
+
+        2. Translate from base image attributes from names used by
+           BaseImageService to names used by OpenStack API
+
+        3. Add in any image properties
+
+        4. Format values according to API spec (for example dates must
+           look like "2010-08-10T12:00:00Z")
+    """
+    service_metadata = image_metadata.copy()
+    properties = service_metadata.pop('properties', {})
+
+    # 1. Filter out unecessary attributes
+    api_keys = ['id', 'name', 'updated_at', 'created_at', 'status']
+    api_metadata = utils.subset_dict(service_metadata, api_keys)
+
+    # 2. Translate base image attributes
+    api_map = {'updated_at': 'updated', 'created_at': 'created'}
+    api_metadata = utils.map_dict_keys(api_metadata, api_map)
+
+    # 3. Add in any image properties
+    # 3a. serverId is used for backups and snapshots
+    try:
+        api_metadata['serverId'] = int(properties['instance_id'])
+    except KeyError:
+        pass  # skip if it's not present
+    except ValueError:
+        pass  # skip if it's not an integer
+
+    # 3b. Progress special case
+    # TODO(sirp): ImageService doesn't have a notion of progress yet, so for
+    # now just fake it
+    if service_metadata['status'] == 'saving':
+        api_metadata['progress'] = 0
+
+    # 4. Format values
+    # 4a. Format Image Status (API requires uppercase)
+    api_metadata['status'] = _format_status_for_api(api_metadata['status'])
+
+    # 4b. Format timestamps
+    for attr in ('created', 'updated'):
+        if attr in api_metadata:
+            api_metadata[attr] = _format_datetime_for_api(
+                api_metadata[attr])
+
+    return api_metadata
+
+
+def _format_status_for_api(status):
+    """Return status in a format compliant with OpenStack API"""
+    mapping = {'queued': 'QUEUED',
+               'preparing': 'PREPARING',
+               'saving': 'SAVING',
+               'active': 'ACTIVE',
+               'killed': 'FAILED'}
+    return mapping[status]
+
+
+def _format_datetime_for_api(datetime_):
+    """Stringify datetime objects in a format compliant with OpenStack API"""
+    API_DATETIME_FMT = '%Y-%m-%dT%H:%M:%SZ'
+    return datetime_.strftime(API_DATETIME_FMT)
+
+
+def _safe_translate(image_metadata):
+    """Translate attributes for OpenStack API, temporary workaround for
+    S3ImageService attribute leakage.
+    """
+    # FIXME(sirp): The S3ImageService appears to be leaking implementation
+    # details, including its internal attribute names, and internal
+    # `status` values. Working around it for now.
+    s3_like_image = ('imageId' in image_metadata)
+    if s3_like_image:
+        translate = _translate_s3_like_images
+    else:
+        translate = _translate_from_image_service_to_api
+    return translate(image_metadata)
+
+
 class Controller(wsgi.Controller):
 
     _serialization_metadata = {
@@ -117,33 +215,32 @@ class Controller(wsgi.Controller):
 
     def index(self, req):
         """Return all public images in brief"""
-        items = self._service.index(req.environ['nova.context'])
-        items = common.limited(items, req)
-        items = [_filter_keys(item, ('id', 'name')) for item in items]
-        return dict(images=items)
+        context = req.environ['nova.context']
+        image_metas = self._service.index(context)
+        image_metas = common.limited(image_metas, req)
+        return dict(images=image_metas)
 
     def detail(self, req):
         """Return all public images in detail"""
-        try:
-            items = self._service.detail(req.environ['nova.context'])
-        except NotImplementedError:
-            items = self._service.index(req.environ['nova.context'])
-        for image in items:
-            _convert_image_id_to_hash(image)
-
-        items = common.limited(items, req)
-        items = [_translate_keys(item) for item in items]
-        items = [_translate_status(item) for item in items]
-        return dict(images=items)
+        context = req.environ['nova.context']
+        image_metas = self._service.detail(context)
+        image_metas = common.limited(image_metas, req)
+        api_image_metas = [_safe_translate(image_meta)
+                           for image_meta in image_metas]
+        return dict(images=api_image_metas)
 
     def show(self, req, id):
         """Return data about the given image id"""
-        image_id = common.get_image_id_from_image_hash(self._service,
-                    req.environ['nova.context'], id)
+        context = req.environ['nova.context']
+        try:
+            image_id = common.get_image_id_from_image_hash(
+                self._service, context, id)
+        except exception.NotFound:
+            raise faults.Fault(exc.HTTPNotFound())
 
-        image = self._service.show(req.environ['nova.context'], image_id)
-        _convert_image_id_to_hash(image)
-        return dict(image=image)
+        image_meta = self._service.show(context, image_id)
+        api_image_meta = _safe_translate(image_meta)
+        return dict(image=api_image_meta)
 
     def delete(self, req, id):
         # Only public images are supported for now.
@@ -151,14 +248,13 @@ class Controller(wsgi.Controller):
 
     def create(self, req):
         context = req.environ['nova.context']
-        env = self._deserialize(req.body, req)
+        env = self._deserialize(req.body, req.get_content_type())
         instance_id = env["image"]["serverId"]
         name = env["image"]["name"]
-
         image_meta = compute.API().snapshot(
             context, instance_id, name)
-
-        return dict(image=image_meta)
+        api_image_meta = _safe_translate(image_meta)
+        return dict(image=api_image_meta)
 
     def update(self, req, id):
         # Users may not modify public images, and that's all that
diff --git a/nova/api/openstack/limits.py b/nova/api/openstack/limits.py
new file mode 100644
index 000000000..efc7d193d
--- /dev/null
+++ b/nova/api/openstack/limits.py
@@ -0,0 +1,358 @@
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.import datetime
+
+"""
+Module dedicated functions/classes dealing with rate limiting requests.
+"""
+
+import copy
+import httplib
+import json
+import math
+import re
+import time
+import urllib
+import webob.exc
+
+from collections import defaultdict
+
+from webob.dec import wsgify
+
+from nova import wsgi
+from nova.api.openstack import faults
+from nova.wsgi import Controller
+from nova.wsgi import Middleware
+
+
+# Convenience constants for the limits dictionary passed to Limiter().
+PER_SECOND = 1
+PER_MINUTE = 60
+PER_HOUR = 60 * 60
+PER_DAY = 60 * 60 * 24
+
+
+class LimitsController(Controller):
+    """
+    Controller for accessing limits in the OpenStack API.
+    """
+
+    _serialization_metadata = {
+        "application/xml": {
+            "attributes": {
+                "limit": ["verb", "URI", "regex", "value", "unit",
+                    "resetTime", "remaining", "name"],
+            },
+            "plurals": {
+                "rate": "limit",
+            },
+        },
+    }
+
+    def index(self, req):
+        """
+        Return all global and rate limit information.
+        """
+        abs_limits = {}
+        rate_limits = req.environ.get("nova.limits", [])
+
+        return {
+            "limits": {
+                "rate": rate_limits,
+                "absolute": abs_limits,
+            },
+        }
+
+
+class Limit(object):
+    """
+    Stores information about a limit for HTTP requets.
+    """
+
+    UNITS = {
+        1: "SECOND",
+        60: "MINUTE",
+        60 * 60: "HOUR",
+        60 * 60 * 24: "DAY",
+    }
+
+    def __init__(self, verb, uri, regex, value, unit):
+        """
+        Initialize a new `Limit`.
+
+        @param verb: HTTP verb (POST, PUT, etc.)
+        @param uri: Human-readable URI
+        @param regex: Regular expression format for this limit
+        @param value: Integer number of requests which can be made
+        @param unit: Unit of measure for the value parameter
+        """
+        self.verb = verb
+        self.uri = uri
+        self.regex = regex
+        self.value = int(value)
+        self.unit = unit
+        self.unit_string = self.display_unit().lower()
+        self.remaining = int(value)
+
+        if value <= 0:
+            raise ValueError("Limit value must be > 0")
+
+        self.last_request = None
+        self.next_request = None
+
+        self.water_level = 0
+        self.capacity = self.unit
+        self.request_value = float(self.capacity) / float(self.value)
+        self.error_message = _("Only %(value)s %(verb)s request(s) can be "\
+            "made to %(uri)s every %(unit_string)s." % self.__dict__)
+
+    def __call__(self, verb, url):
+        """
+        Represents a call to this limit from a relevant request.
+
+        @param verb: string http verb (POST, GET, etc.)
+        @param url: string URL
+        """
+        if self.verb != verb or not re.match(self.regex, url):
+            return
+
+        now = self._get_time()
+
+        if self.last_request is None:
+            self.last_request = now
+
+        leak_value = now - self.last_request
+
+        self.water_level -= leak_value
+        self.water_level = max(self.water_level, 0)
+        self.water_level += self.request_value
+
+        difference = self.water_level - self.capacity
+
+        self.last_request = now
+
+        if difference > 0:
+            self.water_level -= self.request_value
+            self.next_request = now + difference
+            return difference
+
+        cap = self.capacity
+        water = self.water_level
+        val = self.value
+
+        self.remaining = math.floor(((cap - water) / cap) * val)
+        self.next_request = now
+
+    def _get_time(self):
+        """Retrieve the current time. Broken out for testability."""
+        return time.time()
+
+    def display_unit(self):
+        """Display the string name of the unit."""
+        return self.UNITS.get(self.unit, "UNKNOWN")
+
+    def display(self):
+        """Return a useful representation of this class."""
+        return {
+            "verb": self.verb,
+            "URI": self.uri,
+            "regex": self.regex,
+            "value": self.value,
+            "remaining": int(self.remaining),
+            "unit": self.display_unit(),
+            "resetTime": int(self.next_request or self._get_time()),
+        }
+
+# "Limit" format is a dictionary with the HTTP verb, human-readable URI,
+# a regular-expression to match, value and unit of measure (PER_DAY, etc.)
+
+DEFAULT_LIMITS = [
+    Limit("POST", "*", ".*", 10, PER_MINUTE),
+    Limit("POST", "*/servers", "^/servers", 50, PER_DAY),
+    Limit("PUT", "*", ".*", 10, PER_MINUTE),
+    Limit("GET", "*changes-since*", ".*changes-since.*", 3, PER_MINUTE),
+    Limit("DELETE", "*", ".*", 100, PER_MINUTE),
+]
+
+
+class RateLimitingMiddleware(Middleware):
+    """
+    Rate-limits requests passing through this middleware. All limit information
+    is stored in memory for this implementation.
+    """
+
+    def __init__(self, application, limits=None):
+        """
+        Initialize new `RateLimitingMiddleware`, which wraps the given WSGI
+        application and sets up the given limits.
+
+        @param application: WSGI application to wrap
+        @param limits: List of dictionaries describing limits
+        """
+        Middleware.__init__(self, application)
+        self._limiter = Limiter(limits or DEFAULT_LIMITS)
+
+    @wsgify(RequestClass=wsgi.Request)
+    def __call__(self, req):
+        """
+        Represents a single call through this middleware. We should record the
+        request if we have a limit relevant to it. If no limit is relevant to
+        the request, ignore it.
+
+        If the request should be rate limited, return a fault telling the user
+        they are over the limit and need to retry later.
+        """
+        verb = req.method
+        url = req.url
+        context = req.environ.get("nova.context")
+
+        if context:
+            username = context.user_id
+        else:
+            username = None
+
+        delay, error = self._limiter.check_for_delay(verb, url, username)
+
+        if delay:
+            msg = _("This request was rate-limited.")
+            retry = time.time() + delay
+            return faults.OverLimitFault(msg, error, retry)
+
+        req.environ["nova.limits"] = self._limiter.get_limits(username)
+
+        return self.application
+
+
+class Limiter(object):
+    """
+    Rate-limit checking class which handles limits in memory.
+    """
+
+    def __init__(self, limits):
+        """
+        Initialize the new `Limiter`.
+
+        @param limits: List of `Limit` objects
+        """
+        self.limits = copy.deepcopy(limits)
+        self.levels = defaultdict(lambda: copy.deepcopy(limits))
+
+    def get_limits(self, username=None):
+        """
+        Return the limits for a given user.
+        """
+        return [limit.display() for limit in self.levels[username]]
+
+    def check_for_delay(self, verb, url, username=None):
+        """
+        Check the given verb/user/user triplet for limit.
+
+        @return: Tuple of delay (in seconds) and error message (or None, None)
+        """
+        delays = []
+
+        for limit in self.levels[username]:
+            delay = limit(verb, url)
+            if delay:
+                delays.append((delay, limit.error_message))
+
+        if delays:
+            delays.sort()
+            return delays[0]
+
+        return None, None
+
+
+class WsgiLimiter(object):
+    """
+    Rate-limit checking from a WSGI application. Uses an in-memory `Limiter`.
+
+    To use:
+        POST /<username> with JSON data such as:
+        {
+            "verb" : GET,
+            "path" : "/servers"
+        }
+
+    and receive a 204 No Content, or a 403 Forbidden with an X-Wait-Seconds
+    header containing the number of seconds to wait before the action would
+    succeed.
+    """
+
+    def __init__(self, limits=None):
+        """
+        Initialize the new `WsgiLimiter`.
+
+        @param limits: List of `Limit` objects
+        """
+        self._limiter = Limiter(limits or DEFAULT_LIMITS)
+
+    @wsgify(RequestClass=wsgi.Request)
+    def __call__(self, request):
+        """
+        Handles a call to this application. Returns 204 if the request is
+        acceptable to the limiter, else a 403 is returned with a relevant
+        header indicating when the request *will* succeed.
+        """
+        if request.method != "POST":
+            raise webob.exc.HTTPMethodNotAllowed()
+
+        try:
+            info = dict(json.loads(request.body))
+        except ValueError:
+            raise webob.exc.HTTPBadRequest()
+
+        username = request.path_info_pop()
+        verb = info.get("verb")
+        path = info.get("path")
+
+        delay, error = self._limiter.check_for_delay(verb, path, username)
+
+        if delay:
+            headers = {"X-Wait-Seconds": "%.2f" % delay}
+            return webob.exc.HTTPForbidden(headers=headers, explanation=error)
+        else:
+            return webob.exc.HTTPNoContent()
+
+
+class WsgiLimiterProxy(object):
+    """
+    Rate-limit requests based on answers from a remote source.
+    """
+
+    def __init__(self, limiter_address):
+        """
+        Initialize the new `WsgiLimiterProxy`.
+
+        @param limiter_address: IP/port combination of where to request limit
+        """
+        self.limiter_address = limiter_address
+
+    def check_for_delay(self, verb, path, username=None):
+        body = json.dumps({"verb": verb, "path": path})
+        headers = {"Content-Type": "application/json"}
+
+        conn = httplib.HTTPConnection(self.limiter_address)
+
+        if username:
+            conn.request("POST", "/%s" % (username), body, headers)
+        else:
+            conn.request("POST", "/", body, headers)
+
+        resp = conn.getresponse()
+
+        if 200 >= resp.status < 300:
+            return None, None
+
+        return resp.getheader("X-Wait-Seconds"), resp.read() or None
diff --git a/nova/api/openstack/ratelimiting/__init__.py b/nova/api/openstack/ratelimiting/__init__.py
index cbb4b897e..88ffc3246 100644
--- a/nova/api/openstack/ratelimiting/__init__.py
+++ b/nova/api/openstack/ratelimiting/__init__.py
@@ -57,7 +57,7 @@ class RateLimitingMiddleware(wsgi.Middleware):
             self.limiter = WSGIAppProxy(service_host)
         super(RateLimitingMiddleware, self).__init__(application)
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         """Rate limit the request.
 
@@ -183,7 +183,7 @@ class WSGIApp(object):
         """Create the WSGI application using the given Limiter instance."""
         self.limiter = limiter
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         parts = req.path_info.split('/')
         # format: /limiter/<username>/<urlencoded action>
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index 69273ad7b..0dad46268 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -13,84 +13,37 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import base64
 import hashlib
-import json
 import traceback
 
 from webob import exc
+from xml.dom import minidom
 
 from nova import compute
+from nova import context
 from nova import exception
 from nova import flags
 from nova import log as logging
-from nova import wsgi
+from nova import quota
 from nova import utils
+from nova import wsgi
 from nova.api.openstack import common
 from nova.api.openstack import faults
+import nova.api.openstack.views.addresses
+import nova.api.openstack.views.flavors
+import nova.api.openstack.views.servers
 from nova.auth import manager as auth_manager
 from nova.compute import instance_types
 from nova.compute import power_state
 import nova.api.openstack
+from nova.scheduler import api as scheduler_api
 
 
 LOG = logging.getLogger('server')
-
-
 FLAGS = flags.FLAGS
 
 
-def _translate_detail_keys(inst):
-    """ Coerces into dictionary format, mapping everything to Rackspace-like
-    attributes for return"""
-    power_mapping = {
-        None: 'build',
-        power_state.NOSTATE: 'build',
-        power_state.RUNNING: 'active',
-        power_state.BLOCKED: 'active',
-        power_state.SUSPENDED: 'suspended',
-        power_state.PAUSED: 'paused',
-        power_state.SHUTDOWN: 'active',
-        power_state.SHUTOFF: 'active',
-        power_state.CRASHED: 'error',
-        power_state.FAILED: 'error'}
-    inst_dict = {}
-
-    mapped_keys = dict(status='state', imageId='image_id',
-        flavorId='instance_type', name='display_name', id='id')
-
-    for k, v in mapped_keys.iteritems():
-        inst_dict[k] = inst[v]
-
-    inst_dict['status'] = power_mapping[inst_dict['status']]
-    inst_dict['addresses'] = dict(public=[], private=[])
-
-    # grab single private fixed ip
-    private_ips = utils.get_from_path(inst, 'fixed_ip/address')
-    inst_dict['addresses']['private'] = private_ips
-
-    # grab all public floating ips
-    public_ips = utils.get_from_path(inst, 'fixed_ip/floating_ips/address')
-    inst_dict['addresses']['public'] = public_ips
-
-    # Return the metadata as a dictionary
-    metadata = {}
-    for item in inst['metadata']:
-        metadata[item['key']] = item['value']
-    inst_dict['metadata'] = metadata
-
-    inst_dict['hostId'] = ''
-    if inst['host']:
-        inst_dict['hostId'] = hashlib.sha224(inst['host']).hexdigest()
-
-    return dict(server=inst_dict)
-
-
-def _translate_keys(inst):
-    """ Coerces into dictionary format, excluding all model attributes
-    save for id and name """
-    return dict(server=dict(id=inst['id'], name=inst['display_name']))
-
-
 class Controller(wsgi.Controller):
     """ The Server API controller for the OpenStack API """
 
@@ -98,39 +51,55 @@ class Controller(wsgi.Controller):
         'application/xml': {
             "attributes": {
                 "server": ["id", "imageId", "name", "flavorId", "hostId",
-                           "status", "progress"]}}}
+                           "status", "progress", "adminPass", "flavorRef",
+                           "imageRef"]}}}
 
     def __init__(self):
         self.compute_api = compute.API()
         self._image_service = utils.import_object(FLAGS.image_service)
         super(Controller, self).__init__()
 
+    def ips(self, req, id):
+        try:
+            instance = self.compute_api.get(req.environ['nova.context'], id)
+        except exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
+
+        builder = self._get_addresses_view_builder(req)
+        return builder.build(instance)
+
     def index(self, req):
         """ Returns a list of server names and ids for a given user """
-        return self._items(req, entity_maker=_translate_keys)
+        return self._items(req, is_detail=False)
 
     def detail(self, req):
         """ Returns a list of server details for a given user """
-        return self._items(req, entity_maker=_translate_detail_keys)
+        return self._items(req, is_detail=True)
 
-    def _items(self, req, entity_maker):
+    def _items(self, req, is_detail):
         """Returns a list of servers for a given user.
 
-        entity_maker - either _translate_detail_keys or _translate_keys
+        builder - the response model builder
         """
         instance_list = self.compute_api.get_all(req.environ['nova.context'])
         limited_list = common.limited(instance_list, req)
-        res = [entity_maker(inst)['server'] for inst in limited_list]
-        return dict(servers=res)
+        builder = self._get_view_builder(req)
+        servers = [builder.build(inst, is_detail)['server']
+                for inst in limited_list]
+        return dict(servers=servers)
 
+    @scheduler_api.redirect_handler
     def show(self, req, id):
         """ Returns server details by server id """
         try:
-            instance = self.compute_api.get(req.environ['nova.context'], id)
-            return _translate_detail_keys(instance)
+            instance = self.compute_api.routing_get(
+                req.environ['nova.context'], id)
+            builder = self._get_view_builder(req)
+            return builder.build(instance, is_detail=True)
         except exception.NotFound:
             return faults.Fault(exc.HTTPNotFound())
 
+    @scheduler_api.redirect_handler
     def delete(self, req, id):
         """ Destroys a server """
         try:
@@ -141,18 +110,23 @@ class Controller(wsgi.Controller):
 
     def create(self, req):
         """ Creates a new server for a given user """
-        env = self._deserialize(req.body, req)
+        env = self._deserialize_create(req)
         if not env:
             return faults.Fault(exc.HTTPUnprocessableEntity())
 
         context = req.environ['nova.context']
+
+        key_name = None
+        key_data = None
         key_pairs = auth_manager.AuthManager.get_key_pairs(context)
-        if not key_pairs:
-            raise exception.NotFound(_("No keypairs defined"))
-        key_pair = key_pairs[0]
+        if key_pairs:
+            key_pair = key_pairs[0]
+            key_name = key_pair['name']
+            key_data = key_pair['public_key']
 
+        requested_image_id = self._image_id_from_req_data(env)
         image_id = common.get_image_id_from_image_hash(self._image_service,
-            context, env['server']['imageId'])
+            context, requested_image_id)
         kernel_id, ramdisk_id = self._get_kernel_ramdisk_from_image(
             req, image_id)
 
@@ -166,23 +140,103 @@ class Controller(wsgi.Controller):
             for k, v in env['server']['metadata'].items():
                 metadata.append({'key': k, 'value': v})
 
-        instances = self.compute_api.create(
-            context,
-            instance_types.get_by_flavor_id(env['server']['flavorId']),
-            image_id,
-            kernel_id=kernel_id,
-            ramdisk_id=ramdisk_id,
-            display_name=env['server']['name'],
-            display_description=env['server']['name'],
-            key_name=key_pair['name'],
-            key_data=key_pair['public_key'],
-            metadata=metadata,
-            onset_files=env.get('onset_files', []))
-        return _translate_keys(instances[0])
+        personality = env['server'].get('personality')
+        injected_files = []
+        if personality:
+            injected_files = self._get_injected_files(personality)
+
+        flavor_id = self._flavor_id_from_req_data(env)
+        try:
+            (inst,) = self.compute_api.create(
+                context,
+                instance_types.get_by_flavor_id(flavor_id),
+                image_id,
+                kernel_id=kernel_id,
+                ramdisk_id=ramdisk_id,
+                display_name=env['server']['name'],
+                display_description=env['server']['name'],
+                key_name=key_name,
+                key_data=key_data,
+                metadata=metadata,
+                injected_files=injected_files)
+        except quota.QuotaError as error:
+            self._handle_quota_error(error)
+
+        inst['instance_type'] = flavor_id
+        inst['image_id'] = requested_image_id
+
+        builder = self._get_view_builder(req)
+        server = builder.build(inst, is_detail=True)
+        password = "%s%s" % (server['server']['name'][:4],
+                             utils.generate_password(12))
+        server['server']['adminPass'] = password
+        self.compute_api.set_admin_password(context, server['server']['id'],
+                                            password)
+        return server
+
+    def _deserialize_create(self, request):
+        """
+        Deserialize a create request
+
+        Overrides normal behavior in the case of xml content
+        """
+        if request.content_type == "application/xml":
+            deserializer = ServerCreateRequestXMLDeserializer()
+            return deserializer.deserialize(request.body)
+        else:
+            return self._deserialize(request.body, request.get_content_type())
+
+    def _get_injected_files(self, personality):
+        """
+        Create a list of injected files from the personality attribute
+
+        At this time, injected_files must be formatted as a list of
+        (file_path, file_content) pairs for compatibility with the
+        underlying compute service.
+        """
+        injected_files = []
 
+        for item in personality:
+            try:
+                path = item['path']
+                contents = item['contents']
+            except KeyError as key:
+                expl = _('Bad personality format: missing %s') % key
+                raise exc.HTTPBadRequest(explanation=expl)
+            except TypeError:
+                expl = _('Bad personality format')
+                raise exc.HTTPBadRequest(explanation=expl)
+            try:
+                contents = base64.b64decode(contents)
+            except TypeError:
+                expl = _('Personality content for %s cannot be decoded') % path
+                raise exc.HTTPBadRequest(explanation=expl)
+            injected_files.append((path, contents))
+        return injected_files
+
+    def _handle_quota_error(self, error):
+        """
+        Reraise quota errors as api-specific http exceptions
+        """
+        if error.code == "OnsetFileLimitExceeded":
+            expl = _("Personality file limit exceeded")
+            raise exc.HTTPBadRequest(explanation=expl)
+        if error.code == "OnsetFilePathLimitExceeded":
+            expl = _("Personality file path too long")
+            raise exc.HTTPBadRequest(explanation=expl)
+        if error.code == "OnsetFileContentLimitExceeded":
+            expl = _("Personality file content too long")
+            raise exc.HTTPBadRequest(explanation=expl)
+        # if the original error is okay, just reraise it
+        raise error
+
+    @scheduler_api.redirect_handler
     def update(self, req, id):
         """ Updates the server name or password """
-        inst_dict = self._deserialize(req.body, req)
+        if len(req.body) == 0:
+            raise exc.HTTPUnprocessableEntity()
+
+        inst_dict = self._deserialize(req.body, req.get_content_type())
         if not inst_dict:
             return faults.Fault(exc.HTTPUnprocessableEntity())
 
@@ -192,7 +246,7 @@ class Controller(wsgi.Controller):
             update_dict['admin_pass'] = inst_dict['server']['adminPass']
             try:
                 self.compute_api.set_admin_password(ctxt, id)
-            except exception.TimeoutException, e:
+            except exception.TimeoutException:
                 return exc.HTTPRequestTimeout()
         if 'name' in inst_dict['server']:
             update_dict['display_name'] = inst_dict['server']['name']
@@ -202,11 +256,60 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPNotFound())
         return exc.HTTPNoContent()
 
+    @scheduler_api.redirect_handler
     def action(self, req, id):
-        """ Multi-purpose method used to reboot, rebuild, and
-        resize a server """
-        input_dict = self._deserialize(req.body, req)
-        #TODO(sandy): rebuild/resize not supported.
+        """Multi-purpose method used to reboot, rebuild, or
+        resize a server"""
+
+        actions = {
+            'reboot':        self._action_reboot,
+            'resize':        self._action_resize,
+            'confirmResize': self._action_confirm_resize,
+            'revertResize':  self._action_revert_resize,
+            'rebuild':       self._action_rebuild,
+            }
+
+        input_dict = self._deserialize(req.body, req.get_content_type())
+        for key in actions.keys():
+            if key in input_dict:
+                return actions[key](input_dict, req, id)
+        return faults.Fault(exc.HTTPNotImplemented())
+
+    def _action_confirm_resize(self, input_dict, req, id):
+        try:
+            self.compute_api.confirm_resize(req.environ['nova.context'], id)
+        except Exception, e:
+            LOG.exception(_("Error in confirm-resize %s"), e)
+            return faults.Fault(exc.HTTPBadRequest())
+        return exc.HTTPNoContent()
+
+    def _action_revert_resize(self, input_dict, req, id):
+        try:
+            self.compute_api.revert_resize(req.environ['nova.context'], id)
+        except Exception, e:
+            LOG.exception(_("Error in revert-resize %s"), e)
+            return faults.Fault(exc.HTTPBadRequest())
+        return exc.HTTPAccepted()
+
+    def _action_rebuild(self, input_dict, req, id):
+        return faults.Fault(exc.HTTPNotImplemented())
+
+    def _action_resize(self, input_dict, req, id):
+        """ Resizes a given instance to the flavor size requested """
+        try:
+            if 'resize' in input_dict and 'flavorId' in input_dict['resize']:
+                flavor_id = input_dict['resize']['flavorId']
+                self.compute_api.resize(req.environ['nova.context'], id,
+                        flavor_id)
+            else:
+                LOG.exception(_("Missing arguments for resize"))
+                return faults.Fault(exc.HTTPUnprocessableEntity())
+        except Exception, e:
+            LOG.exception(_("Error in resize %s"), e)
+            return faults.Fault(exc.HTTPBadRequest())
+        return faults.Fault(exc.HTTPAccepted())
+
+    def _action_reboot(self, input_dict, req, id):
         try:
             reboot_type = input_dict['reboot']['type']
         except Exception:
@@ -219,6 +322,7 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
     def lock(self, req, id):
         """
         lock the instance with id
@@ -234,6 +338,7 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
     def unlock(self, req, id):
         """
         unlock the instance with id
@@ -249,6 +354,7 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
     def get_lock(self, req, id):
         """
         return the boolean state of (instance with id)'s lock
@@ -263,6 +369,7 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
     def reset_network(self, req, id):
         """
         Reset networking on an instance (admin only).
@@ -277,6 +384,7 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
     def inject_network_info(self, req, id):
         """
         Inject network info for an instance (admin only).
@@ -291,6 +399,7 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
     def pause(self, req, id):
         """ Permit Admins to Pause the server. """
         ctxt = req.environ['nova.context']
@@ -302,6 +411,7 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
     def unpause(self, req, id):
         """ Permit Admins to Unpause the server. """
         ctxt = req.environ['nova.context']
@@ -313,6 +423,7 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
     def suspend(self, req, id):
         """permit admins to suspend the server"""
         context = req.environ['nova.context']
@@ -324,6 +435,7 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
     def resume(self, req, id):
         """permit admins to resume the server from suspend"""
         context = req.environ['nova.context']
@@ -335,6 +447,31 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
+    def rescue(self, req, id):
+        """Permit users to rescue the server."""
+        context = req.environ["nova.context"]
+        try:
+            self.compute_api.rescue(context, id)
+        except:
+            readable = traceback.format_exc()
+            LOG.exception(_("compute.api::rescue %s"), readable)
+            return faults.Fault(exc.HTTPUnprocessableEntity())
+        return exc.HTTPAccepted()
+
+    @scheduler_api.redirect_handler
+    def unrescue(self, req, id):
+        """Permit users to unrescue the server."""
+        context = req.environ["nova.context"]
+        try:
+            self.compute_api.unrescue(context, id)
+        except:
+            readable = traceback.format_exc()
+            LOG.exception(_("compute.api::unrescue %s"), readable)
+            return faults.Fault(exc.HTTPUnprocessableEntity())
+        return exc.HTTPAccepted()
+
+    @scheduler_api.redirect_handler
     def get_ajax_console(self, req, id):
         """ Returns a url to an instance's ajaxterm console. """
         try:
@@ -344,6 +481,7 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPNotFound())
         return exc.HTTPAccepted()
 
+    @scheduler_api.redirect_handler
     def diagnostics(self, req, id):
         """Permit Admins to retrieve server diagnostics."""
         ctxt = req.environ["nova.context"]
@@ -380,7 +518,7 @@ class Controller(wsgi.Controller):
                 _("Cannot build from image %(image_id)s, status not active") %
                   locals())
 
-        if image['type'] != 'machine':
+        if image['disk_format'] != 'ami':
             return None, None
 
         try:
@@ -396,3 +534,118 @@ class Controller(wsgi.Controller):
                 _("Ramdisk not found for image %(image_id)s") % locals())
 
         return kernel_id, ramdisk_id
+
+
+class ControllerV10(Controller):
+    def _image_id_from_req_data(self, data):
+        return data['server']['imageId']
+
+    def _flavor_id_from_req_data(self, data):
+        return data['server']['flavorId']
+
+    def _get_view_builder(self, req):
+        addresses_builder = nova.api.openstack.views.addresses.ViewBuilderV10()
+        return nova.api.openstack.views.servers.ViewBuilderV10(
+            addresses_builder)
+
+    def _get_addresses_view_builder(self, req):
+        return nova.api.openstack.views.addresses.ViewBuilderV10(req)
+
+
+class ControllerV11(Controller):
+    def _image_id_from_req_data(self, data):
+        href = data['server']['imageRef']
+        return common.get_id_from_href(href)
+
+    def _flavor_id_from_req_data(self, data):
+        href = data['server']['flavorRef']
+        return common.get_id_from_href(href)
+
+    def _get_view_builder(self, req):
+        base_url = req.application_url
+        flavor_builder = nova.api.openstack.views.flavors.ViewBuilderV11(
+            base_url)
+        image_builder = nova.api.openstack.views.images.ViewBuilderV11(
+            base_url)
+        addresses_builder = nova.api.openstack.views.addresses.ViewBuilderV11()
+        return nova.api.openstack.views.servers.ViewBuilderV11(
+            addresses_builder, flavor_builder, image_builder)
+
+    def _get_addresses_view_builder(self, req):
+        return nova.api.openstack.views.addresses.ViewBuilderV11(req)
+
+
+class ServerCreateRequestXMLDeserializer(object):
+    """
+    Deserializer to handle xml-formatted server create requests.
+
+    Handles standard server attributes as well as optional metadata
+    and personality attributes
+    """
+
+    def deserialize(self, string):
+        """Deserialize an xml-formatted server create request"""
+        dom = minidom.parseString(string)
+        server = self._extract_server(dom)
+        return {'server': server}
+
+    def _extract_server(self, node):
+        """Marshal the server attribute of a parsed request"""
+        server = {}
+        server_node = self._find_first_child_named(node, 'server')
+        for attr in ["name", "imageId", "flavorId"]:
+            server[attr] = server_node.getAttribute(attr)
+        metadata = self._extract_metadata(server_node)
+        if metadata is not None:
+            server["metadata"] = metadata
+        personality = self._extract_personality(server_node)
+        if personality is not None:
+            server["personality"] = personality
+        return server
+
+    def _extract_metadata(self, server_node):
+        """Marshal the metadata attribute of a parsed request"""
+        metadata_node = self._find_first_child_named(server_node, "metadata")
+        if metadata_node is None:
+            return None
+        metadata = {}
+        for meta_node in self._find_children_named(metadata_node, "meta"):
+            key = meta_node.getAttribute("key")
+            metadata[key] = self._extract_text(meta_node)
+        return metadata
+
+    def _extract_personality(self, server_node):
+        """Marshal the personality attribute of a parsed request"""
+        personality_node = \
+                self._find_first_child_named(server_node, "personality")
+        if personality_node is None:
+            return None
+        personality = []
+        for file_node in self._find_children_named(personality_node, "file"):
+            item = {}
+            if file_node.hasAttribute("path"):
+                item["path"] = file_node.getAttribute("path")
+            item["contents"] = self._extract_text(file_node)
+            personality.append(item)
+        return personality
+
+    def _find_first_child_named(self, parent, name):
+        """Search a nodes children for the first child with a given name"""
+        for node in parent.childNodes:
+            if node.nodeName == name:
+                return node
+        return None
+
+    def _find_children_named(self, parent, name):
+        """Return all of a nodes children who have the given name"""
+        for node in parent.childNodes:
+            if node.nodeName == name:
+                yield node
+
+    def _extract_text(self, node):
+        """Get the text field contained by the given node"""
+        if len(node.childNodes) == 1:
+            child = node.childNodes[0]
+            if child.nodeType == child.TEXT_NODE:
+                return child.nodeValue
+        return ""
diff --git a/nova/api/openstack/users.py b/nova/api/openstack/users.py
new file mode 100644
index 000000000..d3ab3d553
--- /dev/null
+++ b/nova/api/openstack/users.py
@@ -0,0 +1,104 @@
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from webob import exc
+
+from nova import exception
+from nova import flags
+from nova import log as logging
+from nova import wsgi
+from nova.api.openstack import common
+from nova.api.openstack import faults
+from nova.auth import manager
+
+FLAGS = flags.FLAGS
+LOG = logging.getLogger('nova.api.openstack')
+
+
+def _translate_keys(user):
+    return dict(id=user.id,
+                name=user.name,
+                access=user.access,
+                secret=user.secret,
+                admin=user.admin)
+
+
+class Controller(wsgi.Controller):
+
+    _serialization_metadata = {
+        'application/xml': {
+            "attributes": {
+                "user": ["id", "name", "access", "secret", "admin"]}}}
+
+    def __init__(self):
+        self.manager = manager.AuthManager()
+
+    def _check_admin(self, context):
+        """We cannot depend on the db layer to check for admin access
+           for the auth manager, so we do it here"""
+        if not context.is_admin:
+            raise exception.NotAuthorized(_("Not admin user"))
+
+    def index(self, req):
+        """Return all users in brief"""
+        users = self.manager.get_users()
+        users = common.limited(users, req)
+        users = [_translate_keys(user) for user in users]
+        return dict(users=users)
+
+    def detail(self, req):
+        """Return all users in detail"""
+        return self.index(req)
+
+    def show(self, req, id):
+        """Return data about the given user id"""
+
+        #NOTE(justinsb): The drivers are a little inconsistent in how they
+        #  deal with "NotFound" - some throw, some return None.
+        try:
+            user = self.manager.get_user(id)
+        except exception.NotFound:
+            user = None
+
+        if user is None:
+            raise faults.Fault(exc.HTTPNotFound())
+
+        return dict(user=_translate_keys(user))
+
+    def delete(self, req, id):
+        self._check_admin(req.environ['nova.context'])
+        self.manager.delete_user(id)
+        return {}
+
+    def create(self, req):
+        self._check_admin(req.environ['nova.context'])
+        env = self._deserialize(req.body, req.get_content_type())
+        is_admin = env['user'].get('admin') in ('T', 'True', True)
+        name = env['user'].get('name')
+        access = env['user'].get('access')
+        secret = env['user'].get('secret')
+        user = self.manager.create_user(name, access, secret, is_admin)
+        return dict(user=_translate_keys(user))
+
+    def update(self, req, id):
+        self._check_admin(req.environ['nova.context'])
+        env = self._deserialize(req.body, req.get_content_type())
+        is_admin = env['user'].get('admin')
+        if is_admin is not None:
+            is_admin = is_admin in ('T', 'True', True)
+        access = env['user'].get('access')
+        secret = env['user'].get('secret')
+        self.manager.modify_user(id, access, secret, is_admin)
+        return dict(user=_translate_keys(self.manager.get_user(id)))
diff --git a/nova/api/openstack/views/__init__.py b/nova/api/openstack/views/__init__.py
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/nova/api/openstack/views/__init__.py
diff --git a/nova/api/openstack/views/addresses.py b/nova/api/openstack/views/addresses.py
new file mode 100644
index 000000000..90c77855b
--- /dev/null
+++ b/nova/api/openstack/views/addresses.py
@@ -0,0 +1,42 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from nova import utils
+from nova.api.openstack import common
+
+
+class ViewBuilder(object):
+    ''' Models a server addresses response as a python dictionary.'''
+
+    def build(self, inst):
+        raise NotImplementedError()
+
+
+class ViewBuilderV10(ViewBuilder):
+    def build(self, inst):
+        private_ips = utils.get_from_path(inst, 'fixed_ip/address')
+        public_ips = utils.get_from_path(inst, 'fixed_ip/floating_ips/address')
+        return dict(public=public_ips, private=private_ips)
+
+
+class ViewBuilderV11(ViewBuilder):
+    def build(self, inst):
+        private_ips = utils.get_from_path(inst, 'fixed_ip/address')
+        private_ips = [dict(version=4, addr=a) for a in private_ips]
+        public_ips = utils.get_from_path(inst, 'fixed_ip/floating_ips/address')
+        public_ips = [dict(version=4, addr=a) for a in public_ips]
+        return dict(public=public_ips, private=private_ips)
diff --git a/nova/api/openstack/views/flavors.py b/nova/api/openstack/views/flavors.py
new file mode 100644
index 000000000..18bd779c0
--- /dev/null
+++ b/nova/api/openstack/views/flavors.py
@@ -0,0 +1,34 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from nova.api.openstack import common
+
+
+class ViewBuilder(object):
+    def __init__(self):
+        pass
+
+    def build(self, flavor_obj):
+        raise NotImplementedError()
+
+
+class ViewBuilderV11(ViewBuilder):
+    def __init__(self, base_url):
+        self.base_url = base_url
+
+    def generate_href(self, flavor_id):
+        return "%s/flavors/%s" % (self.base_url, flavor_id)
diff --git a/nova/api/openstack/views/images.py b/nova/api/openstack/views/images.py
new file mode 100644
index 000000000..a6c6ad7d1
--- /dev/null
+++ b/nova/api/openstack/views/images.py
@@ -0,0 +1,34 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from nova.api.openstack import common
+
+
+class ViewBuilder(object):
+    def __init__(self):
+        pass
+
+    def build(self, image_obj):
+        raise NotImplementedError()
+
+
+class ViewBuilderV11(ViewBuilder):
+    def __init__(self, base_url):
+        self.base_url = base_url
+
+    def generate_href(self, image_id):
+        return "%s/images/%s" % (self.base_url, image_id)
diff --git a/nova/api/openstack/views/servers.py b/nova/api/openstack/views/servers.py
new file mode 100644
index 000000000..f93435198
--- /dev/null
+++ b/nova/api/openstack/views/servers.py
@@ -0,0 +1,125 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import hashlib
+
+from nova.compute import power_state
+import nova.compute
+import nova.context
+from nova.api.openstack import common
+from nova.api.openstack.views import addresses as addresses_view
+from nova.api.openstack.views import flavors as flavors_view
+from nova.api.openstack.views import images as images_view
+from nova import utils
+
+
+class ViewBuilder(object):
+    """Model a server response as a python dictionary.
+
+    Public methods: build
+    Abstract methods: _build_image, _build_flavor
+
+    """
+
+    def __init__(self, addresses_builder):
+        self.addresses_builder = addresses_builder
+
+    def build(self, inst, is_detail):
+        """Return a dict that represenst a server."""
+        if is_detail:
+            return self._build_detail(inst)
+        else:
+            return self._build_simple(inst)
+
+    def _build_simple(self, inst):
+        """Return a simple model of a server."""
+        return dict(server=dict(id=inst['id'], name=inst['display_name']))
+
+    def _build_detail(self, inst):
+        """Returns a detailed model of a server."""
+        power_mapping = {
+            None: 'build',
+            power_state.NOSTATE: 'build',
+            power_state.RUNNING: 'active',
+            power_state.BLOCKED: 'active',
+            power_state.SUSPENDED: 'suspended',
+            power_state.PAUSED: 'paused',
+            power_state.SHUTDOWN: 'active',
+            power_state.SHUTOFF: 'active',
+            power_state.CRASHED: 'error',
+            power_state.FAILED: 'error'}
+
+        inst_dict = {
+            'id': int(inst['id']),
+            'name': inst['display_name'],
+            'addresses': self.addresses_builder.build(inst),
+            'status': power_mapping[inst.get('state')]}
+
+        ctxt = nova.context.get_admin_context()
+        compute_api = nova.compute.API()
+        if compute_api.has_finished_migration(ctxt, inst['id']):
+            inst_dict['status'] = 'resize-confirm'
+
+        # Return the metadata as a dictionary
+        metadata = {}
+        for item in inst.get('metadata', []):
+            metadata[item['key']] = item['value']
+        inst_dict['metadata'] = metadata
+
+        inst_dict['hostId'] = ''
+        if inst.get('host'):
+            inst_dict['hostId'] = hashlib.sha224(inst['host']).hexdigest()
+
+        self._build_image(inst_dict, inst)
+        self._build_flavor(inst_dict, inst)
+
+        return dict(server=inst_dict)
+
+    def _build_image(self, response, inst):
+        """Return the image sub-resource of a server."""
+        raise NotImplementedError()
+
+    def _build_flavor(self, response, inst):
+        """Return the flavor sub-resource of a server."""
+        raise NotImplementedError()
+
+
+class ViewBuilderV10(ViewBuilder):
+    """Model an Openstack API V1.0 server response."""
+
+    def _build_image(self, response, inst):
+        response['imageId'] = inst['image_id']
+
+    def _build_flavor(self, response, inst):
+        response['flavorId'] = inst['instance_type']
+
+
+class ViewBuilderV11(ViewBuilder):
+    """Model an Openstack API V1.0 server response."""
+
+    def __init__(self, addresses_builder, flavor_builder, image_builder):
+        ViewBuilder.__init__(self, addresses_builder)
+        self.flavor_builder = flavor_builder
+        self.image_builder = image_builder
+
+    def _build_image(self, response, inst):
+        image_id = inst["image_id"]
+        response["imageRef"] = self.image_builder.generate_href(image_id)
+
+    def _build_flavor(self, response, inst):
+        flavor_id = inst["instance_type"]
+        response["flavorRef"] = self.flavor_builder.generate_href(flavor_id)
diff --git a/nova/api/openstack/zones.py b/nova/api/openstack/zones.py
index d5206da20..846cb48a1 100644
--- a/nova/api/openstack/zones.py
+++ b/nova/api/openstack/zones.py
@@ -1,4 +1,4 @@
-# Copyright 2010 OpenStack LLC.
+# Copyright 2011 OpenStack LLC.
 # All Rights Reserved.
 #
 #    Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -15,9 +15,11 @@
 
 import common
 
+from nova import db
 from nova import flags
+from nova import log as logging
 from nova import wsgi
-from nova import db
+from nova.scheduler import api
 
 
 FLAGS = flags.FLAGS
@@ -32,8 +34,13 @@ def _filter_keys(item, keys):
     return dict((k, v) for k, v in item.iteritems() if k in keys)
 
 
+def _exclude_keys(item, keys):
+    return dict((k, v) for k, v in item.iteritems() if k not in keys)
+
+
 def _scrub_zone(zone):
-    return _filter_keys(zone, ('id', 'api_url'))
+    return _exclude_keys(zone, ('username', 'password', 'created_at',
+                    'deleted', 'deleted_at', 'updated_at'))
 
 
 class Controller(wsgi.Controller):
@@ -41,11 +48,13 @@ class Controller(wsgi.Controller):
     _serialization_metadata = {
         'application/xml': {
             "attributes": {
-                "zone": ["id", "api_url"]}}}
+                "zone": ["id", "api_url", "name", "capabilities"]}}}
 
     def index(self, req):
         """Return all zones in brief"""
-        items = db.zone_get_all(req.environ['nova.context'])
+        # Ask the ZoneManager in the Scheduler for most recent data,
+        # or fall-back to the database ...
+        items = api.get_zone_list(req.environ['nova.context'])
         items = common.limited(items, req)
         items = [_scrub_zone(item) for item in items]
         return dict(zones=items)
@@ -54,26 +63,39 @@ class Controller(wsgi.Controller):
         """Return all zones in detail"""
         return self.index(req)
 
+    def info(self, req):
+        """Return name and capabilities for this zone."""
+        items = api.get_zone_capabilities(req.environ['nova.context'])
+
+        zone = dict(name=FLAGS.zone_name)
+        caps = FLAGS.zone_capabilities
+        for cap in caps:
+            key, value = cap.split('=')
+            zone[key] = value
+        for item, (min_value, max_value) in items.iteritems():
+            zone[item] = "%s,%s" % (min_value, max_value)
+        return dict(zone=zone)
+
     def show(self, req, id):
         """Return data about the given zone id"""
         zone_id = int(id)
-        zone = db.zone_get(req.environ['nova.context'], zone_id)
+        zone = api.zone_get(req.environ['nova.context'], zone_id)
         return dict(zone=_scrub_zone(zone))
 
     def delete(self, req, id):
         zone_id = int(id)
-        db.zone_delete(req.environ['nova.context'], zone_id)
+        api.zone_delete(req.environ['nova.context'], zone_id)
         return {}
 
     def create(self, req):
         context = req.environ['nova.context']
-        env = self._deserialize(req.body, req)
-        zone = db.zone_create(context, env["zone"])
+        env = self._deserialize(req.body, req.get_content_type())
+        zone = api.zone_create(context, env["zone"])
         return dict(zone=_scrub_zone(zone))
 
     def update(self, req, id):
         context = req.environ['nova.context']
-        env = self._deserialize(req.body, req)
+        env = self._deserialize(req.body, req.get_content_type())
         zone_id = int(id)
-        zone = db.zone_update(context, zone_id, env["zone"])
+        zone = api.zone_update(context, zone_id, env["zone"])
         return dict(zone=_scrub_zone(zone))