start removing references to AuthManager

3 files changed, 15 insertions, 24 deletions

diff --git a/nova/api/direct.py b/nova/api/direct.py
index ec79151b1..993815fc7 100644
--- a/nova/api/direct.py
+++ b/nova/api/direct.py
@@ -107,7 +107,8 @@ class DelegatedAuthMiddleware(wsgi.Middleware):
     def process_request(self, request):
         os_user = request.headers['X-OpenStack-User']
         os_project = request.headers['X-OpenStack-Project']
-        context_ref = context.RequestContext(user=os_user, project=os_project)
+        context_ref = context.RequestContext(user_id=os_user,
+                                             project_id=os_project)
         request.environ['openstack.context'] = context_ref
 
 
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index cf1734281..8bb2ea944 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -174,8 +174,8 @@ class Authenticate(wsgi.Middleware):
         remote_address = req.remote_addr
         if FLAGS.use_forwarded_for:
             remote_address = req.headers.get('X-Forwarded-For', remote_address)
-        ctxt = context.RequestContext(user=user,
-                                      project=project,
+        ctxt = context.RequestContext(user_id=user.id,
+                                      project_id=project.id,
                                       remote_address=remote_address)
         req.environ['ec2.context'] = ctxt
         uname = user.name
@@ -295,13 +295,15 @@ class Authorizer(wsgi.Middleware):
 
     def _matches_any_role(self, context, roles):
         """Return True if any role in roles is allowed in context."""
-        if context.user.is_superuser():
+        authman = manager.AuthManager()
+        user = authman.get_user(context.user_id)
+        if user.is_superuser():
             return True
         if 'all' in roles:
             return True
         if 'none' in roles:
             return False
-        return any(context.project.has_role(context.user_id, role)
+        return any(authman.has_role(context.user_id, role, context.project_id)
                    for role in roles)
 
 
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index 7c3e683d6..5b387c081 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -48,31 +48,19 @@ class AuthMiddleware(wsgi.Middleware):
     def __call__(self, req):
         if not self.has_authentication(req):
             return self.authenticate(req)
-        user = self.get_user_by_authentication(req)
-        if not user:
+        user_id = self.get_user_by_authentication(req)
+        if not user_id:
             token = req.headers["X-Auth-Token"]
-            msg = _("%(user)s could not be found with token '%(token)s'")
+            msg = _("%(user_id)s could not be found with token '%(token)s'")
             LOG.warn(msg % locals())
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
         try:
-            account = req.headers["X-Auth-Project-Id"]
+            project_id = req.headers["X-Auth-Project-Id"]
         except KeyError:
-            # FIXME(usrleon): It needed only for compatibility
-            # while osapi clients don't use this header
-            accounts = self.auth.get_projects(user=user)
-            if accounts:
-                account = accounts[0]
-            else:
-                return faults.Fault(webob.exc.HTTPUnauthorized())
-
-        if not self.auth.is_admin(user) and \
-           not self.auth.is_project_member(user, account):
-            msg = _("%(user)s must be an admin or a member of %(account)s")
-            LOG.warn(msg % locals())
-            return faults.Fault(webob.exc.HTTPUnauthorized())
+            project_id = user_id
 
-        req.environ['nova.context'] = context.RequestContext(user, account)
+        req.environ['nova.context'] = context.RequestContext(user_id, project_id)
         return self.application
 
     def has_authentication(self, req):
@@ -133,7 +121,7 @@ class AuthMiddleware(wsgi.Middleware):
             if delta.days >= 2:
                 self.db.auth_token_destroy(ctxt, token['token_hash'])
             else:
-                return self.auth.get_user(token['user_id'])
+                return token['user_id']
         return None
 
     def _authorize_user(self, username, key, req):