Merge with trunk

20 files changed, 453 insertions, 127 deletions

diff --git a/nova/api/__init__.py b/nova/api/__init__.py
index 0fedbbfad..747015af5 100644
--- a/nova/api/__init__.py
+++ b/nova/api/__init__.py
@@ -15,5 +15,3 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
-
-"""No-op __init__ for directory full of api goodies."""
diff --git a/nova/api/direct.py b/nova/api/direct.py
index f487df7c7..8ceae299c 100644
--- a/nova/api/direct.py
+++ b/nova/api/direct.py
@@ -44,14 +44,33 @@ from nova import utils
 from nova import wsgi
 
 
+# Global storage for registering modules.
 ROUTES = {}
 
 
 def register_service(path, handle):
+    """Register a service handle at a given path.
+
+    Services registered in this way will be made available to any instances of
+    nova.api.direct.Router.
+
+    :param path: `routes` path, can be a basic string like "/path"
+    :param handle: an object whose methods will be made available via the api
+
+    """
     ROUTES[path] = handle
 
 
 class Router(wsgi.Router):
+    """A simple WSGI router configured via `register_service`.
+
+    This is a quick way to attach multiple services to a given endpoint.
+    It will automatically load the routes registered in the `ROUTES` global.
+
+    TODO(termie): provide a paste-deploy version of this.
+
+    """
+
     def __init__(self, mapper=None):
         if mapper is None:
             mapper = routes.Mapper()
@@ -66,6 +85,24 @@ class Router(wsgi.Router):
 
 
 class DelegatedAuthMiddleware(wsgi.Middleware):
+    """A simple and naive authentication middleware.
+
+    Designed mostly to provide basic support for alternative authentication
+    schemes, this middleware only desires the identity of the user and will
+    generate the appropriate nova.context.RequestContext for the rest of the
+    application. This allows any middleware above it in the stack to
+    authenticate however it would like while only needing to conform to a
+    minimal interface.
+
+    Expects two headers to determine identity:
+     - X-OpenStack-User
+     - X-OpenStack-Project
+
+    This middleware is tied to identity management and will need to be kept
+    in sync with any changes to the way identity is dealt with internally.
+
+    """
+
     def process_request(self, request):
         os_user = request.headers['X-OpenStack-User']
         os_project = request.headers['X-OpenStack-Project']
@@ -74,6 +111,20 @@ class DelegatedAuthMiddleware(wsgi.Middleware):
 
 
 class JsonParamsMiddleware(wsgi.Middleware):
+    """Middleware to allow method arguments to be passed as serialized JSON.
+
+    Accepting arguments as JSON is useful for accepting data that may be more
+    complex than simple primitives.
+
+    In this case we accept it as urlencoded data under the key 'json' as in
+    json=<urlencoded_json> but this could be extended to accept raw JSON
+    in the POST body.
+
+    Filters out the parameters `self`, `context` and anything beginning with
+    an underscore.
+
+    """
+
     def process_request(self, request):
         if 'json' not in request.params:
             return
@@ -92,6 +143,13 @@ class JsonParamsMiddleware(wsgi.Middleware):
 
 
 class PostParamsMiddleware(wsgi.Middleware):
+    """Middleware to allow method arguments to be passed as POST parameters.
+
+    Filters out the parameters `self`, `context` and anything beginning with
+    an underscore.
+
+    """
+
     def process_request(self, request):
         params_parsed = request.params
         params = {}
@@ -106,12 +164,21 @@ class PostParamsMiddleware(wsgi.Middleware):
 
 
 class Reflection(object):
-    """Reflection methods to list available methods."""
+    """Reflection methods to list available methods.
+
+    This is an object that expects to be registered via register_service.
+    These methods allow the endpoint to be self-describing. They introspect
+    the exposed methods and provide call signatures and documentation for
+    them allowing quick experimentation.
+
+    """
+
     def __init__(self):
         self._methods = {}
         self._controllers = {}
 
     def _gather_methods(self):
+        """Introspect available methods and generate documentation for them."""
         methods = {}
         controllers = {}
         for route, handler in ROUTES.iteritems():
@@ -185,6 +252,16 @@ class Reflection(object):
 
 
 class ServiceWrapper(wsgi.Controller):
+    """Wrapper to dynamically povide a WSGI controller for arbitrary objects.
+
+    With lightweight introspection allows public methods on the object to
+    be accesed via simple WSGI routing and parameters and serializes the
+    return values.
+
+    Automatically used be nova.api.direct.Router to wrap registered instances.
+
+    """
+
     def __init__(self, service_handle):
         self.service_handle = service_handle
 
@@ -260,7 +337,16 @@ class Limited(object):
 
 
 class Proxy(object):
-    """Pretend a Direct API endpoint is an object."""
+    """Pretend a Direct API endpoint is an object.
+
+    This is mostly useful in testing at the moment though it should be easily
+    extendable to provide a basic API library functionality.
+
+    In testing we use this to stub out internal objects to verify that results
+    from the API are serializable.
+
+    """
+
     def __init__(self, app, prefix=None):
         self.app = app
         self.prefix = prefix
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index a3c3b25a1..cd59340bd 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -46,8 +46,6 @@ flags.DEFINE_integer('lockout_minutes', 15,
                      'Number of minutes to lockout if triggered.')
 flags.DEFINE_integer('lockout_window', 15,
                      'Number of minutes for lockout window.')
-flags.DEFINE_list('lockout_memcached_servers', None,
-                  'Memcached servers or None for in process cache.')
 
 
 class RequestLogging(wsgi.Middleware):
@@ -107,11 +105,11 @@ class Lockout(wsgi.Middleware):
 
     def __init__(self, application):
         """middleware can use fake for testing."""
-        if FLAGS.lockout_memcached_servers:
+        if FLAGS.memcached_servers:
             import memcache
         else:
             from nova import fakememcache as memcache
-        self.mc = memcache.Client(FLAGS.lockout_memcached_servers,
+        self.mc = memcache.Client(FLAGS.memcached_servers,
                                   debug=0)
         super(Lockout, self).__init__(application)
 
@@ -322,9 +320,7 @@ class Executor(wsgi.Application):
         except exception.InstanceNotFound as ex:
             LOG.info(_('InstanceNotFound raised: %s'), unicode(ex),
                      context=context)
-            ec2_id = ec2utils.id_to_ec2_id(ex.instance_id)
-            message = _('Instance %s not found') % ec2_id
-            return self._error(req, context, type(ex).__name__, message)
+            return self._error(req, context, type(ex).__name__, ex.message)
         except exception.VolumeNotFound as ex:
             LOG.info(_('VolumeNotFound raised: %s'), unicode(ex),
                      context=context)
diff --git a/nova/api/ec2/admin.py b/nova/api/ec2/admin.py
index 6a5609d4a..ea94d9c1f 100644
--- a/nova/api/ec2/admin.py
+++ b/nova/api/ec2/admin.py
@@ -266,7 +266,7 @@ class AdminController(object):
     def _vpn_for(self, context, project_id):
         """Get the VPN instance for a project ID."""
         for instance in db.instance_get_all_by_project(context, project_id):
-            if (instance['image_id'] == FLAGS.vpn_image_id
+            if (instance['image_id'] == str(FLAGS.vpn_image_id)
                 and not instance['state_description'] in
                     ['shutting_down', 'shutdown']):
                 return instance
diff --git a/nova/api/ec2/apirequest.py b/nova/api/ec2/apirequest.py
index d7ad08d2f..6672e60bb 100644
--- a/nova/api/ec2/apirequest.py
+++ b/nova/api/ec2/apirequest.py
@@ -196,7 +196,7 @@ class APIRequest(object):
         elif isinstance(data, datetime.datetime):
             data_el.appendChild(
                   xml.createTextNode(_database_to_isoformat(data)))
-        elif data != None:
+        elif data is not None:
             data_el.appendChild(xml.createTextNode(str(data)))
 
         return data_el
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index 651ec47f9..092b80fa2 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -49,8 +49,6 @@ flags.DECLARE('service_down_time', 'nova.scheduler.driver')
 
 LOG = logging.getLogger("nova.api.cloud")
 
-InvalidInputException = exception.InvalidInputException
-
 
 def _gen_key(context, user_id, key_name):
     """Generate a key
@@ -61,8 +59,7 @@ def _gen_key(context, user_id, key_name):
     #             creation before creating key_pair
     try:
         db.key_pair_get(context, user_id, key_name)
-        raise exception.Duplicate(_("The key_pair %s already exists")
-                                  % key_name)
+        raise exception.KeyPairExists(key_name=key_name)
     except exception.NotFound:
         pass
     private_key, public_key, fingerprint = crypto.generate_key_pair()
@@ -142,6 +139,11 @@ class CloudController(object):
         instance_ref = self.compute_api.get_all(ctxt, fixed_ip=address)
         if instance_ref is None:
             return None
+
+        # This ensures that all attributes of the instance
+        # are populated.
+        instance_ref = db.instance_get(ctxt, instance_ref['id'])
+
         mpi = self._get_mpi_data(ctxt, instance_ref['project_id'])
         if instance_ref['key_name']:
             keys = {'0': {'_name': instance_ref['key_name'],
@@ -154,7 +156,7 @@ class CloudController(object):
         floating_ip = db.instance_get_floating_address(ctxt,
                                                        instance_ref['id'])
         ec2_id = ec2utils.id_to_ec2_id(instance_ref['id'])
-        image_ec2_id = self._image_ec2_id(instance_ref['image_id'], 'ami')
+        image_ec2_id = self.image_ec2_id(instance_ref['image_id'])
         data = {
             'user-data': base64.b64decode(instance_ref['user_data']),
             'meta-data': {
@@ -182,9 +184,9 @@ class CloudController(object):
                 'mpi': mpi}}
 
         for image_type in ['kernel', 'ramdisk']:
-            if '%s_id' % image_type in instance_ref:
-                ec2_id = self._image_ec2_id(instance_ref['%s_id' % image_type],
-                                            self._image_type(image_type))
+            if instance_ref.get('%s_id' % image_type):
+                ec2_id = self.image_ec2_id(instance_ref['%s_id' % image_type],
+                                           self._image_type(image_type))
                 data['meta-data']['%s-id' % image_type] = ec2_id
 
         if False:  # TODO(vish): store ancestor ids
@@ -394,11 +396,11 @@ class CloudController(object):
             ip_protocol = str(ip_protocol)
 
             if ip_protocol.upper() not in ['TCP', 'UDP', 'ICMP']:
-                raise InvalidInputException(_('%s is not a valid ipProtocol') %
-                                            (ip_protocol,))
+                raise exception.InvalidIpProtocol(protocol=ip_protocol)
             if ((min(from_port, to_port) < -1) or
                 (max(from_port, to_port) > 65535)):
-                raise InvalidInputException(_('Invalid port range'))
+                raise exception.InvalidPortRange(from_port=from_port,
+                                                 to_port=to_port)
 
             values['protocol'] = ip_protocol
             values['from_port'] = from_port
@@ -437,7 +439,7 @@ class CloudController(object):
                                                        group_name)
 
         criteria = self._revoke_rule_args_to_dict(context, **kwargs)
-        if criteria == None:
+        if criteria is None:
             raise exception.ApiError(_("Not enough parameters to build a "
                                        "valid rule."))
 
@@ -608,7 +610,7 @@ class CloudController(object):
         # TODO(vish): Instance should be None at db layer instead of
         #             trying to lazy load, but for now we turn it into
         #             a dict to avoid an error.
-        return {'volumeSet': [self._format_volume(context, dict(volume))]}
+        return self._format_volume(context, dict(volume))
 
     def delete_volume(self, context, volume_id, **kwargs):
         volume_id = ec2utils.ec2_id_to_id(volume_id)
@@ -659,7 +661,7 @@ class CloudController(object):
                 'volumeId': ec2utils.id_to_ec2_id(volume_id, 'vol-%08x')}
 
     def _convert_to_set(self, lst, label):
-        if lst == None or lst == []:
+        if lst is None or lst == []:
             return None
         if not isinstance(lst, list):
             lst = [lst]
@@ -698,13 +700,13 @@ class CloudController(object):
             instances = self.compute_api.get_all(context, **kwargs)
         for instance in instances:
             if not context.is_admin:
-                if instance['image_id'] == FLAGS.vpn_image_id:
+                if instance['image_id'] == str(FLAGS.vpn_image_id):
                     continue
             i = {}
             instance_id = instance['id']
             ec2_id = ec2utils.id_to_ec2_id(instance_id)
             i['instanceId'] = ec2_id
-            i['imageId'] = self._image_ec2_id(instance['image_id'])
+            i['imageId'] = self.image_ec2_id(instance['image_id'])
             i['instanceState'] = {
                 'code': instance['state'],
                 'name': instance['state_description']}
@@ -721,7 +723,9 @@ class CloudController(object):
                         instance['mac_address'])
 
             i['privateDnsName'] = fixed_addr
+            i['privateIpAddress'] = fixed_addr
             i['publicDnsName'] = floating_addr
+            i['ipAddress'] = floating_addr or fixed_addr
             i['dnsName'] = i['publicDnsName'] or i['privateDnsName']
             i['keyName'] = instance['key_name']
 
@@ -893,7 +897,7 @@ class CloudController(object):
         return image_type
 
     @staticmethod
-    def _image_ec2_id(image_id, image_type='ami'):
+    def image_ec2_id(image_id, image_type='ami'):
         """Returns image ec2_id using id and three letter type."""
         template = image_type + '-%08x'
         return ec2utils.id_to_ec2_id(int(image_id), template=template)
@@ -902,22 +906,25 @@ class CloudController(object):
         try:
             internal_id = ec2utils.ec2_id_to_id(ec2_id)
             return self.image_service.show(context, internal_id)
-        except exception.NotFound:
-            return self.image_service.show_by_name(context, ec2_id)
+        except ValueError:
+            try:
+                return self.image_service.show_by_name(context, ec2_id)
+            except exception.NotFound:
+                raise exception.ImageNotFound(image_id=ec2_id)
 
     def _format_image(self, image):
         """Convert from format defined by BaseImageService to S3 format."""
         i = {}
         image_type = self._image_type(image.get('container_format'))
-        ec2_id = self._image_ec2_id(image.get('id'), image_type)
+        ec2_id = self.image_ec2_id(image.get('id'), image_type)
         name = image.get('name')
         i['imageId'] = ec2_id
         kernel_id = image['properties'].get('kernel_id')
         if kernel_id:
-            i['kernelId'] = self._image_ec2_id(kernel_id, 'aki')
+            i['kernelId'] = self.image_ec2_id(kernel_id, 'aki')
         ramdisk_id = image['properties'].get('ramdisk_id')
         if ramdisk_id:
-            i['ramdiskId'] = self._image_ec2_id(ramdisk_id, 'ari')
+            i['ramdiskId'] = self.image_ec2_id(ramdisk_id, 'ari')
         i['imageOwnerId'] = image['properties'].get('owner_id')
         if name:
             i['imageLocation'] = "%s (%s)" % (image['properties'].
@@ -947,8 +954,7 @@ class CloudController(object):
                 try:
                     image = self._get_image(context, ec2_id)
                 except exception.NotFound:
-                    raise exception.NotFound(_('Image %s not found') %
-                                             ec2_id)
+                    raise exception.ImageNotFound(image_id=ec2_id)
                 images.append(image)
         else:
             images = self.image_service.detail(context)
@@ -968,8 +974,8 @@ class CloudController(object):
         metadata = {'properties': {'image_location': image_location}}
         image = self.image_service.create(context, metadata)
         image_type = self._image_type(image.get('container_format'))
-        image_id = self._image_ec2_id(image['id'],
-                                      image_type)
+        image_id = self.image_ec2_id(image['id'],
+                                     image_type)
         msg = _("Registered image %(image_location)s with"
                 " id %(image_id)s") % locals()
         LOG.audit(msg, context=context)
@@ -982,7 +988,7 @@ class CloudController(object):
         try:
             image = self._get_image(context, image_id)
         except exception.NotFound:
-            raise exception.NotFound(_('Image %s not found') % image_id)
+            raise exception.ImageNotFound(image_id=image_id)
         result = {'imageId': image_id, 'launchPermission': []}
         if image['is_public']:
             result['launchPermission'].append({'group': 'all'})
@@ -1005,7 +1011,7 @@ class CloudController(object):
         try:
             image = self._get_image(context, image_id)
         except exception.NotFound:
-            raise exception.NotFound(_('Image %s not found') % image_id)
+            raise exception.ImageNotFound(image_id=image_id)
         internal_id = image['id']
         del(image['id'])
 
diff --git a/nova/api/ec2/ec2utils.py b/nova/api/ec2/ec2utils.py
index 3b34f6ea5..1ac48163c 100644
--- a/nova/api/ec2/ec2utils.py
+++ b/nova/api/ec2/ec2utils.py
@@ -21,10 +21,7 @@ from nova import exception
 
 def ec2_id_to_id(ec2_id):
     """Convert an ec2 ID (i-[base 16 number]) to an instance id (int)"""
-    try:
-        return int(ec2_id.split('-')[-1], 16)
-    except ValueError:
-        raise exception.NotFound(_("Id %s Not Found") % ec2_id)
+    return int(ec2_id.split('-')[-1], 16)
 
 
 def id_to_ec2_id(instance_id, template='i-%08x'):
diff --git a/nova/api/openstack/__init__.py b/nova/api/openstack/__init__.py
index 5e76a06f7..348b70d5b 100644
--- a/nova/api/openstack/__init__.py
+++ b/nova/api/openstack/__init__.py
@@ -112,9 +112,6 @@ class APIRouter(wsgi.Router):
                         parent_resource=dict(member_name='server',
                         collection_name='servers'))
 
-        _limits = limits.LimitsController()
-        mapper.resource("limit", "limits", controller=_limits)
-
         super(APIRouter, self).__init__(mapper)
 
 
@@ -145,6 +142,9 @@ class APIRouterV10(APIRouter):
                         parent_resource=dict(member_name='server',
                         collection_name='servers'))
 
+        mapper.resource("limit", "limits",
+                        controller=limits.LimitsControllerV10())
+
         mapper.resource("ip", "ips", controller=ips.Controller(),
                         collection=dict(public='GET', private='GET'),
                         parent_resource=dict(member_name='server',
@@ -178,3 +178,6 @@ class APIRouterV11(APIRouter):
         mapper.resource("flavor", "flavors",
                         controller=flavors.ControllerV11(),
                         collection={'detail': 'GET'})
+
+        mapper.resource("limit", "limits",
+                        controller=limits.LimitsControllerV11())
diff --git a/nova/api/openstack/accounts.py b/nova/api/openstack/accounts.py
index 6e3763e47..00fdd4540 100644
--- a/nova/api/openstack/accounts.py
+++ b/nova/api/openstack/accounts.py
@@ -48,7 +48,7 @@ class Controller(common.OpenstackController):
         """We cannot depend on the db layer to check for admin access
            for the auth manager, so we do it here"""
         if not context.is_admin:
-            raise exception.NotAuthorized(_("Not admin user."))
+            raise exception.AdminRequired()
 
     def index(self, req):
         raise faults.Fault(webob.exc.HTTPNotImplemented())
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index f3a9bdeca..311e6bde9 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -55,6 +55,9 @@ class AuthMiddleware(wsgi.Middleware):
         user = self.get_user_by_authentication(req)
         accounts = self.auth.get_projects(user=user)
         if not user:
+            token = req.headers["X-Auth-Token"]
+            msg = _("%(user)s could not be found with token '%(token)s'")
+            LOG.warn(msg % locals())
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
         if accounts:
@@ -66,6 +69,8 @@ class AuthMiddleware(wsgi.Middleware):
 
         if not self.auth.is_admin(user) and \
            not self.auth.is_project_member(user, account):
+            msg = _("%(user)s must be an admin or a member of %(account)s")
+            LOG.warn(msg % locals())
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
         req.environ['nova.context'] = context.RequestContext(user, account)
@@ -82,12 +87,16 @@ class AuthMiddleware(wsgi.Middleware):
         # honor it
         path_info = req.path_info
         if len(path_info) > 1:
-            return faults.Fault(webob.exc.HTTPUnauthorized())
+            msg = _("Authentication requests must be made against a version "
+                    "root (e.g. /v1.0 or /v1.1).")
+            LOG.warn(msg)
+            return faults.Fault(webob.exc.HTTPUnauthorized(explanation=msg))
 
         try:
             username = req.headers['X-Auth-User']
             key = req.headers['X-Auth-Key']
-        except KeyError:
+        except KeyError as ex:
+            LOG.warn(_("Could not find %s in request.") % ex)
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
         token, user = self._authorize_user(username, key, req)
@@ -100,6 +109,7 @@ class AuthMiddleware(wsgi.Middleware):
             res.headers['X-CDN-Management-Url'] = token.cdn_management_url
             res.content_type = 'text/plain'
             res.status = '204'
+            LOG.debug(_("Successfully authenticated '%s'") % username)
             return res
         else:
             return faults.Fault(webob.exc.HTTPUnauthorized())
@@ -139,6 +149,7 @@ class AuthMiddleware(wsgi.Middleware):
         try:
             user = self.auth.get_user_from_access_key(key)
         except exception.NotFound:
+            LOG.warn(_("User not found with provided API key."))
             user = None
 
         if user and user.name == username:
@@ -153,4 +164,9 @@ class AuthMiddleware(wsgi.Middleware):
             token_dict['user_id'] = user.id
             token = self.db.auth_token_create(ctxt, token_dict)
             return token, user
+        elif user and user.name != username:
+            msg = _("Provided API key is valid, but not for user "
+                    "'%(username)s'") % locals()
+            LOG.warn(msg)
+
         return None, None
diff --git a/nova/api/openstack/common.py b/nova/api/openstack/common.py
index 234f921ab..32cd689ca 100644
--- a/nova/api/openstack/common.py
+++ b/nova/api/openstack/common.py
@@ -15,6 +15,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import re
 from urlparse import urlparse
 
 import webob
@@ -25,7 +26,7 @@ from nova import log as logging
 from nova import wsgi
 
 
-LOG = logging.getLogger('common')
+LOG = logging.getLogger('nova.api.openstack.common')
 
 
 FLAGS = flags.FLAGS
@@ -116,18 +117,30 @@ def get_image_id_from_image_hash(image_service, context, image_hash):
         items = image_service.index(context)
     for image in items:
         image_id = image['id']
-        if abs(hash(image_id)) == int(image_hash):
-            return image_id
-    raise exception.NotFound(image_hash)
+        try:
+            if abs(hash(image_id)) == int(image_hash):
+                return image_id
+        except ValueError:
+            msg = _("Requested image_id has wrong format: %s,"
+                    "should have numerical format") % image_id
+            LOG.error(msg)
+            raise Exception(msg)
+    raise exception.ImageNotFound(image_id=image_hash)
 
 
 def get_id_from_href(href):
     """Return the id portion of a url as an int.
 
-    Given: http://www.foo.com/bar/123?q=4
+    Given: 'http://www.foo.com/bar/123?q=4'
+    Returns: 123
+
+    In order to support local hrefs, the href argument can be just an id:
+    Given: '123'
     Returns: 123
 
     """
+    if re.match(r'\d+$', str(href)):
+        return int(href)
     try:
         return int(urlparse(href).path.split('/')[-1])
     except:
diff --git a/nova/api/openstack/contrib/volumes.py b/nova/api/openstack/contrib/volumes.py
index 6efacce52..18de2ec71 100644
--- a/nova/api/openstack/contrib/volumes.py
+++ b/nova/api/openstack/contrib/volumes.py
@@ -322,8 +322,7 @@ class Volumes(extensions.ExtensionDescriptor):
         # Does this matter?
         res = extensions.ResourceExtension('volumes',
                                         VolumeController(),
-                                        collection_actions={'detail': 'GET'}
-                                          )
+                                        collection_actions={'detail': 'GET'})
         resources.append(res)
 
         res = extensions.ResourceExtension('volume_attachments',
diff --git a/nova/api/openstack/images.py b/nova/api/openstack/images.py
index 77baf5947..34d4c27fc 100644
--- a/nova/api/openstack/images.py
+++ b/nova/api/openstack/images.py
@@ -127,7 +127,7 @@ class Controller(common.OpenstackController):
             raise webob.exc.HTTPBadRequest()
 
         image = self._compute_service.snapshot(context, server_id, image_name)
-        return self.get_builder(req).build(image, detail=True)
+        return dict(image=self.get_builder(req).build(image, detail=True))
 
     def get_builder(self, request):
         """Indicates that you must use a Controller subclass."""
diff --git a/nova/api/openstack/limits.py b/nova/api/openstack/limits.py
index 9877af191..47bc238f1 100644
--- a/nova/api/openstack/limits.py
+++ b/nova/api/openstack/limits.py
@@ -33,7 +33,7 @@ from webob.dec import wsgify
 from nova import wsgi
 from nova.api.openstack import common
 from nova.api.openstack import faults
-from nova.wsgi import Middleware
+from nova.api.openstack.views import limits as limits_views
 
 
 # Convenience constants for the limits dictionary passed to Limiter().
@@ -51,8 +51,8 @@ class LimitsController(common.OpenstackController):
     _serialization_metadata = {
         "application/xml": {
             "attributes": {
-                "limit": ["verb", "URI", "regex", "value", "unit",
-                    "resetTime", "remaining", "name"],
+                "limit": ["verb", "URI", "uri", "regex", "value", "unit",
+                    "resetTime", "next-available", "remaining", "name"],
             },
             "plurals": {
                 "rate": "limit",
@@ -67,12 +67,21 @@ class LimitsController(common.OpenstackController):
         abs_limits = {}
         rate_limits = req.environ.get("nova.limits", [])
 
-        return {
-            "limits": {
-                "rate": rate_limits,
-                "absolute": abs_limits,
-            },
-        }
+        builder = self._get_view_builder(req)
+        return builder.build(rate_limits, abs_limits)
+
+    def _get_view_builder(self, req):
+        raise NotImplementedError()
+
+
+class LimitsControllerV10(LimitsController):
+    def _get_view_builder(self, req):
+        return limits_views.ViewBuilderV10()
+
+
+class LimitsControllerV11(LimitsController):
+    def _get_view_builder(self, req):
+        return limits_views.ViewBuilderV11()
 
 
 class Limit(object):
@@ -186,7 +195,7 @@ DEFAULT_LIMITS = [
 ]
 
 
-class RateLimitingMiddleware(Middleware):
+class RateLimitingMiddleware(wsgi.Middleware):
     """
     Rate-limits requests passing through this middleware. All limit information
     is stored in memory for this implementation.
@@ -200,7 +209,7 @@ class RateLimitingMiddleware(Middleware):
         @param application: WSGI application to wrap
         @param limits: List of dictionaries describing limits
         """
-        Middleware.__init__(self, application)
+        wsgi.Middleware.__init__(self, application)
         self._limiter = Limiter(limits or DEFAULT_LIMITS)
 
     @wsgify(RequestClass=wsgi.Request)
diff --git a/nova/api/openstack/server_metadata.py b/nova/api/openstack/server_metadata.py
index 5c1390b9c..fd64ee4fb 100644
--- a/nova/api/openstack/server_metadata.py
+++ b/nova/api/openstack/server_metadata.py
@@ -18,6 +18,7 @@
 from webob import exc
 
 from nova import compute
+from nova import quota
 from nova import wsgi
 from nova.api.openstack import common
 from nova.api.openstack import faults
@@ -44,10 +45,14 @@ class Controller(common.OpenstackController):
 
     def create(self, req, server_id):
         context = req.environ['nova.context']
-        body = self._deserialize(req.body, req.get_content_type())
-        self.compute_api.update_or_create_instance_metadata(context,
-                                                            server_id,
-                                                            body['metadata'])
+        data = self._deserialize(req.body, req.get_content_type())
+        metadata = data.get('metadata')
+        try:
+            self.compute_api.update_or_create_instance_metadata(context,
+                                                                server_id,
+                                                                metadata)
+        except quota.QuotaError as error:
+            self._handle_quota_error(error)
         return req.body
 
     def update(self, req, server_id, id):
@@ -59,9 +64,13 @@ class Controller(common.OpenstackController):
         if len(body) > 1:
             expl = _('Request body contains too many items')
             raise exc.HTTPBadRequest(explanation=expl)
-        self.compute_api.update_or_create_instance_metadata(context,
-                                                            server_id,
-                                                            body)
+        try:
+            self.compute_api.update_or_create_instance_metadata(context,
+                                                                server_id,
+                                                                body)
+        except quota.QuotaError as error:
+            self._handle_quota_error(error)
+
         return req.body
 
     def show(self, req, server_id, id):
@@ -77,3 +86,9 @@ class Controller(common.OpenstackController):
         """ Deletes an existing metadata """
         context = req.environ['nova.context']
         self.compute_api.delete_instance_metadata(context, server_id, id)
+
+    def _handle_quota_error(self, error):
+        """Reraise quota errors as api-specific http exceptions."""
+        if error.code == "MetadataLimitExceeded":
+            raise exc.HTTPBadRequest(explanation=error.message)
+        raise error
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index 43e0c7963..547310613 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -14,33 +14,30 @@
 #    under the License.
 
 import base64
-import hashlib
 import traceback
 
 from webob import exc
 from xml.dom import minidom
 
 from nova import compute
-from nova import context
 from nova import exception
 from nova import flags
 from nova import log as logging
 from nova import quota
 from nova import utils
-from nova import wsgi
 from nova.api.openstack import common
 from nova.api.openstack import faults
 import nova.api.openstack.views.addresses
 import nova.api.openstack.views.flavors
+import nova.api.openstack.views.images
 import nova.api.openstack.views.servers
 from nova.auth import manager as auth_manager
 from nova.compute import instance_types
-from nova.compute import power_state
 import nova.api.openstack
 from nova.scheduler import api as scheduler_api
 
 
-LOG = logging.getLogger('server')
+LOG = logging.getLogger('nova.api.openstack.servers')
 FLAGS = flags.FLAGS
 
 
@@ -118,6 +115,8 @@ class Controller(common.OpenstackController):
 
         context = req.environ['nova.context']
 
+        password = self._get_server_admin_password(env['server'])
+
         key_name = None
         key_data = None
         key_pairs = auth_manager.AuthManager.get_key_pairs(context)
@@ -127,21 +126,16 @@ class Controller(common.OpenstackController):
             key_data = key_pair['public_key']
 
         requested_image_id = self._image_id_from_req_data(env)
-        image_id = common.get_image_id_from_image_hash(self._image_service,
-            context, requested_image_id)
+        try:
+            image_id = common.get_image_id_from_image_hash(self._image_service,
+                context, requested_image_id)
+        except:
+            msg = _("Can not find requested image")
+            return faults.Fault(exc.HTTPBadRequest(msg))
+
         kernel_id, ramdisk_id = self._get_kernel_ramdisk_from_image(
             req, image_id)
 
-        # Metadata is a list, not a Dictionary, because we allow duplicate keys
-        # (even though JSON can't encode this)
-        # In future, we may not allow duplicate keys.
-        # However, the CloudServers API is not definitive on this front,
-        #  and we want to be compatible.
-        metadata = []
-        if env['server'].get('metadata'):
-            for k, v in env['server']['metadata'].items():
-                metadata.append({'key': k, 'value': v})
-
         personality = env['server'].get('personality')
         injected_files = []
         if personality:
@@ -170,7 +164,7 @@ class Controller(common.OpenstackController):
                 display_description=name,
                 key_name=key_name,
                 key_data=key_data,
-                metadata=metadata,
+                metadata=env['server'].get('metadata', {}),
                 injected_files=injected_files)
         except quota.QuotaError as error:
             self._handle_quota_error(error)
@@ -180,7 +174,6 @@ class Controller(common.OpenstackController):
 
         builder = self._get_view_builder(req)
         server = builder.build(inst, is_detail=True)
-        password = utils.generate_password(16)
         server['server']['adminPass'] = password
         self.compute_api.set_admin_password(context, server['server']['id'],
                                             password)
@@ -242,6 +235,10 @@ class Controller(common.OpenstackController):
         # if the original error is okay, just reraise it
         raise error
 
+    def _get_server_admin_password(self, server):
+        """ Determine the admin password for a server on creation """
+        return utils.generate_password(16)
+
     @scheduler_api.redirect_handler
     def update(self, req, id):
         """ Updates the server name or password """
@@ -320,9 +317,6 @@ class Controller(common.OpenstackController):
             return faults.Fault(exc.HTTPBadRequest())
         return exc.HTTPAccepted()
 
-    def _action_rebuild(self, input_dict, req, id):
-        return faults.Fault(exc.HTTPNotImplemented())
-
     def _action_resize(self, input_dict, req, id):
         """ Resizes a given instance to the flavor size requested """
         try:
@@ -336,18 +330,20 @@ class Controller(common.OpenstackController):
         except Exception, e:
             LOG.exception(_("Error in resize %s"), e)
             return faults.Fault(exc.HTTPBadRequest())
-        return faults.Fault(exc.HTTPAccepted())
+        return exc.HTTPAccepted()
 
     def _action_reboot(self, input_dict, req, id):
-        try:
+        if 'reboot' in input_dict and 'type' in input_dict['reboot']:
             reboot_type = input_dict['reboot']['type']
-        except Exception:
-            raise faults.Fault(exc.HTTPNotImplemented())
+        else:
+            LOG.exception(_("Missing argument 'type' for reboot"))
+            return faults.Fault(exc.HTTPUnprocessableEntity())
         try:
             # TODO(gundlach): pass reboot_type, support soft reboot in
             # virt driver
             self.compute_api.reboot(req.environ['nova.context'], id)
-        except:
+        except Exception, e:
+            LOG.exception(_("Error in reboot %s"), e)
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
@@ -561,9 +557,8 @@ class Controller(common.OpenstackController):
         """
         image_id = image_meta['id']
         if image_meta['status'] != 'active':
-            raise exception.Invalid(
-                _("Cannot build from image %(image_id)s, status not active") %
-                  locals())
+            raise exception.ImageUnacceptable(image_id=image_id,
+                                              reason=_("status is not active"))
 
         if image_meta.get('container_format') != 'ami':
             return None, None
@@ -571,14 +566,12 @@ class Controller(common.OpenstackController):
         try:
             kernel_id = image_meta['properties']['kernel_id']
         except KeyError:
-            raise exception.NotFound(
-                _("Kernel not found for image %(image_id)s") % locals())
+            raise exception.KernelNotFoundForImage(image_id=image_id)
 
         try:
             ramdisk_id = image_meta['properties']['ramdisk_id']
         except KeyError:
-            raise exception.NotFound(
-                _("Ramdisk not found for image %(image_id)s") % locals())
+            raise exception.RamdiskNotFoundForImage(image_id=image_id)
 
         return kernel_id, ramdisk_id
 
@@ -595,19 +588,35 @@ class ControllerV10(Controller):
         return nova.api.openstack.views.servers.ViewBuilderV10(
             addresses_builder)
 
-    def _get_addresses_view_builder(self, req):
-        return nova.api.openstack.views.addresses.ViewBuilderV10(req)
-
     def _limit_items(self, items, req):
         return common.limited(items, req)
 
     def _parse_update(self, context, server_id, inst_dict, update_dict):
         if 'adminPass' in inst_dict['server']:
             update_dict['admin_pass'] = inst_dict['server']['adminPass']
-            try:
-                self.compute_api.set_admin_password(context, server_id)
-            except exception.TimeoutException:
-                return exc.HTTPRequestTimeout()
+            self.compute_api.set_admin_password(context, server_id)
+
+    def _action_rebuild(self, info, request, instance_id):
+        context = request.environ['nova.context']
+        instance_id = int(instance_id)
+
+        try:
+            image_id = info["rebuild"]["imageId"]
+        except (KeyError, TypeError):
+            msg = _("Could not parse imageId from request.")
+            LOG.debug(msg)
+            return faults.Fault(exc.HTTPBadRequest(explanation=msg))
+
+        try:
+            self.compute_api.rebuild(context, instance_id, image_id)
+        except exception.BuildInProgress:
+            msg = _("Instance %d is currently being rebuilt.") % instance_id
+            LOG.debug(msg)
+            return faults.Fault(exc.HTTPConflict(explanation=msg))
+
+        response = exc.HTTPAccepted()
+        response.empty_body = True
+        return response
 
 
 class ControllerV11(Controller):
@@ -629,9 +638,6 @@ class ControllerV11(Controller):
         return nova.api.openstack.views.servers.ViewBuilderV11(
             addresses_builder, flavor_builder, image_builder, base_url)
 
-    def _get_addresses_view_builder(self, req):
-        return nova.api.openstack.views.addresses.ViewBuilderV11(req)
-
     def _action_change_password(self, input_dict, req, id):
         context = req.environ['nova.context']
         if (not 'changePassword' in input_dict
@@ -648,6 +654,73 @@ class ControllerV11(Controller):
     def _limit_items(self, items, req):
         return common.limited_by_marker(items, req)
 
+    def _validate_metadata(self, metadata):
+        """Ensure that we can work with the metadata given."""
+        try:
+            metadata.iteritems()
+        except AttributeError as ex:
+            msg = _("Unable to parse metadata key/value pairs.")
+            LOG.debug(msg)
+            raise faults.Fault(exc.HTTPBadRequest(explanation=msg))
+
+    def _decode_personalities(self, personalities):
+        """Decode the Base64-encoded personalities."""
+        for personality in personalities:
+            try:
+                path = personality["path"]
+                contents = personality["contents"]
+            except (KeyError, TypeError):
+                msg = _("Unable to parse personality path/contents.")
+                LOG.info(msg)
+                raise faults.Fault(exc.HTTPBadRequest(explanation=msg))
+
+            try:
+                personality["contents"] = base64.b64decode(contents)
+            except TypeError:
+                msg = _("Personality content could not be Base64 decoded.")
+                LOG.info(msg)
+                raise faults.Fault(exc.HTTPBadRequest(explanation=msg))
+
+    def _action_rebuild(self, info, request, instance_id):
+        context = request.environ['nova.context']
+        instance_id = int(instance_id)
+
+        try:
+            image_ref = info["rebuild"]["imageRef"]
+        except (KeyError, TypeError):
+            msg = _("Could not parse imageRef from request.")
+            LOG.debug(msg)
+            return faults.Fault(exc.HTTPBadRequest(explanation=msg))
+
+        image_id = common.get_id_from_href(image_ref)
+        personalities = info["rebuild"].get("personality", [])
+        metadata = info["rebuild"].get("metadata", {})
+
+        self._validate_metadata(metadata)
+        self._decode_personalities(personalities)
+
+        try:
+            self.compute_api.rebuild(context, instance_id, image_id, metadata,
+                                     personalities)
+        except exception.BuildInProgress:
+            msg = _("Instance %d is currently being rebuilt.") % instance_id
+            LOG.debug(msg)
+            return faults.Fault(exc.HTTPConflict(explanation=msg))
+
+        response = exc.HTTPAccepted()
+        response.empty_body = True
+        return response
+
+    def _get_server_admin_password(self, server):
+        """ Determine the admin password for a server on creation """
+        password = server.get('adminPass')
+        if password is None:
+            return utils.generate_password(16)
+        if not isinstance(password, basestring) or password == '':
+            msg = _("Invalid adminPass")
+            raise exc.HTTPBadRequest(msg)
+        return password
+
     def get_default_xmlns(self, req):
         return common.XML_NS_V11
 
diff --git a/nova/api/openstack/users.py b/nova/api/openstack/users.py
index 077ccfc79..7ae4c3232 100644
--- a/nova/api/openstack/users.py
+++ b/nova/api/openstack/users.py
@@ -48,7 +48,7 @@ class Controller(common.OpenstackController):
         """We cannot depend on the db layer to check for admin access
            for the auth manager, so we do it here"""
         if not context.is_admin:
-            raise exception.NotAuthorized(_("Not admin user"))
+            raise exception.AdminRequired()
 
     def index(self, req):
         """Return all users in brief"""
diff --git a/nova/api/openstack/views/images.py b/nova/api/openstack/views/images.py
index 9dec8a355..2773c9c13 100644
--- a/nova/api/openstack/views/images.py
+++ b/nova/api/openstack/views/images.py
@@ -46,6 +46,14 @@ class ViewBuilder(object):
         except KeyError:
             image['status'] = image['status'].upper()
 
+    def _build_server(self, image, instance_id):
+        """Indicates that you must use a ViewBuilder subclass."""
+        raise NotImplementedError
+
+    def generate_server_ref(self, server_id):
+        """Return an href string pointing to this server."""
+        return os.path.join(self._url, "servers", str(server_id))
+
     def generate_href(self, image_id):
         """Return an href string pointing to this object."""
         return os.path.join(self._url, "images", str(image_id))
@@ -66,7 +74,7 @@ class ViewBuilder(object):
 
         if "instance_id" in properties:
             try:
-                image["serverId"] = int(properties["instance_id"])
+                self._build_server(image, int(properties["instance_id"]))
             except ValueError:
                 pass
 
@@ -85,12 +93,17 @@ class ViewBuilder(object):
 
 class ViewBuilderV10(ViewBuilder):
     """OpenStack API v1.0 Image Builder"""
-    pass
+
+    def _build_server(self, image, instance_id):
+        image["serverId"] = instance_id
 
 
 class ViewBuilderV11(ViewBuilder):
     """OpenStack API v1.1 Image Builder"""
 
+    def _build_server(self, image, instance_id):
+        image["serverRef"] = self.generate_server_ref(instance_id)
+
     def build(self, image_obj, detail=False):
         """Return a standardized image structure for display by the API."""
         image = ViewBuilder.build(self, image_obj, detail)
diff --git a/nova/api/openstack/views/limits.py b/nova/api/openstack/views/limits.py
new file mode 100644
index 000000000..552db39ee
--- /dev/null
+++ b/nova/api/openstack/views/limits.py
@@ -0,0 +1,100 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import time
+
+from nova.api.openstack import common
+
+
+class ViewBuilder(object):
+    """Openstack API base limits view builder."""
+
+    def build(self, rate_limits, absolute_limits):
+        rate_limits = self._build_rate_limits(rate_limits)
+        absolute_limits = self._build_absolute_limits(absolute_limits)
+
+        output = {
+            "limits": {
+                "rate": rate_limits,
+                "absolute": absolute_limits,
+            },
+        }
+
+        return output
+
+
+class ViewBuilderV10(ViewBuilder):
+    """Openstack API v1.0 limits view builder."""
+
+    def _build_rate_limits(self, rate_limits):
+        return [self._build_rate_limit(r) for r in rate_limits]
+
+    def _build_rate_limit(self, rate_limit):
+        return {
+            "verb": rate_limit["verb"],
+            "URI": rate_limit["URI"],
+            "regex": rate_limit["regex"],
+            "value": rate_limit["value"],
+            "remaining": int(rate_limit["remaining"]),
+            "unit": rate_limit["unit"],
+            "resetTime": rate_limit["resetTime"],
+        }
+
+    def _build_absolute_limits(self, absolute_limit):
+        return {}
+
+
+class ViewBuilderV11(ViewBuilder):
+    """Openstack API v1.1 limits view builder."""
+
+    def _build_rate_limits(self, rate_limits):
+        limits = []
+        for rate_limit in rate_limits:
+            _rate_limit_key = None
+            _rate_limit = self._build_rate_limit(rate_limit)
+
+            # check for existing key
+            for limit in limits:
+                if limit["uri"] == rate_limit["URI"] and \
+                   limit["regex"] == limit["regex"]:
+                    _rate_limit_key = limit
+                    break
+
+            # ensure we have a key if we didn't find one
+            if not _rate_limit_key:
+                _rate_limit_key = {
+                    "uri": rate_limit["URI"],
+                    "regex": rate_limit["regex"],
+                    "limit": [],
+                }
+                limits.append(_rate_limit_key)
+
+            _rate_limit_key["limit"].append(_rate_limit)
+
+        return limits
+
+    def _build_rate_limit(self, rate_limit):
+        return {
+            "verb": rate_limit["verb"],
+            "value": rate_limit["value"],
+            "remaining": int(rate_limit["remaining"]),
+            "unit": rate_limit["unit"],
+            "next-available": rate_limit["resetTime"],
+        }
+
+    def _build_absolute_limits(self, absolute_limit):
+        return {}
diff --git a/nova/api/openstack/views/servers.py b/nova/api/openstack/views/servers.py
index e52bfaea3..0be468edc 100644
--- a/nova/api/openstack/views/servers.py
+++ b/nova/api/openstack/views/servers.py
@@ -63,10 +63,12 @@ class ViewBuilder(object):
             power_state.BLOCKED: 'ACTIVE',
             power_state.SUSPENDED: 'SUSPENDED',
             power_state.PAUSED: 'PAUSED',
-            power_state.SHUTDOWN: 'ACTIVE',
-            power_state.SHUTOFF: 'ACTIVE',
+            power_state.SHUTDOWN: 'SHUTDOWN',
+            power_state.SHUTOFF: 'SHUTOFF',
             power_state.CRASHED: 'ERROR',
-            power_state.FAILED: 'ERROR'}
+            power_state.FAILED: 'ERROR',
+            power_state.BUILDING: 'BUILD',
+        }
 
         inst_dict = {
             'id': int(inst['id']),