Merge trunk.

27 files changed, 790 insertions, 227 deletions

diff --git a/nova/api/__init__.py b/nova/api/__init__.py
index 0fedbbfad..747015af5 100644
--- a/nova/api/__init__.py
+++ b/nova/api/__init__.py
@@ -15,5 +15,3 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
-
-"""No-op __init__ for directory full of api goodies."""
diff --git a/nova/api/direct.py b/nova/api/direct.py
index f487df7c7..8ceae299c 100644
--- a/nova/api/direct.py
+++ b/nova/api/direct.py
@@ -44,14 +44,33 @@ from nova import utils
 from nova import wsgi
 
 
+# Global storage for registering modules.
 ROUTES = {}
 
 
 def register_service(path, handle):
+    """Register a service handle at a given path.
+
+    Services registered in this way will be made available to any instances of
+    nova.api.direct.Router.
+
+    :param path: `routes` path, can be a basic string like "/path"
+    :param handle: an object whose methods will be made available via the api
+
+    """
     ROUTES[path] = handle
 
 
 class Router(wsgi.Router):
+    """A simple WSGI router configured via `register_service`.
+
+    This is a quick way to attach multiple services to a given endpoint.
+    It will automatically load the routes registered in the `ROUTES` global.
+
+    TODO(termie): provide a paste-deploy version of this.
+
+    """
+
     def __init__(self, mapper=None):
         if mapper is None:
             mapper = routes.Mapper()
@@ -66,6 +85,24 @@ class Router(wsgi.Router):
 
 
 class DelegatedAuthMiddleware(wsgi.Middleware):
+    """A simple and naive authentication middleware.
+
+    Designed mostly to provide basic support for alternative authentication
+    schemes, this middleware only desires the identity of the user and will
+    generate the appropriate nova.context.RequestContext for the rest of the
+    application. This allows any middleware above it in the stack to
+    authenticate however it would like while only needing to conform to a
+    minimal interface.
+
+    Expects two headers to determine identity:
+     - X-OpenStack-User
+     - X-OpenStack-Project
+
+    This middleware is tied to identity management and will need to be kept
+    in sync with any changes to the way identity is dealt with internally.
+
+    """
+
     def process_request(self, request):
         os_user = request.headers['X-OpenStack-User']
         os_project = request.headers['X-OpenStack-Project']
@@ -74,6 +111,20 @@ class DelegatedAuthMiddleware(wsgi.Middleware):
 
 
 class JsonParamsMiddleware(wsgi.Middleware):
+    """Middleware to allow method arguments to be passed as serialized JSON.
+
+    Accepting arguments as JSON is useful for accepting data that may be more
+    complex than simple primitives.
+
+    In this case we accept it as urlencoded data under the key 'json' as in
+    json=<urlencoded_json> but this could be extended to accept raw JSON
+    in the POST body.
+
+    Filters out the parameters `self`, `context` and anything beginning with
+    an underscore.
+
+    """
+
     def process_request(self, request):
         if 'json' not in request.params:
             return
@@ -92,6 +143,13 @@ class JsonParamsMiddleware(wsgi.Middleware):
 
 
 class PostParamsMiddleware(wsgi.Middleware):
+    """Middleware to allow method arguments to be passed as POST parameters.
+
+    Filters out the parameters `self`, `context` and anything beginning with
+    an underscore.
+
+    """
+
     def process_request(self, request):
         params_parsed = request.params
         params = {}
@@ -106,12 +164,21 @@ class PostParamsMiddleware(wsgi.Middleware):
 
 
 class Reflection(object):
-    """Reflection methods to list available methods."""
+    """Reflection methods to list available methods.
+
+    This is an object that expects to be registered via register_service.
+    These methods allow the endpoint to be self-describing. They introspect
+    the exposed methods and provide call signatures and documentation for
+    them allowing quick experimentation.
+
+    """
+
     def __init__(self):
         self._methods = {}
         self._controllers = {}
 
     def _gather_methods(self):
+        """Introspect available methods and generate documentation for them."""
         methods = {}
         controllers = {}
         for route, handler in ROUTES.iteritems():
@@ -185,6 +252,16 @@ class Reflection(object):
 
 
 class ServiceWrapper(wsgi.Controller):
+    """Wrapper to dynamically povide a WSGI controller for arbitrary objects.
+
+    With lightweight introspection allows public methods on the object to
+    be accesed via simple WSGI routing and parameters and serializes the
+    return values.
+
+    Automatically used be nova.api.direct.Router to wrap registered instances.
+
+    """
+
     def __init__(self, service_handle):
         self.service_handle = service_handle
 
@@ -260,7 +337,16 @@ class Limited(object):
 
 
 class Proxy(object):
-    """Pretend a Direct API endpoint is an object."""
+    """Pretend a Direct API endpoint is an object.
+
+    This is mostly useful in testing at the moment though it should be easily
+    extendable to provide a basic API library functionality.
+
+    In testing we use this to stub out internal objects to verify that results
+    from the API are serializable.
+
+    """
+
     def __init__(self, app, prefix=None):
         self.app = app
         self.prefix = prefix
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index a3c3b25a1..c13993dd3 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -46,8 +46,6 @@ flags.DEFINE_integer('lockout_minutes', 15,
                      'Number of minutes to lockout if triggered.')
 flags.DEFINE_integer('lockout_window', 15,
                      'Number of minutes for lockout window.')
-flags.DEFINE_list('lockout_memcached_servers', None,
-                  'Memcached servers or None for in process cache.')
 
 
 class RequestLogging(wsgi.Middleware):
@@ -107,11 +105,11 @@ class Lockout(wsgi.Middleware):
 
     def __init__(self, application):
         """middleware can use fake for testing."""
-        if FLAGS.lockout_memcached_servers:
+        if FLAGS.memcached_servers:
             import memcache
         else:
             from nova import fakememcache as memcache
-        self.mc = memcache.Client(FLAGS.lockout_memcached_servers,
+        self.mc = memcache.Client(FLAGS.memcached_servers,
                                   debug=0)
         super(Lockout, self).__init__(application)
 
@@ -322,9 +320,7 @@ class Executor(wsgi.Application):
         except exception.InstanceNotFound as ex:
             LOG.info(_('InstanceNotFound raised: %s'), unicode(ex),
                      context=context)
-            ec2_id = ec2utils.id_to_ec2_id(ex.instance_id)
-            message = _('Instance %s not found') % ec2_id
-            return self._error(req, context, type(ex).__name__, message)
+            return self._error(req, context, type(ex).__name__, ex.message)
         except exception.VolumeNotFound as ex:
             LOG.info(_('VolumeNotFound raised: %s'), unicode(ex),
                      context=context)
@@ -342,6 +338,10 @@ class Executor(wsgi.Application):
             else:
                 return self._error(req, context, type(ex).__name__,
                                    unicode(ex))
+        except exception.KeyPairExists as ex:
+            LOG.debug(_('KeyPairExists raised: %s'), unicode(ex),
+                     context=context)
+            return self._error(req, context, type(ex).__name__, unicode(ex))
         except Exception as ex:
             extra = {'environment': req.environ}
             LOG.exception(_('Unexpected error raised: %s'), unicode(ex),
diff --git a/nova/api/ec2/admin.py b/nova/api/ec2/admin.py
index c0c2bcd0d..0d08aba7a 100644
--- a/nova/api/ec2/admin.py
+++ b/nova/api/ec2/admin.py
@@ -272,7 +272,7 @@ class AdminController(object):
     def _vpn_for(self, context, project_id):
         """Get the VPN instance for a project ID."""
         for instance in db.instance_get_all_by_project(context, project_id):
-            if (instance['image_id'] == FLAGS.vpn_image_id
+            if (instance['image_id'] == str(FLAGS.vpn_image_id)
                 and not instance['state_description'] in
                     ['shutting_down', 'shutdown']):
                 return instance
diff --git a/nova/api/ec2/apirequest.py b/nova/api/ec2/apirequest.py
index d7ad08d2f..6672e60bb 100644
--- a/nova/api/ec2/apirequest.py
+++ b/nova/api/ec2/apirequest.py
@@ -196,7 +196,7 @@ class APIRequest(object):
         elif isinstance(data, datetime.datetime):
             data_el.appendChild(
                   xml.createTextNode(_database_to_isoformat(data)))
-        elif data != None:
+        elif data is not None:
             data_el.appendChild(xml.createTextNode(str(data)))
 
         return data_el
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index 58effd134..c35b6024e 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -27,6 +27,8 @@ import datetime
 import IPy
 import os
 import urllib
+import tempfile
+import shutil
 
 from nova import compute
 from nova import context
@@ -35,6 +37,7 @@ from nova import crypto
 from nova import db
 from nova import exception
 from nova import flags
+from nova import ipv6
 from nova import log as logging
 from nova import network
 from nova import utils
@@ -49,8 +52,6 @@ flags.DECLARE('service_down_time', 'nova.scheduler.driver')
 
 LOG = logging.getLogger("nova.api.cloud")
 
-InvalidInputException = exception.InvalidInputException
-
 
 def _gen_key(context, user_id, key_name):
     """Generate a key
@@ -61,8 +62,7 @@ def _gen_key(context, user_id, key_name):
     #             creation before creating key_pair
     try:
         db.key_pair_get(context, user_id, key_name)
-        raise exception.Duplicate(_("The key_pair %s already exists")
-                                  % key_name)
+        raise exception.KeyPairExists(key_name=key_name)
     except exception.NotFound:
         pass
     private_key, public_key, fingerprint = crypto.generate_key_pair()
@@ -142,6 +142,11 @@ class CloudController(object):
         instance_ref = self.compute_api.get_all(ctxt, fixed_ip=address)
         if instance_ref is None:
             return None
+
+        # This ensures that all attributes of the instance
+        # are populated.
+        instance_ref = db.instance_get(ctxt, instance_ref['id'])
+
         mpi = self._get_mpi_data(ctxt, instance_ref['project_id'])
         if instance_ref['key_name']:
             keys = {'0': {'_name': instance_ref['key_name'],
@@ -154,7 +159,7 @@ class CloudController(object):
         floating_ip = db.instance_get_floating_address(ctxt,
                                                        instance_ref['id'])
         ec2_id = ec2utils.id_to_ec2_id(instance_ref['id'])
-        image_ec2_id = self._image_ec2_id(instance_ref['image_id'], 'machine')
+        image_ec2_id = self.image_ec2_id(instance_ref['image_id'])
         data = {
             'user-data': base64.b64decode(instance_ref['user_data']),
             'meta-data': {
@@ -182,9 +187,9 @@ class CloudController(object):
                 'mpi': mpi}}
 
         for image_type in ['kernel', 'ramdisk']:
-            if '%s_id' % image_type in instance_ref:
-                ec2_id = self._image_ec2_id(instance_ref['%s_id' % image_type],
-                                            image_type)
+            if instance_ref.get('%s_id' % image_type):
+                ec2_id = self.image_ec2_id(instance_ref['%s_id' % image_type],
+                                           self._image_type(image_type))
                 data['meta-data']['%s-id' % image_type] = ec2_id
 
         if False:  # TODO(vish): store ancestor ids
@@ -313,6 +318,27 @@ class CloudController(object):
                 'keyMaterial': data['private_key']}
         # TODO(vish): when context is no longer an object, pass it here
 
+    def import_public_key(self, context, key_name, public_key,
+                         fingerprint=None):
+        LOG.audit(_("Import key %s"), key_name, context=context)
+        key = {}
+        key['user_id'] = context.user_id
+        key['name'] = key_name
+        key['public_key'] = public_key
+        if fingerprint is None:
+            tmpdir = tempfile.mkdtemp()
+            pubfile = os.path.join(tmpdir, 'temp.pub')
+            fh = open(pubfile, 'w')
+            fh.write(public_key)
+            fh.close()
+            (out, err) = utils.execute('ssh-keygen', '-q', '-l', '-f',
+                                       '%s' % (pubfile))
+            fingerprint = out.split(' ')[1]
+            shutil.rmtree(tmpdir)
+        key['fingerprint'] = fingerprint
+        db.key_pair_create(context, key)
+        return True
+
     def delete_key_pair(self, context, key_name, **kwargs):
         LOG.audit(_("Delete key pair %s"), key_name, context=context)
         try:
@@ -394,11 +420,11 @@ class CloudController(object):
             ip_protocol = str(ip_protocol)
 
             if ip_protocol.upper() not in ['TCP', 'UDP', 'ICMP']:
-                raise InvalidInputException(_('%s is not a valid ipProtocol') %
-                                            (ip_protocol,))
+                raise exception.InvalidIpProtocol(protocol=ip_protocol)
             if ((min(from_port, to_port) < -1) or
                 (max(from_port, to_port) > 65535)):
-                raise InvalidInputException(_('Invalid port range'))
+                raise exception.InvalidPortRange(from_port=from_port,
+                                                 to_port=to_port)
 
             values['protocol'] = ip_protocol
             values['from_port'] = from_port
@@ -437,7 +463,7 @@ class CloudController(object):
                                                        group_name)
 
         criteria = self._revoke_rule_args_to_dict(context, **kwargs)
-        if criteria == None:
+        if criteria is None:
             raise exception.ApiError(_("Not enough parameters to build a "
                                        "valid rule."))
 
@@ -608,7 +634,7 @@ class CloudController(object):
         # TODO(vish): Instance should be None at db layer instead of
         #             trying to lazy load, but for now we turn it into
         #             a dict to avoid an error.
-        return {'volumeSet': [self._format_volume(context, dict(volume))]}
+        return self._format_volume(context, dict(volume))
 
     def delete_volume(self, context, volume_id, **kwargs):
         volume_id = ec2utils.ec2_id_to_id(volume_id)
@@ -659,7 +685,7 @@ class CloudController(object):
                 'volumeId': ec2utils.id_to_ec2_id(volume_id, 'vol-%08x')}
 
     def _convert_to_set(self, lst, label):
-        if lst == None or lst == []:
+        if lst is None or lst == []:
             return None
         if not isinstance(lst, list):
             lst = [lst]
@@ -698,13 +724,13 @@ class CloudController(object):
             instances = self.compute_api.get_all(context, **kwargs)
         for instance in instances:
             if not context.is_admin:
-                if instance['image_id'] == FLAGS.vpn_image_id:
+                if instance['image_id'] == str(FLAGS.vpn_image_id):
                     continue
             i = {}
             instance_id = instance['id']
             ec2_id = ec2utils.id_to_ec2_id(instance_id)
             i['instanceId'] = ec2_id
-            i['imageId'] = self._image_ec2_id(instance['image_id'])
+            i['imageId'] = self.image_ec2_id(instance['image_id'])
             i['instanceState'] = {
                 'code': instance['state'],
                 'name': instance['state_description']}
@@ -716,12 +742,15 @@ class CloudController(object):
                     fixed = instance['fixed_ip']
                     floating_addr = fixed['floating_ips'][0]['address']
                 if instance['fixed_ip']['network'] and 'use_v6' in kwargs:
-                    i['dnsNameV6'] = utils.to_global_ipv6(
+                    i['dnsNameV6'] = ipv6.to_global(
                         instance['fixed_ip']['network']['cidr_v6'],
-                        instance['mac_address'])
+                        instance['mac_address'],
+                        instance['project_id'])
 
             i['privateDnsName'] = fixed_addr
+            i['privateIpAddress'] = fixed_addr
             i['publicDnsName'] = floating_addr
+            i['ipAddress'] = floating_addr or fixed_addr
             i['dnsName'] = i['publicDnsName'] or i['privateDnsName']
             i['keyName'] = instance['key_name']
 
@@ -730,7 +759,10 @@ class CloudController(object):
                     instance['project_id'],
                     instance['host'])
             i['productCodesSet'] = self._convert_to_set([], 'product_codes')
-            i['instanceType'] = instance['instance_type']
+            if instance['instance_type']:
+                i['instanceType'] = instance['instance_type'].get('name')
+            else:
+                i['instanceType'] = None
             i['launchTime'] = instance['created_at']
             i['amiLaunchIndex'] = instance['launch_index']
             i['displayName'] = instance['display_name']
@@ -785,7 +817,7 @@ class CloudController(object):
     def allocate_address(self, context, **kwargs):
         LOG.audit(_("Allocate address"), context=context)
         public_ip = self.network_api.allocate_floating_ip(context)
-        return {'addressSet': [{'publicIp': public_ip}]}
+        return {'publicIp': public_ip}
 
     def release_address(self, context, public_ip, **kwargs):
         LOG.audit(_("Release address %s"), public_ip, context=context)
@@ -815,7 +847,7 @@ class CloudController(object):
             ramdisk = self._get_image(context, kwargs['ramdisk_id'])
             kwargs['ramdisk_id'] = ramdisk['id']
         instances = self.compute_api.create(context,
-            instance_type=instance_types.get_by_type(
+            instance_type=instance_types.get_instance_type_by_name(
                 kwargs.get('instance_type', None)),
             image_id=self._get_image(context, kwargs['image_id'])['id'],
             min_count=int(kwargs.get('min_count', max_count)),
@@ -872,46 +904,70 @@ class CloudController(object):
             self.compute_api.update(context, instance_id=instance_id, **kwargs)
         return True
 
-    _type_prefix_map = {'machine': 'ami',
-                        'kernel': 'aki',
-                        'ramdisk': 'ari'}
+    @staticmethod
+    def _image_type(image_type):
+        """Converts to a three letter image type.
+
+        aki, kernel => aki
+        ari, ramdisk => ari
+        anything else => ami
 
-    def _image_ec2_id(self, image_id, image_type='machine'):
-        prefix = self._type_prefix_map[image_type]
-        template = prefix + '-%08x'
+        """
+        if image_type == 'kernel':
+            return 'aki'
+        if image_type == 'ramdisk':
+            return 'ari'
+        if image_type not in ['aki', 'ari']:
+            return 'ami'
+        return image_type
+
+    @staticmethod
+    def image_ec2_id(image_id, image_type='ami'):
+        """Returns image ec2_id using id and three letter type."""
+        template = image_type + '-%08x'
         return ec2utils.id_to_ec2_id(int(image_id), template=template)
 
     def _get_image(self, context, ec2_id):
         try:
             internal_id = ec2utils.ec2_id_to_id(ec2_id)
             return self.image_service.show(context, internal_id)
-        except exception.NotFound:
-            return self.image_service.show_by_name(context, ec2_id)
+        except (exception.InvalidEc2Id, exception.ImageNotFound):
+            try:
+                return self.image_service.show_by_name(context, ec2_id)
+            except exception.NotFound:
+                raise exception.ImageNotFound(image_id=ec2_id)
 
     def _format_image(self, image):
         """Convert from format defined by BaseImageService to S3 format."""
         i = {}
-        image_type = image['properties'].get('type')
-        ec2_id = self._image_ec2_id(image.get('id'), image_type)
+        image_type = self._image_type(image.get('container_format'))
+        ec2_id = self.image_ec2_id(image.get('id'), image_type)
         name = image.get('name')
         i['imageId'] = ec2_id
         kernel_id = image['properties'].get('kernel_id')
         if kernel_id:
-            i['kernelId'] = self._image_ec2_id(kernel_id, 'kernel')
+            i['kernelId'] = self.image_ec2_id(kernel_id, 'aki')
         ramdisk_id = image['properties'].get('ramdisk_id')
         if ramdisk_id:
-            i['ramdiskId'] = self._image_ec2_id(ramdisk_id, 'ramdisk')
+            i['ramdiskId'] = self.image_ec2_id(ramdisk_id, 'ari')
         i['imageOwnerId'] = image['properties'].get('owner_id')
         if name:
             i['imageLocation'] = "%s (%s)" % (image['properties'].
                                               get('image_location'), name)
         else:
             i['imageLocation'] = image['properties'].get('image_location')
-        i['imageState'] = image['properties'].get('image_state')
+        # NOTE(vish): fallback status if image_state isn't set
+        state = image.get('status')
+        if state == 'active':
+            state = 'available'
+        i['imageState'] = image['properties'].get('image_state', state)
         i['displayName'] = name
         i['description'] = image.get('description')
-        i['imageType'] = image_type
-        i['isPublic'] = str(image['properties'].get('is_public', '')) == 'True'
+        display_mapping = {'aki': 'kernel',
+                           'ari': 'ramdisk',
+                           'ami': 'machine'}
+        i['imageType'] = display_mapping.get(image_type)
+        i['isPublic'] = image.get('is_public') == True
         i['architecture'] = image['properties'].get('architecture')
         return i
 
@@ -923,8 +979,7 @@ class CloudController(object):
                 try:
                     image = self._get_image(context, ec2_id)
                 except exception.NotFound:
-                    raise exception.NotFound(_('Image %s not found') %
-                                             ec2_id)
+                    raise exception.ImageNotFound(image_id=ec2_id)
                 images.append(image)
         else:
             images = self.image_service.detail(context)
@@ -943,8 +998,9 @@ class CloudController(object):
             image_location = kwargs['name']
         metadata = {'properties': {'image_location': image_location}}
         image = self.image_service.create(context, metadata)
-        image_id = self._image_ec2_id(image['id'],
-                                      image['properties']['type'])
+        image_type = self._image_type(image.get('container_format'))
+        image_id = self.image_ec2_id(image['id'],
+                                     image_type)
         msg = _("Registered image %(image_location)s with"
                 " id %(image_id)s") % locals()
         LOG.audit(msg, context=context)
@@ -957,9 +1013,9 @@ class CloudController(object):
         try:
             image = self._get_image(context, image_id)
         except exception.NotFound:
-            raise exception.NotFound(_('Image %s not found') % image_id)
+            raise exception.ImageNotFound(image_id=image_id)
         result = {'imageId': image_id, 'launchPermission': []}
-        if image['properties']['is_public']:
+        if image['is_public']:
             result['launchPermission'].append({'group': 'all'})
         return result
 
@@ -980,11 +1036,11 @@ class CloudController(object):
         try:
             image = self._get_image(context, image_id)
         except exception.NotFound:
-            raise exception.NotFound(_('Image %s not found') % image_id)
+            raise exception.ImageNotFound(image_id=image_id)
         internal_id = image['id']
         del(image['id'])
 
-        image['properties']['is_public'] = (operation_type == 'add')
+        image['is_public'] = (operation_type == 'add')
         return self.image_service.update(context, internal_id, image)
 
     def update_image(self, context, image_id, **kwargs):
diff --git a/nova/api/ec2/ec2utils.py b/nova/api/ec2/ec2utils.py
index 3b34f6ea5..163aa4ed2 100644
--- a/nova/api/ec2/ec2utils.py
+++ b/nova/api/ec2/ec2utils.py
@@ -24,7 +24,7 @@ def ec2_id_to_id(ec2_id):
     try:
         return int(ec2_id.split('-')[-1], 16)
     except ValueError:
-        raise exception.NotFound(_("Id %s Not Found") % ec2_id)
+        raise exception.InvalidEc2Id(ec2_id=ec2_id)
 
 
 def id_to_ec2_id(instance_id, template='i-%08x'):
diff --git a/nova/api/openstack/__init__.py b/nova/api/openstack/__init__.py
index 7545eb0c9..5b7f080ad 100644
--- a/nova/api/openstack/__init__.py
+++ b/nova/api/openstack/__init__.py
@@ -34,6 +34,7 @@ from nova.api.openstack import consoles
 from nova.api.openstack import flavors
 from nova.api.openstack import images
 from nova.api.openstack import image_metadata
+from nova.api.openstack import ips
 from nova.api.openstack import limits
 from nova.api.openstack import servers
 from nova.api.openstack import server_metadata
@@ -97,7 +98,8 @@ class APIRouter(wsgi.Router):
             server_members['inject_network_info'] = 'POST'
 
             mapper.resource("zone", "zones", controller=zones.Controller(),
-                        collection={'detail': 'GET', 'info': 'GET'}),
+                        collection={'detail': 'GET', 'info': 'GET',
+                                    'select': 'GET'})
 
             mapper.resource("user", "users", controller=users.Controller(),
                         collection={'detail': 'GET'})
@@ -111,9 +113,6 @@ class APIRouter(wsgi.Router):
                         parent_resource=dict(member_name='server',
                         collection_name='servers'))
 
-        _limits = limits.LimitsController()
-        mapper.resource("limit", "limits", controller=_limits)
-
         super(APIRouter, self).__init__(mapper)
 
 
@@ -144,6 +143,14 @@ class APIRouterV10(APIRouter):
                         parent_resource=dict(member_name='server',
                         collection_name='servers'))
 
+        mapper.resource("limit", "limits",
+                        controller=limits.LimitsControllerV10())
+
+        mapper.resource("ip", "ips", controller=ips.Controller(),
+                        collection=dict(public='GET', private='GET'),
+                        parent_resource=dict(member_name='server',
+                                             collection_name='servers'))
+
 
 class APIRouterV11(APIRouter):
     """Define routes specific to OpenStack API V1.1."""
@@ -172,3 +179,6 @@ class APIRouterV11(APIRouter):
         mapper.resource("flavor", "flavors",
                         controller=flavors.ControllerV11(),
                         collection={'detail': 'GET'})
+
+        mapper.resource("limit", "limits",
+                        controller=limits.LimitsControllerV11())
diff --git a/nova/api/openstack/accounts.py b/nova/api/openstack/accounts.py
index 6e3763e47..00fdd4540 100644
--- a/nova/api/openstack/accounts.py
+++ b/nova/api/openstack/accounts.py
@@ -48,7 +48,7 @@ class Controller(common.OpenstackController):
         """We cannot depend on the db layer to check for admin access
            for the auth manager, so we do it here"""
         if not context.is_admin:
-            raise exception.NotAuthorized(_("Not admin user."))
+            raise exception.AdminRequired()
 
     def index(self, req):
         raise faults.Fault(webob.exc.HTTPNotImplemented())
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index f3a9bdeca..6c6ee22a2 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -17,7 +17,6 @@
 
 import datetime
 import hashlib
-import json
 import time
 
 import webob.exc
@@ -25,11 +24,9 @@ import webob.dec
 
 from nova import auth
 from nova import context
-from nova import db
 from nova import exception
 from nova import flags
 from nova import log as logging
-from nova import manager
 from nova import utils
 from nova import wsgi
 from nova.api.openstack import faults
@@ -55,6 +52,9 @@ class AuthMiddleware(wsgi.Middleware):
         user = self.get_user_by_authentication(req)
         accounts = self.auth.get_projects(user=user)
         if not user:
+            token = req.headers["X-Auth-Token"]
+            msg = _("%(user)s could not be found with token '%(token)s'")
+            LOG.warn(msg % locals())
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
         if accounts:
@@ -66,6 +66,8 @@ class AuthMiddleware(wsgi.Middleware):
 
         if not self.auth.is_admin(user) and \
            not self.auth.is_project_member(user, account):
+            msg = _("%(user)s must be an admin or a member of %(account)s")
+            LOG.warn(msg % locals())
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
         req.environ['nova.context'] = context.RequestContext(user, account)
@@ -82,24 +84,29 @@ class AuthMiddleware(wsgi.Middleware):
         # honor it
         path_info = req.path_info
         if len(path_info) > 1:
-            return faults.Fault(webob.exc.HTTPUnauthorized())
+            msg = _("Authentication requests must be made against a version "
+                    "root (e.g. /v1.0 or /v1.1).")
+            LOG.warn(msg)
+            return faults.Fault(webob.exc.HTTPUnauthorized(explanation=msg))
 
         try:
             username = req.headers['X-Auth-User']
             key = req.headers['X-Auth-Key']
-        except KeyError:
+        except KeyError as ex:
+            LOG.warn(_("Could not find %s in request.") % ex)
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
         token, user = self._authorize_user(username, key, req)
         if user and token:
             res = webob.Response()
-            res.headers['X-Auth-Token'] = token.token_hash
+            res.headers['X-Auth-Token'] = token['token_hash']
             res.headers['X-Server-Management-Url'] = \
-                token.server_management_url
-            res.headers['X-Storage-Url'] = token.storage_url
-            res.headers['X-CDN-Management-Url'] = token.cdn_management_url
+                token['server_management_url']
+            res.headers['X-Storage-Url'] = token['storage_url']
+            res.headers['X-CDN-Management-Url'] = token['cdn_management_url']
             res.content_type = 'text/plain'
             res.status = '204'
+            LOG.debug(_("Successfully authenticated '%s'") % username)
             return res
         else:
             return faults.Fault(webob.exc.HTTPUnauthorized())
@@ -120,11 +127,11 @@ class AuthMiddleware(wsgi.Middleware):
         except exception.NotFound:
             return None
         if token:
-            delta = datetime.datetime.now() - token.created_at
+            delta = datetime.datetime.utcnow() - token['created_at']
             if delta.days >= 2:
-                self.db.auth_token_destroy(ctxt, token.token_hash)
+                self.db.auth_token_destroy(ctxt, token['token_hash'])
             else:
-                return self.auth.get_user(token.user_id)
+                return self.auth.get_user(token['user_id'])
         return None
 
     def _authorize_user(self, username, key, req):
@@ -139,6 +146,7 @@ class AuthMiddleware(wsgi.Middleware):
         try:
             user = self.auth.get_user_from_access_key(key)
         except exception.NotFound:
+            LOG.warn(_("User not found with provided API key."))
             user = None
 
         if user and user.name == username:
@@ -153,4 +161,9 @@ class AuthMiddleware(wsgi.Middleware):
             token_dict['user_id'] = user.id
             token = self.db.auth_token_create(ctxt, token_dict)
             return token, user
+        elif user and user.name != username:
+            msg = _("Provided API key is valid, but not for user "
+                    "'%(username)s'") % locals()
+            LOG.warn(msg)
+
         return None, None
diff --git a/nova/api/openstack/common.py b/nova/api/openstack/common.py
index 234f921ab..32cd689ca 100644
--- a/nova/api/openstack/common.py
+++ b/nova/api/openstack/common.py
@@ -15,6 +15,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import re
 from urlparse import urlparse
 
 import webob
@@ -25,7 +26,7 @@ from nova import log as logging
 from nova import wsgi
 
 
-LOG = logging.getLogger('common')
+LOG = logging.getLogger('nova.api.openstack.common')
 
 
 FLAGS = flags.FLAGS
@@ -116,18 +117,30 @@ def get_image_id_from_image_hash(image_service, context, image_hash):
         items = image_service.index(context)
     for image in items:
         image_id = image['id']
-        if abs(hash(image_id)) == int(image_hash):
-            return image_id
-    raise exception.NotFound(image_hash)
+        try:
+            if abs(hash(image_id)) == int(image_hash):
+                return image_id
+        except ValueError:
+            msg = _("Requested image_id has wrong format: %s,"
+                    "should have numerical format") % image_id
+            LOG.error(msg)
+            raise Exception(msg)
+    raise exception.ImageNotFound(image_id=image_hash)
 
 
 def get_id_from_href(href):
     """Return the id portion of a url as an int.
 
-    Given: http://www.foo.com/bar/123?q=4
+    Given: 'http://www.foo.com/bar/123?q=4'
+    Returns: 123
+
+    In order to support local hrefs, the href argument can be just an id:
+    Given: '123'
     Returns: 123
 
     """
+    if re.match(r'\d+$', str(href)):
+        return int(href)
     try:
         return int(urlparse(href).path.split('/')[-1])
     except:
diff --git a/nova/api/openstack/contrib/volumes.py b/nova/api/openstack/contrib/volumes.py
index 6efacce52..18de2ec71 100644
--- a/nova/api/openstack/contrib/volumes.py
+++ b/nova/api/openstack/contrib/volumes.py
@@ -322,8 +322,7 @@ class Volumes(extensions.ExtensionDescriptor):
         # Does this matter?
         res = extensions.ResourceExtension('volumes',
                                         VolumeController(),
-                                        collection_actions={'detail': 'GET'}
-                                          )
+                                        collection_actions={'detail': 'GET'})
         resources.append(res)
 
         res = extensions.ResourceExtension('volume_attachments',
diff --git a/nova/api/openstack/extensions.py b/nova/api/openstack/extensions.py
index 7ea7afef6..8e77b25fb 100644
--- a/nova/api/openstack/extensions.py
+++ b/nova/api/openstack/extensions.py
@@ -105,15 +105,14 @@ class ExtensionDescriptor(object):
         actions = []
         return actions
 
-    def get_response_extensions(self):
-        """List of extensions.ResponseExtension extension objects.
+    def get_request_extensions(self):
+        """List of extensions.RequestException extension objects.
 
-        Response extensions are used to insert information into existing
-        response data.
+        Request extensions are used to handle custom request data.
 
         """
-        response_exts = []
-        return response_exts
+        request_exts = []
+        return request_exts
 
 
 class ActionExtensionController(common.OpenstackController):
@@ -137,7 +136,7 @@ class ActionExtensionController(common.OpenstackController):
         return res
 
 
-class ResponseExtensionController(common.OpenstackController):
+class RequestExtensionController(common.OpenstackController):
 
     def __init__(self, application):
         self.application = application
@@ -148,20 +147,9 @@ class ResponseExtensionController(common.OpenstackController):
 
     def process(self, req, *args, **kwargs):
         res = req.get_response(self.application)
-        content_type = req.best_match_content_type()
-        # currently response handlers are un-ordered
+        # currently request handlers are un-ordered
         for handler in self.handlers:
-            res = handler(res)
-            try:
-                body = res.body
-                headers = res.headers
-            except AttributeError:
-                default_xmlns = None
-                body = self._serialize(res, content_type, default_xmlns)
-                headers = {"Content-Type": content_type}
-            res = webob.Response()
-            res.body = body
-            res.headers = headers
+            res = handler(req, res)
         return res
 
 
@@ -226,24 +214,24 @@ class ExtensionMiddleware(wsgi.Middleware):
 
         return action_controllers
 
-    def _response_ext_controllers(self, application, ext_mgr, mapper):
-        """Returns a dict of ResponseExtensionController-s by collection."""
-        response_ext_controllers = {}
-        for resp_ext in ext_mgr.get_response_extensions():
-            if not resp_ext.key in response_ext_controllers.keys():
-                controller = ResponseExtensionController(application)
-                mapper.connect(resp_ext.url_route + '.:(format)',
+    def _request_ext_controllers(self, application, ext_mgr, mapper):
+        """Returns a dict of RequestExtensionController-s by collection."""
+        request_ext_controllers = {}
+        for req_ext in ext_mgr.get_request_extensions():
+            if not req_ext.key in request_ext_controllers.keys():
+                controller = RequestExtensionController(application)
+                mapper.connect(req_ext.url_route + '.:(format)',
                                 action='process',
                                 controller=controller,
-                                conditions=resp_ext.conditions)
+                                conditions=req_ext.conditions)
 
-                mapper.connect(resp_ext.url_route,
+                mapper.connect(req_ext.url_route,
                                 action='process',
                                 controller=controller,
-                                conditions=resp_ext.conditions)
-                response_ext_controllers[resp_ext.key] = controller
+                                conditions=req_ext.conditions)
+                request_ext_controllers[req_ext.key] = controller
 
-        return response_ext_controllers
+        return request_ext_controllers
 
     def __init__(self, application, ext_mgr=None):
 
@@ -271,13 +259,13 @@ class ExtensionMiddleware(wsgi.Middleware):
             controller = action_controllers[action.collection]
             controller.add_action(action.action_name, action.handler)
 
-        # extended responses
-        resp_controllers = self._response_ext_controllers(application, ext_mgr,
+        # extended requests
+        req_controllers = self._request_ext_controllers(application, ext_mgr,
                                                             mapper)
-        for response_ext in ext_mgr.get_response_extensions():
-            LOG.debug(_('Extended response: %s'), response_ext.key)
-            controller = resp_controllers[response_ext.key]
-            controller.add_handler(response_ext.handler)
+        for request_ext in ext_mgr.get_request_extensions():
+            LOG.debug(_('Extended request: %s'), request_ext.key)
+            controller = req_controllers[request_ext.key]
+            controller.add_handler(request_ext.handler)
 
         self._router = routes.middleware.RoutesMiddleware(self._dispatch,
                                                           mapper)
@@ -347,17 +335,17 @@ class ExtensionManager(object):
                 pass
         return actions
 
-    def get_response_extensions(self):
-        """Returns a list of ResponseExtension objects."""
-        response_exts = []
+    def get_request_extensions(self):
+        """Returns a list of RequestExtension objects."""
+        request_exts = []
         for alias, ext in self.extensions.iteritems():
             try:
-                response_exts.extend(ext.get_response_extensions())
+                request_exts.extend(ext.get_request_extensions())
             except AttributeError:
-                # NOTE(dprince): Extension aren't required to have response
+                # NOTE(dprince): Extension aren't required to have request
                 # extensions
                 pass
-        return response_exts
+        return request_exts
 
     def _check_extension(self, extension):
         """Checks for required methods in extension objects."""
@@ -421,9 +409,13 @@ class ExtensionManager(object):
         self.extensions[alias] = ext
 
 
-class ResponseExtension(object):
-    """Add data to responses from core nova OpenStack API controllers."""
+class RequestExtension(object):
+    """Extend requests and responses of core nova OpenStack API controllers.
 
+    Provide a way to add data to responses and handle custom request data
+    that is sent to core nova OpenStack API controllers.
+
+    """
     def __init__(self, method, url_route, handler):
         self.url_route = url_route
         self.handler = handler
diff --git a/nova/api/openstack/faults.py b/nova/api/openstack/faults.py
index bc97639a0..87118ce19 100644
--- a/nova/api/openstack/faults.py
+++ b/nova/api/openstack/faults.py
@@ -47,7 +47,7 @@ class Fault(webob.exc.HTTPException):
         """Generate a WSGI response based on the exception passed to ctor."""
         # Replace the body with fault details.
         code = self.wrapped_exc.status_int
-        fault_name = self._fault_names.get(code, "computeFault")
+        fault_name = self._fault_names.get(code, "cloudServersFault")
         fault_data = {
             fault_name: {
                 'code': code,
diff --git a/nova/api/openstack/flavors.py b/nova/api/openstack/flavors.py
index 40787bd17..4c5971cf6 100644
--- a/nova/api/openstack/flavors.py
+++ b/nova/api/openstack/flavors.py
@@ -45,6 +45,9 @@ class Controller(common.OpenstackController):
         items = self._get_flavors(req, is_detail=True)
         return dict(flavors=items)
 
+    def _get_view_builder(self, req):
+        raise NotImplementedError()
+
     def _get_flavors(self, req, is_detail=True):
         """Helper function that returns a list of flavor dicts."""
         ctxt = req.environ['nova.context']
diff --git a/nova/api/openstack/image_metadata.py b/nova/api/openstack/image_metadata.py
index e673e5f7b..1eccc0174 100644
--- a/nova/api/openstack/image_metadata.py
+++ b/nova/api/openstack/image_metadata.py
@@ -18,6 +18,7 @@
 from webob import exc
 
 from nova import flags
+from nova import quota
 from nova import utils
 from nova import wsgi
 from nova.api.openstack import common
@@ -40,6 +41,15 @@ class Controller(common.OpenstackController):
         metadata = image.get('properties', {})
         return metadata
 
+    def _check_quota_limit(self, context, metadata):
+        if metadata is None:
+            return
+        num_metadata = len(metadata)
+        quota_metadata = quota.allowed_metadata_items(context, num_metadata)
+        if quota_metadata < num_metadata:
+            expl = _("Image metadata limit exceeded")
+            raise exc.HTTPBadRequest(explanation=expl)
+
     def index(self, req, image_id):
         """Returns the list of metadata for a given instance"""
         context = req.environ['nova.context']
@@ -62,6 +72,7 @@ class Controller(common.OpenstackController):
         if 'metadata' in body:
             for key, value in body['metadata'].iteritems():
                 metadata[key] = value
+        self._check_quota_limit(context, metadata)
         img['properties'] = metadata
         self.image_service.update(context, image_id, img, None)
         return dict(metadata=metadata)
@@ -78,6 +89,7 @@ class Controller(common.OpenstackController):
         img = self.image_service.show(context, image_id)
         metadata = self._get_metadata(context, image_id, img)
         metadata[id] = body[id]
+        self._check_quota_limit(context, metadata)
         img['properties'] = metadata
         self.image_service.update(context, image_id, img, None)
 
diff --git a/nova/api/openstack/images.py b/nova/api/openstack/images.py
index 77baf5947..34d4c27fc 100644
--- a/nova/api/openstack/images.py
+++ b/nova/api/openstack/images.py
@@ -127,7 +127,7 @@ class Controller(common.OpenstackController):
             raise webob.exc.HTTPBadRequest()
 
         image = self._compute_service.snapshot(context, server_id, image_name)
-        return self.get_builder(req).build(image, detail=True)
+        return dict(image=self.get_builder(req).build(image, detail=True))
 
     def get_builder(self, request):
         """Indicates that you must use a Controller subclass."""
diff --git a/nova/api/openstack/ips.py b/nova/api/openstack/ips.py
new file mode 100644
index 000000000..778e9ba1a
--- /dev/null
+++ b/nova/api/openstack/ips.py
@@ -0,0 +1,72 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import time
+
+from webob import exc
+
+import nova
+import nova.api.openstack.views.addresses
+from nova.api.openstack import common
+from nova.api.openstack import faults
+
+
+class Controller(common.OpenstackController):
+    """The servers addresses API controller for the Openstack API."""
+
+    _serialization_metadata = {
+        'application/xml': {
+            'list_collections': {
+                'public':  {'item_name': 'ip', 'item_key': 'addr'},
+                'private': {'item_name': 'ip', 'item_key': 'addr'},
+            },
+        },
+    }
+
+    def __init__(self):
+        self.compute_api = nova.compute.API()
+        self.builder = nova.api.openstack.views.addresses.ViewBuilderV10()
+
+    def index(self, req, server_id):
+        try:
+            instance = self.compute_api.get(req.environ['nova.context'], id)
+        except nova.exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
+        return {'addresses': self.builder.build(instance)}
+
+    def public(self, req, server_id):
+        try:
+            instance = self.compute_api.get(req.environ['nova.context'], id)
+        except nova.exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
+        return {'public': self.builder.build_public_parts(instance)}
+
+    def private(self, req, server_id):
+        try:
+            instance = self.compute_api.get(req.environ['nova.context'], id)
+        except nova.exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
+        return {'private': self.builder.build_private_parts(instance)}
+
+    def show(self, req, server_id, id):
+        return faults.Fault(exc.HTTPNotImplemented())
+
+    def create(self, req, server_id):
+        return faults.Fault(exc.HTTPNotImplemented())
+
+    def delete(self, req, server_id, id):
+        return faults.Fault(exc.HTTPNotImplemented())
diff --git a/nova/api/openstack/limits.py b/nova/api/openstack/limits.py
index 9877af191..bd0250a7f 100644
--- a/nova/api/openstack/limits.py
+++ b/nova/api/openstack/limits.py
@@ -30,10 +30,11 @@ from collections import defaultdict
 
 from webob.dec import wsgify
 
+from nova import quota
 from nova import wsgi
 from nova.api.openstack import common
 from nova.api.openstack import faults
-from nova.wsgi import Middleware
+from nova.api.openstack.views import limits as limits_views
 
 
 # Convenience constants for the limits dictionary passed to Limiter().
@@ -51,8 +52,8 @@ class LimitsController(common.OpenstackController):
     _serialization_metadata = {
         "application/xml": {
             "attributes": {
-                "limit": ["verb", "URI", "regex", "value", "unit",
-                    "resetTime", "remaining", "name"],
+                "limit": ["verb", "URI", "uri", "regex", "value", "unit",
+                    "resetTime", "next-available", "remaining", "name"],
             },
             "plurals": {
                 "rate": "limit",
@@ -64,15 +65,25 @@ class LimitsController(common.OpenstackController):
         """
         Return all global and rate limit information.
         """
-        abs_limits = {}
+        context = req.environ['nova.context']
+        abs_limits = quota.get_project_quotas(context, context.project_id)
         rate_limits = req.environ.get("nova.limits", [])
 
-        return {
-            "limits": {
-                "rate": rate_limits,
-                "absolute": abs_limits,
-            },
-        }
+        builder = self._get_view_builder(req)
+        return builder.build(rate_limits, abs_limits)
+
+    def _get_view_builder(self, req):
+        raise NotImplementedError()
+
+
+class LimitsControllerV10(LimitsController):
+    def _get_view_builder(self, req):
+        return limits_views.ViewBuilderV10()
+
+
+class LimitsControllerV11(LimitsController):
+    def _get_view_builder(self, req):
+        return limits_views.ViewBuilderV11()
 
 
 class Limit(object):
@@ -186,7 +197,7 @@ DEFAULT_LIMITS = [
 ]
 
 
-class RateLimitingMiddleware(Middleware):
+class RateLimitingMiddleware(wsgi.Middleware):
     """
     Rate-limits requests passing through this middleware. All limit information
     is stored in memory for this implementation.
@@ -200,7 +211,7 @@ class RateLimitingMiddleware(Middleware):
         @param application: WSGI application to wrap
         @param limits: List of dictionaries describing limits
         """
-        Middleware.__init__(self, application)
+        wsgi.Middleware.__init__(self, application)
         self._limiter = Limiter(limits or DEFAULT_LIMITS)
 
     @wsgify(RequestClass=wsgi.Request)
diff --git a/nova/api/openstack/server_metadata.py b/nova/api/openstack/server_metadata.py
index 5c1390b9c..fd64ee4fb 100644
--- a/nova/api/openstack/server_metadata.py
+++ b/nova/api/openstack/server_metadata.py
@@ -18,6 +18,7 @@
 from webob import exc
 
 from nova import compute
+from nova import quota
 from nova import wsgi
 from nova.api.openstack import common
 from nova.api.openstack import faults
@@ -44,10 +45,14 @@ class Controller(common.OpenstackController):
 
     def create(self, req, server_id):
         context = req.environ['nova.context']
-        body = self._deserialize(req.body, req.get_content_type())
-        self.compute_api.update_or_create_instance_metadata(context,
-                                                            server_id,
-                                                            body['metadata'])
+        data = self._deserialize(req.body, req.get_content_type())
+        metadata = data.get('metadata')
+        try:
+            self.compute_api.update_or_create_instance_metadata(context,
+                                                                server_id,
+                                                                metadata)
+        except quota.QuotaError as error:
+            self._handle_quota_error(error)
         return req.body
 
     def update(self, req, server_id, id):
@@ -59,9 +64,13 @@ class Controller(common.OpenstackController):
         if len(body) > 1:
             expl = _('Request body contains too many items')
             raise exc.HTTPBadRequest(explanation=expl)
-        self.compute_api.update_or_create_instance_metadata(context,
-                                                            server_id,
-                                                            body)
+        try:
+            self.compute_api.update_or_create_instance_metadata(context,
+                                                                server_id,
+                                                                body)
+        except quota.QuotaError as error:
+            self._handle_quota_error(error)
+
         return req.body
 
     def show(self, req, server_id, id):
@@ -77,3 +86,9 @@ class Controller(common.OpenstackController):
         """ Deletes an existing metadata """
         context = req.environ['nova.context']
         self.compute_api.delete_instance_metadata(context, server_id, id)
+
+    def _handle_quota_error(self, error):
+        """Reraise quota errors as api-specific http exceptions."""
+        if error.code == "MetadataLimitExceeded":
+            raise exc.HTTPBadRequest(explanation=error.message)
+        raise error
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index f224825cc..5c10fc916 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -14,33 +14,30 @@
 #    under the License.
 
 import base64
-import hashlib
 import traceback
 
 from webob import exc
 from xml.dom import minidom
 
 from nova import compute
-from nova import context
 from nova import exception
 from nova import flags
 from nova import log as logging
 from nova import quota
 from nova import utils
-from nova import wsgi
 from nova.api.openstack import common
 from nova.api.openstack import faults
 import nova.api.openstack.views.addresses
 import nova.api.openstack.views.flavors
+import nova.api.openstack.views.images
 import nova.api.openstack.views.servers
 from nova.auth import manager as auth_manager
 from nova.compute import instance_types
-from nova.compute import power_state
 import nova.api.openstack
 from nova.scheduler import api as scheduler_api
 
 
-LOG = logging.getLogger('server')
+LOG = logging.getLogger('nova.api.openstack.servers')
 FLAGS = flags.FLAGS
 
 
@@ -55,6 +52,13 @@ class Controller(common.OpenstackController):
                            "imageRef"],
                 "link": ["rel", "type", "href"],
             },
+            "dict_collections": {
+                "metadata": {"item_name": "meta", "item_key": "key"},
+            },
+            "list_collections": {
+                "public": {"item_name": "ip", "item_key": "addr"},
+                "private": {"item_name": "ip", "item_key": "addr"},
+            },
         },
     }
 
@@ -63,15 +67,6 @@ class Controller(common.OpenstackController):
         self._image_service = utils.import_object(FLAGS.image_service)
         super(Controller, self).__init__()
 
-    def ips(self, req, id):
-        try:
-            instance = self.compute_api.get(req.environ['nova.context'], id)
-        except exception.NotFound:
-            return faults.Fault(exc.HTTPNotFound())
-
-        builder = self._get_addresses_view_builder(req)
-        return builder.build(instance)
-
     def index(self, req):
         """ Returns a list of server names and ids for a given user """
         return self._items(req, is_detail=False)
@@ -80,6 +75,21 @@ class Controller(common.OpenstackController):
         """ Returns a list of server details for a given user """
         return self._items(req, is_detail=True)
 
+    def _image_id_from_req_data(self, data):
+        raise NotImplementedError()
+
+    def _flavor_id_from_req_data(self, data):
+        raise NotImplementedError()
+
+    def _get_view_builder(self, req):
+        raise NotImplementedError()
+
+    def _limit_items(self, items, req):
+        raise NotImplementedError()
+
+    def _action_rebuild(self, info, request, instance_id):
+        raise NotImplementedError()
+
     def _items(self, req, is_detail):
         """Returns a list of servers for a given user.
 
@@ -120,6 +130,8 @@ class Controller(common.OpenstackController):
 
         context = req.environ['nova.context']
 
+        password = self._get_server_admin_password(env['server'])
+
         key_name = None
         key_data = None
         key_pairs = auth_manager.AuthManager.get_key_pairs(context)
@@ -129,21 +141,16 @@ class Controller(common.OpenstackController):
             key_data = key_pair['public_key']
 
         requested_image_id = self._image_id_from_req_data(env)
-        image_id = common.get_image_id_from_image_hash(self._image_service,
-            context, requested_image_id)
+        try:
+            image_id = common.get_image_id_from_image_hash(self._image_service,
+                context, requested_image_id)
+        except:
+            msg = _("Can not find requested image")
+            return faults.Fault(exc.HTTPBadRequest(msg))
+
         kernel_id, ramdisk_id = self._get_kernel_ramdisk_from_image(
             req, image_id)
 
-        # Metadata is a list, not a Dictionary, because we allow duplicate keys
-        # (even though JSON can't encode this)
-        # In future, we may not allow duplicate keys.
-        # However, the CloudServers API is not definitive on this front,
-        #  and we want to be compatible.
-        metadata = []
-        if env['server'].get('metadata'):
-            for k, v in env['server']['metadata'].items():
-                metadata.append({'key': k, 'value': v})
-
         personality = env['server'].get('personality')
         injected_files = []
         if personality:
@@ -160,9 +167,11 @@ class Controller(common.OpenstackController):
         name = name.strip()
 
         try:
+            inst_type = \
+                instance_types.get_instance_type_by_flavor_id(flavor_id)
             (inst,) = self.compute_api.create(
                 context,
-                instance_types.get_by_flavor_id(flavor_id),
+                inst_type,
                 image_id,
                 kernel_id=kernel_id,
                 ramdisk_id=ramdisk_id,
@@ -170,20 +179,18 @@ class Controller(common.OpenstackController):
                 display_description=name,
                 key_name=key_name,
                 key_data=key_data,
-                metadata=metadata,
-                injected_files=injected_files)
+                metadata=env['server'].get('metadata', {}),
+                injected_files=injected_files,
+                admin_password=password)
         except quota.QuotaError as error:
             self._handle_quota_error(error)
 
-        inst['instance_type'] = flavor_id
+        inst['instance_type'] = inst_type
         inst['image_id'] = requested_image_id
 
         builder = self._get_view_builder(req)
         server = builder.build(inst, is_detail=True)
-        password = utils.generate_password(16)
         server['server']['adminPass'] = password
-        self.compute_api.set_admin_password(context, server['server']['id'],
-                                            password)
         return server
 
     def _deserialize_create(self, request):
@@ -242,6 +249,10 @@ class Controller(common.OpenstackController):
         # if the original error is okay, just reraise it
         raise error
 
+    def _get_server_admin_password(self, server):
+        """ Determine the admin password for a server on creation """
+        return utils.generate_password(16)
+
     @scheduler_api.redirect_handler
     def update(self, req, id):
         """ Updates the server name or password """
@@ -320,9 +331,6 @@ class Controller(common.OpenstackController):
             return faults.Fault(exc.HTTPBadRequest())
         return exc.HTTPAccepted()
 
-    def _action_rebuild(self, input_dict, req, id):
-        return faults.Fault(exc.HTTPNotImplemented())
-
     def _action_resize(self, input_dict, req, id):
         """ Resizes a given instance to the flavor size requested """
         try:
@@ -336,18 +344,20 @@ class Controller(common.OpenstackController):
         except Exception, e:
             LOG.exception(_("Error in resize %s"), e)
             return faults.Fault(exc.HTTPBadRequest())
-        return faults.Fault(exc.HTTPAccepted())
+        return exc.HTTPAccepted()
 
     def _action_reboot(self, input_dict, req, id):
-        try:
+        if 'reboot' in input_dict and 'type' in input_dict['reboot']:
             reboot_type = input_dict['reboot']['type']
-        except Exception:
-            raise faults.Fault(exc.HTTPNotImplemented())
+        else:
+            LOG.exception(_("Missing argument 'type' for reboot"))
+            return faults.Fault(exc.HTTPUnprocessableEntity())
         try:
             # TODO(gundlach): pass reboot_type, support soft reboot in
             # virt driver
             self.compute_api.reboot(req.environ['nova.context'], id)
-        except:
+        except Exception, e:
+            LOG.exception(_("Error in reboot %s"), e)
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
@@ -561,24 +571,21 @@ class Controller(common.OpenstackController):
         """
         image_id = image_meta['id']
         if image_meta['status'] != 'active':
-            raise exception.Invalid(
-                _("Cannot build from image %(image_id)s, status not active") %
-                  locals())
+            raise exception.ImageUnacceptable(image_id=image_id,
+                                              reason=_("status is not active"))
 
-        if image_meta['properties']['disk_format'] != 'ami':
+        if image_meta.get('container_format') != 'ami':
             return None, None
 
         try:
             kernel_id = image_meta['properties']['kernel_id']
         except KeyError:
-            raise exception.NotFound(
-                _("Kernel not found for image %(image_id)s") % locals())
+            raise exception.KernelNotFoundForImage(image_id=image_id)
 
         try:
             ramdisk_id = image_meta['properties']['ramdisk_id']
         except KeyError:
-            raise exception.NotFound(
-                _("Ramdisk not found for image %(image_id)s") % locals())
+            raise exception.RamdiskNotFoundForImage(image_id=image_id)
 
         return kernel_id, ramdisk_id
 
@@ -595,19 +602,35 @@ class ControllerV10(Controller):
         return nova.api.openstack.views.servers.ViewBuilderV10(
             addresses_builder)
 
-    def _get_addresses_view_builder(self, req):
-        return nova.api.openstack.views.addresses.ViewBuilderV10(req)
-
     def _limit_items(self, items, req):
         return common.limited(items, req)
 
     def _parse_update(self, context, server_id, inst_dict, update_dict):
         if 'adminPass' in inst_dict['server']:
-            update_dict['admin_pass'] = inst_dict['server']['adminPass']
-            try:
-                self.compute_api.set_admin_password(context, server_id)
-            except exception.TimeoutException:
-                return exc.HTTPRequestTimeout()
+            self.compute_api.set_admin_password(context, server_id,
+                    inst_dict['server']['adminPass'])
+
+    def _action_rebuild(self, info, request, instance_id):
+        context = request.environ['nova.context']
+        instance_id = int(instance_id)
+
+        try:
+            image_id = info["rebuild"]["imageId"]
+        except (KeyError, TypeError):
+            msg = _("Could not parse imageId from request.")
+            LOG.debug(msg)
+            return faults.Fault(exc.HTTPBadRequest(explanation=msg))
+
+        try:
+            self.compute_api.rebuild(context, instance_id, image_id)
+        except exception.BuildInProgress:
+            msg = _("Instance %d is currently being rebuilt.") % instance_id
+            LOG.debug(msg)
+            return faults.Fault(exc.HTTPConflict(explanation=msg))
+
+        response = exc.HTTPAccepted()
+        response.empty_body = True
+        return response
 
 
 class ControllerV11(Controller):
@@ -629,9 +652,6 @@ class ControllerV11(Controller):
         return nova.api.openstack.views.servers.ViewBuilderV11(
             addresses_builder, flavor_builder, image_builder, base_url)
 
-    def _get_addresses_view_builder(self, req):
-        return nova.api.openstack.views.addresses.ViewBuilderV11(req)
-
     def _action_change_password(self, input_dict, req, id):
         context = req.environ['nova.context']
         if (not 'changePassword' in input_dict
@@ -648,6 +668,73 @@ class ControllerV11(Controller):
     def _limit_items(self, items, req):
         return common.limited_by_marker(items, req)
 
+    def _validate_metadata(self, metadata):
+        """Ensure that we can work with the metadata given."""
+        try:
+            metadata.iteritems()
+        except AttributeError as ex:
+            msg = _("Unable to parse metadata key/value pairs.")
+            LOG.debug(msg)
+            raise faults.Fault(exc.HTTPBadRequest(explanation=msg))
+
+    def _decode_personalities(self, personalities):
+        """Decode the Base64-encoded personalities."""
+        for personality in personalities:
+            try:
+                path = personality["path"]
+                contents = personality["contents"]
+            except (KeyError, TypeError):
+                msg = _("Unable to parse personality path/contents.")
+                LOG.info(msg)
+                raise faults.Fault(exc.HTTPBadRequest(explanation=msg))
+
+            try:
+                personality["contents"] = base64.b64decode(contents)
+            except TypeError:
+                msg = _("Personality content could not be Base64 decoded.")
+                LOG.info(msg)
+                raise faults.Fault(exc.HTTPBadRequest(explanation=msg))
+
+    def _action_rebuild(self, info, request, instance_id):
+        context = request.environ['nova.context']
+        instance_id = int(instance_id)
+
+        try:
+            image_ref = info["rebuild"]["imageRef"]
+        except (KeyError, TypeError):
+            msg = _("Could not parse imageRef from request.")
+            LOG.debug(msg)
+            return faults.Fault(exc.HTTPBadRequest(explanation=msg))
+
+        image_id = common.get_id_from_href(image_ref)
+        personalities = info["rebuild"].get("personality", [])
+        metadata = info["rebuild"].get("metadata", {})
+
+        self._validate_metadata(metadata)
+        self._decode_personalities(personalities)
+
+        try:
+            self.compute_api.rebuild(context, instance_id, image_id, metadata,
+                                     personalities)
+        except exception.BuildInProgress:
+            msg = _("Instance %d is currently being rebuilt.") % instance_id
+            LOG.debug(msg)
+            return faults.Fault(exc.HTTPConflict(explanation=msg))
+
+        response = exc.HTTPAccepted()
+        response.empty_body = True
+        return response
+
+    def _get_server_admin_password(self, server):
+        """ Determine the admin password for a server on creation """
+        password = server.get('adminPass')
+        if password is None:
+            return utils.generate_password(16)
+        if not isinstance(password, basestring) or password == '':
+            msg = _("Invalid adminPass")
+            raise exc.HTTPBadRequest(msg)
+        return password
+
     def get_default_xmlns(self, req):
         return common.XML_NS_V11
 
@@ -670,8 +757,9 @@ class ServerCreateRequestXMLDeserializer(object):
         """Marshal the server attribute of a parsed request"""
         server = {}
         server_node = self._find_first_child_named(node, 'server')
-        for attr in ["name", "imageId", "flavorId"]:
-            server[attr] = server_node.getAttribute(attr)
+        for attr in ["name", "imageId", "flavorId", "imageRef", "flavorRef"]:
+            if server_node.getAttribute(attr):
+                server[attr] = server_node.getAttribute(attr)
         metadata = self._extract_metadata(server_node)
         if metadata is not None:
             server["metadata"] = metadata
diff --git a/nova/api/openstack/users.py b/nova/api/openstack/users.py
index 077ccfc79..7ae4c3232 100644
--- a/nova/api/openstack/users.py
+++ b/nova/api/openstack/users.py
@@ -48,7 +48,7 @@ class Controller(common.OpenstackController):
         """We cannot depend on the db layer to check for admin access
            for the auth manager, so we do it here"""
         if not context.is_admin:
-            raise exception.NotAuthorized(_("Not admin user"))
+            raise exception.AdminRequired()
 
     def index(self, req):
         """Return all users in brief"""
diff --git a/nova/api/openstack/views/addresses.py b/nova/api/openstack/views/addresses.py
index 90c77855b..2810cce39 100644
--- a/nova/api/openstack/views/addresses.py
+++ b/nova/api/openstack/views/addresses.py
@@ -28,10 +28,16 @@ class ViewBuilder(object):
 
 class ViewBuilderV10(ViewBuilder):
     def build(self, inst):
-        private_ips = utils.get_from_path(inst, 'fixed_ip/address')
-        public_ips = utils.get_from_path(inst, 'fixed_ip/floating_ips/address')
+        private_ips = self.build_private_parts(inst)
+        public_ips = self.build_public_parts(inst)
         return dict(public=public_ips, private=private_ips)
 
+    def build_public_parts(self, inst):
+        return utils.get_from_path(inst, 'fixed_ip/floating_ips/address')
+
+    def build_private_parts(self, inst):
+        return utils.get_from_path(inst, 'fixed_ip/address')
+
 
 class ViewBuilderV11(ViewBuilder):
     def build(self, inst):
diff --git a/nova/api/openstack/views/images.py b/nova/api/openstack/views/images.py
index 16195b050..2773c9c13 100644
--- a/nova/api/openstack/views/images.py
+++ b/nova/api/openstack/views/images.py
@@ -34,11 +34,11 @@ class ViewBuilder(object):
     def _format_status(self, image):
         """Update the status field to standardize format."""
         status_mapping = {
-            'pending': 'queued',
-            'decrypting': 'preparing',
-            'untarring': 'saving',
-            'available': 'active',
-            'killed': 'failed',
+            'pending': 'QUEUED',
+            'decrypting': 'PREPARING',
+            'untarring': 'SAVING',
+            'available': 'ACTIVE',
+            'killed': 'FAILED',
         }
 
         try:
@@ -46,6 +46,14 @@ class ViewBuilder(object):
         except KeyError:
             image['status'] = image['status'].upper()
 
+    def _build_server(self, image, instance_id):
+        """Indicates that you must use a ViewBuilder subclass."""
+        raise NotImplementedError
+
+    def generate_server_ref(self, server_id):
+        """Return an href string pointing to this server."""
+        return os.path.join(self._url, "servers", str(server_id))
+
     def generate_href(self, image_id):
         """Return an href string pointing to this object."""
         return os.path.join(self._url, "images", str(image_id))
@@ -66,7 +74,7 @@ class ViewBuilder(object):
 
         if "instance_id" in properties:
             try:
-                image["serverId"] = int(properties["instance_id"])
+                self._build_server(image, int(properties["instance_id"]))
             except ValueError:
                 pass
 
@@ -85,12 +93,17 @@ class ViewBuilder(object):
 
 class ViewBuilderV10(ViewBuilder):
     """OpenStack API v1.0 Image Builder"""
-    pass
+
+    def _build_server(self, image, instance_id):
+        image["serverId"] = instance_id
 
 
 class ViewBuilderV11(ViewBuilder):
     """OpenStack API v1.1 Image Builder"""
 
+    def _build_server(self, image, instance_id):
+        image["serverRef"] = self.generate_server_ref(instance_id)
+
     def build(self, image_obj, detail=False):
         """Return a standardized image structure for display by the API."""
         image = ViewBuilder.build(self, image_obj, detail)
diff --git a/nova/api/openstack/views/limits.py b/nova/api/openstack/views/limits.py
new file mode 100644
index 000000000..e21c9f2fd
--- /dev/null
+++ b/nova/api/openstack/views/limits.py
@@ -0,0 +1,131 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import time
+
+from nova.api.openstack import common
+
+
+class ViewBuilder(object):
+    """Openstack API base limits view builder."""
+
+    def _build_rate_limits(self, rate_limits):
+        raise NotImplementedError()
+
+    def _build_rate_limit(self, rate_limit):
+        raise NotImplementedError()
+
+    def _build_absolute_limits(self, absolute_limit):
+        raise NotImplementedError()
+
+    def build(self, rate_limits, absolute_limits):
+        rate_limits = self._build_rate_limits(rate_limits)
+        absolute_limits = self._build_absolute_limits(absolute_limits)
+
+        output = {
+            "limits": {
+                "rate": rate_limits,
+                "absolute": absolute_limits,
+            },
+        }
+
+        return output
+
+    def _build_absolute_limits(self, absolute_limits):
+        """Builder for absolute limits
+
+        absolute_limits should be given as a dict of limits.
+        For example: {"ram": 512, "gigabytes": 1024}.
+
+        """
+        limit_names = {
+            "ram": ["maxTotalRAMSize"],
+            "instances": ["maxTotalInstances"],
+            "cores": ["maxTotalCores"],
+            "metadata_items": ["maxServerMeta", "maxImageMeta"],
+            "injected_files": ["maxPersonality"],
+            "injected_file_content_bytes": ["maxPersonalitySize"],
+        }
+        limits = {}
+        for name, value in absolute_limits.iteritems():
+            if name in limit_names and value is not None:
+                for name in limit_names[name]:
+                    limits[name] = value
+        return limits
+
+    def _build_rate_limits(self, rate_limits):
+        raise NotImplementedError()
+
+    def _build_rate_limit(self, rate_limit):
+        raise NotImplementedError()
+
+
+class ViewBuilderV10(ViewBuilder):
+    """Openstack API v1.0 limits view builder."""
+
+    def _build_rate_limits(self, rate_limits):
+        return [self._build_rate_limit(r) for r in rate_limits]
+
+    def _build_rate_limit(self, rate_limit):
+        return {
+            "verb": rate_limit["verb"],
+            "URI": rate_limit["URI"],
+            "regex": rate_limit["regex"],
+            "value": rate_limit["value"],
+            "remaining": int(rate_limit["remaining"]),
+            "unit": rate_limit["unit"],
+            "resetTime": rate_limit["resetTime"],
+        }
+
+
+class ViewBuilderV11(ViewBuilder):
+    """Openstack API v1.1 limits view builder."""
+
+    def _build_rate_limits(self, rate_limits):
+        limits = []
+        for rate_limit in rate_limits:
+            _rate_limit_key = None
+            _rate_limit = self._build_rate_limit(rate_limit)
+
+            # check for existing key
+            for limit in limits:
+                if limit["uri"] == rate_limit["URI"] and \
+                   limit["regex"] == rate_limit["regex"]:
+                    _rate_limit_key = limit
+                    break
+
+            # ensure we have a key if we didn't find one
+            if not _rate_limit_key:
+                _rate_limit_key = {
+                    "uri": rate_limit["URI"],
+                    "regex": rate_limit["regex"],
+                    "limit": [],
+                }
+                limits.append(_rate_limit_key)
+
+            _rate_limit_key["limit"].append(_rate_limit)
+
+        return limits
+
+    def _build_rate_limit(self, rate_limit):
+        return {
+            "verb": rate_limit["verb"],
+            "value": rate_limit["value"],
+            "remaining": int(rate_limit["remaining"]),
+            "unit": rate_limit["unit"],
+            "next-available": rate_limit["resetTime"],
+        }
diff --git a/nova/api/openstack/views/servers.py b/nova/api/openstack/views/servers.py
index d24c025be..0be468edc 100644
--- a/nova/api/openstack/views/servers.py
+++ b/nova/api/openstack/views/servers.py
@@ -63,10 +63,12 @@ class ViewBuilder(object):
             power_state.BLOCKED: 'ACTIVE',
             power_state.SUSPENDED: 'SUSPENDED',
             power_state.PAUSED: 'PAUSED',
-            power_state.SHUTDOWN: 'ACTIVE',
-            power_state.SHUTOFF: 'ACTIVE',
+            power_state.SHUTDOWN: 'SHUTDOWN',
+            power_state.SHUTOFF: 'SHUTOFF',
             power_state.CRASHED: 'ERROR',
-            power_state.FAILED: 'ERROR'}
+            power_state.FAILED: 'ERROR',
+            power_state.BUILDING: 'BUILD',
+        }
 
         inst_dict = {
             'id': int(inst['id']),
@@ -82,7 +84,7 @@ class ViewBuilder(object):
         # Return the metadata as a dictionary
         metadata = {}
         for item in inst.get('metadata', []):
-            metadata[item['key']] = item['value']
+            metadata[item['key']] = str(item['value'])
         inst_dict['metadata'] = metadata
 
         inst_dict['hostId'] = ''
@@ -115,7 +117,7 @@ class ViewBuilderV10(ViewBuilder):
 
     def _build_flavor(self, response, inst):
         if 'instance_type' in dict(inst):
-            response['flavorId'] = inst['instance_type']
+            response['flavorId'] = inst['instance_type']['flavorid']
 
 
 class ViewBuilderV11(ViewBuilder):
@@ -134,7 +136,7 @@ class ViewBuilderV11(ViewBuilder):
 
     def _build_flavor(self, response, inst):
         if "instance_type" in dict(inst):
-            flavor_id = inst["instance_type"]
+            flavor_id = inst["instance_type"]['flavorid']
             flavor_ref = self.flavor_builder.generate_href(flavor_id)
             response["flavorRef"] = flavor_ref
 
diff --git a/nova/api/openstack/zones.py b/nova/api/openstack/zones.py
index 227ffecdc..af73d8f6d 100644
--- a/nova/api/openstack/zones.py
+++ b/nova/api/openstack/zones.py
@@ -13,7 +13,12 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import json
+import urlparse
+
+from nova import crypto
 from nova import db
+from nova import exception
 from nova import flags
 from nova import log as logging
 from nova.api.openstack import common
@@ -21,6 +26,12 @@ from nova.scheduler import api
 
 
 FLAGS = flags.FLAGS
+flags.DEFINE_string('build_plan_encryption_key',
+        None,
+        '128bit (hex) encryption key for scheduler build plans.')
+
+
+LOG = logging.getLogger('nova.api.openstack.zones')
 
 
 def _filter_keys(item, keys):
@@ -97,3 +108,35 @@ class Controller(common.OpenstackController):
         zone_id = int(id)
         zone = api.zone_update(context, zone_id, env["zone"])
         return dict(zone=_scrub_zone(zone))
+
+    def select(self, req):
+        """Returns a weighted list of costs to create instances
+           of desired capabilities."""
+        ctx = req.environ['nova.context']
+        qs = req.environ['QUERY_STRING']
+        param_dict = urlparse.parse_qs(qs)
+        param_dict.pop("fresh", None)
+        # parse_qs returns a dict where the values are lists,
+        # since query strings can have multiple values for the
+        # same key. We need to convert that to single values.
+        for key in param_dict:
+            param_dict[key] = param_dict[key][0]
+        build_plan = api.select(ctx, specs=param_dict)
+        cooked = self._scrub_build_plan(build_plan)
+        return {"weights": cooked}
+
+    def _scrub_build_plan(self, build_plan):
+        """Remove all the confidential data and return a sanitized
+        version of the build plan. Include an encrypted full version
+        of the weighting entry so we can get back to it later."""
+        if not FLAGS.build_plan_encryption_key:
+            raise exception.FlagNotSet(flag='build_plan_encryption_key')
+
+        encryptor = crypto.encryptor(FLAGS.build_plan_encryption_key)
+        cooked = []
+        for entry in build_plan:
+            json_entry = json.dumps(entry)
+            cipher_text = encryptor(json_entry)
+            cooked.append(dict(weight=entry['weight'],
+                blob=cipher_text))
+        return cooked