Create and delete security groups works.

Adding and revoking rules works.
DescribeSecurityGroups returns the groups and rules.
So, the API seems to be done. Yay.

3 files changed, 15 insertions, 3 deletions

diff --git a/nova/db/api.py b/nova/db/api.py
index 63ead04e0..c7a6da183 100644
--- a/nova/db/api.py
+++ b/nova/db/api.py
@@ -451,6 +451,11 @@ def security_group_create(context, values):
     return IMPL.security_group_create(context, values)
 
 
+def security_group_get_by_id(context, security_group_id):
+    """Get security group by its internal id"""
+    return IMPL.security_group_get_by_id(context, security_group_id)
+
+
 def security_group_get_by_instance(context, instance_id):
     """Get security groups to which the instance is assigned"""
     return IMPL.security_group_get_by_instance(context, instance_id)
diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
index 2db876154..4027e901c 100644
--- a/nova/db/sqlalchemy/api.py
+++ b/nova/db/sqlalchemy/api.py
@@ -595,6 +595,12 @@ def security_group_create(_context, values):
     return security_group_ref
 
 
+def security_group_get_by_id(_context, security_group_id):
+    with managed_session() as session:
+        return session.query(models.SecurityGroup) \
+                      .get(security_group_id)
+
+
 def security_group_get_by_instance(_context, instance_id):
     with managed_session() as session:
         return session.query(models.Instance) \
@@ -608,6 +614,7 @@ def security_group_get_by_user(_context, user_id):
         return session.query(models.SecurityGroup) \
                              .filter_by(user_id=user_id) \
                              .filter_by(deleted=False) \
+                             .options(eagerload('rules')) \
                              .all()
 
 def security_group_get_by_user_and_name(_context, user_id, name):
diff --git a/nova/db/sqlalchemy/models.py b/nova/db/sqlalchemy/models.py
index d177688d8..27c8e4d4c 100644
--- a/nova/db/sqlalchemy/models.py
+++ b/nova/db/sqlalchemy/models.py
@@ -329,8 +329,8 @@ class SecurityGroupIngressRule(BASE, NovaBase):
     id = Column(Integer, primary_key=True)
 
     parent_group_id = Column(Integer, ForeignKey('security_group.id'))
-    parent_group = relationship("SecurityGroup", backref="rules", foreign_keys=parent_group_id)
-#                                primaryjoin=SecurityGroup().id==parent_group_id)
+    parent_group = relationship("SecurityGroup", backref="rules", foreign_keys=parent_group_id,
+                                  primaryjoin=parent_group_id==SecurityGroup.id)
 
     protocol = Column(String(5)) # "tcp", "udp", or "icmp"
     from_port = Column(Integer)
@@ -338,7 +338,7 @@ class SecurityGroupIngressRule(BASE, NovaBase):
 
     # Note: This is not the parent SecurityGroup. It's SecurityGroup we're
     # granting access for.
-#    group_id = Column(Integer, ForeignKey('security_group.id'))
+    group_id = Column(Integer, ForeignKey('security_group.id'))
 
     @property
     def user(self):