def test_extension_authorizer_throws_exception_if_policy_fails(self):
     target = {"project_id": "1234", "user_id": "5678"}
     self.mox.StubOutWithMock(nova.policy, "enforce")
     nova.policy.enforce(self.fake_context, "compute_extension:used_limits_for_admin", target).AndRaise(
         exception.PolicyNotAuthorized(action="compute_extension:used_limits_for_admin")
     )
     self.mox.ReplayAll()
     authorize = base_extensions.extension_authorizer("compute", "used_limits_for_admin")
     self.assertRaises(exception.PolicyNotAuthorized, authorize, self.fake_context, target=target)

 def test_extension_authorizer_throws_exception_if_policy_fails(self):
     target = {'project_id': '1234',
               'user_id': '5678'}
     self.mox.StubOutWithMock(nova.policy, 'enforce')
     nova.policy.enforce(self.fake_context,
                         "compute_extension:used_limits_for_admin",
                         target).AndRaise(
         exception.PolicyNotAuthorized(
             action="compute_extension:used_limits_for_admin"))
     ('compute', 'used_limits_for_admin')
     self.mox.ReplayAll()
     authorize = base_extensions.extension_authorizer('compute',
                                                     'used_limits_for_admin'
     )
     self.assertRaises(exception.PolicyNotAuthorized, authorize,
                       self.fake_context, target=target)

#    under the License

import webob

from nova.api.openstack import extensions
from nova.api.openstack import wsgi
from nova.api.openstack import xmlutil
from nova import compute
from nova import exception
from nova import log as logging
from nova import network
from nova.rpc import common as rpc_common


LOG = logging.getLogger(__name__)
authorize = extensions.extension_authorizer('compute', 'floating_ips')


def make_float_ip(elem):
    elem.set('id')
    elem.set('ip')
    elem.set('pool')
    elem.set('fixed_ip')
    elem.set('instance_id')


class FloatingIPTemplate(xmlutil.TemplateBuilder):
    def construct(self):
        root = xmlutil.TemplateElement('floating_ip',
                                       selector='floating_ip')
        make_float_ip(root)

from nova.api.openstack import extensions
from nova.api.openstack import wsgi
from nova.api.openstack import xmlutil
from nova import compute
from nova.compute import api as compute_api
from nova import db
from nova import exception
from nova.network.security_group import openstack_driver
from nova.network.security_group import quantum_driver
from nova.openstack.common import log as logging
from nova import utils
from nova.virt import netutils


LOG = logging.getLogger(__name__)
authorize = extensions.extension_authorizer('compute', 'security_groups')
softauth = extensions.soft_extension_authorizer('compute', 'security_groups')


def make_rule(elem):
    elem.set('id')
    elem.set('parent_group_id')

    proto = xmlutil.SubTemplateElement(elem, 'ip_protocol')
    proto.text = 'ip_protocol'

    from_port = xmlutil.SubTemplateElement(elem, 'from_port')
    from_port.text = 'from_port'

    to_port = xmlutil.SubTemplateElement(elem, 'to_port')
    to_port.text = 'to_port'

#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.

"""The bare-metal admin extension."""

import webob

from nova.api.openstack import extensions
from nova.api.openstack import wsgi
from nova.api.openstack import xmlutil
from nova import exception
from nova.virt.baremetal import db

authorize = extensions.extension_authorizer('compute', 'baremetal_nodes')

node_fields = ['id', 'cpus', 'local_gb', 'memory_mb', 'pm_address',
               'pm_user',
               'service_host', 'terminal_port', 'instance_uuid',
               ]

interface_fields = ['id', 'address', 'datapath_id', 'port_no']


def _node_dict(node_ref):
    d = {}
    for f in node_fields:
        d[f] = node_ref.get(f)
    return d

#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.

from oslo.config import cfg

from nova.api.openstack import extensions
from nova.api.openstack import wsgi
from nova import availability_zones
from nova import db
from nova import servicegroup

CONF = cfg.CONF
ALIAS = "os-availability-zone"
ATTRIBUTE_NAME = "%s:availability_zone" % ALIAS
authorize_list = extensions.extension_authorizer('compute',
                                                 'v3:' + ALIAS + ':list')
authorize_detail = extensions.extension_authorizer('compute',
                                                   'v3:' + ALIAS + ':detail')


class AvailabilityZoneController(wsgi.Controller):
    """The Availability Zone API controller for the OpenStack API."""

    def __init__(self):
        super(AvailabilityZoneController, self).__init__()
        self.servicegroup_api = servicegroup.API()

    def _get_filtered_availability_zones(self, zones, is_available):
        result = []
        for zone in zones:
            # Hide internal_service_availability_zone

#    License for the specific language governing permissions and limitations
#    under the License.

"""The instance type extra specs extension."""

from webob import exc

from nova.api.openstack import extensions
from nova.api.openstack import wsgi
from nova.api.openstack import xmlutil
from nova import db
from nova import exception
from nova.openstack.common.gettextutils import _


authorize = extensions.extension_authorizer('compute', 'flavorextraspecs')


class ExtraSpecsTemplate(xmlutil.TemplateBuilder):
    def construct(self):
        return xmlutil.MasterTemplate(xmlutil.make_flat_dict('extra_specs'), 1)


class ExtraSpecTemplate(xmlutil.TemplateBuilder):
    def construct(self):
        sel = xmlutil.Selector(xmlutil.get_items, 0)
        root = xmlutil.TemplateElement('extra_spec', selector=sel)
        root.set('key', 0)
        root.text = 1
        return xmlutil.MasterTemplate(root, 1)

def authorize(context, action_name):
    action = 'admin_actions:%s' % action_name
    extensions.extension_authorizer('compute', action)(context)

#    License for the specific language governing permissions and limitations
#    under the License.

"""The virtual interfaces extension."""

from nova.api.openstack import common
from nova.api.openstack import extensions
from nova.api.openstack import wsgi
from nova.api.openstack import xmlutil
from nova import compute
from nova import log as logging
from nova import network


LOG = logging.getLogger(__name__)
authorize = extensions.extension_authorizer('compute', 'virtual_interfaces')


vif_nsmap = {None: wsgi.XMLNS_V11}


class VirtualInterfaceTemplate(xmlutil.TemplateBuilder):
    def construct(self):
        root = xmlutil.TemplateElement('virtual_interfaces')
        elem = xmlutil.SubTemplateElement(root, 'virtual_interface',
                                          selector='virtual_interfaces')
        elem.set('id')
        elem.set('mac_address')
        return xmlutil.MasterTemplate(root, 1, nsmap=vif_nsmap)

#    under the License.

import datetime

import iso8601
from oslo_utils import timeutils
import six
import six.moves.urllib.parse as urlparse
from webob import exc

from nova.api.openstack import extensions
from nova import exception
from nova.i18n import _
from nova import objects

authorize_show = extensions.extension_authorizer('compute',
                                                 'simple_tenant_usage:show')
authorize_list = extensions.extension_authorizer('compute',
                                                 'simple_tenant_usage:list')


def parse_strtime(dstr, fmt):
    try:
        return timeutils.parse_strtime(dstr, fmt)
    except (TypeError, ValueError) as e:
        raise exception.InvalidStrTime(reason=six.text_type(e))


class SimpleTenantUsageController(object):
    def _hours_for(self, instance, period_start, period_stop):
        launched_at = instance.launched_at
        terminated_at = instance.terminated_at

import netaddr
from webob import exc

from nova.api.openstack.compute.schemas.v3 import networks as schema
from nova.api.openstack import extensions
from nova.api.openstack import wsgi
from nova.api import validation
from nova import exception
from nova.i18n import _
from nova import network
from nova.objects import base as base_obj
from nova.objects import fields as obj_fields

ALIAS = 'os-networks'
authorize = extensions.extension_authorizer('compute', 'v3:' + ALIAS)
authorize_view = extensions.extension_authorizer('compute',
                                                 'v3:' + ALIAS + ':view')


def network_dict(context, network):
    fields = ('id', 'cidr', 'netmask', 'gateway', 'broadcast', 'dns1', 'dns2',
              'cidr_v6', 'gateway_v6', 'label', 'netmask_v6')
    admin_fields = ('created_at', 'updated_at', 'deleted_at', 'deleted',
                    'injected', 'bridge', 'vlan', 'vpn_public_address',
                    'vpn_public_port', 'vpn_private_address', 'dhcp_start',
                    'project_id', 'host', 'bridge_interface', 'multi_host',
                    'priority', 'rxtx_base', 'mtu', 'dhcp_server',
                    'enable_dhcp', 'share_address')
    if network:
        # NOTE(mnaser): We display a limited set of fields so users can know

from nova.api.openstack import common
from nova.api.openstack import extensions
from nova.api.openstack import wsgi
from nova.api.openstack import xmlutil
from nova import compute
from nova.compute import utils as compute_utils
from nova import exception
from nova.i18n import _
from nova.i18n import _LW
from nova import network
from nova.openstack.common import log as logging
from nova.openstack.common import uuidutils


LOG = logging.getLogger(__name__)
authorize = extensions.extension_authorizer("compute", "floating_ips")


def make_float_ip(elem):
    elem.set("id")
    elem.set("ip")
    elem.set("pool")
    elem.set("fixed_ip")
    elem.set("instance_id")


class FloatingIPTemplate(xmlutil.TemplateBuilder):
    def construct(self):
        root = xmlutil.TemplateElement("floating_ip", selector="floating_ip")
        make_float_ip(root)
        return xmlutil.MasterTemplate(root, 1)

from xml.dom import minidom
from xml.parsers import expat

from nova.api.openstack import wsgi
from nova.api.openstack import xmlutil
from nova.api.openstack import extensions
from nova import compute
from nova import exception
from nova import flags
from nova import log as logging
from nova.scheduler import api as scheduler_api


LOG = logging.getLogger("nova.api.openstack.compute.contrib.hosts")
FLAGS = flags.FLAGS
authorize = extensions.extension_authorizer('compute', 'hosts')


class HostIndexTemplate(xmlutil.TemplateBuilder):
    def construct(self):
        def shimmer(obj, do_raise=False):
            # A bare list is passed in; we need to wrap it in a dict
            return dict(hosts=obj)

        root = xmlutil.TemplateElement('hosts', selector=shimmer)
        elem = xmlutil.SubTemplateElement(root, 'host', selector='hosts')
        elem.set('host_name')
        elem.set('service')

        return xmlutil.MasterTemplate(root, 1)

from nova.api.openstack import xmlutil
from nova.api.openstack import extensions
from nova.auth import manager
from nova.cloudpipe import pipelib
from nova import compute
from nova.compute import vm_states
from nova import db
from nova import exception
from nova import flags
from nova import log as logging
from nova import utils


FLAGS = flags.FLAGS
LOG = logging.getLogger("nova.api.openstack.compute.contrib.cloudpipe")
authorize = extensions.extension_authorizer('compute', 'cloudpipe')


class CloudpipeTemplate(xmlutil.TemplateBuilder):
    def construct(self):
        return xmlutil.MasterTemplate(xmlutil.make_flat_dict('cloudpipe'), 1)


class CloudpipesTemplate(xmlutil.TemplateBuilder):
    def construct(self):
        root = xmlutil.TemplateElement('cloudpipes')
        elem = xmlutil.make_flat_dict('cloudpipe', selector='cloudpipes',
                                      subselector='cloudpipe')
        root.append(elem)
        return xmlutil.MasterTemplate(root, 1)

#    License for the specific language governing permissions and limitations
#    under the License.

from oslo.config import cfg
import webob.exc

from nova.api.openstack import extensions
from nova.api.openstack import wsgi
from nova.api.openstack import xmlutil
from nova import compute
from nova import exception
from nova.openstack.common.gettextutils import _
from nova import servicegroup
from nova import utils

authorize = extensions.extension_authorizer('compute', 'services')
CONF = cfg.CONF
CONF.import_opt('service_down_time', 'nova.service')


class ServicesIndexTemplate(xmlutil.TemplateBuilder):
    def construct(self):
        root = xmlutil.TemplateElement('services')
        elem = xmlutil.SubTemplateElement(root, 'service', selector='services')
        elem.set('id')
        elem.set('binary')
        elem.set('host')
        elem.set('zone')
        elem.set('status')
        elem.set('state')
        elem.set('updated_at')

from webob import exc

from nova.api.openstack import common
from nova.api.openstack import extensions
from nova.cells import rpcapi as cells_rpcapi
from nova.compute import api as compute
from nova import exception
from nova.i18n import _
from nova import rpc


CONF = cfg.CONF
CONF.import_opt('name', 'nova.cells.opts', group='cells')
CONF.import_opt('capabilities', 'nova.cells.opts', group='cells')

authorize = extensions.extension_authorizer('compute', 'cells')


def _filter_keys(item, keys):
    """Filters all model attributes except for keys
    item is a dict

    """
    return {k: v for k, v in item.iteritems() if k in keys}


def _fixup_cell_info(cell_info, keys):
    """If the transport_url is present in the cell, derive username,
    rpc_host, and rpc_port from it.
    """

def authorize(context, action_name):
    action = 'v3:%s:%s' % (ALIAS, action_name)
    extensions.extension_authorizer('compute', action)(context)

import webob
from webob import exc

from nova.api.openstack import extensions as exts
from nova.api.openstack import wsgi
from nova import compute
from nova import exception
from nova import flags
from nova import log as logging
from nova import utils


FLAGS = flags.FLAGS
LOG = logging.getLogger(__name__)
authorize = exts.extension_authorizer('compute', 'rescue')


class RescueController(wsgi.Controller):
    def __init__(self, *args, **kwargs):
        super(RescueController, self).__init__(*args, **kwargs)
        self.compute_api = compute.API()

    def _get_instance(self, context, instance_id):
        try:
            return self.compute_api.get(context, instance_id)
        except exception.InstanceNotFound:
            msg = _("Server not found")
            raise exc.HTTPNotFound(msg)

    @wsgi.action('rescue')

from nova.api.openstack import common
from nova.api.openstack.compute.schemas.v3 import extended_volumes
from nova.api.openstack import extensions
from nova.api.openstack import wsgi
from nova.api import validation
from nova import compute
from nova import exception
from nova.openstack.common.gettextutils import _
from nova.openstack.common import log as logging
from nova import volume

ALIAS = "os-extended-volumes"
LOG = logging.getLogger(__name__)
authorize = extensions.soft_extension_authorizer('compute', 'v3:' + ALIAS)
authorize_attach = extensions.extension_authorizer('compute',
                                                   'v3:%s:attach' % ALIAS)
authorize_detach = extensions.extension_authorizer('compute',
                                                   'v3:%s:detach' % ALIAS)
authorize_swap = extensions.extension_authorizer('compute',
                                                 'v3:%s:swap' % ALIAS)


class ExtendedVolumesController(wsgi.Controller):
    def __init__(self, *args, **kwargs):
        super(ExtendedVolumesController, self).__init__(*args, **kwargs)
        self.compute_api = compute.API()
        self.volume_api = volume.API()

    def _extend_server(self, context, server, instance):
        bdms = self.compute_api.get_instance_bdms(context, instance)
        volume_ids = [bdm['volume_id'] for bdm in bdms if bdm['volume_id']]

from nova.api.openstack import wsgi
import nova.context
from nova import db
from nova import exception
from nova.i18n import _
from nova import quota
from nova import utils


QUOTAS = quota.QUOTAS
# Quotas that are only enabled by specific extensions
EXTENDED_QUOTAS = {'server_groups': 'os-server-group-quotas',
                   'server_group_members': 'os-server-group-quotas'}


authorize = extensions.extension_authorizer('compute', 'quota_classes')


class QuotaClassSetsController(wsgi.Controller):

    supported_quotas = []

    def __init__(self, ext_mgr):
        self.ext_mgr = ext_mgr
        self.supported_quotas = QUOTAS.resources
        for resource, extension in EXTENDED_QUOTAS.items():
            if not self.ext_mgr.is_loaded(extension):
                self.supported_quotas.remove(resource)

    def _format_quota_set(self, quota_class, quota_set):
        """Convert the quota object to a result dict."""