Skip to content

Commit 3cbbb5f

Browse files
abh1sarabh1sar
committed
Add events when api key access is changed via api or config setting
1 parent 7b24581 commit 3cbbb5f

File tree

4 files changed

+20
-5
lines changed

4 files changed

+20
-5
lines changed

‎api/src/main/java/com/cloud/event/EventTypes.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,7 @@ public class EventTypes {
292292

293293
//register for user API and secret keys
294294
public static final String EVENT_REGISTER_FOR_SECRET_API_KEY = "REGISTER.USER.KEY";
295+
public static final String API_KEY_ACCESS_UPDATE = "API.KEY.ACCESS.UPDATE";
295296

296297
// Template Events
297298
public static final String EVENT_TEMPLATE_CREATE = "TEMPLATE.CREATE";

‎server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
import org.apache.cloudstack.agent.lb.IndirectAgentLBServiceImpl;
5454
import org.apache.cloudstack.annotation.AnnotationService;
5555
import org.apache.cloudstack.annotation.dao.AnnotationDao;
56+
import org.apache.cloudstack.api.ApiCommandResourceType;
5657
import org.apache.cloudstack.api.ApiConstants;
5758
import org.apache.cloudstack.api.command.admin.config.ResetCfgCmd;
5859
import org.apache.cloudstack.api.command.admin.config.UpdateCfgCmd;
@@ -707,20 +708,23 @@ public String updateConfiguration(final long userId, final String name, final St
707708
value = DBEncryptionUtil.encrypt(value);
708709
}
709710

711+
ApiCommandResourceType resourceType;
710712
ConfigKey.Scope scopeVal = ConfigKey.Scope.valueOf(scope);
711713
switch (scopeVal) {
712714
case Zone:
713715
final DataCenterVO zone = _zoneDao.findById(resourceId);
714716
if (zone == null) {
715717
throw new InvalidParameterValueException("unable to find zone by id " + resourceId);
716718
}
719+
resourceType = ApiCommandResourceType.Zone;
717720
_dcDetailsDao.addDetail(resourceId, name, value, true);
718721
break;
719722
case Cluster:
720723
final ClusterVO cluster = _clusterDao.findById(resourceId);
721724
if (cluster == null) {
722725
throw new InvalidParameterValueException("unable to find cluster by id " + resourceId);
723726
}
727+
resourceType = ApiCommandResourceType.Cluster;
724728
String newName = name;
725729
if (name.equalsIgnoreCase("cpu.overprovisioning.factor")) {
726730
newName = "cpuOvercommitRatio";
@@ -743,6 +747,7 @@ public String updateConfiguration(final long userId, final String name, final St
743747
if (pool == null) {
744748
throw new InvalidParameterValueException("unable to find storage pool by id " + resourceId);
745749
}
750+
resourceType = ApiCommandResourceType.StoragePool;
746751
if(name.equals(CapacityManager.StorageOverprovisioningFactor.key())) {
747752
if(!pool.getPoolType().supportsOverProvisioning() ) {
748753
throw new InvalidParameterValueException("Unable to update storage pool with id " + resourceId + ". Overprovision not supported for " + pool.getPoolType());
@@ -764,6 +769,7 @@ public String updateConfiguration(final long userId, final String name, final St
764769
if (account == null) {
765770
throw new InvalidParameterValueException("unable to find account by id " + resourceId);
766771
}
772+
resourceType = ApiCommandResourceType.Account;
767773
AccountDetailVO accountDetailVO = _accountDetailsDao.findDetail(resourceId, name);
768774
if (accountDetailVO == null) {
769775
accountDetailVO = new AccountDetailVO(resourceId, name, value);
@@ -777,6 +783,7 @@ public String updateConfiguration(final long userId, final String name, final St
777783
case ImageStore:
778784
final ImageStoreVO imgStore = _imageStoreDao.findById(resourceId);
779785
Preconditions.checkState(imgStore != null);
786+
resourceType = ApiCommandResourceType.ImageStore;
780787
_imageStoreDetailsDao.addDetail(resourceId, name, value, true);
781788
break;
782789

@@ -785,6 +792,7 @@ public String updateConfiguration(final long userId, final String name, final St
785792
if (domain == null) {
786793
throw new InvalidParameterValueException("unable to find domain by id " + resourceId);
787794
}
795+
resourceType = ApiCommandResourceType.Domain;
788796
DomainDetailVO domainDetailVO = _domainDetailsDao.findDetail(resourceId, name);
789797
if (domainDetailVO == null) {
790798
domainDetailVO = new DomainDetailVO(resourceId, name, value);
@@ -799,6 +807,10 @@ public String updateConfiguration(final long userId, final String name, final St
799807
throw new InvalidParameterValueException("Scope provided is invalid");
800808
}
801809

810+
CallContext.current().setEventResourceType(resourceType);
811+
CallContext.current().setEventResourceId(resourceId);
812+
CallContext.current().setEventDetails(String.format(" Name: %s, New Value: %s, Scope: %s", name, value, scope));
813+
802814
_configDepot.invalidateConfigCache(name, scopeVal, resourceId);
803815
return valueEncrypted ? DBEncryptionUtil.decrypt(value) : value;
804816
}
@@ -1012,7 +1024,6 @@ public Configuration updateConfiguration(final UpdateCfgCmd cmd) throws InvalidP
10121024
if (value.isEmpty() || value.equals("null")) {
10131025
value = (id == null) ? null : "";
10141026
}
1015-
10161027
final String updatedValue = updateConfiguration(userId, name, category, value, scope, id);
10171028
if (value == null && updatedValue == null || updatedValue.equalsIgnoreCase(value)) {
10181029
return _configDao.findByName(name);

‎server/src/main/java/com/cloud/user/AccountManagerImpl.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1456,9 +1456,9 @@ public UserAccount updateUser(UpdateUserCmd updateUserCmd) {
14561456
logger.debug("Updating user with Id: " + user.getUuid());
14571457

14581458
validateAndUpdateApiAndSecretKeyIfNeeded(updateUserCmd, user);
1459-
validateAndUpdateUserApiKeyAccess(updateUserCmd, user);
14601459
Account account = retrieveAndValidateAccount(user);
14611460

1461+
validateAndUpdateUserApiKeyAccess(updateUserCmd, user, account);
14621462
validateAndUpdateFirstNameIfNeeded(updateUserCmd, user);
14631463
validateAndUpdateLastNameIfNeeded(updateUserCmd, user);
14641464
validateAndUpdateUsernameIfNeeded(updateUserCmd, user, account);
@@ -1676,11 +1676,12 @@ protected void validateAndUpdateApiAndSecretKeyIfNeeded(UpdateUserCmd updateUser
16761676
user.setSecretKey(secretKey);
16771677
}
16781678

1679-
protected void validateAndUpdateUserApiKeyAccess(UpdateUserCmd updateUserCmd, UserVO user) {
1679+
protected void validateAndUpdateUserApiKeyAccess(UpdateUserCmd updateUserCmd, UserVO user, Account account) {
16801680
if (updateUserCmd.getApiKeyAccess() != null) {
16811681
try {
16821682
ApiConstants.ApiKeyAccess access = ApiConstants.ApiKeyAccess.valueOf(updateUserCmd.getApiKeyAccess().toUpperCase());
16831683
user.setApiKeyAccess(access.toBoolean());
1684+
ActionEventUtils.onActionEvent(user.getId(), account.getAccountId(), account.getDomainId(), EventTypes.API_KEY_ACCESS_UPDATE, "Api key access was changed for the user to " + access.toString(), user.getId(), ApiCommandResourceType.User.toString());
16841685
} catch (IllegalArgumentException ex) {
16851686
throw new InvalidParameterValueException("ApiKeyAccess value can only be Enabled/Disabled/Inherit");
16861687
}
@@ -1692,6 +1693,7 @@ protected void validateAndUpdateAccountApiKeyAccess(UpdateAccountCmd updateAccou
16921693
try {
16931694
ApiConstants.ApiKeyAccess access = ApiConstants.ApiKeyAccess.valueOf(updateAccountCmd.getApiKeyAccess().toUpperCase());
16941695
account.setApiKeyAccess(access.toBoolean());
1696+
ActionEventUtils.onActionEvent(User.UID_SYSTEM, account.getAccountId(), account.getDomainId(), EventTypes.API_KEY_ACCESS_UPDATE, "Api key access was changed for the account to " + access.toString(), account.getId(), ApiCommandResourceType.Account.toString());
16951697
} catch (IllegalArgumentException ex) {
16961698
throw new InvalidParameterValueException("ApiKeyAccess value can only be Enabled/Disabled/Inherit");
16971699
}
@@ -2828,6 +2830,7 @@ public Map<String, String> getKeys(Long userId) {
28282830
preventRootDomainAdminAccessToRootAdminKeys(caller, account);
28292831
checkAccess(caller, account);
28302832

2833+
// TODO : can return api key access here
28312834
Map<String, String> keys = new HashMap<String, String>();
28322835
keys.put("apikey", user.getApiKey());
28332836
keys.put("secretkey", user.getSecretKey());

‎server/src/test/java/com/cloud/user/AccountManagerImplTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -514,15 +514,15 @@ public void validateAndUpdatApiAndSecretKeyIfNeededTest() {
514514
@Test
515515
public void validateAndUpdatUserApiKeyAccess() {
516516
Mockito.doReturn("Enabled").when(UpdateUserCmdMock).getApiKeyAccess();
517-
accountManagerImpl.validateAndUpdateUserApiKeyAccess(UpdateUserCmdMock, userVoMock);
517+
accountManagerImpl.validateAndUpdateUserApiKeyAccess(UpdateUserCmdMock, userVoMock, accountMock);
518518

519519
Mockito.verify(userVoMock).setApiKeyAccess(true);
520520
}
521521

522522
@Test(expected = InvalidParameterValueException.class)
523523
public void validateAndUpdatUserApiKeyAccessInvalidParameter() {
524524
Mockito.doReturn("False").when(UpdateUserCmdMock).getApiKeyAccess();
525-
accountManagerImpl.validateAndUpdateUserApiKeyAccess(UpdateUserCmdMock, userVoMock);
525+
accountManagerImpl.validateAndUpdateUserApiKeyAccess(UpdateUserCmdMock, userVoMock, accountMock);
526526
}
527527

528528
@Test

0 commit comments

Comments
 (0)