Skip to content

Commit f64c0e6

Browse files
abh1sarabh1sar
committed
Return apiKeyAccess in user and account response only for Root Admin
1 parent 554d0c9 commit f64c0e6

File tree

10 files changed

+35
-21
lines changed

10 files changed

+35
-21
lines changed

‎api/src/main/java/org/apache/cloudstack/api/command/admin/account/UpdateAccountCmd.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323

2424
import org.apache.cloudstack.acl.RoleType;
2525
import org.apache.cloudstack.api.ApiCommandResourceType;
26+
import org.apache.cloudstack.api.command.user.UserCmd;
2627
import org.apache.cloudstack.api.response.RoleResponse;
2728

2829
import org.apache.cloudstack.acl.SecurityChecker.AccessType;
@@ -41,8 +42,8 @@
4142
import com.cloud.user.Account;
4243

4344
@APICommand(name = "updateAccount", description = "Updates account information for the authenticated user", responseObject = AccountResponse.class, entityType = {Account.class},
44-
requestHasSensitiveInfo = false, responseHasSensitiveInfo = true)
45-
public class UpdateAccountCmd extends BaseCmd {
45+
responseView = ResponseView.Restricted, requestHasSensitiveInfo = false, responseHasSensitiveInfo = true)
46+
public class UpdateAccountCmd extends BaseCmd implements UserCmd {
4647

4748
/////////////////////////////////////////////////////
4849
//////////////// API parameters /////////////////////
@@ -139,7 +140,7 @@ public long getEntityOwnerId() {
139140
public void execute() {
140141
Account result = _regionService.updateAccount(this);
141142
if (result != null){
142-
AccountResponse response = _responseGenerator.createAccountResponse(ResponseView.Full, result);
143+
AccountResponse response = _responseGenerator.createAccountResponse(getResponseView(), result);
143144
response.setResponseName(getCommandName());
144145
setResponseObject(response);
145146
} else {

‎api/src/main/java/org/apache/cloudstack/api/command/admin/user/ListUsersCmd.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,22 @@
2020
import com.cloud.server.ResourceTag;
2121
import com.cloud.user.Account;
2222
import org.apache.cloudstack.acl.RoleType;
23+
import org.apache.cloudstack.api.command.user.UserCmd;
2324
import org.apache.cloudstack.api.response.ResourceIconResponse;
2425

2526
import org.apache.cloudstack.api.APICommand;
2627
import org.apache.cloudstack.api.ApiConstants;
2728
import org.apache.cloudstack.api.BaseListAccountResourcesCmd;
2829
import org.apache.cloudstack.api.Parameter;
30+
import org.apache.cloudstack.api.ResponseObject.ResponseView;
2931
import org.apache.cloudstack.api.response.ListResponse;
3032
import org.apache.cloudstack.api.response.UserResponse;
3133

3234
import java.util.List;
3335

3436
@APICommand(name = "listUsers", description = "Lists user accounts", responseObject = UserResponse.class,
35-
requestHasSensitiveInfo = false, responseHasSensitiveInfo = true)
36-
public class ListUsersCmd extends BaseListAccountResourcesCmd {
37+
responseView = ResponseView.Restricted, requestHasSensitiveInfo = false, responseHasSensitiveInfo = true)
38+
public class ListUsersCmd extends BaseListAccountResourcesCmd implements UserCmd {
3739

3840

3941
/////////////////////////////////////////////////////
@@ -95,7 +97,7 @@ public Boolean getShowIcon() {
9597

9698
@Override
9799
public void execute() {
98-
ListResponse<UserResponse> response = _queryService.searchForUsers(this);
100+
ListResponse<UserResponse> response = _queryService.searchForUsers(getResponseView(), this);
99101
response.setResponseName(getCommandName());
100102
this.setResponseObject(response);
101103
if (response != null && response.getCount() > 0 && getShowIcon()) {

‎api/src/main/java/org/apache/cloudstack/query/QueryService.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import java.util.List;
2020

2121
import org.apache.cloudstack.affinity.AffinityGroupResponse;
22+
import org.apache.cloudstack.api.ResponseObject;
2223
import org.apache.cloudstack.api.command.admin.domain.ListDomainsCmd;
2324
import org.apache.cloudstack.api.command.admin.host.ListHostTagsCmd;
2425
import org.apache.cloudstack.api.command.admin.host.ListHostsCmd;
@@ -130,7 +131,7 @@ public interface QueryService {
130131
ConfigKey<Boolean> ReturnVmStatsOnVmList = new ConfigKey<>("Advanced", Boolean.class, "list.vm.default.details.stats", "true",
131132
"Determines whether VM stats should be returned when details are not explicitly specified in listVirtualMachines API request. When false, details default to [group, nics, secgrp, tmpl, servoff, diskoff, backoff, iso, volume, min, affgrp]. When true, all details are returned including 'stats'.", true, ConfigKey.Scope.Global);
132133

133-
ListResponse<UserResponse> searchForUsers(ListUsersCmd cmd) throws PermissionDeniedException;
134+
ListResponse<UserResponse> searchForUsers(ResponseObject.ResponseView responseView, ListUsersCmd cmd) throws PermissionDeniedException;
134135

135136
ListResponse<UserResponse> searchForUsers(Long domainId, boolean recursive) throws PermissionDeniedException;
136137

‎server/src/main/java/com/cloud/api/ApiDBUtils.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1945,11 +1945,11 @@ public static InstanceGroupJoinVO newInstanceGroupView(InstanceGroup e) {
19451945
}
19461946

19471947
public static UserResponse newUserResponse(UserAccountJoinVO usr) {
1948-
return newUserResponse(usr, null);
1948+
return newUserResponse(ResponseView.Restricted, null, usr);
19491949
}
19501950

1951-
public static UserResponse newUserResponse(UserAccountJoinVO usr, Long domainId) {
1952-
UserResponse response = s_userAccountJoinDao.newUserResponse(usr);
1951+
public static UserResponse newUserResponse(ResponseView view, Long domainId, UserAccountJoinVO usr) {
1952+
UserResponse response = s_userAccountJoinDao.newUserResponse(view, usr);
19531953
if(!AccountManager.UseSecretKeyInResponse.value()){
19541954
response.setSecretKey(null);
19551955
}

‎server/src/main/java/com/cloud/api/query/QueryManagerImpl.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -655,10 +655,13 @@ private SearchCriteria<ServiceOfferingJoinVO> getMinimumCpuSpeedServiceOfferingJ
655655
* .api.command.admin.user.ListUsersCmd)
656656
*/
657657
@Override
658-
public ListResponse<UserResponse> searchForUsers(ListUsersCmd cmd) throws PermissionDeniedException {
658+
public ListResponse<UserResponse> searchForUsers(ResponseView responseView, ListUsersCmd cmd) throws PermissionDeniedException {
659659
Pair<List<UserAccountJoinVO>, Integer> result = searchForUsersInternal(cmd);
660660
ListResponse<UserResponse> response = new ListResponse<UserResponse>();
661-
List<UserResponse> userResponses = ViewResponseHelper.createUserResponse(CallContext.current().getCallingAccount().getDomainId(),
661+
if (CallContext.current().getCallingAccount().getType() == Account.Type.ADMIN) {
662+
responseView = ResponseView.Full;
663+
}
664+
List<UserResponse> userResponses = ViewResponseHelper.createUserResponse(responseView, CallContext.current().getCallingAccount().getDomainId(),
662665
result.first().toArray(new UserAccountJoinVO[result.first().size()]));
663666
response.setResponses(userResponses, result.second());
664667
return response;
@@ -688,7 +691,7 @@ public ListResponse<UserResponse> searchForUsers(Long domainId, boolean recursiv
688691
Pair<List<UserAccountJoinVO>, Integer> result = getUserListInternal(caller, permittedAccounts, listAll, id,
689692
username, type, accountName, state, keyword, null, domainId, recursive, null);
690693
ListResponse<UserResponse> response = new ListResponse<UserResponse>();
691-
List<UserResponse> userResponses = ViewResponseHelper.createUserResponse(CallContext.current().getCallingAccount().getDomainId(),
694+
List<UserResponse> userResponses = ViewResponseHelper.createUserResponse(ResponseView.Restricted, CallContext.current().getCallingAccount().getDomainId(),
692695
result.first().toArray(new UserAccountJoinVO[result.first().size()]));
693696
response.setResponses(userResponses, result.second());
694697
return response;

‎server/src/main/java/com/cloud/api/query/ViewResponseHelper.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -105,13 +105,13 @@ public class ViewResponseHelper {
105105
protected Logger logger = LogManager.getLogger(getClass());
106106

107107
public static List<UserResponse> createUserResponse(UserAccountJoinVO... users) {
108-
return createUserResponse(null, users);
108+
return createUserResponse(ResponseView.Restricted, null, users);
109109
}
110110

111-
public static List<UserResponse> createUserResponse(Long domainId, UserAccountJoinVO... users) {
111+
public static List<UserResponse> createUserResponse(ResponseView responseView, Long domainId, UserAccountJoinVO... users) {
112112
List<UserResponse> respList = new ArrayList<UserResponse>();
113113
for (UserAccountJoinVO vt : users) {
114-
respList.add(ApiDBUtils.newUserResponse(vt, domainId));
114+
respList.add(ApiDBUtils.newUserResponse(responseView, domainId, vt));
115115
}
116116
return respList;
117117
}

‎server/src/main/java/com/cloud/api/query/dao/AccountJoinDaoImpl.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,9 @@ public AccountResponse newAccountResponse(ResponseView view, EnumSet<DomainDetai
8282
accountResponse.setNetworkDomain(account.getNetworkDomain());
8383
accountResponse.setDefaultZone(account.getDataCenterUuid());
8484
accountResponse.setIsDefault(account.isDefault());
85-
accountResponse.setApiKeyAccess(account.getApiKeyAccess());
85+
if (view == ResponseView.Full) {
86+
accountResponse.setApiKeyAccess(account.getApiKeyAccess());
87+
}
8688

8789
// get network stat
8890
accountResponse.setBytesReceived(account.getBytesReceived());

‎server/src/main/java/com/cloud/api/query/dao/UserAccountJoinDao.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
import java.util.List;
2020

21+
import org.apache.cloudstack.api.ResponseObject;
2122
import org.apache.cloudstack.api.response.UserResponse;
2223

2324
import com.cloud.api.query.vo.UserAccountJoinVO;
@@ -27,7 +28,7 @@
2728

2829
public interface UserAccountJoinDao extends GenericDao<UserAccountJoinVO, Long> {
2930

30-
UserResponse newUserResponse(UserAccountJoinVO usr);
31+
UserResponse newUserResponse(ResponseObject.ResponseView responseView, UserAccountJoinVO usr);
3132

3233
UserAccountJoinVO newUserView(User usr);
3334

‎server/src/main/java/com/cloud/api/query/dao/UserAccountJoinDaoImpl.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020

2121

2222
import com.cloud.user.AccountManagerImpl;
23+
import org.apache.cloudstack.api.ResponseObject.ResponseView;
2324
import org.springframework.stereotype.Component;
2425

2526
import org.apache.cloudstack.api.response.UserResponse;
@@ -52,7 +53,7 @@ protected UserAccountJoinDaoImpl() {
5253
}
5354

5455
@Override
55-
public UserResponse newUserResponse(UserAccountJoinVO usr) {
56+
public UserResponse newUserResponse(ResponseView view, UserAccountJoinVO usr) {
5657
UserResponse userResponse = new UserResponse();
5758
userResponse.setAccountId(usr.getAccountUuid());
5859
userResponse.setAccountName(usr.getAccountName());
@@ -75,7 +76,9 @@ public UserResponse newUserResponse(UserAccountJoinVO usr) {
7576
long domainId = usr.getDomainId();
7677
boolean is2FAmandated = Boolean.TRUE.equals(AccountManagerImpl.enableUserTwoFactorAuthentication.valueIn(domainId)) && Boolean.TRUE.equals(AccountManagerImpl.mandateUserTwoFactorAuthentication.valueIn(domainId));
7778
userResponse.set2FAmandated(is2FAmandated);
78-
userResponse.setApiKeyAccess(usr.getApiKeyAccess());
79+
if (view == ResponseView.Full) {
80+
userResponse.setApiKeyAccess(usr.getApiKeyAccess());
81+
}
7982

8083
// set async job
8184
if (usr.getJobId() != null) {

‎server/src/test/java/com/cloud/api/query/QueryManagerImplTest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@
6262

6363
import org.apache.cloudstack.acl.SecurityChecker;
6464
import org.apache.cloudstack.api.ApiCommandResourceType;
65+
import org.apache.cloudstack.api.ResponseObject;
6566
import org.apache.cloudstack.api.command.admin.storage.ListObjectStoragePoolsCmd;
6667
import org.apache.cloudstack.api.command.admin.user.ListUsersCmd;
6768
import org.apache.cloudstack.api.command.admin.vm.ListAffectedVmsForStorageScopeChangeCmd;
@@ -523,7 +524,7 @@ public void testSearchForUsers() {
523524
Mockito.when(sb.create()).thenReturn(sc);
524525
Mockito.when(userAccountJoinDao.searchAndCount(any(SearchCriteria.class), any(Filter.class))).thenReturn(result);
525526

526-
queryManager.searchForUsers(cmd);
527+
queryManager.searchForUsers(ResponseObject.ResponseView.Restricted, cmd);
527528

528529
Mockito.verify(sc).setParameters("username", username);
529530
Mockito.verify(sc).setParameters("accountName", accountName);

0 commit comments

Comments
 (0)