Oved Ourfali has uploaded a new change for review.

Change subject: core: requiring permissions to manage tags, bookmarks and 
notifications
......................................................................

core: requiring permissions to manage tags, bookmarks and notifications

This patch adds three new action groups, and three new roles, used to
manage tags, bookmarks and notifications.
Relevant commands were once allowed for every administrator, so the
upgrade process adds these action groups to every admin role that
includes more than the login permissions action group (to solve the
ReadOnlyAdmin use-case).

Change-Id: I477bca5703f59c67914e6395118e29d53fa7d007
Signed-off-by: Oved Ourfali <[email protected]>
---
D 
backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/AdminOperationCommandBase.java
M 
backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/BookmarkCommandBase.java
M 
backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/EventSubscriptionCommandBase.java
M 
backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/PredefinedRoles.java
M 
backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/TagsCommandBase.java
M 
backend/manager/modules/common/src/main/java/org/ovirt/engine/core/common/businessentities/ActionGroup.java
M 
backend/manager/modules/restapi/interface/definition/src/main/java/org/ovirt/engine/api/model/PermitType.java
M 
backend/manager/modules/restapi/types/src/main/java/org/ovirt/engine/api/restapi/types/PermitMapper.java
M 
frontend/webadmin/modules/uicommonweb/src/main/java/org/ovirt/engine/ui/uicommonweb/models/configure/roles_ui/RoleTreeView.java
M 
frontend/webadmin/modules/uicompat/src/main/java/org/ovirt/engine/ui/uicompat/LocalizedEnums.java
M 
frontend/webadmin/modules/uicompat/src/main/java/org/ovirt/engine/ui/uicompat/UIConstants.java
M 
frontend/webadmin/modules/uicompat/src/main/resources/org/ovirt/engine/ui/uicompat/LocalizedEnums.properties
A 
packaging/dbscripts/upgrade/03_04_0320_add_admin_operations_action_groups_and_roles.sql
13 files changed, 153 insertions(+), 76 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/ovirt-engine refs/changes/31/22731/1

diff --git 
a/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/AdminOperationCommandBase.java
 
b/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/AdminOperationCommandBase.java
deleted file mode 100644
index 8964c17..0000000
--- 
a/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/AdminOperationCommandBase.java
+++ /dev/null
@@ -1,70 +0,0 @@
-package org.ovirt.engine.core.bll;
-
-import java.util.Collections;
-import java.util.List;
-
-import org.ovirt.engine.core.bll.utils.PermissionSubject;
-import org.ovirt.engine.core.common.action.VdcActionParametersBase;
-import org.ovirt.engine.core.common.config.Config;
-import org.ovirt.engine.core.common.config.ConfigValues;
-import org.ovirt.engine.core.common.errors.VdcBllMessages;
-import org.ovirt.engine.core.utils.log.Log;
-import org.ovirt.engine.core.utils.log.LogFactory;
-
-/**
- * This class implements IsUserAuthorizedToRunAction() so only admin users can
- * execute it without explicit permissions given for users, Any command that 
can
- * be executed by administrators and there are no permission for should extend
- * this class for example - no permissions can be given on tags and only admin
- * users can manipulate tags
- *
- * 'admin user' logic is in MultiLevelAdministrationHandler.isAdminUser method
- *
- */
-public abstract class AdminOperationCommandBase<T extends 
VdcActionParametersBase> extends CommandBase<T> {
-
-    private static Log log = 
LogFactory.getLog(AdminOperationCommandBase.class);
-
-    protected AdminOperationCommandBase(T parameters) {
-        super(parameters);
-    }
-
-    protected AdminOperationCommandBase() {
-    }
-
-    /**
-     * Check if current user is admin according to
-     * MultiLevelAdministrationHandler.isAdminUser
-     *
-     */
-    @Override
-    protected boolean isUserAuthorizedToRunAction() {
-        if (isInternalExecution() || !Config.<Boolean> 
getValue(ConfigValues.IsMultilevelAdministrationOn)) {
-            if (log.isDebugEnabled()) {
-                log.debugFormat(
-                        "IsUserAuthorizedToRunAction: Internal action or MLA 
is off - permission check skipped for action {0}",
-                        getActionType());
-            }
-            return true;
-        }
-
-        if (getCurrentUser() != null) {
-            if (MultiLevelAdministrationHandler.isAdminUser(getCurrentUser())) 
{
-                return true;
-            }
-            
addCanDoActionMessage(VdcBllMessages.USER_NOT_AUTHORIZED_TO_PERFORM_ACTION);
-            return false;
-        } // user not logged in
-        else {
-            addCanDoActionMessage(VdcBllMessages.USER_IS_NOT_LOGGED_IN);
-            return false;
-        }
-    }
-
-    @Override
-    public List<PermissionSubject> getPermissionCheckSubjects() {
-        // Not needed for admin operations.
-        return Collections.emptyList();
-    }
-
-}
diff --git 
a/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/BookmarkCommandBase.java
 
b/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/BookmarkCommandBase.java
index 8b40c3d..ce9d7a0 100644
--- 
a/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/BookmarkCommandBase.java
+++ 
b/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/BookmarkCommandBase.java
@@ -1,12 +1,18 @@
 package org.ovirt.engine.core.bll;
 
+import org.ovirt.engine.core.bll.utils.PermissionSubject;
+import org.ovirt.engine.core.common.VdcObjectType;
 import org.ovirt.engine.core.common.action.BookmarksParametersBase;
+import org.ovirt.engine.core.common.businessentities.ActionGroup;
 import org.ovirt.engine.core.common.businessentities.Bookmark;
 import org.ovirt.engine.core.common.errors.VdcBllMessages;
 import org.ovirt.engine.core.compat.Guid;
 import org.ovirt.engine.core.dal.dbbroker.DbFacade;
 
-public abstract class BookmarkCommandBase<T extends BookmarksParametersBase> 
extends AdminOperationCommandBase<T> {
+import java.util.Collections;
+import java.util.List;
+
+public abstract class BookmarkCommandBase<T extends BookmarksParametersBase> 
extends CommandBase<T> {
     private Bookmark mBookmark;
     private String mBookmarkName;
 
@@ -53,4 +59,12 @@
     protected void addInvalidIdErrorMessages(VdcBllMessages 
messageActionTypeParameter) {
         addErrorMessages(messageActionTypeParameter, 
VdcBllMessages.ACTION_TYPE_FAILED_BOOKMARK_INVALID_ID);
     }
+
+    @Override
+    public List<PermissionSubject> getPermissionCheckSubjects() {
+        return Collections.singletonList(new PermissionSubject(Guid.SYSTEM,
+                VdcObjectType.System,
+                ActionGroup.BOOKMARK_MANAGEMENT));
+    }
+
 }
diff --git 
a/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/EventSubscriptionCommandBase.java
 
b/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/EventSubscriptionCommandBase.java
index 96a4e40..9437a85 100644
--- 
a/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/EventSubscriptionCommandBase.java
+++ 
b/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/EventSubscriptionCommandBase.java
@@ -1,21 +1,26 @@
 package org.ovirt.engine.core.bll;
 
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 
 import org.apache.commons.lang.StringUtils;
+import org.ovirt.engine.core.bll.utils.PermissionSubject;
 import org.ovirt.engine.core.common.EventNotificationMethods;
+import org.ovirt.engine.core.common.VdcObjectType;
 import org.ovirt.engine.core.common.action.EventSubscriptionParametesBase;
+import org.ovirt.engine.core.common.businessentities.ActionGroup;
 import org.ovirt.engine.core.common.businessentities.DbUser;
 import org.ovirt.engine.core.common.businessentities.EventNotificationMethod;
 import org.ovirt.engine.core.common.businessentities.event_subscriber;
 import org.ovirt.engine.core.common.businessentities.Tags;
 import org.ovirt.engine.core.common.errors.VdcBllMessages;
+import org.ovirt.engine.core.compat.Guid;
 import org.ovirt.engine.core.compat.Regex;
 import org.ovirt.engine.core.dal.dbbroker.DbFacade;
 
 public abstract class EventSubscriptionCommandBase<T extends 
EventSubscriptionParametesBase> extends
-        AdminOperationCommandBase<T> {
+        CommandBase<T> {
     protected EventSubscriptionCommandBase(T parameters) {
         super(parameters);
     }
@@ -160,4 +165,12 @@
         }
         return retValue;
     }
+
+    @Override
+    public List<PermissionSubject> getPermissionCheckSubjects() {
+        return Collections.singletonList(new PermissionSubject(Guid.SYSTEM,
+                VdcObjectType.System,
+                ActionGroup.EVENT_NOTIFICATION_MANAGEMENT));
+    }
+
 }
diff --git 
a/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/PredefinedRoles.java
 
b/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/PredefinedRoles.java
index 855202d..41dcb5d 100644
--- 
a/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/PredefinedRoles.java
+++ 
b/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/PredefinedRoles.java
@@ -23,7 +23,10 @@
     TEMPLATE_OWNER(new Guid("DEF0000A-0000-0000-0000-DEF00000000F")),
     VNIC_PROFILE_USER(new Guid("DEF0000A-0000-0000-0000-DEF000000010")),
     INSTANCE_CREATOR(new Guid("DEF00011-0000-0000-0000-DEF000000011")),
-    INSTANCE_OPERATOR(new Guid("DEF00012-0000-0000-0000-DEF000000012"));
+    INSTANCE_OPERATOR(new Guid("DEF00012-0000-0000-0000-DEF000000012")),
+    TAG_ADMIN(new Guid("DEF00011-0000-0000-0000-DEF000000013")),
+    BOOKMARK_ADMIN(new Guid("DEF00011-0000-0000-0000-DEF000000014")),
+    EVENT_NOTIFICATION_ADMIN(new Guid("DEF00011-0000-0000-0000-DEF000000015"));
 
     private Guid id;
 
diff --git 
a/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/TagsCommandBase.java
 
b/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/TagsCommandBase.java
index b33a078..b679c50 100644
--- 
a/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/TagsCommandBase.java
+++ 
b/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/TagsCommandBase.java
@@ -1,11 +1,17 @@
 package org.ovirt.engine.core.bll;
 
+import org.ovirt.engine.core.bll.utils.PermissionSubject;
+import org.ovirt.engine.core.common.VdcObjectType;
 import org.ovirt.engine.core.common.action.TagsActionParametersBase;
+import org.ovirt.engine.core.common.businessentities.ActionGroup;
 import org.ovirt.engine.core.common.businessentities.Tags;
 import org.ovirt.engine.core.compat.Guid;
 import org.ovirt.engine.core.dal.dbbroker.DbFacade;
 
-public abstract class TagsCommandBase<T extends TagsActionParametersBase> 
extends AdminOperationCommandBase<T> {
+import java.util.Collections;
+import java.util.List;
+
+public abstract class TagsCommandBase<T extends TagsActionParametersBase> 
extends CommandBase<T> {
     private Tags mTag = null;
     protected boolean noActionDone = true;
 
@@ -28,4 +34,12 @@
         super(parameters);
 
     }
+
+    @Override
+    public List<PermissionSubject> getPermissionCheckSubjects() {
+        return Collections.singletonList(new PermissionSubject(Guid.SYSTEM,
+                VdcObjectType.System,
+                ActionGroup.TAG_MANAGEMENT));
+    }
+
 }
diff --git 
a/backend/manager/modules/common/src/main/java/org/ovirt/engine/core/common/businessentities/ActionGroup.java
 
b/backend/manager/modules/common/src/main/java/org/ovirt/engine/core/common/businessentities/ActionGroup.java
index 2ee2a2c..34c07cb 100644
--- 
a/backend/manager/modules/common/src/main/java/org/ovirt/engine/core/common/businessentities/ActionGroup.java
+++ 
b/backend/manager/modules/common/src/main/java/org/ovirt/engine/core/common/businessentities/ActionGroup.java
@@ -119,8 +119,16 @@
     INJECT_EXTERNAL_EVENTS(1400, RoleType.ADMIN, VdcObjectType.Event, false),
 
     // Inject external tasks action group
-    INJECT_EXTERNAL_TASKS(1500, RoleType.ADMIN, VdcObjectType.ExternalTask, 
false);
+    INJECT_EXTERNAL_TASKS(1500, RoleType.ADMIN, VdcObjectType.ExternalTask, 
false),
 
+    // Tag management action group
+    TAG_MANAGEMENT(1301, RoleType.ADMIN, VdcObjectType.Tags, false),
+
+    // Bookmark management action group
+    BOOKMARK_MANAGEMENT(1302, RoleType.ADMIN, VdcObjectType.Bookmarks, false),
+
+    // Event notification management action group
+    EVENT_NOTIFICATION_MANAGEMENT(1303, RoleType.ADMIN, 
VdcObjectType.EventNotification, false);
 
     private int id;
     private RoleType roleType;
diff --git 
a/backend/manager/modules/restapi/interface/definition/src/main/java/org/ovirt/engine/api/model/PermitType.java
 
b/backend/manager/modules/restapi/interface/definition/src/main/java/org/ovirt/engine/api/model/PermitType.java
index d40c506..433aa91 100644
--- 
a/backend/manager/modules/restapi/interface/definition/src/main/java/org/ovirt/engine/api/model/PermitType.java
+++ 
b/backend/manager/modules/restapi/interface/definition/src/main/java/org/ovirt/engine/api/model/PermitType.java
@@ -107,7 +107,10 @@
     // Login action group
     LOGIN,
     INJECT_EXTERNAL_EVENTS,
-    INJECT_EXTERNAL_TASKS;
+    INJECT_EXTERNAL_TASKS,
+    TAG_MANAGEMENT,
+    BOOKMARK_MANAGEMENT,
+    EVENT_NOTIFICATION_MANAGEMENT;
 
     public String value() {
         return name().toLowerCase();
diff --git 
a/backend/manager/modules/restapi/types/src/main/java/org/ovirt/engine/api/restapi/types/PermitMapper.java
 
b/backend/manager/modules/restapi/types/src/main/java/org/ovirt/engine/api/restapi/types/PermitMapper.java
index 7900e63..459b4ba 100644
--- 
a/backend/manager/modules/restapi/types/src/main/java/org/ovirt/engine/api/restapi/types/PermitMapper.java
+++ 
b/backend/manager/modules/restapi/types/src/main/java/org/ovirt/engine/api/restapi/types/PermitMapper.java
@@ -180,6 +180,12 @@
             return PermitType.INJECT_EXTERNAL_TASKS;
         case ACCESS_IMAGE_STORAGE:
             return PermitType.ACCESS_IMAGE_STORAGE;
+        case TAG_MANAGEMENT:
+            return PermitType.TAG_MANAGEMENT;
+        case BOOKMARK_MANAGEMENT:
+            return PermitType.BOOKMARK_MANAGEMENT;
+        case EVENT_NOTIFICATION_MANAGEMENT:
+            return PermitType.EVENT_NOTIFICATION_MANAGEMENT;
         default:
             return null;
         }
diff --git 
a/frontend/webadmin/modules/uicommonweb/src/main/java/org/ovirt/engine/ui/uicommonweb/models/configure/roles_ui/RoleTreeView.java
 
b/frontend/webadmin/modules/uicommonweb/src/main/java/org/ovirt/engine/ui/uicommonweb/models/configure/roles_ui/RoleTreeView.java
index 9d60713..09f9ea2 100644
--- 
a/frontend/webadmin/modules/uicommonweb/src/main/java/org/ovirt/engine/ui/uicommonweb/models/configure/roles_ui/RoleTreeView.java
+++ 
b/frontend/webadmin/modules/uicommonweb/src/main/java/org/ovirt/engine/ui/uicommonweb/models/configure/roles_ui/RoleTreeView.java
@@ -287,6 +287,9 @@
                                 new RoleNode(ActionGroup.MANIPULATE_ROLES,
                                         
getConstants().allowToDefineConfigureRolesInTheSystemRoleTreeTooltip()),
                                 new RoleNode(ActionGroup.LOGIN, 
getConstants().allowToLoginToTheSystemRoleTreeTooltip()),
+                                new RoleNode(ActionGroup.TAG_MANAGEMENT, 
getConstants().allowToManageTags()),
+                                new RoleNode(ActionGroup.BOOKMARK_MANAGEMENT, 
getConstants().allowToManageBookmarks()),
+                                new 
RoleNode(ActionGroup.EVENT_NOTIFICATION_MANAGEMENT, 
getConstants().allowToManageEventNotifications()),
                                 new RoleNode(ActionGroup.CONFIGURE_ENGINE,
                                         
getConstants().allowToGetOrSetSystemConfigurationRoleTreeTooltip()) }));
     }
diff --git 
a/frontend/webadmin/modules/uicompat/src/main/java/org/ovirt/engine/ui/uicompat/LocalizedEnums.java
 
b/frontend/webadmin/modules/uicompat/src/main/java/org/ovirt/engine/ui/uicompat/LocalizedEnums.java
index 96ae1d8..53ea881 100644
--- 
a/frontend/webadmin/modules/uicompat/src/main/java/org/ovirt/engine/ui/uicompat/LocalizedEnums.java
+++ 
b/frontend/webadmin/modules/uicompat/src/main/java/org/ovirt/engine/ui/uicompat/LocalizedEnums.java
@@ -144,6 +144,12 @@
 
     String ActionGroup___LOGIN();
 
+    String ActionGroup___TAG_MANAGEMENT();
+
+    String ActionGroup___BOOKMARK_MANAGEMENT();
+
+    String ActionGroup___EVENT_NOTIFICATION_MANAGEMENT();
+
     String ActionGroup___MANIPULATE_ROLES();
 
     String ActionGroup___CONFIGURE_STORAGE_POOL_NETWORK();
diff --git 
a/frontend/webadmin/modules/uicompat/src/main/java/org/ovirt/engine/ui/uicompat/UIConstants.java
 
b/frontend/webadmin/modules/uicompat/src/main/java/org/ovirt/engine/ui/uicompat/UIConstants.java
index 4a5dd7b..f370295 100644
--- 
a/frontend/webadmin/modules/uicompat/src/main/java/org/ovirt/engine/ui/uicompat/UIConstants.java
+++ 
b/frontend/webadmin/modules/uicompat/src/main/java/org/ovirt/engine/ui/uicompat/UIConstants.java
@@ -1057,6 +1057,15 @@
     @DefaultStringValue("Allow to login to the system")
     String allowToLoginToTheSystemRoleTreeTooltip();
 
+    @DefaultStringValue("Allow to manage Tags")
+    String allowToManageTags();
+
+    @DefaultStringValue("Allow to manage Bookmarks")
+    String allowToManageBookmarks();
+
+    @DefaultStringValue("Allow to manage Event Notifications")
+    String allowToManageEventNotifications();
+
     @DefaultStringValue("Allow to define/configure roles in the System")
     String allowToDefineConfigureRolesInTheSystemRoleTreeTooltip();
 
diff --git 
a/frontend/webadmin/modules/uicompat/src/main/resources/org/ovirt/engine/ui/uicompat/LocalizedEnums.properties
 
b/frontend/webadmin/modules/uicompat/src/main/resources/org/ovirt/engine/ui/uicompat/LocalizedEnums.properties
index 71719e9..baee1da 100644
--- 
a/frontend/webadmin/modules/uicompat/src/main/resources/org/ovirt/engine/ui/uicompat/LocalizedEnums.properties
+++ 
b/frontend/webadmin/modules/uicompat/src/main/resources/org/ovirt/engine/ui/uicompat/LocalizedEnums.properties
@@ -68,6 +68,9 @@
 ActionGroup___MANIPULATE_USERS=Manipulate Users
 ActionGroup___MANIPULATE_PERMISSIONS=Manipulate Permissions
 ActionGroup___LOGIN=Login Permissions
+ActionGroup___TAG_MANAGEMENT=Tag management Permissions
+ActionGroup___BOOKMARK_MANAGEMENT=Bookmark management Permissions
+ActionGroup___EVENT_NOTIFICATION_MANAGEMENT=Event notification management 
Permissions
 ActionGroup___MANIPULATE_ROLES=Manipulate Roles
 ActionGroup___CONFIGURE_STORAGE_POOL_NETWORK=Edit Properties
 ActionGroup___CREATE_STORAGE_POOL_NETWORK=Create
diff --git 
a/packaging/dbscripts/upgrade/03_04_0320_add_admin_operations_action_groups_and_roles.sql
 
b/packaging/dbscripts/upgrade/03_04_0320_add_admin_operations_action_groups_and_roles.sql
new file mode 100644
index 0000000..928b38d
--- /dev/null
+++ 
b/packaging/dbscripts/upgrade/03_04_0320_add_admin_operations_action_groups_and_roles.sql
@@ -0,0 +1,65 @@
+CREATE OR REPLACE FUNCTION __temp_add_admin_operations_action_groups()
+  RETURNS void AS
+$BODY$
+   DECLARE
+      v_roles_to_filter_out uuid[];
+      v_TAG_MANAGER_ROLE_ID uuid;
+      v_BOOKMARK_MANAGER_ROLE_ID uuid;
+      v_EVENT_NOTIFICATION_MANAGER_ROLE_ID uuid;
+BEGIN
+   v_TAG_MANAGER_ROLE_ID := 'DEF00011-0000-0000-0000-DEF000000013';
+   v_BOOKMARK_MANAGER_ROLE_ID := 'DEF00011-0000-0000-0000-DEF000000014';
+   v_EVENT_NOTIFICATION_MANAGER_ROLE_ID := 
'DEF00011-0000-0000-0000-DEF000000015';
+
+   -- We only add these action groups to ADMIN roles that have an action group 
that isn't the login permissions one
+   v_roles_to_filter_out := array(select id from roles where role_type = 2 or 
(exists (select * from roles_groups where role_id = id) and not exists (select 
* from roles_groups where role_id = id and action_group_id != 1300)));
+
+   -- Adding the TAG_MANAGEMENT action group
+   perform fn_db_grant_action_group_to_all_roles_filter(1301, 
v_roles_to_filter_out);
+
+   -- Adding the BOOKMARK_MANAGEMENT action group
+   perform fn_db_grant_action_group_to_all_roles_filter(1302, 
v_roles_to_filter_out);
+
+   -- Adding the EVENT_NOTIFICATION_MANAGEMENT action group
+   perform fn_db_grant_action_group_to_all_roles_filter(1303, 
v_roles_to_filter_out);
+
+   -- Adding the TagManager role
+   DELETE FROM roles_groups WHERE role_id = v_TAG_MANAGER_ROLE_ID;
+
+   INSERT INTO roles(id, name, description, is_readonly, role_type, 
allows_viewing_children, app_mode) SELECT v_TAG_MANAGER_ROLE_ID, 'TagManager', 
'Tag Manager', true, 1, false, 255
+   WHERE NOT EXISTS (SELECT id
+                     FROM roles
+                     WHERE id = v_TAG_MANAGER_ROLE_ID);
+
+   INSERT INTO roles_groups values(v_TAG_MANAGER_ROLE_ID, 1301);
+   INSERT INTO roles_groups values(v_TAG_MANAGER_ROLE_ID, 1300);
+
+   -- Adding the BookmarkManager role
+   DELETE FROM roles_groups WHERE role_id = v_BOOKMARK_MANAGER_ROLE_ID;
+
+   INSERT INTO roles(id, name, description, is_readonly, role_type, 
allows_viewing_children, app_mode) SELECT v_BOOKMARK_MANAGER_ROLE_ID, 
'BookmarkManager', 'Bookmark Manager', true, 1, false, 255
+   WHERE NOT EXISTS (SELECT id
+                     FROM roles
+                     WHERE id = v_BOOKMARK_MANAGER_ROLE_ID);
+
+   INSERT INTO roles_groups values(v_BOOKMARK_MANAGER_ROLE_ID, 1302);
+   INSERT INTO roles_groups values(v_BOOKMARK_MANAGER_ROLE_ID, 1300);
+
+   -- Adding the EventNotificationManager role
+   DELETE FROM roles_groups WHERE role_id = 
v_EVENT_NOTIFICATION_MANAGER_ROLE_ID;
+
+   INSERT INTO roles(id, name, description, is_readonly, role_type, 
allows_viewing_children, app_mode) SELECT v_EVENT_NOTIFICATION_MANAGER_ROLE_ID, 
'EventNotificationManager', 'Event Notification Manager', true, 1, false, 255
+   WHERE NOT EXISTS (SELECT id
+                     FROM roles
+                     WHERE id = v_EVENT_NOTIFICATION_MANAGER_ROLE_ID);
+
+   INSERT INTO roles_groups values(v_EVENT_NOTIFICATION_MANAGER_ROLE_ID, 1303);
+   INSERT INTO roles_groups values(v_EVENT_NOTIFICATION_MANAGER_ROLE_ID, 1300);
+
+END; $BODY$
+
+LANGUAGE plpgsql;
+
+select __temp_add_admin_operations_action_groups();
+drop function __temp_add_admin_operations_action_groups();
+


-- 
To view, visit http://gerrit.ovirt.org/22731
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I477bca5703f59c67914e6395118e29d53fa7d007
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-engine
Gerrit-Branch: master
Gerrit-Owner: Oved Ourfali <[email protected]>
_______________________________________________
Engine-patches mailing list
[email protected]
http://lists.ovirt.org/mailman/listinfo/engine-patches

Reply via email to