NAS-133519 / 25.04 / require role_prefix for public CRUD / Config ser…

…vices (#15374)

This commit adds a role_prefix for all public CRUDService and
ConfigService plugins, and raises an exception in a plugin
of this type is created without a defined role_prefix.

src/middlewared/middlewared/plugins/acme_protocol.py

@@ -206,6 +206,7 @@ class Config:
         datastore = 'system.acmednsauthenticator'
         cli_namespace = 'system.acme.dns_auth'
         entry = ACMEDNSAuthenticatorEntry
+        role_prefix = 'NETWORK_INTERFACE'
 
     @private
     async def common_validation(self, data, schema_name, old=None):

src/middlewared/middlewared/plugins/auth_/2fa.py

@@ -37,6 +37,7 @@ class Config:
         datastore_extend = 'auth.twofactor.two_factor_extend'
         namespace = 'auth.twofactor'
         cli_namespace = 'auth.two_factor'
+        role_prefix = 'SYSTEM_SECURITY'
 
     ENTRY = Dict(
         'auth_twofactor_entry',

src/middlewared/middlewared/plugins/cron.py

@@ -38,6 +38,7 @@ class Config:
         namespace = 'cronjob'
         cli_namespace = 'task.cron_job'
         entry = CronJobEntry
+        role_prefix = 'SYSTEM_CRON'
 
     @private
     def cron_extend(self, data):

src/middlewared/middlewared/plugins/disk.py

@@ -48,6 +48,7 @@ class Config:
         event_register = False
         event_send = False
         cli_namespace = 'storage.disk'
+        role_prefix = 'DISK'
 
     ENTRY = Dict(
         'disk_entry',

src/middlewared/middlewared/plugins/init_shutdown_script.py

@@ -37,6 +37,7 @@ class Config:
         datastore_extend = 'initshutdownscript.init_shutdown_script_extend'
         cli_namespace = 'system.init_shutdown_script'
         entry = InitShutdownScriptEntry
+        role_prefix = 'SYSTEM_CRON'
 
     @api_method(InitShutdownScriptCreateArgs, InitShutdownScriptCreateResult, roles=['FULL_ADMIN'])
     async def do_create(self, data):

src/middlewared/middlewared/plugins/ipmi_/lan.py

@@ -87,6 +87,7 @@ class IPMILanService(CRUDService):
     class Config:
         namespace = 'ipmi.lan'
         cli_namespace = 'network.ipmi'
+        role_prefix = 'IPMI'
 
     @accepts(roles=['IPMI_READ'])
     @returns(List('lan_channels', items=[Int('lan_channel')]))

src/middlewared/middlewared/plugins/mail.py

@@ -78,6 +78,7 @@ class Config:
         datastore_prefix = 'em_'
         datastore_extend = 'mail.mail_extend'
         cli_namespace = 'system.mail'
+        role_prefix = 'ALERT'
 
     ENTRY = Dict(
         'mail_entry',

src/middlewared/middlewared/plugins/network_/global_config.py

@@ -36,6 +36,7 @@ class Config:
         datastore_prefix = 'gc_'
         datastore_extend = 'network.configuration.network_config_extend'
         cli_namespace = 'network.configuration'
+        role_prefix = 'NETWORK_GENERAL'
 
     ENTRY = Dict(
         'network_configuration_entry',

src/middlewared/middlewared/plugins/network_/static_routes.py

@@ -31,6 +31,7 @@ class Config:
         datastore_prefix = 'sr_'
         cli_namespace = 'network.static_route'
         entry = StaticRouteEntry
+        role_prefix = 'NETWORK_INTERFACE'
 
     @api_method(StaticRouteCreateArgs, StaticRouteCreateResult)
     async def do_create(self, data):

src/middlewared/middlewared/plugins/ntp.py

@@ -100,6 +100,7 @@ class Config:
         datastore_prefix = 'ntp_'
         cli_namespace = 'system.ntp_server'
         entry = NTPServerEntry
+        role_prefix = 'NETWORK_GENERAL'
 
     @api_method(NTPServerCreateArgs, NTPServerCreateResult)
     async def do_create(self, data):

src/middlewared/middlewared/plugins/pool_/user_props.py

@@ -10,6 +10,7 @@ class Config:
         datastore_primary_key_type = 'string'
         namespace = 'pool.dataset.userprop'
         cli_namespace = 'storage.dataset.user_prop'
+        role_prefix = 'DATASET'
 
     ENTRY = Dict(
         'pool_dataset_userprop_entry',

src/middlewared/middlewared/plugins/rsync.py

@@ -128,6 +128,7 @@ class Config:
         datastore_extend = 'rsynctask.rsync_task_extend'
         datastore_extend_context = 'rsynctask.rsync_task_extend_context'
         cli_namespace = 'task.rsync'
+        role_prefix = 'SNAPSHOT_TASK'
 
     ENTRY = Patch(
         'rsync_task_create', 'rsync_task_entry',

src/middlewared/middlewared/plugins/smart.py

@@ -266,6 +266,7 @@ class Config:
         datastore_prefix = 'smarttest_'
         namespace = 'smart.test'
         cli_namespace = 'task.smart_test'
+        role_prefix = 'DISK'
 
     ENTRY = Patch(
         'smart_task_create', 'smart_task_entry',
@@ -773,6 +774,7 @@ class Config:
         datastore_extend = "smart.smart_extend"
         datastore_prefix = "smart_"
         cli_namespace = "service.smart"
+        role_prefix = 'DISK'
 
     ENTRY = Dict(
         'smart_entry',

src/middlewared/middlewared/plugins/snmp.py

@@ -45,6 +45,7 @@ class Config:
         datastore_prefix = 'snmp_'
         cli_namespace = 'service.snmp'
         entry = SnmpEntry
+        role_prefix = 'SYSTEM_GENERAL'
 
     @private
     def get_snmp_users(self):

src/middlewared/middlewared/plugins/ssh.py

@@ -50,6 +50,7 @@ class Config:
         service = "ssh"
         datastore_prefix = "ssh_"
         cli_namespace = 'service.ssh'
+        role_prefix = 'SSH'
 
     ENTRY = Dict(
         'ssh_entry',

src/middlewared/middlewared/plugins/sysdataset.py

@@ -39,6 +39,7 @@ class Config:
         datastore_extend = 'systemdataset.config_extend'
         datastore_prefix = 'sys_'
         cli_namespace = 'system.system_dataset'
+        role_prefix = 'DATASET'
 
     ENTRY = Dict(
         'systemdataset_entry',

src/middlewared/middlewared/plugins/tunables.py

@@ -38,6 +38,7 @@ class Config:
         datastore = 'system.tunable'
         datastore_prefix = 'tun_'
         cli_namespace = 'system.tunable'
+        role_prefix = 'SYSTEM_TUNABLE'
 
     SYSCTLS = set()
 

src/middlewared/middlewared/plugins/ups.py

@@ -83,6 +83,7 @@ class Config:
         service = 'ups'
         service_verb = 'restart'
         cli_namespace = 'service.ups'
+        role_prefix = 'SYSTEM_GENERAL'
 
     @private
     async def ups_config_extend(self, data):

src/middlewared/middlewared/plugins/vmware.py

@@ -34,6 +34,7 @@ class VMWareService(CRUDService):
     class Config:
         datastore = 'storage.vmwareplugin'
         cli_namespace = 'storage.vmware'
+        role_prefix = 'SNAPSHOT_TASK'
 
     ENTRY = Patch(
         "vmware_create",

src/middlewared/middlewared/role.py

@@ -38,6 +38,9 @@ class Role:
     'DIRECTORY_SERVICE_READ': Role(),
     'DIRECTORY_SERVICE_WRITE': Role(includes=['DIRECTORY_SERVICE_READ']),
 
+    'DISK_READ': Role(),
+    'DISK_WRITE': Role(includes=['DISK_READ']),
+
     'KMIP_READ': Role(),
     'KMIP_WRITE': Role(includes=['KMIP_READ']),
 
@@ -61,6 +64,9 @@ class Role:
     'SUPPORT_READ': Role(),
     'SUPPORT_WRITE': Role(includes=['SUPPORT_READ']),
 
+    'SSH_READ': Role(),
+    'SSH_WRITE': Role(includes=['SSH_READ']),
+
     'SYSTEM_AUDIT_READ': Role(),
     'SYSTEM_AUDIT_WRITE': Role(),
 
@@ -89,6 +95,8 @@ class Role:
 
     # Network roles
     'NETWORK_GENERAL_READ': Role(),
+    'NETWORK_GENERAL_WRITE': Role(includes=['NETWORK_GENERAL_READ']),
+
     'NETWORK_INTERFACE_READ': Role(),
     'NETWORK_INTERFACE_WRITE': Role(includes=['NETWORK_INTERFACE_READ']),
 
@@ -220,6 +228,12 @@ class Role:
     'SYSTEM_SECURITY_READ': Role(),
     'SYSTEM_SECURITY_WRITE': Role(includes=['SYSTEM_SECURITY_READ']),
 
+    'SYSTEM_TUNABLE_READ': Role(),
+    'SYSTEM_TUNABLE_WRITE': Role(includes=['SYSTEM_TUNABLE_READ']),
+
+    'SYSTEM_CRON_READ': Role(),
+    'SYSTEM_CRON_WRITE': Role(includes=['SYSTEM_CRON_READ']),
+
     # Virtualization
     'VIRT_GLOBAL_READ': Role(),
     'VIRT_GLOBAL_WRITE': Role(includes=['VIRT_GLOBAL_READ'], stig=None),

src/middlewared/middlewared/service/config_service.py

@@ -36,6 +36,9 @@ def __new__(cls, name, bases, attrs):
         config_entry_key = f'{namespace}_entry'
         config_model_name = f'{namespace.capitalize()}Config'
 
+        if not klass._config.private and not klass._config.role_prefix:
+            raise ValueError(f'{klass._config.namespace}: public ConfigService must have role_prefix defined')
+
         if klass._config.entry is not None and not hasattr(klass.config, 'new_style_accepts'):
             klass.ENTRY = None
             result_model = create_model(

src/middlewared/middlewared/service/crud_service.py

@@ -62,6 +62,9 @@ def __new__(cls, name, bases, attrs):
         ):
             return klass
 
+        if not klass._config.private and not klass._config.role_prefix:
+            raise ValueError(f'{klass._config.namespace}: public CRUDService must have role_prefix defined')
+
         if klass._config.entry is not None:
             # FIXME: This is to prevent `Method cloudsync.credentials.ENTRY is public but has no @accepts()`, remove
             # eventually.