Return HTTP 404 for deleted images in v2

For admin contexts, the db api will return deleted images. This patch
manually checks for deleted images in the v2 controller code to treat
these cases as if the images didn't exist.

Fixes bug 1071446

Change-Id: I33075f94e9d560a279085e2afd18c8052f57d60b

glance/api/v2/images.py

@@ -142,9 +142,12 @@ def index(self, req, marker=None, limit=None, sort_key='created_at',
 
     def _get_image(self, context, image_id):
         try:
-            return self.db_api.image_get(context, image_id)
+            image = self.db_api.image_get(context, image_id)
+            if image['deleted']:
+                raise exception.NotFound()
         except (exception.NotFound, exception.Forbidden):
             raise webob.exc.HTTPNotFound()
+        return image
 
     def show(self, req, image_id):
         self._enforce(req, 'get_image')
@@ -158,6 +161,8 @@ def update(self, req, image_id, changes):
         context = req.context
         try:
             image = self.db_api.image_get(context, image_id)
+            if image['deleted']:
+                raise exception.NotFound()
         except (exception.NotFound, exception.Forbidden):
             msg = ("Failed to find image %(image_id)s to update" % locals())
             LOG.info(msg)

glance/tests/unit/v2/test_images_resource.py

@@ -108,6 +108,20 @@ def test_index(self):
         expected = set([UUID3])
         self.assertEqual(actual, expected)
 
+    def test_index_admin(self):
+        request = unit_test_utils.get_fake_request(is_admin=True)
+        output = self.controller.index(request)
+        self.assertEqual(3, len(output['images']))
+
+    def test_index_admin_deleted_images_hidden(self):
+        request = unit_test_utils.get_fake_request(is_admin=True)
+        self.controller.delete(request, UUID1)
+        output = self.controller.index(request)
+        self.assertEqual(2, len(output['images']))
+        actual = set([image['id'] for image in output['images']])
+        expected = set([UUID2, UUID3])
+        self.assertEqual(actual, expected)
+
     def test_index_return_parameters(self):
         self.config(limit_param_default=1, api_limit_max=3)
         request = unit_test_utils.get_fake_request()
@@ -319,6 +333,12 @@ def test_show_non_existent(self):
         self.assertRaises(webob.exc.HTTPNotFound,
                           self.controller.show, request, image_id)
 
+    def test_show_deleted_image_admin(self):
+        request = unit_test_utils.get_fake_request(is_admin=True)
+        self.controller.delete(request, UUID1)
+        self.assertRaises(webob.exc.HTTPNotFound,
+                          self.controller.show, request, UUID1)
+
     def test_create(self):
         request = unit_test_utils.get_fake_request()
         image = {'name': 'image-1'}
@@ -376,6 +396,12 @@ def test_update_image_doesnt_exist(self):
         self.assertRaises(webob.exc.HTTPNotFound, self.controller.update,
                           request, utils.generate_uuid(), changes=[])
 
+    def test_update_deleted_image_admin(self):
+        request = unit_test_utils.get_fake_request(is_admin=True)
+        self.controller.delete(request, UUID1)
+        self.assertRaises(webob.exc.HTTPNotFound, self.controller.update,
+                          request, UUID1, changes=[])
+
     def test_update_replace_base_attribute(self):
         self.db.image_update(None, UUID1, {'properties': {'foo': 'bar'}})
         request = unit_test_utils.get_fake_request()
@@ -608,6 +634,12 @@ def test_delete_non_existent(self):
         self.assertRaises(webob.exc.HTTPNotFound, self.controller.delete,
                           request, utils.generate_uuid())
 
+    def test_delete_already_deleted_image_admin(self):
+        request = unit_test_utils.get_fake_request(is_admin=True)
+        self.controller.delete(request, UUID1)
+        self.assertRaises(webob.exc.HTTPNotFound,
+                          self.controller.delete, request, UUID1)
+
     def test_index_with_invalid_marker(self):
         fake_uuid = utils.generate_uuid()
         request = unit_test_utils.get_fake_request()