Pass a mutable target to oslo policy enforcer

Magnum API previously passed magnum.objects.cluster.Cluster objects as
the target argument to magnum.common.policy.enforce(). However, enforce()
expects target to be a mutable mapping, as it adds an entry for
trustee_domain_id which is used by the magnum policy.json. This causes
cluster detailed GET requests to fail with the following message:

AttributeError: 'Cluster' object has no attribute 'trustee_domain_id'

This change uses the as_dict() method of the magnum RPC objects to
provide a mutable mapping to the policy enforcer.

Change-Id: I54b136243afff9e0fadae3be4b36cad1679e5721
Closes-Bug: #1689797

magnum/api/controllers/v1/bay.py

@@ -372,7 +372,7 @@ def get_one(self, bay_ident):
         """
         context = pecan.request.context
         bay = api_utils.get_resource('Cluster', bay_ident)
-        policy.enforce(context, 'bay:get', bay,
+        policy.enforce(context, 'bay:get', bay.as_dict(),
                        action='bay:get')
 
         bay = Bay.convert_with_links(bay)
@@ -479,7 +479,7 @@ def patch(self, bay_ident, rollback=False, patch=None):
     def _patch(self, bay_ident, patch):
         context = pecan.request.context
         bay = api_utils.get_resource('Cluster', bay_ident)
-        policy.enforce(context, 'bay:update', bay,
+        policy.enforce(context, 'bay:update', bay.as_dict(),
                        action='bay:update')
         try:
             bay_dict = bay.as_dict()
@@ -529,6 +529,6 @@ def delete(self, bay_ident):
     def _delete(self, bay_ident):
         context = pecan.request.context
         bay = api_utils.get_resource('Cluster', bay_ident)
-        policy.enforce(context, 'bay:delete', bay,
+        policy.enforce(context, 'bay:delete', bay.as_dict(),
                        action='bay:delete')
         return bay

magnum/api/controllers/v1/baymodel.py

@@ -312,7 +312,7 @@ def get_one(self, baymodel_ident):
         context = pecan.request.context
         baymodel = api_utils.get_resource('ClusterTemplate', baymodel_ident)
         if not baymodel.public:
-            policy.enforce(context, 'baymodel:get', baymodel,
+            policy.enforce(context, 'baymodel:get', baymodel.as_dict(),
                            action='baymodel:get')
 
         return BayModel.convert_with_links(baymodel)
@@ -369,7 +369,7 @@ def patch(self, baymodel_ident, patch):
         """
         context = pecan.request.context
         baymodel = api_utils.get_resource('ClusterTemplate', baymodel_ident)
-        policy.enforce(context, 'baymodel:update', baymodel,
+        policy.enforce(context, 'baymodel:update', baymodel.as_dict(),
                        action='baymodel:update')
         try:
             baymodel_dict = baymodel.as_dict()
@@ -410,6 +410,6 @@ def delete(self, baymodel_ident):
         """
         context = pecan.request.context
         baymodel = api_utils.get_resource('ClusterTemplate', baymodel_ident)
-        policy.enforce(context, 'baymodel:delete', baymodel,
+        policy.enforce(context, 'baymodel:delete', baymodel.as_dict(),
                        action='baymodel:delete')
         baymodel.destroy()

magnum/api/controllers/v1/certificate.py

@@ -143,7 +143,7 @@ def get_one(self, cluster_ident):
         """
         context = pecan.request.context
         cluster = api_utils.get_resource('Cluster', cluster_ident)
-        policy.enforce(context, 'certificate:get', cluster,
+        policy.enforce(context, 'certificate:get', cluster.as_dict(),
                        action='certificate:get')
         certificate = pecan.request.rpcapi.get_ca_certificate(cluster)
         return Certificate.convert_with_links(certificate)
@@ -156,7 +156,7 @@ def post(self, certificate):
         """
         context = pecan.request.context
         cluster = certificate.get_cluster()
-        policy.enforce(context, 'certificate:create', cluster,
+        policy.enforce(context, 'certificate:create', cluster.as_dict(),
                        action='certificate:create')
         certificate_dict = certificate.as_dict()
         certificate_dict['project_id'] = context.project_id
@@ -171,7 +171,7 @@ def post(self, certificate):
     def patch(self, cluster_ident):
         context = pecan.request.context
         cluster = api_utils.get_resource('Cluster', cluster_ident)
-        policy.enforce(context, 'certificate:rotate_ca', cluster,
+        policy.enforce(context, 'certificate:rotate_ca', cluster.as_dict(),
                        action='certificate:rotate_ca')
         if cluster.cluster_template.tls_disabled:
             raise exception.NotSupported("Rotating the CA certificate on a "

magnum/api/controllers/v1/cluster.py

@@ -346,7 +346,7 @@ def get_one(self, cluster_ident):
         """
         context = pecan.request.context
         cluster = api_utils.get_resource('Cluster', cluster_ident)
-        policy.enforce(context, 'cluster:get', cluster,
+        policy.enforce(context, 'cluster:get', cluster.as_dict(),
                        action='cluster:get')
 
         cluster = Cluster.convert_with_links(cluster)
@@ -451,7 +451,7 @@ def patch(self, cluster_ident, rollback=False, patch=None):
     def _patch(self, cluster_ident, patch):
         context = pecan.request.context
         cluster = api_utils.get_resource('Cluster', cluster_ident)
-        policy.enforce(context, 'cluster:update', cluster,
+        policy.enforce(context, 'cluster:update', cluster.as_dict(),
                        action='cluster:update')
         try:
             cluster_dict = cluster.as_dict()
@@ -485,7 +485,7 @@ def delete(self, cluster_ident):
         """
         context = pecan.request.context
         cluster = api_utils.get_resource('Cluster', cluster_ident)
-        policy.enforce(context, 'cluster:delete', cluster,
+        policy.enforce(context, 'cluster:delete', cluster.as_dict(),
                        action='cluster:delete')
 
         pecan.request.rpcapi.cluster_delete_async(cluster.uuid)

magnum/api/controllers/v1/cluster_template.py

@@ -320,7 +320,8 @@ def get_one(self, cluster_template_ident):
         cluster_template = api_utils.get_resource('ClusterTemplate',
                                                   cluster_template_ident)
         if not cluster_template.public:
-            policy.enforce(context, 'clustertemplate:get', cluster_template,
+            policy.enforce(context, 'clustertemplate:get',
+                           cluster_template.as_dict(),
                            action='clustertemplate:get')
 
         return ClusterTemplate.convert_with_links(cluster_template)
@@ -383,7 +384,8 @@ def patch(self, cluster_template_ident, patch):
         context = pecan.request.context
         cluster_template = api_utils.get_resource('ClusterTemplate',
                                                   cluster_template_ident)
-        policy.enforce(context, 'clustertemplate:update', cluster_template,
+        policy.enforce(context, 'clustertemplate:update',
+                       cluster_template.as_dict(),
                        action='clustertemplate:update')
         try:
             cluster_template_dict = cluster_template.as_dict()
@@ -427,6 +429,7 @@ def delete(self, cluster_template_ident):
         context = pecan.request.context
         cluster_template = api_utils.get_resource('ClusterTemplate',
                                                   cluster_template_ident)
-        policy.enforce(context, 'clustertemplate:delete', cluster_template,
+        policy.enforce(context, 'clustertemplate:delete',
+                       cluster_template.as_dict(),
                        action='clustertemplate:delete')
         cluster_template.destroy()