#    Licensed under the Apache License, Version 2.0 (the "License"); you may
#    not use this file except in compliance with the License. You may obtain
#    a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.

from oslo_policy import policy

from manila.policies import base


BASE_POLICY_NAME = 'service:%s'


service_policies = [
    policy.DocumentedRuleDefault(
        name=BASE_POLICY_NAME % 'index',
        check_str=base.RULE_ADMIN_API,
        description="Return a list of all running services.",
        operations=[
            {
                'method': 'GET',
                'path': '/os-services',
            },
            {
                'method': 'GET',
                'path': '/os-services?{query}',
            },
            {
                'method': 'GET',
                'path': '/services',
            },
            {
                'method': 'GET',
                'path': '/services?{query}',
            }
        ]),
    policy.DocumentedRuleDefault(
        name=BASE_POLICY_NAME % 'update',
        check_str=base.RULE_ADMIN_API,
        description="Enable/Disable scheduling for a service.",
        operations=[
            {
                'method': 'PUT',
                'path': '/os-services/disable',
            },
            {
                'method': 'PUT',
                'path': '/os-services/enable',
            },
            {
                'method': 'PUT',
                'path': '/services/disable',
            },
            {
                'method': 'PUT',
                'path': '/services/enable',
            },
        ]),
]


def list_rules():
    return service_policies

@@ -566,16 +566,50 @@
 cense.%0A%0A
+from oslo_log import versionutils%0A
 from osl
@@ -631,16 +631,16 @@
  policy%0A
-
 %0Afrom ma
@@ -700,16 +700,355 @@
 ce:%25s'%0A%0A
+DEPRECATED_REASON = %22%22%22%0AThe service API now supports system scope and default roles.%0A%22%22%22%0A%0Adeprecated_service_index = policy.DeprecatedRule(%0A    name=BASE_POLICY_NAME %25 'index',%0A    check_str=base.RULE_ADMIN_API%0A)%0Adeprecated_service_update = policy.DeprecatedRule(%0A    name=BASE_POLICY_NAME %25 'update',%0A    check_str=base.RULE_ADMIN_API%0A)%0A%0A
 %0Aservice
@@ -1155,38 +1155,69 @@
 ck_str=base.
-RULE_ADMIN_API
+SYSTEM_READER,%0A        scope_types=%5B'system'%5D
 ,%0A        de
@@ -1715,16 +1715,174 @@
        %5D
+,%0A        deprecated_rule=deprecated_service_index,%0A        deprecated_reason=DEPRECATED_REASON,%0A        deprecated_since=versionutils.deprecated.WALLABY%0A    
 ),%0A    p
@@ -1975,30 +1975,60 @@
 tr=base.
-RULE_ADMIN_API
+SYSTEM_ADMIN,%0A        scope_types=%5B'system'%5D
 ,%0A      
@@ -2530,32 +2530,32 @@
 %0A            %7D,%0A
-
         %5D),%0A%5D%0A%0A%0A
@@ -2547,16 +2547,175 @@
        %5D
+,%0A        deprecated_rule=deprecated_service_update,%0A        deprecated_reason=DEPRECATED_REASON,%0A        deprecated_since=versionutils.deprecated.WALLABY%0A    
 ),%0A%5D%0A%0A%0Ad

Implement secure RBAC for services