# Copyright (c) 2019 Intel Corporation.
#
#    Licensed under the Apache License, Version 2.0 (the "License"); you may
#    not use this file except in compliance with the License. You may obtain
#    a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.
#

from oslo_policy import policy

from neutron.conf.policies import base


COLLECTION_PATH = '/network_segment_ranges'
RESOURCE_PATH = '/network_segment_ranges/{id}'


rules = [
    policy.DocumentedRuleDefault(
        'create_network_segment_range',
        base.RULE_ADMIN_ONLY,
        'Create a network segment range',
        [
            {
                'method': 'POST',
                'path': COLLECTION_PATH,
            },
        ]
    ),
    policy.DocumentedRuleDefault(
        'get_network_segment_range',
        base.RULE_ADMIN_ONLY,
        'Get a network segment range',
        [
            {
                'method': 'GET',
                'path': COLLECTION_PATH,
            },
            {
                'method': 'GET',
                'path': RESOURCE_PATH,
            },
        ]
    ),
    policy.DocumentedRuleDefault(
        'update_network_segment_range',
        base.RULE_ADMIN_ONLY,
        'Update a network segment range',
        [
            {
                'method': 'PUT',
                'path': RESOURCE_PATH,
            },
        ]
    ),
    policy.DocumentedRuleDefault(
        'delete_network_segment_range',
        base.RULE_ADMIN_ONLY,
        'Delete a network segment range',
        [
            {
                'method': 'DELETE',
                'path': RESOURCE_PATH,
            },
        ]
    ),
]


def list_rules():
    return rules

@@ -610,16 +610,50 @@
 nse.%0A#%0A%0A
+from oslo_log import versionutils%0A
 from osl
@@ -716,16 +716,119 @@
 t base%0A%0A
+DEPRECATED_REASON = %22%22%22%0AThe network segment range API now supports system scope and default roles.%0A%22%22%22%0A
 %0ACOLLECT
@@ -965,16 +965,21 @@
         
+name=
 'create_
@@ -1014,38 +1014,89 @@
     
-base.RULE_ADMIN_ONLY,%0A        
+check_str=base.SYSTEM_ADMIN,%0A        scope_types=%5B'system'%5D,%0A        description=
 'Cre
@@ -1125,32 +1125,43 @@
 range',%0A        
+operations=
 %5B%0A            %7B%0A
@@ -1251,32 +1251,276 @@
     %7D,%0A        %5D
+,%0A        deprecated_rule=policy.DeprecatedRule(%0A            name='create_network_segment_range',%0A            check_str=base.RULE_ADMIN_ONLY),%0A        deprecated_reason=DEPRECATED_REASON,%0A        deprecated_since=versionutils.deprecated.WALLABY
 %0A    ),%0A    poli
@@ -1553,16 +1553,21 @@
         
+name=
 'get_net
@@ -1599,38 +1599,90 @@
     
-base.RULE_ADMIN_ONLY,%0A        
+check_str=base.SYSTEM_READER,%0A        scope_types=%5B'system'%5D,%0A        description=
 'Get
@@ -1708,32 +1708,43 @@
 range',%0A        
+operations=
 %5B%0A            %7B%0A
@@ -1934,32 +1934,273 @@
     %7D,%0A        %5D
+,%0A        deprecated_rule=policy.DeprecatedRule(%0A            name='get_network_segment_range',%0A            check_str=base.RULE_ADMIN_ONLY),%0A        deprecated_reason=DEPRECATED_REASON,%0A        deprecated_since=versionutils.deprecated.WALLABY
 %0A    ),%0A    poli
@@ -2233,16 +2233,21 @@
         
+name=
 'update_
@@ -2282,38 +2282,89 @@
     
-base.RULE_ADMIN_ONLY,%0A        
+check_str=base.SYSTEM_ADMIN,%0A        scope_types=%5B'system'%5D,%0A        description=
 'Upd
@@ -2393,32 +2393,43 @@
 range',%0A        
+operations=
 %5B%0A            %7B%0A
@@ -2516,32 +2516,276 @@
     %7D,%0A        %5D
+,%0A        deprecated_rule=policy.DeprecatedRule(%0A            name='update_network_segment_range',%0A            check_str=base.RULE_ADMIN_ONLY),%0A        deprecated_reason=DEPRECATED_REASON,%0A        deprecated_since=versionutils.deprecated.WALLABY
 %0A    ),%0A    poli
@@ -2818,16 +2818,21 @@
         
+name=
 'delete_
@@ -2867,38 +2867,89 @@
     
-base.RULE_ADMIN_ONLY,%0A        
+check_str=base.SYSTEM_ADMIN,%0A        scope_types=%5B'system'%5D,%0A        description=
 'Del
@@ -2986,16 +2986,27 @@
         
+operations=
 %5B%0A      
@@ -3112,16 +3112,260 @@
        %5D
+,%0A        deprecated_rule=policy.DeprecatedRule(%0A            name='delete_network_segment_range',%0A            check_str=base.RULE_ADMIN_ONLY),%0A        deprecated_reason=DEPRECATED_REASON,%0A        deprecated_since=versionutils.deprecated.WALLABY
 %0A    ),%0A

Implement secure RBAC for the network segment range API