Method validate

st2common/st2common/models/api/rbac.py:168–214

(self)

    }

    def validate(self):
        # Parent JSON schema validation
        cleaned = super(RoleDefinitionFileFormatAPI, self).validate()

        # Custom validation

        # Validate that only the correct permission types are used
        permission_grants = getattr(self, "permission_grants", [])
        for permission_grant in permission_grants:
            resource_uid = permission_grant.get("resource_uid", None)
            permission_types = permission_grant.get("permission_types", [])

            if resource_uid:
                # Permission types which apply to a resource
                resource_type, _ = parse_uid(uid=resource_uid)
                valid_permission_types = (
                    PermissionType.get_valid_permissions_for_resource_type(
                        resource_type=resource_type
                    )
                )

                for permission_type in permission_types:
                    if permission_type not in valid_permission_types:
                        message = (
                            'Invalid permission type "%s" for resource type "%s"'
                            % (
                                permission_type,
                                resource_type,
                            )
                        )
                        raise ValueError(message)
            else:
                # Right now we only support single permission type (list) which is global and
                # doesn't apply to a resource
                for permission_type in permission_types:
                    if permission_type not in GLOBAL_PERMISSION_TYPES:
                        valid_global_permission_types = ", ".join(
                            GLOBAL_PERMISSION_TYPES
                        )
                        message = (
                            'Invalid permission type "%s". Valid global permission types '
                            "which can be used without a resource id are: %s"
                            % (permission_type, valid_global_permission_types)
                        )
                        raise ValueError(message)

        return cleaned


class BaseRoleAssigmentAPI(BaseAPI):