Merge branch 'main' into ghi7297-messages

Author: DaanHoogland

.asf.yaml

@@ -58,6 +58,7 @@ github:
     - GaOrtiga
     - bhouse-nexthop
     - Dogface2k
+    - prashanthr2
 
   rulesets:
     - name: "Default Branch Protection"
@@ -73,7 +74,7 @@ github:
 
   copilot_code_review:
     enabled: true
-    review_drafts: true
+    review_drafts: false
     review_on_push: true
 
 notifications:

.github/linters/codespell.txt

@@ -184,6 +184,8 @@ environmnet
 equivalant
 erro
 erronous
+errorprone
+everthing
 everytime
 excute
 execept

.github/workflows/rat.yml

@@ -41,7 +41,7 @@ jobs:
         uses: ./.github/actions/install-nonoss
       - name: RAT licence checks
         run: |
-          mvn -P developer,systemvm -Dsimulator -Dnoredist -pl . org.apache.rat:apache-rat-plugin:0.12:check
+          mvn -P developer,systemvm -Dsimulator -Dnoredist -pl . org.apache.rat:apache-rat-plugin:0.18:check
       - name: Rat Report
         if: always()
         run: |

agent/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.23.0.0-SNAPSHOT</version>
+        <version>4.24.0.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>

agent/src/main/java/com/cloud/agent/mockvm/MockVmMgr.java

@@ -249,7 +249,7 @@ public void freeVncPort(int port) {
     public MockVm createVmFromSpec(VirtualMachineTO vmSpec) {
         String vmName = vmSpec.getName();
         long ramSize = vmSpec.getMinRam();
-        int utilizationPercent = randSeed.nextInt() % 100;
+        int utilizationPercent = randSeed.nextInt(100);
         MockVm vm = null;
 
         synchronized (this) {

api/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.23.0.0-SNAPSHOT</version>
+        <version>4.24.0.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>

api/src/main/java/com/cloud/projects/ProjectService.java

@@ -23,6 +23,7 @@
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.projects.ProjectAccount.Role;
 import com.cloud.user.Account;
+import com.cloud.user.User;
 
 public interface ProjectService {
     /**
@@ -102,4 +103,5 @@ public interface ProjectService {
 
     boolean addUserToProject(Long projectId, String username, String email, Long projectRoleId, Role projectRole) throws ResourceAllocationException;
 
+    void moveProjectAssociationsToUser(User oldUser, User newUser) throws ResourceAllocationException;
 }

api/src/main/java/com/cloud/user/AccountService.java

@@ -185,4 +185,6 @@ User createUser(String userName, String password, String firstName, String lastN
     String getAccessingApiKey(BaseCmd cmd);
 
     List<RolePermissionEntity> getAllKeypairPermissions(String apiKey);
+
+    List<? extends ApiKeyPairPermission> getAllExplicitKeyPairPermissions(Long keyPairId);
 }

api/src/main/java/com/cloud/vm/VirtualMachineProfile.java

@@ -79,6 +79,7 @@ public static class Param {
         public static final Param PreserveNics = new Param("PreserveNics");
         public static final Param ConsiderLastHost = new Param("ConsiderLastHost");
         public static final Param ReturnAfterVolumePrepare = new Param("ReturnAfterVolumePrepare");
+        public static final Param ResetPasswordOnRestore = new Param("ResetPasswordOnRestore");
 
         private String name;
 

api/src/main/java/org/apache/cloudstack/acl/APIChecker.java

@@ -17,23 +17,30 @@
 package org.apache.cloudstack.acl;
 
 import com.cloud.exception.PermissionDeniedException;
+import com.cloud.exception.RequestLimitException;
 import com.cloud.user.Account;
 import com.cloud.user.User;
 import com.cloud.utils.component.Adapter;
+import org.apache.cloudstack.acl.apikeypair.ApiKeyPair;
 import org.apache.cloudstack.acl.apikeypair.ApiKeyPairPermission;
 
+import java.util.ArrayList;
 import java.util.List;
 
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
 /**
  * APICheckers is designed to verify the ownership of resources and to control the access to APIs.
  */
 public interface APIChecker extends Adapter {
+    Logger LOGGER = LogManager.getLogger(APIChecker.class);
     // Interface for checking access for a role using apiname
     // If true, apiChecker has checked the operation
     // If false, apiChecker is unable to handle the operation or not implemented
     // On exception, checkAccess failed don't allow
-    boolean checkAccess(User user, String apiCommandName, ApiKeyPairPermission... apiKeyPairPermissions) throws PermissionDeniedException;
-    boolean checkAccess(Account account, String apiCommandName, ApiKeyPairPermission... apiKeyPairPermissions) throws PermissionDeniedException;
+    boolean checkAccess(User user, String apiCommandName, ApiKeyPair keyPair, ApiKeyPairPermission... apiKeyPairPermissions) throws PermissionDeniedException;
+    boolean checkAccess(Account account, String apiCommandName, ApiKeyPair keyPair, ApiKeyPairPermission... apiKeyPairPermissions) throws PermissionDeniedException;
     /**
      * Verifies if the account has permission for the given list of APIs and returns only the allowed ones.
      *
@@ -43,6 +50,28 @@ public interface APIChecker extends Adapter {
      * @return the list of allowed apis for the given user
      */
     List<String> getApisAllowedToUser(Role role, User user, List<String> apiNames) throws PermissionDeniedException;
+
+    default List<String> getApisAllowedToAccount(Account account, List<String> apiNames) {
+        List<String> allowedApis = new ArrayList<>();
+        for (String apiName : apiNames) {
+            try {
+                checkAccess(account, apiName, null);
+                allowedApis.add(apiName);
+            } catch (RequestLimitException e) {
+                // Non-ACL failure (e.g. rate limiting) should not be treated as simple "not allowed".
+                // Propagate as unchecked so callers are aware of the failure.
+                throw new RuntimeException("Failed to check access for API [" + apiName + "] due to request limits", e);
+            } catch (PermissionDeniedException e) {
+                LOGGER.trace("Account [" + account + "] is not allowed to access API [" + apiName + "]");
+            }
+        }
+        return allowedApis;
+    }
+
     boolean isEnabled();
     List<RolePermissionEntity> getImplicitRolePermissions(RoleType roleType);
+
+    default void refreshRoleCacheOnPermissionsChange(Role role) {
+        // Only applicable for dynamic role based checkers
+    }
 }