# Path: aodh/api/controllers/v2/base.py
# class ClientSideError(wsme.exc.ClientSideError):
# class ProjectNotAuthorized(ClientSideError):
# class AdvEnum(wtypes.wsproperty):
# class Base(wtypes.DynamicBase):
# class Query(Base):
# class AlarmNotFound(ClientSideError):
# class AlarmRule(Base):
#     def __init__(self, error, status_code=400):
#     def __init__(self, id, aspect='project'):
#     def __init__(self, name, *args, **kwargs):
#     def _get(self, parent):
#     def _set(self, parent, value):
#     def from_db_model(cls, m):
#     def from_db_and_links(cls, m, links):
#     def as_dict(self, db_model):
#     def as_dict_from_keys(self, keys):
#     def to_dict(self):
#     def get_op(self):
#     def set_op(self, value):
#     def __repr__(self):
#     def sample(cls):
#     def as_dict(self):
#     def get_value(self, forced_type=None):
#     def __init__(self, alarm, auth_project):
#     def validate_alarm(alarm):
#     def create_hook(alarm):
#     def update_hook(alarm):
# 
# Path: aodh/api/rbac.py
# def target_from_segregation_rule(headers, enforcer):
# def enforce(policy_name, headers, enforcer, target):
# def get_limited_to(headers, enforcer):
# def get_limited_to_project(headers, enforcer):
# def is_admin(headers):
# 
# Path: aodh/utils.py
# def get_func_valid_keys(func):
#     return inspect.getfullargspec(func)[0]


import copy
import datetime
import pecan
import wsme
from oslo_utils import timeutils
from urllib import parse as urllib_parse
from aodh.api.controllers.v2 import base
from aodh.api import rbac
from aodh.utils import get_func_valid_keys
    # the creating tenant differs from the tenant on whose behalf the
    # alarm is being created
    auth_project = rbac.get_limited_to_project(pecan.request.headers,
                                               pecan.request.enforcer)
    created_by = pecan.request.headers.get('X-Project-Id')
    is_admin = auth_project is None

    if is_admin and on_behalf_of != created_by:
        auth_project = on_behalf_of
    return auth_project


def sanitize_query(query, db_func, on_behalf_of=None):
    """Check the query.

    See if:
    1) the request is coming from admin - then allow full visibility
    2) non-admin - make sure that the query includes the requester's project.
    """
    q = copy.copy(query)

    auth_project = get_auth_project(on_behalf_of)
    if auth_project:
        _verify_query_segregation(q, auth_project)

        proj_q = [i for i in q if i.field == 'project_id']
        valid_keys = get_func_valid_keys(db_func)
        if not proj_q and 'on_behalf_of' not in valid_keys:
            # The user is restricted, but they didn't specify a project
            # so add it for them.

# Path: aodh/api/controllers/v2/base.py
# class ClientSideError(wsme.exc.ClientSideError):
# class ProjectNotAuthorized(ClientSideError):
# class AdvEnum(wtypes.wsproperty):
# class Base(wtypes.DynamicBase):
# class Query(Base):
# class AlarmNotFound(ClientSideError):
# class AlarmRule(Base):
#     def __init__(self, error, status_code=400):
#     def __init__(self, id, aspect='project'):
#     def __init__(self, name, *args, **kwargs):
#     def _get(self, parent):
#     def _set(self, parent, value):
#     def from_db_model(cls, m):
#     def from_db_and_links(cls, m, links):
#     def as_dict(self, db_model):
#     def as_dict_from_keys(self, keys):
#     def to_dict(self):
#     def get_op(self):
#     def set_op(self, value):
#     def __repr__(self):
#     def sample(cls):
#     def as_dict(self):
#     def get_value(self, forced_type=None):
#     def __init__(self, alarm, auth_project):
#     def validate_alarm(alarm):
#     def create_hook(alarm):
#     def update_hook(alarm):
# 
# Path: aodh/api/rbac.py
# def target_from_segregation_rule(headers, enforcer):
# def enforce(policy_name, headers, enforcer, target):
# def get_limited_to(headers, enforcer):
# def get_limited_to_project(headers, enforcer):
# def is_admin(headers):
# 
# Path: aodh/utils.py
# def get_func_valid_keys(func):
#     return inspect.getfullargspec(func)[0]


# Path: aodh/api/controllers/v2/utils.py
import copy
import datetime
import pecan
import wsme
from oslo_utils import timeutils
from urllib import parse as urllib_parse
from aodh.api.controllers.v2 import base
from aodh.api import rbac
from aodh.utils import get_func_valid_keys

    # the creating tenant differs from the tenant on whose behalf the
    # alarm is being created
    auth_project = rbac.get_limited_to_project(pecan.request.headers,
                                               pecan.request.enforcer)
    created_by = pecan.request.headers.get('X-Project-Id')
    is_admin = auth_project is None

    if is_admin and on_behalf_of != created_by:
        auth_project = on_behalf_of
    return auth_project


def sanitize_query(query, db_func, on_behalf_of=None):
    """Check the query.

    See if:
    1) the request is coming from admin - then allow full visibility
    2) non-admin - make sure that the query includes the requester's project.
    """
    q = copy.copy(query)

    auth_project = get_auth_project(on_behalf_of)
    if auth_project:
        _verify_query_segregation(q, auth_project)

        proj_q = [i for i in q if i.field == 'project_id']
        valid_keys = get_func_valid_keys(db_func)
        if not proj_q and 'on_behalf_of' not in valid_keys:
            # The user is restricted, but they didn't specify a project
            # so add it for them.

            q.append(base.Query(field='project_id',