# Path: aodh/api/policies.py
# RULE_CONTEXT_IS_ADMIN = 'rule:context_is_admin'
# RULE_ADMIN_OR_OWNER = 'rule:context_is_admin or project_id:%(project_id)s'
# UNPROTECTED = ''
# SYSTEM_ADMIN = 'role:admin and system_scope:all'
# SYSTEM_READER = 'role:reader and system_scope:all'
# PROJECT_MEMBER = 'role:member and project_id:%(project_id)s'
# PROJECT_READER = 'role:reader and project_id:%(project_id)s'
# SYSTEM_ADMIN_OR_PROJECT_MEMBER = (
#     '(' + SYSTEM_ADMIN + ')'
#     ' or (' + PROJECT_MEMBER + ')'
# )
# SYSTEM_OR_PROJECT_READER = (
#     '(' + SYSTEM_READER + ')'
#     ' or (' + PROJECT_READER + ')'
# )
# DEPRECATED_REASON = """
# The alarm and quota APIs now support system-scope and default roles.
# """
# def list_rules():


from oslo_config import cfg
from oslo_policy import opts
from oslo_policy import policy
from pecan import hooks
from aodh.api import policies
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.



# TODO(gmann): Remove setting the default value of config policy_file
# once oslo_policy change the default value to 'policy.yaml'.
# https://github.com/openstack/oslo.policy/blob/a626ad12fe5a3abd49d70e3e5b95589d279ab578/oslo_policy/opts.py#L49
DEFAULT_POLICY_FILE = 'policy.yaml'
opts.set_defaults(cfg.CONF, DEFAULT_POLICY_FILE)


class ConfigHook(hooks.PecanHook):
    """Attach the configuration and policy enforcer object to the request.

    That allows controllers to get it.
    """

    def __init__(self, conf):
        self.conf = conf
        self.enforcer = policy.Enforcer(conf, default_rule="default")
        # NOTE(gmann): Explictly disable the warnings for policies
        # changing their default check_str. With new RBAC policy
        # work, all the policy defaults have been changed and warning for
        # each policy started filling the logs limit for various tool.
        # Once we move to new defaults only world then we can enable these
        # warning again.
        self.enforcer.suppress_default_change_warnings = True

# Path: aodh/api/policies.py
# RULE_CONTEXT_IS_ADMIN = 'rule:context_is_admin'
# RULE_ADMIN_OR_OWNER = 'rule:context_is_admin or project_id:%(project_id)s'
# UNPROTECTED = ''
# SYSTEM_ADMIN = 'role:admin and system_scope:all'
# SYSTEM_READER = 'role:reader and system_scope:all'
# PROJECT_MEMBER = 'role:member and project_id:%(project_id)s'
# PROJECT_READER = 'role:reader and project_id:%(project_id)s'
# SYSTEM_ADMIN_OR_PROJECT_MEMBER = (
#     '(' + SYSTEM_ADMIN + ')'
#     ' or (' + PROJECT_MEMBER + ')'
# )
# SYSTEM_OR_PROJECT_READER = (
#     '(' + SYSTEM_READER + ')'
#     ' or (' + PROJECT_READER + ')'
# )
# DEPRECATED_REASON = """
# The alarm and quota APIs now support system-scope and default roles.
# """
# def list_rules():


# Path: aodh/api/hooks.py
from oslo_config import cfg
from oslo_policy import opts
from oslo_policy import policy
from pecan import hooks
from aodh.api import policies

# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.



# TODO(gmann): Remove setting the default value of config policy_file
# once oslo_policy change the default value to 'policy.yaml'.
# https://github.com/openstack/oslo.policy/blob/a626ad12fe5a3abd49d70e3e5b95589d279ab578/oslo_policy/opts.py#L49
DEFAULT_POLICY_FILE = 'policy.yaml'
opts.set_defaults(cfg.CONF, DEFAULT_POLICY_FILE)


class ConfigHook(hooks.PecanHook):
    """Attach the configuration and policy enforcer object to the request.

    That allows controllers to get it.
    """

    def __init__(self, conf):
        self.conf = conf
        self.enforcer = policy.Enforcer(conf, default_rule="default")
        # NOTE(gmann): Explictly disable the warnings for policies
        # changing their default check_str. With new RBAC policy
        # work, all the policy defaults have been changed and warning for
        # each policy started filling the logs limit for various tool.
        # Once we move to new defaults only world then we can enable these
        # warning again.
        self.enforcer.suppress_default_change_warnings = True

        self.enforcer.register_defaults(policies.list_rules())