plugins/identity/app/controllers/identity/projects/role_assignments_controller.rb
# This method removes obsolete and assigns new roles to project.
This method removes obsolete and assigns new roles to project.
This method removes obsolete and assigns new roles to project .
def update_project_role_assignments(scope_project_id, member_type, member_id, new_roles)
        unless %w[user group].include?(member_type)
          raise StandardError, 'Unknown member type'
        end
        filter_options = {
          'scope.project.id' => scope_project_id, "#{member_type}.id" => member_id
        }
        current_role_assignments = cloud_admin.identity.role_assignments(
          filter_options
        )
        current_roles = current_role_assignments.collect do |role_assignment|
          role_assignment.role['id']
        end
        available_role_ids = available_roles.collect(&:id)
        roles_to_be_added = new_roles - current_roles
        roles_to_be_removed = current_roles - new_roles
        roles_to_be_added.each do |role_id|
          next unless available_role_ids.include?(role_id)
          services.identity.send(
            "grant_project_#{member_type}_role!",
            scope_project_id, member_id, role_id
          )
        end
        roles_to_be_removed.each do |role_id|
          next unless available_role_ids.include?(role_id)
          services.identity.send(
            "revoke_project_#{member_type}_role!",
            scope_project_id, member_id, role_id
          )
        end
        new_role_assignments = cloud_admin.identity.role_assignments(
          filter_options.merge(include_names: true)
        )
        group_and_extend_role_assignments(new_role_assignments)
      end
def update_project_role_assignments ( scope_project_id , member_type , member_id , new_roles ) unless %w[ user group ] . include? ( member_type ) raise StandardError , 'Unknown member type' end filter_options = { 'scope.project.id' => scope_project_id , "#{member_type}.id" => member_id } current_role_assignments = cloud_admin . identity . role_assignments ( filter_options ) current_roles = current_role_assignments . collect do | role_assignment | role_assignment . role [ 'id' ] end available_role_ids = available_roles . collect ( & :id ) roles_to_be_added = new_roles - current_roles roles_to_be_removed = current_roles - new_roles roles_to_be_added . each do | role_id | next unless available_role_ids . include? ( role_id ) services . identity . send ( "grant_project_#{member_type}_role!" , scope_project_id , member_id , role_id ) end roles_to_be_removed . each do | role_id | next unless available_role_ids . include? ( role_id ) services . identity . send ( "revoke_project_#{member_type}_role!" , scope_project_id , member_id , role_id ) end new_role_assignments = cloud_admin . identity . role_assignments ( filter_options . merge ( include_names : true ) ) group_and_extend_role_assignments ( new_role_assignments ) end
This method removes obsolete and assigns new roles to project.
This method removes obsolete and assigns new roles to project .
# only user and group project role assignments are allowed # get current project member role assignments from API # Cloud admin is important! If user removes himself from the # project role assignments, so he cant request role assignments. # get role ids from current role assignments # calculate differences # add new member roles to project # important: use current user (services.) to grant new roles # remove obsolete user roles from project # important: use current user (services.) to revoke roles # reload uproject member role assignments # here we can use cloud admin again.
scope_project_id
<not_specific>
member_type
<not_specific>
member_id
<not_specific>
new_roles
<not_specific>