

def authorize(self, env_identity, req):
    req.environ.pop('swift_owner', None)
    (tenant_id, tenant_name) = env_identity['tenant']
    (user_id, user_name) = env_identity['user']
    (referrers, roles) = swift_acl.parse_acl(getattr(req, 'acl', None))
    if (req.method == 'OPTIONS'):
        return
    try:
        part = req.split_path(1, 4, True)
        (version, account, container, obj) = part
    except ValueError:
        return HTTPNotFound(request=req)
    self._set_project_domain_id(req, part, env_identity)
    user_roles = [r.lower() for r in env_identity.get('roles', [])]
    user_service_roles = [r.lower() for r in env_identity.get('service_roles', [])]
    if (self.reseller_admin_role in user_roles):
        msg = 'User %s has reseller admin authorizing'
        self.logger.debug(msg, tenant_id)
        req.environ['swift_owner'] = True
        return
    if ((not container) and (not obj) and (req.method == 'DELETE')):
        msg = 'User %s:%s is not allowed to delete its own account'
        self.logger.debug(msg, tenant_name, user_name)
        return self.denied_response(req)
    matched_acl = None
    if roles:
        allow_names = self._is_name_allowed_in_acl(req, part, env_identity)
        matched_acl = self._authorize_cross_tenant(user_id, user_name, tenant_id, tenant_name, roles, allow_names)
    if (matched_acl is not None):
        log_msg = 'user %s allowed in ACL authorizing.'
        self.logger.debug(log_msg, matched_acl)
        return
    acl_authorized = self._authorize_unconfirmed_identity(req, obj, referrers, roles)
    if acl_authorized:
        return
    if (not self._account_matches_tenant(account, tenant_id)):
        log_msg = 'tenant mismatch: %s != %s'
        self.logger.debug(log_msg, account, tenant_id)
        return self.denied_response(req)
    account_prefix = self._get_account_prefix(account)
    operator_roles = self.account_rules[account_prefix]['operator_roles']
    have_operator_role = set(operator_roles).intersection(set(user_roles))
    service_roles = self.account_rules[account_prefix]['service_roles']
    have_service_role = set(service_roles).intersection(set(user_service_roles))
    allowed = False
    if (have_operator_role and (service_roles and have_service_role)):
        allowed = True
    elif (have_operator_role and (not service_roles)):
        allowed = True
    if allowed:
        log_msg = 'allow user with role(s) %s as account admin'
        self.logger.debug(log_msg, ','.join(have_operator_role.union(have_service_role)))
        req.environ['swift_owner'] = True
        return
    if (acl_authorized is not None):
        return self.denied_response(req)
    for user_role in user_roles:
        if (user_role in (r.lower() for r in roles)):
            log_msg = 'user %s:%s allowed in ACL: %s authorizing'
            self.logger.debug(log_msg, tenant_name, user_name, user_role)
            return
    return self.denied_response(req)

dataset/ETHPy150Open openstack/swift/swift/common/middleware/keystoneauth.py KeystoneAuth.authorize/original