Copilot commented on code in PR #13907: URL: https://github.com/apache/cloudstack/pull/13907#discussion_r3871599018
########## api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupMemberCmd.java: ########## @@ -0,0 +1,87 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package org.apache.cloudstack.api.command.user.bootgroup; + +import javax.inject.Inject; + +import org.apache.cloudstack.acl.RoleType; +import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandResourceType; +import org.apache.cloudstack.api.ApiConstants; +import org.apache.cloudstack.api.ApiErrorCode; +import org.apache.cloudstack.api.BaseCmd; +import org.apache.cloudstack.api.Parameter; +import org.apache.cloudstack.api.ServerApiException; +import org.apache.cloudstack.api.command.user.UserCmd; +import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse; +import org.apache.cloudstack.context.CallContext; +import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember; +import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService; + +@APICommand(name = "updateInstanceBootGroupMember", + description = "Updates the boot order of a member in an instance boot group", + responseObject = InstanceBootGroupMemberResponse.class, + entityType = {InstanceBootGroupMember.class}, + requestHasSensitiveInfo = false, + responseHasSensitiveInfo = false, + authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User}) +public class UpdateInstanceBootGroupMemberCmd extends BaseCmd implements UserCmd { + + @Inject + InstanceBootGroupService instanceBootGroupService; + + @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupMemberResponse.class, required = true, description = "The UUID of the boot group member entry") + private Long id; Review Comment: The command parameter `id` is explicitly a boot-group *member entry* UUID (`InstanceBootGroupMemberResponse`), but `getApiResourceType()` returns `InstanceBootGroup`. This resource-type/id mismatch can break API resource UUID resolution/auditing/permission checks that rely on `(resourceType, id)`. Consider either (a) introducing `ApiCommandResourceType.InstanceBootGroupMember` and returning that here, or (b) changing `getApiResourceId()`/resource type semantics to use the boot group ID (and rename the parameter accordingly) if the intent is to authorize/audit against the group. ########## api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupReadinessRuleCmd.java: ########## @@ -0,0 +1,132 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package org.apache.cloudstack.api.command.user.bootgroup; + +import java.util.Collection; +import java.util.Map; + +import javax.inject.Inject; + +import org.apache.cloudstack.acl.RoleType; +import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandResourceType; +import org.apache.cloudstack.api.ApiConstants; +import org.apache.cloudstack.api.ApiErrorCode; +import org.apache.cloudstack.api.BaseCmd; +import org.apache.cloudstack.api.Parameter; +import org.apache.cloudstack.api.ServerApiException; +import org.apache.cloudstack.api.command.user.UserCmd; +import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse; +import org.apache.cloudstack.api.response.InstanceBootGroupResponse; +import org.apache.cloudstack.api.response.InstanceGroupResponse; +import org.apache.cloudstack.api.response.UserVmResponse; +import org.apache.cloudstack.context.CallContext; +import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule; +import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService; + +@APICommand(name = "createInstanceBootGroupReadinessRule", + description = "Creates a readiness rule for a VM or instance group that is a member (directly, or via its instance group) of an instance boot group. " + + "Exactly one of virtualmachineid or instancegroupid must be specified.", + responseObject = InstanceBootGroupReadinessRuleResponse.class, + entityType = {InstanceBootGroupReadinessRule.class}, + requestHasSensitiveInfo = false, + responseHasSensitiveInfo = false, + authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User}) +public class CreateInstanceBootGroupReadinessRuleCmd extends BaseCmd implements UserCmd { + + @Inject + InstanceBootGroupService instanceBootGroupService; + + @Parameter(name = ApiConstants.BOOT_GROUP_ID, type = CommandType.UUID, entityType = InstanceBootGroupResponse.class, required = true, + description = "The ID of the boot group this rule belongs to") + private Long bootGroupId; + + @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID, type = CommandType.UUID, entityType = UserVmResponse.class, + description = "The ID of the VM this rule applies to (exclusive with instancegroupid)") + private Long virtualMachineId; + + @Parameter(name = ApiConstants.INSTANCE_GROUP_ID, type = CommandType.UUID, entityType = InstanceGroupResponse.class, + description = "The ID of the instance group this rule applies to (exclusive with virtualmachineid)") + private Long instanceGroupId; + + @Parameter(name = ApiConstants.RULE_TYPE, type = CommandType.STRING, required = true, + description = "The readiness rule type: GuestAgentLiveness, Ping, PortCheck, MemberQuorum or CustomScript") + private String ruleType; + + @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, description = "The name of the readiness rule; auto-generated if not provided") + private String name; + + @Parameter(name = ApiConstants.ENABLED, type = CommandType.BOOLEAN, description = "Whether the rule is enabled; defaults to true") + private Boolean enabled; + + @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP, description = "Rule-type-specific configuration, e.g. port/protocol, script, threshold_type/threshold_value") + private Map details; + + public Long getBootGroupId() { + return bootGroupId; + } + + public Long getVirtualMachineId() { + return virtualMachineId; + } + + public Long getInstanceGroupId() { + return instanceGroupId; + } + + public String getRuleType() { + return ruleType; + } + + public String getName() { + return name; + } + + public boolean isEnabled() { + return enabled == null || enabled; + } + + public Map<String, String> getDetails() { + if (this.details == null || this.details.isEmpty()) { + return null; + } + Collection<String> paramsCollection = this.details.values(); + return (Map<String, String>) (paramsCollection.toArray())[0]; + } Review Comment: `details` is declared as a raw `Map` and `getDetails()` assumes the first `values()` element is a `Map<String, String>`, using an array cast. This is fragile (ClassCastException risk) and order-dependent if multiple entries exist. Prefer strongly typing the field (e.g., `Map<String, Map<String, String>>`) and extracting via `values().iterator().next()` with explicit unchecked suppression in one place, or use the existing CloudStack helper/pattern for MAP parameters to safely convert to `Map<String, String>`. ########## api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupReadinessRuleCmd.java: ########## @@ -0,0 +1,109 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package org.apache.cloudstack.api.command.user.bootgroup; + +import java.util.Collection; +import java.util.Map; + +import javax.inject.Inject; + +import org.apache.cloudstack.acl.RoleType; +import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandResourceType; +import org.apache.cloudstack.api.ApiConstants; +import org.apache.cloudstack.api.ApiErrorCode; +import org.apache.cloudstack.api.BaseCmd; +import org.apache.cloudstack.api.Parameter; +import org.apache.cloudstack.api.ServerApiException; +import org.apache.cloudstack.api.command.user.UserCmd; +import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse; +import org.apache.cloudstack.context.CallContext; +import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule; +import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService; + +@APICommand(name = "updateInstanceBootGroupReadinessRule", + description = "Updates an instance boot group readiness rule. The rule type, boot group and item are immutable after creation.", + responseObject = InstanceBootGroupReadinessRuleResponse.class, + entityType = {InstanceBootGroupReadinessRule.class}, + requestHasSensitiveInfo = false, + responseHasSensitiveInfo = false, + authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User}) +public class UpdateInstanceBootGroupReadinessRuleCmd extends BaseCmd implements UserCmd { + + @Inject + InstanceBootGroupService instanceBootGroupService; + + @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupReadinessRuleResponse.class, required = true, + description = "The ID of the readiness rule") + private Long id; + + @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, description = "New name for the readiness rule") + private String name; + + @Parameter(name = ApiConstants.ENABLED, type = CommandType.BOOLEAN, description = "Whether the rule is enabled") + private Boolean enabled; + + @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP, description = "Rule-type-specific configuration") + private Map details; + + public Long getId() { + return id; + } + + public String getName() { + return name; + } + + public Boolean getEnabled() { + return enabled; + } + + public Map<String, String> getDetails() { + if (this.details == null || this.details.isEmpty()) { + return null; + } + Collection<String> paramsCollection = this.details.values(); + return (Map<String, String>) (paramsCollection.toArray())[0]; + } Review Comment: Same issue as the create command: this uses a raw `Map` plus an unsafe cast of the first `values()` element. This can throw at runtime depending on how the API framework materializes MAP params. Strongly type `details` and extract deterministically (e.g. iterator), or use a shared utility to parse map parameters. ########## api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupMemberCmd.java: ########## @@ -0,0 +1,87 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package org.apache.cloudstack.api.command.user.bootgroup; + +import javax.inject.Inject; + +import org.apache.cloudstack.acl.RoleType; +import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandResourceType; +import org.apache.cloudstack.api.ApiConstants; +import org.apache.cloudstack.api.ApiErrorCode; +import org.apache.cloudstack.api.BaseCmd; +import org.apache.cloudstack.api.Parameter; +import org.apache.cloudstack.api.ServerApiException; +import org.apache.cloudstack.api.command.user.UserCmd; +import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse; +import org.apache.cloudstack.context.CallContext; +import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember; +import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService; + +@APICommand(name = "updateInstanceBootGroupMember", + description = "Updates the boot order of a member in an instance boot group", + responseObject = InstanceBootGroupMemberResponse.class, + entityType = {InstanceBootGroupMember.class}, + requestHasSensitiveInfo = false, + responseHasSensitiveInfo = false, + authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User}) +public class UpdateInstanceBootGroupMemberCmd extends BaseCmd implements UserCmd { + + @Inject + InstanceBootGroupService instanceBootGroupService; + + @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupMemberResponse.class, required = true, description = "The UUID of the boot group member entry") + private Long id; + + @Parameter(name = ApiConstants.BOOT_ORDER, type = CommandType.INTEGER, required = true, description = "The new boot order value (0 or greater)") + private int order; + + public Long getId() { + return id; + } + + public int getOrder() { + return order; + } + + @Override + public long getEntityOwnerId() { + return CallContext.current().getCallingAccount().getId(); + } + + @Override + public Long getApiResourceId() { + return id; + } + + @Override + public ApiCommandResourceType getApiResourceType() { + return ApiCommandResourceType.InstanceBootGroup; Review Comment: The command parameter `id` is explicitly a boot-group *member entry* UUID (`InstanceBootGroupMemberResponse`), but `getApiResourceType()` returns `InstanceBootGroup`. This resource-type/id mismatch can break API resource UUID resolution/auditing/permission checks that rely on `(resourceType, id)`. Consider either (a) introducing `ApiCommandResourceType.InstanceBootGroupMember` and returning that here, or (b) changing `getApiResourceId()`/resource type semantics to use the boot group ID (and rename the parameter accordingly) if the intent is to authorize/audit against the group. ########## api/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/ReadinessChecker.java: ########## @@ -0,0 +1,93 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package org.apache.cloudstack.vm.bootgroup.readiness; + +import java.util.Map; + +import org.apache.logging.log4j.Level; +import org.apache.logging.log4j.Logger; + +/** + * Strategy interface for evaluating one readiness rule type. Implementations are collected by + * {@code InstanceBootGroupReadinessRuleManagerImpl} via Spring's {@code List<ReadinessChecker>} + * autowiring and dispatched by {@link #getRuleType()} — an internal implementation detail, not + * API-facing, so left unprefixed. + */ +public interface ReadinessChecker { + + /** + * Below this much remaining budget, a checker should not even attempt to dispatch a remote + * command — there isn't enough time left for a meaningful wait, and dispatching anyway would + * either use an unhelpfully tiny (or, worse, a zero/negative, which some transports treat as "no + * override, use the default") wait value. + */ + long MIN_REMAINING_MS_TO_DISPATCH = 2000L; + + InstanceBootGroupReadinessRule.RuleType getRuleType(); + + /** + * @param remainingMs time budget left for this VM's current attempt; bound any remote dispatch + * to it (e.g. via {@code Command.setWait}) and return {@code Status.Error} directly if + * it's already too small to be worth dispatching. + */ + Result check(InstanceBootGroupReadinessRule rule, Map<String, String> details, long vmId, long remainingMs); + + class Result { + private final InstanceBootGroupReadinessRule.Status status; + private final String message; + + public Result(InstanceBootGroupReadinessRule.Status status, String message) { + this.status = status; + this.message = message; + } + + public InstanceBootGroupReadinessRule.Status getStatus() { + return status; + } + + public String getMessage() { + return message; + } + } + + default Logger getLogger() { + return null; + } + + default Result logAndReturn(InstanceBootGroupReadinessRule rule, Object vmOrId, Result result) { + Logger log = getLogger(); + if (getLogger() == null) { Review Comment: `getLogger()` is called twice; the second call can be replaced with the already-stored `log` variable to avoid redundant calls and make the intent clearer. This also avoids surprises if an implementation computes/returns different logger instances. ########## api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/RemoveInstanceBootGroupMemberCmd.java: ########## @@ -0,0 +1,80 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package org.apache.cloudstack.api.command.user.bootgroup; + +import javax.inject.Inject; + +import org.apache.cloudstack.acl.RoleType; +import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandResourceType; +import org.apache.cloudstack.api.ApiConstants; +import org.apache.cloudstack.api.ApiErrorCode; +import org.apache.cloudstack.api.BaseCmd; +import org.apache.cloudstack.api.Parameter; +import org.apache.cloudstack.api.ServerApiException; +import org.apache.cloudstack.api.command.user.UserCmd; +import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse; +import org.apache.cloudstack.api.response.SuccessResponse; +import org.apache.cloudstack.context.CallContext; +import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember; +import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService; + +@APICommand(name = "removeInstanceBootGroupMember", + description = "Removes a member (VM or instance group) from an instance boot group", + responseObject = SuccessResponse.class, + entityType = {InstanceBootGroupMember.class}, + requestHasSensitiveInfo = false, + responseHasSensitiveInfo = false, + authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User}) +public class RemoveInstanceBootGroupMemberCmd extends BaseCmd implements UserCmd { + + @Inject + InstanceBootGroupService instanceBootGroupService; + + @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupMemberResponse.class, required = true, description = "The ID of the boot group member entry to remove") + private Long id; Review Comment: Same mismatch as `UpdateInstanceBootGroupMemberCmd`: the `id` parameter is a member-entry UUID, but the API resource type returned is `InstanceBootGroup`. Align the resource type with the ID you return (add a member resource type) or change the command to operate on boot group ID if that is what should be authorized/audited. ########## api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/RemoveInstanceBootGroupMemberCmd.java: ########## @@ -0,0 +1,80 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package org.apache.cloudstack.api.command.user.bootgroup; + +import javax.inject.Inject; + +import org.apache.cloudstack.acl.RoleType; +import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandResourceType; +import org.apache.cloudstack.api.ApiConstants; +import org.apache.cloudstack.api.ApiErrorCode; +import org.apache.cloudstack.api.BaseCmd; +import org.apache.cloudstack.api.Parameter; +import org.apache.cloudstack.api.ServerApiException; +import org.apache.cloudstack.api.command.user.UserCmd; +import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse; +import org.apache.cloudstack.api.response.SuccessResponse; +import org.apache.cloudstack.context.CallContext; +import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember; +import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService; + +@APICommand(name = "removeInstanceBootGroupMember", + description = "Removes a member (VM or instance group) from an instance boot group", + responseObject = SuccessResponse.class, + entityType = {InstanceBootGroupMember.class}, + requestHasSensitiveInfo = false, + responseHasSensitiveInfo = false, + authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User}) +public class RemoveInstanceBootGroupMemberCmd extends BaseCmd implements UserCmd { + + @Inject + InstanceBootGroupService instanceBootGroupService; + + @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupMemberResponse.class, required = true, description = "The ID of the boot group member entry to remove") + private Long id; + + public Long getId() { + return id; + } + + @Override + public long getEntityOwnerId() { + return CallContext.current().getCallingAccount().getId(); + } + + @Override + public Long getApiResourceId() { + return id; + } + + @Override + public ApiCommandResourceType getApiResourceType() { + return ApiCommandResourceType.InstanceBootGroup; Review Comment: Same mismatch as `UpdateInstanceBootGroupMemberCmd`: the `id` parameter is a member-entry UUID, but the API resource type returned is `InstanceBootGroup`. Align the resource type with the ID you return (add a member resource type) or change the command to operate on boot group ID if that is what should be authorized/audited. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
