erikbocks commented on PR #12646: URL: https://github.com/apache/cloudstack/pull/12646#issuecomment-6852606421
Hello, @bernardodemarco, @JoaoJandre and @winterhazel @bernardodemarco, regarding your suggestion (https://github.com/apache/cloudstack/pull/12646#discussion_r3268791378), I tried to find the `createProject` API parameters behavior that you mentioned, but could not find it. I analyzed the project creation code, and below are my findings about the usage of the `accountname` and `accountid` parameters: ## `accountname` It determines which account will be the owner of the project. When it is informed in the API, there are two different behaviors based on the role of the calling account. For admins, the account with that name is fetched and the caller's access to the resource is validated. If the caller is a normal user, it is validated that the parameter value is equal to the caller's account name. The account found by this name is defined as owner of the project. <details><summary>Account selection by name</summary> ```java if (isAdmin(caller.getId()) && accountName != null && domainId != null) { Domain domain = _domainMgr.getDomain(domainId); if (domain == null) { throw new InvalidParameterValueException("Unable to find the domain by id=" + domainId); } Account owner = _accountDao.findActiveAccount(accountName, domainId); if (owner == null) { throw new InvalidParameterValueException(String.format("Unable to find account %s in domain %s", accountName, domain)); } checkAccess(caller, domain); return owner; } else if (!isAdmin(caller.getId()) && accountName != null && domainId != null) { if (!accountName.equals(caller.getAccountName()) || domainId != caller.getDomainId()) { throw new PermissionDeniedException("Can't create/list resources for account " + accountName + " in domain " + domainId + ", permission denied"); } else { return caller; } ``` </details> ## `accountid` This parameter is used only if the `userid` parameter is also informed. When the `userid` parameter is sent, the `validateUser` method is executed and the `accountid` parameter value is used to validate whether the informed user belongs to the informed account. If a user with this ID is found, the project owner is changed to the user's account. <details><summary><code>accountid</code> parameter usage</summary> ```java private User validateUser(Long userId, Long accountId, Long domainId) { User user = null; if (userId != null) { user = userDao.findById(userId); if (user == null ) { throw new InvalidParameterValueException("Invalid user ID provided"); } if (user.getAccountId() != accountId || _accountDao.findById(user.getAccountId()).getDomainId() != domainId) { throw new InvalidParameterValueException("User doesn't belong to the specified account or domain"); } } return user; } ``` </details> ## Summary According to the aforementioned code analysis, it is not possible to use the `accountname` and `accountid` in the way that you mentioned, as the project's owner always is either the account that matches the informed name, or the informed user's account. Therefore, due to the code behavior, I will solve the suggestion comment. Could we move on with this one? @JoaoJandre @winterhazel -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
