#    Licensed under the Apache License, Version 2.0 (the "License"); you may
#    not use this file except in compliance with the License. You may obtain
#    a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.


from oslo_policy import policy

from nova.policies import base


RULE_AOO = base.RULE_ADMIN_OR_OWNER
SERVERS = 'os_compute_api:servers:%s'
NETWORK_ATTACH_EXTERNAL = 'network:attach_external_network'
ZERO_DISK_FLAVOR = SERVERS % 'create:zero_disk_flavor'
REQUESTED_DESTINATION = 'compute:servers:create:requested_destination'
CROSS_CELL_RESIZE = 'compute:servers:resize:cross_cell'

rules = [
    policy.DocumentedRuleDefault(
        SERVERS % 'index',
        RULE_AOO,
        "List all servers",
        [
            {
                'method': 'GET',
                'path': '/servers'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'detail',
        RULE_AOO,
        "List all servers with detailed information",
        [
            {
                'method': 'GET',
                'path': '/servers/detail'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'index:get_all_tenants',
        base.RULE_ADMIN_API,
        "List all servers for all projects",
        [
            {
                'method': 'GET',
                'path': '/servers'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'detail:get_all_tenants',
        base.RULE_ADMIN_API,
        "List all servers with detailed information for all projects",
        [
            {
                'method': 'GET',
                'path': '/servers/detail'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'allow_all_filters',
        base.RULE_ADMIN_API,
        "Allow all filters when listing servers",
        [
            {
                'method': 'GET',
                'path': '/servers'
            },
            {
                'method': 'GET',
                'path': '/servers/detail'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'show',
        RULE_AOO,
        "Show a server",
        [
            {
                'method': 'GET',
                'path': '/servers/{server_id}'
            }
        ]),
    # the details in host_status are pretty sensitive, only admins
    # should do that by default.
    policy.DocumentedRuleDefault(
        SERVERS % 'show:host_status',
        base.RULE_ADMIN_API,
        """
Show a server with additional host status information.

This means host_status will be shown irrespective of status value. If showing
only host_status UNKNOWN is desired, use the
``os_compute_api:servers:show:host_status:unknown-only`` policy rule.

Microvision 2.75 added the ``host_status`` attribute in the
``PUT /servers/{server_id}`` and ``POST /servers/{server_id}/action (rebuild)``
API responses which are also controlled by this policy rule, like the
``GET /servers*`` APIs.
""",
        [
            {
                'method': 'GET',
                'path': '/servers/{server_id}'
            },
            {
                'method': 'GET',
                'path': '/servers/detail'
            },
            {
                'method': 'PUT',
                'path': '/servers/{server_id}'
            },
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (rebuild)'
            }
        ]),
    policy.DocumentedRuleDefault(
            SERVERS % 'show:host_status:unknown-only',
        base.RULE_ADMIN_API,
        """
Show a server with additional host status information, only if host status is
UNKNOWN.

This policy rule will only be enforced when the
``os_compute_api:servers:show:host_status`` policy rule does not pass for the
request. An example policy configuration could be where the
``os_compute_api:servers:show:host_status`` rule is set to allow admin-only and
the ``os_compute_api:servers:show:host_status:unknown-only`` rule is set to
allow everyone.
""",
        [
            {
                'method': 'GET',
                'path': '/servers/{server_id}'
            },
            {
                'method': 'GET',
                'path': '/servers/detail'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'create',
        RULE_AOO,
        "Create a server",
        [
            {
                'method': 'POST',
                'path': '/servers'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'create:forced_host',
        base.RULE_ADMIN_API,
        """
Create a server on the specified host and/or node.

In this case, the server is forced to launch on the specified
host and/or node by bypassing the scheduler filters unlike the
``compute:servers:create:requested_destination`` rule.
""",
        [
            {
                'method': 'POST',
                'path': '/servers'
            }
        ]),
    policy.DocumentedRuleDefault(
        REQUESTED_DESTINATION,
        base.RULE_ADMIN_API,
        """
Create a server on the requested compute service host and/or
hypervisor_hostname.

In this case, the requested host and/or hypervisor_hostname is
validated by the scheduler filters unlike the
``os_compute_api:servers:create:forced_host`` rule.
""",
        [
            {
                'method': 'POST',
                'path': '/servers'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'create:attach_volume',
        RULE_AOO,
        "Create a server with the requested volume attached to it",
        [
            {
                'method': 'POST',
                'path': '/servers'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'create:attach_network',
        RULE_AOO,
        "Create a server with the requested network attached to it",
        [
            {
                'method': 'POST',
                'path': '/servers'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'create:trusted_certs',
        RULE_AOO,
        "Create a server with trusted image certificate IDs",
        [
            {
                'method': 'POST',
                'path': '/servers'
            }
        ]),
    policy.DocumentedRuleDefault(
        ZERO_DISK_FLAVOR,
        base.RULE_ADMIN_API,
        """
This rule controls the compute API validation behavior of creating a server
with a flavor that has 0 disk, indicating the server should be volume-backed.

For a flavor with disk=0, the root disk will be set to exactly the size of the
image used to deploy the instance. However, in this case the filter_scheduler
cannot select the compute host based on the virtual image size. Therefore, 0
should only be used for volume booted instances or for testing purposes.

WARNING: It is a potential security exposure to enable this policy rule
if users can upload their own images since repeated attempts to
create a disk=0 flavor instance with a large image can exhaust
the local disk of the compute (or shared storage cluster). See bug
https://bugs.launchpad.net/nova/+bug/1739646 for details.
""",
        [
            {
                'method': 'POST',
                'path': '/servers'
            }
        ]),
    policy.DocumentedRuleDefault(
        NETWORK_ATTACH_EXTERNAL,
        'is_admin:True',
        "Attach an unshared external network to a server",
        [
            # Create a server with a requested network or port.
            {
                'method': 'POST',
                'path': '/servers'
            },
            # Attach a network or port to an existing server.
            {
                'method': 'POST',
                'path': '/servers/{server_id}/os-interface'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'delete',
        RULE_AOO,
        "Delete a server",
        [
            {
                'method': 'DELETE',
                'path': '/servers/{server_id}'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'update',
        RULE_AOO,
        "Update a server",
        [
            {
                'method': 'PUT',
                'path': '/servers/{server_id}'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'confirm_resize',
        RULE_AOO,
        "Confirm a server resize",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (confirmResize)'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'revert_resize',
        RULE_AOO,
        "Revert a server resize",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (revertResize)'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'reboot',
        RULE_AOO,
        "Reboot a server",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (reboot)'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'resize',
        RULE_AOO,
        "Resize a server",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (resize)'
            }
        ]),
    policy.DocumentedRuleDefault(
        CROSS_CELL_RESIZE,
        base.RULE_NOBODY,
        "Resize a server across cells. By default, this is disabled for all "
        "users and recommended to be tested in a deployment for admin users "
        "before opening it up to non-admin users. Resizing within a cell is "
        "the default preferred behavior even if this is enabled. ",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (resize)'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'rebuild',
        RULE_AOO,
        "Rebuild a server",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (rebuild)'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'rebuild:trusted_certs',
        RULE_AOO,
        "Rebuild a server with trusted image certificate IDs",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (rebuild)'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'create_image',
        RULE_AOO,
        "Create an image from a server",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (createImage)'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'create_image:allow_volume_backed',
        RULE_AOO,
        "Create an image from a volume backed server",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (createImage)'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'start',
        RULE_AOO,
        "Start a server",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (os-start)'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'stop',
        RULE_AOO,
        "Stop a server",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (os-stop)'
            }
        ]),
    policy.DocumentedRuleDefault(
        SERVERS % 'trigger_crash_dump',
        RULE_AOO,
        "Trigger crash dump in a server",
        [
            {
                'method': 'POST',
                'path': '/servers/{server_id}/action (trigger_crash_dump)'
            }
        ]),
]


def list_rules():
    return rules

[((27, 4, 36, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(28, 8, 28, 25): "(SERVERS % 'index')", (29, 8, 29, 16): 'RULE_AOO', (30, 8, 30, 26): '"""List all servers"""', (31, 8, 36, 9): "[{'method': 'GET', 'path': '/servers'}]"}, {}), "(SERVERS % 'index', RULE_AOO,\n    'List all servers', [{'method': 'GET', 'path': '/servers'}])", False, 'from oslo_policy import policy\n'), ((37, 4, 46, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(38, 8, 38, 26): "(SERVERS % 'detail')", (39, 8, 39, 16): 'RULE_AOO', (40, 8, 40, 52): '"""List all servers with detailed information"""', (41, 8, 46, 9): "[{'method': 'GET', 'path': '/servers/detail'}]"}, {}), "(SERVERS % 'detail', RULE_AOO,\n    'List all servers with detailed information', [{'method': 'GET', 'path':\n    '/servers/detail'}])", False, 'from oslo_policy import policy\n'), ((47, 4, 56, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(48, 8, 48, 41): "(SERVERS % 'index:get_all_tenants')", (49, 8, 49, 27): 'base.RULE_ADMIN_API', (50, 8, 50, 43): '"""List all servers for all projects"""', (51, 8, 56, 9): "[{'method': 'GET', 'path': '/servers'}]"}, {}), "(SERVERS % 'index:get_all_tenants', base.\n    RULE_ADMIN_API, 'List all servers for all projects', [{'method': 'GET',\n    'path': '/servers'}])", False, 'from oslo_policy import policy\n'), ((57, 4, 66, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(58, 8, 58, 42): "(SERVERS % 'detail:get_all_tenants')", (59, 8, 59, 27): 'base.RULE_ADMIN_API', (60, 8, 60, 69): '"""List all servers with detailed information for all projects"""', (61, 8, 66, 9): "[{'method': 'GET', 'path': '/servers/detail'}]"}, {}), "(SERVERS % 'detail:get_all_tenants', base.\n    RULE_ADMIN_API,\n    'List all servers with detailed information for all projects', [{\n    'method': 'GET', 'path': '/servers/detail'}])", False, 'from oslo_policy import policy\n'), ((67, 4, 80, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(68, 8, 68, 37): "(SERVERS % 'allow_all_filters')", (69, 8, 69, 27): 'base.RULE_ADMIN_API', (70, 8, 70, 48): '"""Allow all filters when listing servers"""', (71, 8, 80, 9): "[{'method': 'GET', 'path': '/servers'}, {'method': 'GET', 'path':\n    '/servers/detail'}]"}, {}), "(SERVERS % 'allow_all_filters', base.\n    RULE_ADMIN_API, 'Allow all filters when listing servers', [{'method':\n    'GET', 'path': '/servers'}, {'method': 'GET', 'path': '/servers/detail'}])", False, 'from oslo_policy import policy\n'), ((81, 4, 90, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(82, 8, 82, 24): "(SERVERS % 'show')", (83, 8, 83, 16): 'RULE_AOO', (84, 8, 84, 23): '"""Show a server"""', (85, 8, 90, 9): "[{'method': 'GET', 'path': '/servers/{server_id}'}]"}, {}), "(SERVERS % 'show', RULE_AOO, 'Show a server', [\n    {'method': 'GET', 'path': '/servers/{server_id}'}])", False, 'from oslo_policy import policy\n'), ((93, 4, 125, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(94, 8, 94, 36): "(SERVERS % 'show:host_status')", (95, 8, 95, 27): 'base.RULE_ADMIN_API', (96, 8, 107, 3): '"""\nShow a server with additional host status information.\n\nThis means host_status will be shown irrespective of status value. If showing\nonly host_status UNKNOWN is desired, use the\n``os_compute_api:servers:show:host_status:unknown-only`` policy rule.\n\nMicrovision 2.75 added the ``host_status`` attribute in the\n``PUT /servers/{server_id}`` and ``POST /servers/{server_id}/action (rebuild)``\nAPI responses which are also controlled by this policy rule, like the\n``GET /servers*`` APIs.\n"""', (108, 8, 125, 9): "[{'method': 'GET', 'path': '/servers/{server_id}'}, {'method': 'GET',\n    'path': '/servers/detail'}, {'method': 'PUT', 'path':\n    '/servers/{server_id}'}, {'method': 'POST', 'path':\n    '/servers/{server_id}/action (rebuild)'}]"}, {}), '(SERVERS % \'show:host_status\', base.\n    RULE_ADMIN_API,\n    """\nShow a server with additional host status information.\n\nThis means host_status will be shown irrespective of status value. If showing\nonly host_status UNKNOWN is desired, use the\n``os_compute_api:servers:show:host_status:unknown-only`` policy rule.\n\nMicrovision 2.75 added the ``host_status`` attribute in the\n``PUT /servers/{server_id}`` and ``POST /servers/{server_id}/action (rebuild)``\nAPI responses which are also controlled by this policy rule, like the\n``GET /servers*`` APIs.\n"""\n    , [{\'method\': \'GET\', \'path\': \'/servers/{server_id}\'}, {\'method\': \'GET\',\n    \'path\': \'/servers/detail\'}, {\'method\': \'PUT\', \'path\':\n    \'/servers/{server_id}\'}, {\'method\': \'POST\', \'path\':\n    \'/servers/{server_id}/action (rebuild)\'}])', False, 'from oslo_policy import policy\n'), ((126, 4, 149, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(127, 12, 127, 53): "(SERVERS % 'show:host_status:unknown-only')", (128, 8, 128, 27): 'base.RULE_ADMIN_API', (129, 8, 139, 3): '"""\nShow a server with additional host status information, only if host status is\nUNKNOWN.\n\nThis policy rule will only be enforced when the\n``os_compute_api:servers:show:host_status`` policy rule does not pass for the\nrequest. An example policy configuration could be where the\n``os_compute_api:servers:show:host_status`` rule is set to allow admin-only and\nthe ``os_compute_api:servers:show:host_status:unknown-only`` rule is set to\nallow everyone.\n"""', (140, 8, 149, 9): "[{'method': 'GET', 'path': '/servers/{server_id}'}, {'method': 'GET',\n    'path': '/servers/detail'}]"}, {}), '(SERVERS % \'show:host_status:unknown-only\',\n    base.RULE_ADMIN_API,\n    """\nShow a server with additional host status information, only if host status is\nUNKNOWN.\n\nThis policy rule will only be enforced when the\n``os_compute_api:servers:show:host_status`` policy rule does not pass for the\nrequest. An example policy configuration could be where the\n``os_compute_api:servers:show:host_status`` rule is set to allow admin-only and\nthe ``os_compute_api:servers:show:host_status:unknown-only`` rule is set to\nallow everyone.\n"""\n    , [{\'method\': \'GET\', \'path\': \'/servers/{server_id}\'}, {\'method\': \'GET\',\n    \'path\': \'/servers/detail\'}])', False, 'from oslo_policy import policy\n'), ((150, 4, 159, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(151, 8, 151, 26): "(SERVERS % 'create')", (152, 8, 152, 16): 'RULE_AOO', (153, 8, 153, 25): '"""Create a server"""', (154, 8, 159, 9): "[{'method': 'POST', 'path': '/servers'}]"}, {}), "(SERVERS % 'create', RULE_AOO,\n    'Create a server', [{'method': 'POST', 'path': '/servers'}])", False, 'from oslo_policy import policy\n'), ((160, 4, 175, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(161, 8, 161, 38): "(SERVERS % 'create:forced_host')", (162, 8, 162, 27): 'base.RULE_ADMIN_API', (163, 8, 169, 3): '"""\nCreate a server on the specified host and/or node.\n\nIn this case, the server is forced to launch on the specified\nhost and/or node by bypassing the scheduler filters unlike the\n``compute:servers:create:requested_destination`` rule.\n"""', (170, 8, 175, 9): "[{'method': 'POST', 'path': '/servers'}]"}, {}), '(SERVERS % \'create:forced_host\', base.\n    RULE_ADMIN_API,\n    """\nCreate a server on the specified host and/or node.\n\nIn this case, the server is forced to launch on the specified\nhost and/or node by bypassing the scheduler filters unlike the\n``compute:servers:create:requested_destination`` rule.\n"""\n    , [{\'method\': \'POST\', \'path\': \'/servers\'}])', False, 'from oslo_policy import policy\n'), ((176, 4, 192, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(177, 8, 177, 29): 'REQUESTED_DESTINATION', (178, 8, 178, 27): 'base.RULE_ADMIN_API', (179, 8, 186, 3): '"""\nCreate a server on the requested compute service host and/or\nhypervisor_hostname.\n\nIn this case, the requested host and/or hypervisor_hostname is\nvalidated by the scheduler filters unlike the\n``os_compute_api:servers:create:forced_host`` rule.\n"""', (187, 8, 192, 9): "[{'method': 'POST', 'path': '/servers'}]"}, {}), '(REQUESTED_DESTINATION, base.RULE_ADMIN_API,\n    """\nCreate a server on the requested compute service host and/or\nhypervisor_hostname.\n\nIn this case, the requested host and/or hypervisor_hostname is\nvalidated by the scheduler filters unlike the\n``os_compute_api:servers:create:forced_host`` rule.\n"""\n    , [{\'method\': \'POST\', \'path\': \'/servers\'}])', False, 'from oslo_policy import policy\n'), ((193, 4, 202, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(194, 8, 194, 40): "(SERVERS % 'create:attach_volume')", (195, 8, 195, 16): 'RULE_AOO', (196, 8, 196, 66): '"""Create a server with the requested volume attached to it"""', (197, 8, 202, 9): "[{'method': 'POST', 'path': '/servers'}]"}, {}), "(SERVERS % 'create:attach_volume', RULE_AOO,\n    'Create a server with the requested volume attached to it', [{'method':\n    'POST', 'path': '/servers'}])", False, 'from oslo_policy import policy\n'), ((203, 4, 212, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(204, 8, 204, 41): "(SERVERS % 'create:attach_network')", (205, 8, 205, 16): 'RULE_AOO', (206, 8, 206, 67): '"""Create a server with the requested network attached to it"""', (207, 8, 212, 9): "[{'method': 'POST', 'path': '/servers'}]"}, {}), "(SERVERS % 'create:attach_network', RULE_AOO,\n    'Create a server with the requested network attached to it', [{'method':\n    'POST', 'path': '/servers'}])", False, 'from oslo_policy import policy\n'), ((213, 4, 222, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(214, 8, 214, 40): "(SERVERS % 'create:trusted_certs')", (215, 8, 215, 16): 'RULE_AOO', (216, 8, 216, 60): '"""Create a server with trusted image certificate IDs"""', (217, 8, 222, 9): "[{'method': 'POST', 'path': '/servers'}]"}, {}), "(SERVERS % 'create:trusted_certs', RULE_AOO,\n    'Create a server with trusted image certificate IDs', [{'method':\n    'POST', 'path': '/servers'}])", False, 'from oslo_policy import policy\n'), ((223, 4, 246, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(224, 8, 224, 24): 'ZERO_DISK_FLAVOR', (225, 8, 225, 27): 'base.RULE_ADMIN_API', (226, 8, 240, 3): '"""\nThis rule controls the compute API validation behavior of creating a server\nwith a flavor that has 0 disk, indicating the server should be volume-backed.\n\nFor a flavor with disk=0, the root disk will be set to exactly the size of the\nimage used to deploy the instance. However, in this case the filter_scheduler\ncannot select the compute host based on the virtual image size. Therefore, 0\nshould only be used for volume booted instances or for testing purposes.\n\nWARNING: It is a potential security exposure to enable this policy rule\nif users can upload their own images since repeated attempts to\ncreate a disk=0 flavor instance with a large image can exhaust\nthe local disk of the compute (or shared storage cluster). See bug\nhttps://bugs.launchpad.net/nova/+bug/1739646 for details.\n"""', (241, 8, 246, 9): "[{'method': 'POST', 'path': '/servers'}]"}, {}), '(ZERO_DISK_FLAVOR, base.RULE_ADMIN_API,\n    """\nThis rule controls the compute API validation behavior of creating a server\nwith a flavor that has 0 disk, indicating the server should be volume-backed.\n\nFor a flavor with disk=0, the root disk will be set to exactly the size of the\nimage used to deploy the instance. However, in this case the filter_scheduler\ncannot select the compute host based on the virtual image size. Therefore, 0\nshould only be used for volume booted instances or for testing purposes.\n\nWARNING: It is a potential security exposure to enable this policy rule\nif users can upload their own images since repeated attempts to\ncreate a disk=0 flavor instance with a large image can exhaust\nthe local disk of the compute (or shared storage cluster). See bug\nhttps://bugs.launchpad.net/nova/+bug/1739646 for details.\n"""\n    , [{\'method\': \'POST\', \'path\': \'/servers\'}])', False, 'from oslo_policy import policy\n'), ((247, 4, 262, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(248, 8, 248, 31): 'NETWORK_ATTACH_EXTERNAL', (249, 8, 249, 23): '"""is_admin:True"""', (250, 8, 250, 57): '"""Attach an unshared external network to a server"""', (251, 8, 262, 9): "[{'method': 'POST', 'path': '/servers'}, {'method': 'POST', 'path':\n    '/servers/{server_id}/os-interface'}]"}, {}), "(NETWORK_ATTACH_EXTERNAL, 'is_admin:True',\n    'Attach an unshared external network to a server', [{'method': 'POST',\n    'path': '/servers'}, {'method': 'POST', 'path':\n    '/servers/{server_id}/os-interface'}])", False, 'from oslo_policy import policy\n'), ((263, 4, 272, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(264, 8, 264, 26): "(SERVERS % 'delete')", (265, 8, 265, 16): 'RULE_AOO', (266, 8, 266, 25): '"""Delete a server"""', (267, 8, 272, 9): "[{'method': 'DELETE', 'path': '/servers/{server_id}'}]"}, {}), "(SERVERS % 'delete', RULE_AOO,\n    'Delete a server', [{'method': 'DELETE', 'path': '/servers/{server_id}'}])", False, 'from oslo_policy import policy\n'), ((273, 4, 282, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(274, 8, 274, 26): "(SERVERS % 'update')", (275, 8, 275, 16): 'RULE_AOO', (276, 8, 276, 25): '"""Update a server"""', (277, 8, 282, 9): "[{'method': 'PUT', 'path': '/servers/{server_id}'}]"}, {}), "(SERVERS % 'update', RULE_AOO,\n    'Update a server', [{'method': 'PUT', 'path': '/servers/{server_id}'}])", False, 'from oslo_policy import policy\n'), ((283, 4, 292, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(284, 8, 284, 34): "(SERVERS % 'confirm_resize')", (285, 8, 285, 16): 'RULE_AOO', (286, 8, 286, 33): '"""Confirm a server resize"""', (287, 8, 292, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (confirmResize)'}]"}, {}), "(SERVERS % 'confirm_resize', RULE_AOO,\n    'Confirm a server resize', [{'method': 'POST', 'path':\n    '/servers/{server_id}/action (confirmResize)'}])", False, 'from oslo_policy import policy\n'), ((293, 4, 302, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(294, 8, 294, 33): "(SERVERS % 'revert_resize')", (295, 8, 295, 16): 'RULE_AOO', (296, 8, 296, 32): '"""Revert a server resize"""', (297, 8, 302, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (revertResize)'}]"}, {}), "(SERVERS % 'revert_resize', RULE_AOO,\n    'Revert a server resize', [{'method': 'POST', 'path':\n    '/servers/{server_id}/action (revertResize)'}])", False, 'from oslo_policy import policy\n'), ((303, 4, 312, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(304, 8, 304, 26): "(SERVERS % 'reboot')", (305, 8, 305, 16): 'RULE_AOO', (306, 8, 306, 25): '"""Reboot a server"""', (307, 8, 312, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (reboot)'}]"}, {}), "(SERVERS % 'reboot', RULE_AOO,\n    'Reboot a server', [{'method': 'POST', 'path':\n    '/servers/{server_id}/action (reboot)'}])", False, 'from oslo_policy import policy\n'), ((313, 4, 322, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(314, 8, 314, 26): "(SERVERS % 'resize')", (315, 8, 315, 16): 'RULE_AOO', (316, 8, 316, 25): '"""Resize a server"""', (317, 8, 322, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (resize)'}]"}, {}), "(SERVERS % 'resize', RULE_AOO,\n    'Resize a server', [{'method': 'POST', 'path':\n    '/servers/{server_id}/action (resize)'}])", False, 'from oslo_policy import policy\n'), ((323, 4, 335, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(324, 8, 324, 25): 'CROSS_CELL_RESIZE', (325, 8, 325, 24): 'base.RULE_NOBODY', (326, 8, 329, 66): '"""Resize a server across cells. By default, this is disabled for all users and recommended to be tested in a deployment for admin users before opening it up to non-admin users. Resizing within a cell is the default preferred behavior even if this is enabled. """', (330, 8, 335, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (resize)'}]"}, {}), "(CROSS_CELL_RESIZE, base.RULE_NOBODY,\n    'Resize a server across cells. By default, this is disabled for all users and recommended to be tested in a deployment for admin users before opening it up to non-admin users. Resizing within a cell is the default preferred behavior even if this is enabled. '\n    , [{'method': 'POST', 'path': '/servers/{server_id}/action (resize)'}])", False, 'from oslo_policy import policy\n'), ((336, 4, 345, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(337, 8, 337, 27): "(SERVERS % 'rebuild')", (338, 8, 338, 16): 'RULE_AOO', (339, 8, 339, 26): '"""Rebuild a server"""', (340, 8, 345, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (rebuild)'}]"}, {}), "(SERVERS % 'rebuild', RULE_AOO,\n    'Rebuild a server', [{'method': 'POST', 'path':\n    '/servers/{server_id}/action (rebuild)'}])", False, 'from oslo_policy import policy\n'), ((346, 4, 355, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(347, 8, 347, 41): "(SERVERS % 'rebuild:trusted_certs')", (348, 8, 348, 16): 'RULE_AOO', (349, 8, 349, 61): '"""Rebuild a server with trusted image certificate IDs"""', (350, 8, 355, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (rebuild)'}]"}, {}), "(SERVERS % 'rebuild:trusted_certs', RULE_AOO,\n    'Rebuild a server with trusted image certificate IDs', [{'method':\n    'POST', 'path': '/servers/{server_id}/action (rebuild)'}])", False, 'from oslo_policy import policy\n'), ((356, 4, 365, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(357, 8, 357, 32): "(SERVERS % 'create_image')", (358, 8, 358, 16): 'RULE_AOO', (359, 8, 359, 39): '"""Create an image from a server"""', (360, 8, 365, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (createImage)'}]"}, {}), "(SERVERS % 'create_image', RULE_AOO,\n    'Create an image from a server', [{'method': 'POST', 'path':\n    '/servers/{server_id}/action (createImage)'}])", False, 'from oslo_policy import policy\n'), ((366, 4, 375, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(367, 8, 367, 52): "(SERVERS % 'create_image:allow_volume_backed')", (368, 8, 368, 16): 'RULE_AOO', (369, 8, 369, 53): '"""Create an image from a volume backed server"""', (370, 8, 375, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (createImage)'}]"}, {}), "(SERVERS % 'create_image:allow_volume_backed',\n    RULE_AOO, 'Create an image from a volume backed server', [{'method':\n    'POST', 'path': '/servers/{server_id}/action (createImage)'}])", False, 'from oslo_policy import policy\n'), ((376, 4, 385, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(377, 8, 377, 25): "(SERVERS % 'start')", (378, 8, 378, 16): 'RULE_AOO', (379, 8, 379, 24): '"""Start a server"""', (380, 8, 385, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (os-start)'}]"}, {}), "(SERVERS % 'start', RULE_AOO, 'Start a server',\n    [{'method': 'POST', 'path': '/servers/{server_id}/action (os-start)'}])", False, 'from oslo_policy import policy\n'), ((386, 4, 395, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(387, 8, 387, 24): "(SERVERS % 'stop')", (388, 8, 388, 16): 'RULE_AOO', (389, 8, 389, 23): '"""Stop a server"""', (390, 8, 395, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (os-stop)'}]"}, {}), "(SERVERS % 'stop', RULE_AOO, 'Stop a server', [\n    {'method': 'POST', 'path': '/servers/{server_id}/action (os-stop)'}])", False, 'from oslo_policy import policy\n'), ((396, 4, 405, 10), 'oslo_policy.policy.DocumentedRuleDefault', 'policy.DocumentedRuleDefault', ({(397, 8, 397, 38): "(SERVERS % 'trigger_crash_dump')", (398, 8, 398, 16): 'RULE_AOO', (399, 8, 399, 40): '"""Trigger crash dump in a server"""', (400, 8, 405, 9): "[{'method': 'POST', 'path': '/servers/{server_id}/action (trigger_crash_dump)'}\n    ]"}, {}), "(SERVERS % 'trigger_crash_dump', RULE_AOO,\n    'Trigger crash dump in a server', [{'method': 'POST', 'path':\n    '/servers/{server_id}/action (trigger_crash_dump)'}])", False, 'from oslo_policy import policy\n')]