'Validates network RBAC policy changes.
On creation, verify that the creator is an admin or that it owns the
network it is sharing.
On update and delete, make sure the tenant losing access does not have
resources that depend on that access.'

@registry.receives(rbac_mixin.RBAC_POLICY, [events.BEFORE_CREATE, events.BEFORE_UPDATE, events.BEFORE_DELETE])
@db_api.retry_if_session_inactive()
def validate_network_rbac_policy_change(self, resource, event, trigger, context, object_type, policy, **kwargs):

    if ((object_type != 'network') or (policy['action'] != 'access_as_shared')):
        return
    net = self._get_network(context, policy['object_id'])
    if (event in (events.BEFORE_CREATE, events.BEFORE_UPDATE)):
        if ((not context.is_admin) and (net['tenant_id'] != context.tenant_id)):
            msg = _('Only    admins    can    manipulate    policies    on    networks    they    do    not    own')
            raise exc.InvalidInput(error_message=msg)
    tenant_to_check = None
    self_sharing = (policy['target_tenant'] == net['tenant_id'])
    if self_sharing:
        return
    if (event == events.BEFORE_UPDATE):
        new_tenant = kwargs['policy_update']['target_tenant']
        if (policy['target_tenant'] != new_tenant):
            tenant_to_check = policy['target_tenant']
    if (event == events.BEFORE_DELETE):
        tenant_to_check = policy['target_tenant']
    if tenant_to_check:
        self.ensure_no_tenant_ports_on_network(net['id'], net['tenant_id'], tenant_to_check)
