resume PR

bernardodemarco · bernardodemarco · commit 88df2e80ca73 · 2026-01-12T15:04:46.000-03:00
diff --git a/api/src/main/java/com/cloud/user/AccountService.java b/api/src/main/java/com/cloud/user/AccountService.java
@@ -138,7 +138,7 @@ User createUser(String userName, String password, String firstName, String lastN
      */
     UserAccount getUserAccountById(Long userId);
 
-    public Pair<Boolean, Map<String, String>> getKeys(GetUserKeysCmd cmd);
+    Pair<Boolean, Map<String, String>> getKeys(GetUserKeysCmd cmd);
 
     ListResponse<ApiKeyPairResponse> listKeys(ListUserKeysCmd cmd);
 
diff --git a/api/src/main/java/org/apache/cloudstack/acl/apikeypair/ApiKeyPairService.java b/api/src/main/java/org/apache/cloudstack/acl/apikeypair/ApiKeyPairService.java
@@ -24,6 +24,4 @@ public interface ApiKeyPairService {
     ApiKeyPair findByApiKey(String apiKey);
 
     ApiKeyPair findById(Long id);
-
-    void validateCallingUserHasAccessToDesiredUser(Long userId);
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/BaseAsyncCmd.java b/api/src/main/java/org/apache/cloudstack/api/BaseAsyncCmd.java
@@ -29,7 +29,6 @@ public abstract class BaseAsyncCmd extends BaseCmd {
     public static final String migrationSyncObject = "migration";
     public static final String snapshotHostSyncObject = "snapshothost";
     public static final String gslbSyncObject = "globalserverloadbalancer";
-    public static final String apiKeySyncObject = "apikey";
     public static final String user = "user";
 
     private Object job;
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/user/DeleteUserKeysCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/user/DeleteUserKeysCmd.java
@@ -29,7 +29,7 @@
 import org.apache.cloudstack.api.response.SuccessResponse;
 
 @APICommand(name = "deleteUserKeys", description = "Deletes a keypair from a user", responseObject = SuccessResponse.class,
-        since = "4.21.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
+        since = "4.23.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
 public class DeleteUserKeysCmd extends BaseAsyncCmd {
 
     @ACL
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/user/GetUserKeysCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/user/GetUserKeysCmd.java
@@ -38,24 +38,22 @@
         responseHasSensitiveInfo = true,
         authorized = {RoleType.User, RoleType.Admin, RoleType.DomainAdmin, RoleType.ResourceAdmin},
         since = "4.10.0")
-
 public class GetUserKeysCmd extends BaseCmd {
-
     @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = UserResponse.class, required = true, description = "ID of the user whose keys are required")
     private Long id;
 
-
-    public Long getId(){
+    public Long getId() {
         return id;
     }
 
-    public long getEntityOwnerId(){
+    public long getEntityOwnerId() {
         User user = _entityMgr.findById(User.class, getId());
         if (user != null) {
             return user.getAccountId();
         }
         return Account.ACCOUNT_ID_SYSTEM;
     }
+
     public void execute() {
         Pair<Boolean, Map<String, String>> keys = _accountService.getKeys(this);
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/user/ListUserKeyRulesCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/user/ListUserKeyRulesCmd.java
@@ -40,7 +40,7 @@
             responseObject = BaseRolePermissionResponse.class,
             requestHasSensitiveInfo = false,
             responseHasSensitiveInfo = false,
-            since = "4.21.0")
+            since = "4.23.0")
 
 public class ListUserKeyRulesCmd extends BaseListDomainResourcesCmd {
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/user/ListUserKeysCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/user/ListUserKeysCmd.java
@@ -37,7 +37,7 @@
         requestHasSensitiveInfo = false,
         responseHasSensitiveInfo = true,
         authorized = {RoleType.User, RoleType.Admin, RoleType.DomainAdmin, RoleType.ResourceAdmin},
-        since = "4.21.0")
+        since = "4.23.0")
 
 public class ListUserKeysCmd extends BaseListDomainResourcesCmd {
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/UserResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/UserResponse.java
@@ -132,7 +132,6 @@ public class UserResponse extends BaseResponse implements SetResourceIconRespons
     @Param(description = "the secret key of the user", isSensitive = true)
     private String secretKey;
 
-
     @Override
     public String getObjectId() {
         return this.getId();
diff --git a/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42010to42100.java b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42010to42100.java
@@ -19,10 +19,11 @@
 import com.cloud.upgrade.SystemVmTemplateRegistration;
 import com.cloud.utils.db.TransactionLegacy;
 import com.cloud.utils.exception.CloudRuntimeException;
-import java.sql.PreparedStatement;
-import java.sql.SQLException;
+
 import java.io.InputStream;
 import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.SQLException;
 import java.util.List;
 
 import org.apache.cloudstack.framework.config.ConfigKey;
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42010to42100.sql b/engine/schema/src/main/resources/META-INF/db/schema-42010to42100.sql
@@ -82,7 +82,7 @@ CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.host_pod_ref', 'storage_access_group
 CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.data_center', 'storage_access_groups', 'varchar(255) DEFAULT NULL COMMENT "storage access groups for the hosts in the zone"');
 
 
--- Create user token_keypairs table for apikey/secretkey tokens
+-- Create "api_keypair" table for api and secret keys
 CREATE TABLE IF NOT EXISTS `cloud`.`api_keypair` (
     `id` bigint(20) unsigned NOT NULL auto_increment,
     `uuid` varchar(40) UNIQUE NOT NULL,
@@ -101,10 +101,10 @@ CREATE TABLE IF NOT EXISTS `cloud`.`api_keypair` (
     CONSTRAINT `fk_api_keypair__user_id` FOREIGN KEY(`user_id`) REFERENCES `cloud`.`user`(`id`),
     CONSTRAINT `fk_api_keypair__account_id` FOREIGN KEY(`account_id`) REFERENCES `cloud`.`account`(`id`),
     CONSTRAINT `fk_api_keypair__domain_id` FOREIGN KEY(`domain_id`) REFERENCES `cloud`.`domain`(`id`)
-    );
+);
 
 CREATE TABLE IF NOT EXISTS `cloud`.`api_keypair_permissions` (
-                                                             `id` bigint(20) unsigned NOT NULL auto_increment,
+    `id` bigint(20) unsigned NOT NULL auto_increment,
     `uuid` varchar(40) UNIQUE,
     `sort_order` bigint(20) unsigned NOT NULL DEFAULT 0,
     `rule` varchar(255) NOT NULL,
@@ -113,7 +113,7 @@ CREATE TABLE IF NOT EXISTS `cloud`.`api_keypair_permissions` (
     `description` varchar(255),
     PRIMARY KEY (`id`),
     CONSTRAINT `fk_keypair_permissions__api_keypair_id` FOREIGN KEY(`api_keypair_id`) REFERENCES `cloud`.`api_keypair`(`id`)
-    );
+);
 
 INSERT INTO `cloud`.`api_keypair` (uuid, user_id, domain_id, account_id, api_key, secret_key, created, name)
 SELECT  uuid(), user.id, account.domain_id, account.id, user.api_key, user.secret_key, now(), 'Active key pair'
diff --git a/plugins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java b/plugins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java
@@ -284,7 +284,7 @@ public ListResponse<? extends BaseResponse> listApis(User user, String name, Lis
                     return null;
                 }
             }
-            responseList.add(s_apiNameDiscoveryResponseMap.get(name));
+            responseList.add(getApiDiscoveryResponseWithAccessibleParams(name, account));
 
         } else {
             if (role == null || role.getId() < 1L) {
@@ -302,7 +302,7 @@ public ListResponse<? extends BaseResponse> listApis(User user, String name, Lis
             }
 
             for (String apiName: apisAllowed) {
-                responseList.add(s_apiNameDiscoveryResponseMap.get(apiName));
+                responseList.add(getApiDiscoveryResponseWithAccessibleParams(apiName, account));
             }
         }
         response.setResponses(responseList);
diff --git a/server/src/main/java/com/cloud/api/query/dao/UserAccountJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/UserAccountJoinDaoImpl.java
@@ -19,6 +19,7 @@
 import java.util.List;
 
 
+import com.cloud.user.AccountManager;
 import com.cloud.user.AccountManagerImpl;
 import org.apache.cloudstack.api.ResponseObject.ResponseView;
 import org.apache.cloudstack.acl.ApiKeyPairVO;
@@ -72,7 +73,7 @@ public UserResponse newUserResponse(ResponseView view, UserAccountJoinVO usr, Ap
         userResponse.setUsername(usr.getUsername());
         userResponse.setIsDefault(usr.isDefault());
         userResponse.set2FAenabled(usr.isUser2faEnabled());
-        if (lastKeyPair != null) {
+        if (lastKeyPair != null && AccountManager.UseSecretKeyInResponse.value()) {
             userResponse.setApiKey(lastKeyPair.getApiKey());
             userResponse.setSecretKey(lastKeyPair.getSecretKey());
         }
diff --git a/server/src/main/java/org/apache/cloudstack/acl/ApiKeyPairManagerImpl.java b/server/src/main/java/org/apache/cloudstack/acl/ApiKeyPairManagerImpl.java
@@ -16,9 +16,6 @@
 // under the License.
 package org.apache.cloudstack.acl;
 
-import com.cloud.exception.InvalidParameterValueException;
-import com.cloud.user.User;
-import com.cloud.user.dao.UserDao;
 import com.cloud.utils.component.ManagerBase;
 
 import java.util.Map;
@@ -28,23 +25,17 @@
 import org.apache.cloudstack.acl.apikeypair.ApiKeyPairPermission;
 import org.apache.cloudstack.acl.dao.ApiKeyPairDao;
 import org.apache.cloudstack.acl.dao.ApiKeyPairPermissionsDao;
-import org.apache.cloudstack.query.QueryService;
 import org.apache.commons.collections.CollectionUtils;
 
 import javax.inject.Inject;
 import java.util.List;
-import java.util.Objects;
 
 public class ApiKeyPairManagerImpl extends ManagerBase implements ApiKeyPairService {
     @Inject
     private ApiKeyPairDao apiKeyPairDao;
     @Inject
     private ApiKeyPairPermissionsDao apiKeyPairPermissionsDao;
     @Inject
-    private UserDao userDao;
-    @Inject
-    private QueryService queryService;
-    @Inject
     private RoleService roleService;
 
     @Override
@@ -90,14 +81,4 @@ public ApiKeyPair findByApiKey(String apiKey) {
     public ApiKeyPair findById(Long id) {
         return apiKeyPairDao.findById(id);
     }
-
-    @Override
-    public void validateCallingUserHasAccessToDesiredUser(Long userId) {
-        List<Long> accessibleUsers = queryService.searchForAccessibleUsers();
-        User desiredUser = userDao.getUser(userId);
-        if (accessibleUsers.stream().noneMatch(u -> Objects.equals(u, userId))) {
-            throw new InvalidParameterValueException(String.format("Could not perform operation because calling user has less permissions " +
-                    "than the informed user [%s].", desiredUser.getId()));
-        }
-    }
 }

Original file line number	Diff line number	Diff line change
`@@ -24,6 +24,4 @@ public interface ApiKeyPairService {`
`24`	`24`	`ApiKeyPair findByApiKey(String apiKey);`
`25`	`25`
`26`	`26`	`ApiKeyPair findById(Long id);`
`27`		`-`
`28`		`- void validateCallingUserHasAccessToDesiredUser(Long userId);`
`29`	`27`	`}`