User and Database List in Instance Creation Not Fully Validated

[Auston McReynolds]

Example:

POST /instances

{
    "instance": {
        "name": "my_db",
        "databases": [
            {
                "character_set": "utf8",
                "collate": "utf8_general_ci",
                "name": "sampledb"
            }
        ],
        "users": [
            {
                "databases": [
                    {
                        "name": "otherdb"
                    }
                ],
                "name": "sampleuser",
                "password": "samplepassword"
            }
        ],
        ...
    }
}

Every database in instance.users.databases should exist in instance.databases, otherwise the guest will attempt to grant privileges to a database that can't possibly exist.

In the example above, the guest will attempt to grant privileges for "sampleuser" to access "otherdb", but "otherdb" does not exist (only "sampledb" does).

Fix: Add validation in the API to assert that all instance.users.databases exist in instance.databases, otherwise raise an exception.

Addendum: The API should validate for duplicate users as well (same name and host).

Note: instance.users.databases is already validated for duplicates via apischema's uniqueItems assertion.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/44978

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/44978
Committed: http://github.com/openstack/trove/commit/52d1203d055b66d49ed6b2dd91de8afe42a7e9d0
Submitter: Jenkins
Branch: master

commit 52d1203d055b66d49ed6b2dd91de8afe42a7e9d0
Author: amcrn <email address hidden>
Date: Wed Sep 4 00:50:57 2013 -0700

    User and Database List in Create Not Validated

    Fix #1: Every database in instance.users.databases should exist in
    instance.databases, otherwise the guest will attempt to grant
    privileges to a database that can't possibly exist.

    Fix #2: The (name, host) of each user in instance.users should be
    unique, otherwise there is a semantic duplicate.

    Note: instance.users.databases is already checked for uniqueness via
    apischema's uniqueItems assertion.

    Change-Id: Ib0a148a1d7dcf6adf2a899b15db815273e5688a4
    Closes-Bug: #1219627