Add a RBAC action field in the query hooks

[Rodolfo Alonso]

Any Neutron resource (that is not only a single database table but a view, a combination of several tables), can register a set of hooks that will be used during the DB query creation [1]. These hooks include a query hook (to modify query depending on the database relationships), a filter hook (to add extra filtering steps to the final query) and a results filter hook (that could be used to join other tables with other dependencies).

This bug proposes to add an extra field to this hooks to be able to filter the RBAC actions. Some resources, like networks [2] and subnets [3], need to add an extra RBAC action "ACCESS_EXTERNAL" to the query filter. This is done now by adding again the same RBAC filter included in the ``query_with_hooks`` [4] but with the "ACCESS_EXTERNAL" action.

If instead of this, the ``query_with_hooks`` can include a configurable set of RBAC actions, the result query could be shorter, less complex and faster.

[1]https://github.com/openstack/neutron-lib/blob/625ae19e29758da98c5dd8c9ce03962840a87949/neutron_lib/db/model_query.py#L86-L90
[2]https://github.com/openstack/neutron/blob/bcf1f707bc9169e8f701613214516e97f039d730/neutron/db/external_net_db.py#L75-L80
[3]https://review.opendev.org/c/openstack/neutron/+/907313/15/neutron/db/external_net_db.py
[4]https://github.com/openstack/neutron-lib/blob/625ae19e29758da98c5dd8c9ce03962840a87949/neutron_lib/db/model_query.py#L127-L132

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-lib/+/914473

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/915370

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Slawek Kaplonski <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/915370
Reason: This review is > 4 weeks without comment, and failed Zuul jobs the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Rodolfo Alonso (rodolfo-alonso-hernandez)]

https://review.opendev.org/c/openstack/neutron/+/915370 restored

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron-lib/+/914473
Committed: https://opendev.org/openstack/neutron-lib/commit/b85503643c92b26e8206b5b39bafba80bbb6722e
Submitter: "Zuul (22348)"
Branch: master

commit b85503643c92b26e8206b5b39bafba80bbb6722e
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Mar 27 10:45:11 2024 +0000

    Add the field "rbac_actions" to the model query hooks

    This patch adds a new field to the models query hook: "rbac_actions".
    This field stores the multiple RBAC actions to filter the query in
    case of making a non-admin query.

    The default RBAC action are "access_as_shared" and "access_as_readonly".
    For networks and subnets, the action "access_as_external" is needed in
    this query. Instead of adding a query hook, this additional field allows
    to modify the required RBAC action filter.

    Related-Bug: #2059236
    Change-Id: Ic41461223719c535ac9d2bbadfb1b6077c898903