Changes in openstack_dashboard/conf/*policy.json won't take effect for Panel visibility until User re-logins

[Timur Sufiev]

The Panel class is a subclass of HorizonComponent class, which should check `self.policy_rules` while determining whether the entity is visible or not. Unfortunately the actual values `self.policy_rules` relies upon are being loaded during first request to Horizon, also the final result of checking whether Panel is visible or not will be cached in user session.

Speaking of concrete example, for Identity -> Users panel https://github.com/openstack/horizon/blob/2014.2.rc1/openstack_dashboard/dashboards/identity/users/panel.py#L29 you can check it yourself by changing both rules in https://github.com/openstack/horizon/blob/2014.2.rc1/openstack_dashboard/conf/keystone_policy.json#L43 to "!" and see that the panel is still visible - until you _both_ reload Horizon and re-login to clear session. After that it will be hidden.

While reloading Horizon is fine - because changing kind of server settings is involved, the need to sign-out and the sign-in for the visibility changes to take effect is not.

[Thiago Paiva Brito (outbrito)]

@Timur: I tested it and happened that my panel has been disabled. But I had to log out and restart Horizon so it can update the policy that was already in memory. There is a double problem here:

1) Horizon isn't considering policy changes until restart

2) Permissions are persistent while the session is opened

[Timur Sufiev (tsufiev-x)]

@Thiago, yes, you're right - I've just checked that Panel is actually hidden only after I _both_ reload Horizon and recreate the session. While reloading browser seems okay to me (after all, files inside Horizon source code were changed!), the need to manually log-out and log-in doesn't, because it prevents, say, cloud admin to change panels visibility for the users immediately - changes won't take an effect until users' sessions expire.

[Thiago Paiva Brito (outbrito)]

@Timur agreed. Will you take a look at it? If you want some help, I'm on IRC (tpborion).

[Timur Sufiev (tsufiev-x)]

@Thiago, sure, the fix should be pretty simple, will upload it in a while.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/127531

[OpenStack Infra (hudson-openstack)]

Change abandoned by Timur Sufiev (<email address hidden>) on branch: master
Review: https://review.openstack.org/127531