add super_extension

Change-Id: I7b234759a4aed653228f02d39df16021286242ed
Signed-off-by: WuKong <rebirthmonkey@gmail.com>

8 files changed, 169 insertions, 408 deletions

diff --git a/keystone-moon/examples/moon/policies/policy_super/assignment.json b/keystone-moon/examples/moon/policies/policy_super/assignment.json
new file mode 100644
index 00000000..3e10a055
--- /dev/null
+++ b/keystone-moon/examples/moon/policies/policy_super/assignment.json
@@ -0,0 +1,23 @@
+{
+    "subject_assignments": {
+        "role": {
+			"super_admin": ["admin"]
+		}
+    },
+
+    "action_assignments": {
+        "action_id": {
+			"read": ["read"],
+			"write": ["write"]
+		}
+    },
+
+    "object_assignments": {
+        "object_id": {
+            "templates": ["templates"],
+		    "sub_meta_rule_algorithm": ["sub_meta_rule_relations"],
+		    "aggregation_algorithms": ["aggregation_algorithms"],
+            "tenants": ["tenants"]
+		}
+    }
+}
diff --git a/keystone-moon/examples/moon/policies/policy_super/metadata.json b/keystone-moon/examples/moon/policies/policy_super/metadata.json
new file mode 100644
index 00000000..b6eb92f3
--- /dev/null
+++ b/keystone-moon/examples/moon/policies/policy_super/metadata.json
@@ -0,0 +1,18 @@
+{
+    "name": "MLS_metadata",
+    "model": "RBAC",
+    "genre": "admin",
+    "description": "",
+
+    "subject_categories": [
+        "role"
+    ],
+
+    "action_categories": [
+        "action_id"
+    ],
+
+    "object_categories": [
+        "object_id"
+    ]
+}
diff --git a/keystone-moon/examples/moon/policies/policy_super/metarule.json b/keystone-moon/examples/moon/policies/policy_super/metarule.json
new file mode 100644
index 00000000..86dbfad2
--- /dev/null
+++ b/keystone-moon/examples/moon/policies/policy_super/metarule.json
@@ -0,0 +1,12 @@
+{
+    "sub_meta_rules": {
+		"rbac_rule": {
+			"subject_categories": ["role"],
+			"action_categories": ["action_id"],
+			"object_categories": ["object_id"],
+			"algorithm": "inclusion"
+		}
+	},
+	"aggregation": "all_true"
+}
+
diff --git a/keystone-moon/examples/moon/policies/policy_super/perimeter.json b/keystone-moon/examples/moon/policies/policy_super/perimeter.json
new file mode 100644
index 00000000..e0be02fa
--- /dev/null
+++ b/keystone-moon/examples/moon/policies/policy_super/perimeter.json
@@ -0,0 +1,15 @@
+{
+    "subjects": [
+        "super_admin"
+    ],
+    "actions": [
+        "read",
+        "write"
+    ],
+    "objects": [
+        "templates",
+        "aggregation_algorithms",
+        "sub_meta_rule_algorithms",
+        "tenants"
+    ]
+}
diff --git a/keystone-moon/examples/moon/policies/policy_super/rule.json b/keystone-moon/examples/moon/policies/policy_super/rule.json
new file mode 100644
index 00000000..234158bc
--- /dev/null
+++ b/keystone-moon/examples/moon/policies/policy_super/rule.json
@@ -0,0 +1,12 @@
+{
+    "rbac_rule":[
+        ["admin" , "read", "templates"],
+        ["admin" , "read", "aggregation_algorithms"],
+        ["admin" , "read", "sub_meta_rule_algorithms"],
+        ["admin" , "read", "tenants"],
+        ["admin" , "write", "templates"],
+        ["admin" , "write", "aggregation_algorithms"],
+        ["admin" , "write", "sub_meta_rule_algorithms"],
+        ["admin" , "write", "tenants"]
+    ]
+}
diff --git a/keystone-moon/examples/moon/policies/policy_super/scope.json b/keystone-moon/examples/moon/policies/policy_super/scope.json
new file mode 100644
index 00000000..bac0b47a
--- /dev/null
+++ b/keystone-moon/examples/moon/policies/policy_super/scope.json
@@ -0,0 +1,23 @@
+{
+  "subject_scopes": {
+    "role": [
+      "admin"
+    ]
+  },
+
+  "action_scopes": {
+    "action_id": [
+      "read",
+      "write"
+    ]
+  },
+
+  "object_scopes": {
+    "object_id": [
+        "templates",
+        "aggregation_algorithms",
+        "sub_meta_rule_algorithms",
+        "tenants"
+      ]
+    }
+}
diff --git a/keystone-moon/keystone/contrib/moon/core.py b/keystone-moon/keystone/contrib/moon/core.py
index ee5e9e54..723569cd 100644
--- a/keystone-moon/keystone/contrib/moon/core.py
+++ b/keystone-moon/keystone/contrib/moon/core.py
@@ -95,7 +95,7 @@ def enforce(action_names, object_name, **extra):
 
             # func.func_globals["_admin_extension_uuid"] = _admin_extension_uuid
             if not intra_admin_extension_id:
-                args[0].moonlog_api.warning("No admin IntraExtension found, authorization granted by default.")
+                raise TenantNoIntraAdminExtension()
                 return func(*args)
             else:
                 authz_result = False
@@ -115,6 +115,7 @@ def enforce(action_names, object_name, **extra):
     return wrap
 
 
+# TODO (dthom) join with filer_args
 def filter_input(data):
     if type(data) not in (str, unicode):
         return data
@@ -1399,6 +1400,7 @@ class IntraExtensionManager(manager.Manager):
             raise RuleUnknown()
         return self.driver.set_rule_dict(intra_extension_id, sub_meta_rule_id, rule_id, rule_list)
 
+
 @dependency.provider('authz_api')
 @dependency.requires('identity_api', 'tenant_api', 'moonlog_api')
 class IntraExtensionAuthzManager(IntraExtensionManager):
@@ -1437,129 +1439,6 @@ class IntraExtensionAuthzManager(IntraExtensionManager):
             raise ActionUnknown()
         return super(IntraExtensionAuthzManager, self).authz(intra_extension_id, subject_id, object_id, action_id)
 
-    def del_intra_extension(self, user_id, intra_extension_id):
-        raise AdminException()
-
-    def set_subject_dict(self, user_id, intra_extension_uuid, subject_dict):
-        raise SubjectAddNotAuthorized()
-
-    def add_subject_dict(self, user_id, intra_extension_uuid, subject_name):
-        raise SubjectAddNotAuthorized()
-
-    def del_subject(self, user_id, intra_extension_uuid, subject_name):
-        raise SubjectDelNotAuthorized()
-
-    def set_object_dict(self, user_id, intra_extension_uuid, object_dict):
-        raise ObjectAddNotAuthorized()
-
-    def add_object(self, user_id, intra_extension_uuid, object_name):
-        raise ObjectAddNotAuthorized()
-
-    def del_object(self, user_id, intra_extension_uuid, object_uuid):
-        raise ObjectDelNotAuthorized()
-
-    def set_action_dict(self, user_id, intra_extension_uuid, action_dict):
-        raise ActionAddNotAuthorized()
-
-    def add_action(self, user_id, intra_extension_uuid, action_dict):
-        raise ActionAddNotAuthorized()
-
-    def del_action(self, user_id, intra_extension_uuid, action_uuid):
-        raise ActionDelNotAuthorized()
-
-    def set_subject_category_dict(self, user_id, intra_extension_uuid, subject_category):
-        raise SubjectCategoryAddNotAuthorized()
-
-    def add_subject_category(self, user_id, intra_extension_uuid, subject_category_name):
-        raise SubjectCategoryAddNotAuthorized()
-
-    def del_subject_category(self, user_id, intra_extension_uuid, subject_uuid):
-        raise SubjectCategoryDelNotAuthorized()
-
-    def set_object_category_dict(self, user_id, intra_extension_uuid, object_category):
-        raise ObjectCategoryAddNotAuthorized()
-
-    def add_object_category(self, user_id, intra_extension_uuid, object_category_name):
-        raise ObjectCategoryAddNotAuthorized()
-
-    def del_object_category(self, user_id, intra_extension_uuid, object_uuid):
-        raise ObjectCategoryDelNotAuthorized()
-
-    def set_action_category_dict(self, user_id, intra_extension_uuid, action_category):
-        raise ActionCategoryAddNotAuthorized()
-
-    def add_action_category(self, user_id, intra_extension_uuid, action_category_name):
-        raise ActionCategoryAddNotAuthorized()
-
-    def del_action_category(self, user_id, intra_extension_uuid, action_uuid):
-        raise ActionCategoryDelNotAuthorized()
-
-    def set_subject_scope_dict(self, user_id, intra_extension_uuid, category, scope):
-        raise SubjectCategoryScopeAddNotAuthorized()
-
-    def add_subject_scope_dict(self, user_id, intra_extension_uuid, subject_category, scope_name):
-        raise SubjectCategoryScopeAddNotAuthorized()
-
-    def del_subject_scope(self, user_id, intra_extension_uuid, subject_category, subject_category_scope):
-        raise SubjectCategoryScopeDelNotAuthorized()
-
-    def set_object_scope_dict(self, user_id, intra_extension_uuid, category, scope):
-        raise ObjectCategoryScopeAddNotAuthorized()
-
-    def add_object_scope(self, user_id, intra_extension_uuid, object_category, scope_name):
-        raise ObjectCategoryScopeAddNotAuthorized()
-
-    def del_object_scope(self, user_id, intra_extension_uuid, object_category, object_category_scope):
-        raise ObjectCategoryScopeDelNotAuthorized()
-
-    def set_action_scope_dict(self, user_id, intra_extension_uuid, category, scope):
-        raise ActionCategoryScopeAddNotAuthorized()
-
-    def add_action_scope(self, user_id, intra_extension_uuid, action_category, scope_name):
-        raise ActionCategoryScopeAddNotAuthorized()
-
-    def del_action_scope(self, user_id, intra_extension_uuid, action_category, action_category_scope):
-        raise ActionCategoryScopeDelNotAuthorized()
-
-    def set_subject_assignment_dict(self, user_id, intra_extension_uuid, subject_uuid, assignment_dict):
-        raise SubjectCategoryAssignmentAddNotAuthorized()
-
-    def del_subject_assignment(self, user_id, intra_extension_uuid, subject_uuid, category_uuid, scope_uuid):
-        raise SubjectCategoryAssignmentAddNotAuthorized()
-
-    def add_subject_assignment(self, user_id, intra_extension_uuid, subject_uuid, category_uuid, scope_uuid):
-        raise SubjectCategoryAssignmentDelNotAuthorized()
-
-    def set_object_category_assignment_dict(self, user_id, intra_extension_uuid, object_uuid, assignment_dict):
-        raise ObjectCategoryAssignmentAddNotAuthorized()
-
-    def del_object_assignment(self, user_id, intra_extension_uuid, object_uuid, category_uuid, scope_uuid):
-        raise ObjectCategoryAssignmentAddNotAuthorized()
-
-    def add_object_assignment(self, user_id, intra_extension_uuid, object_uuid, category_uuid, scope_uuid):
-        raise ObjectCategoryAssignmentDelNotAuthorized()
-
-    def set_action_assignment_dict(self, user_id, intra_extension_uuid, action_uuid, assignment_dict):
-        raise ActionCategoryAssignmentAddNotAuthorized()
-
-    def del_action_assignment(self, user_id, intra_extension_uuid, action_uuid, category_uuid, scope_uuid):
-        raise ActionCategoryAssignmentAddNotAuthorized()
-
-    def add_action_assignment(self, user_id, intra_extension_uuid, action_uuid, category_uuid, scope_uuid):
-        raise ActionCategoryAssignmentDelNotAuthorized()
-
-    def set_aggregation_algorithm_dict(self, user_id, intra_extension_uuid, aggregation_algorithm):
-        raise MetaRuleAddNotAuthorized()
-
-    def get_sub_meta_rule_dict(self, user_id, intra_extension_uuid, sub_meta_rules):
-        raise MetaRuleAddNotAuthorized()
-
-    def set_sub_rule(self, user_id, intra_extension_uuid, relation, sub_rule):
-        raise RuleAddNotAuthorized()
-
-    def del_sub_rule(self, user_id, intra_extension_uuid, relation_name, rule):
-        raise RuleAddNotAuthorized()
-
 
 @dependency.provider('admin_api')
 @dependency.requires('identity_api', 'tenant_api', 'moonlog_api')
diff --git a/keystone-moon/keystone/contrib/moon/exception.py b/keystone-moon/keystone/contrib/moon/exception.py
index 1339122c..fa985a2f 100644
--- a/keystone-moon/keystone/contrib/moon/exception.py
+++ b/keystone-moon/keystone/contrib/moon/exception.py
@@ -69,6 +69,20 @@ class TenantNoIntraExtension(TenantException):
     logger = "ERROR"
 
 
+class TenantNoIntraAuthzExtension(TenantNoIntraExtension):
+    message_format = _("The tenant has not intra_authz_extension.")
+    code = 400
+    title = 'Tenant No Intra_Authz_Extension'
+    logger = "ERROR"
+
+
+class TenantNoIntraAdminExtension(TenantNoIntraExtension):
+    message_format = _("The tenant has not intra_admin_extension.")
+    code = 400
+    title = 'Tenant No Intra_Admin_Extension'
+    logger = "ERROR"
+
+
 # Exceptions for IntraExtension
 
 
@@ -93,500 +107,265 @@ class IntraExtensionCreationError(IntraExtensionException):
 
 # Authz exceptions
 
-
 class AuthzException(MoonError):
+    message_format = _("There is an authorization error requesting this IntraExtension.")
+    code = 403
+    title = 'Authz Exception'
+    logger = "AUTHZ"
+
+
+# Admin exceptions
+
+class AdminException(MoonError):
     message_format = _("There is an error requesting this Authz IntraExtension.")
     code = 400
     title = 'Authz Exception'
     logger = "AUTHZ"
 
 
-class AuthzPerimeter(AuthzException):
+class AdminMetaData(AdminException):
     code = 400
-    title = 'Perimeter Exception'
+    title = 'Metadata Exception'
 
 
-class AuthzScope(AuthzException):
+class AdminPerimeter(AdminException):
     code = 400
-    title = 'Scope Exception'
+    title = 'Perimeter Exception'
 
 
-class AuthzMetadata(AuthzException):
+class AdminScope(AdminException):
     code = 400
-    title = 'Metadata Exception'
+    title = 'Scope Exception'
 
 
-class AuthzAssignment(AuthzException):
+class AdminAssignment(AdminException):
     code = 400
     title = 'Assignment Exception'
 
 
-class AuthzMetaRule(AuthzException):
+class AdminMetaRule(AdminException):
     code = 400
     title = 'Aggregation Algorithm Exception'
 
 
-class AuthzRule(AuthzException):
+class AdminRule(AdminException):
     code = 400
     title = 'Rule Exception'
 
 
-class SubjectCategoryNameExisting(AuthzMetadata):
+class SubjectCategoryNameExisting(AdminMetaData):
     message_format = _("The given subject category name is existing.")
     code = 400
     title = 'Subject Category Name Existing'
     logger = "ERROR"
 
 
-class ObjectCategoryNameExisting(AuthzMetadata):
+class ObjectCategoryNameExisting(AdminMetaData):
     message_format = _("The given object category name is existing.")
     code = 400
     title = 'Object Category Name Existing'
     logger = "ERROR"
 
 
-class ActionCategoryNameExisting(AuthzMetadata):
+class ActionCategoryNameExisting(AdminMetaData):
     message_format = _("The given action category name is existing.")
     code = 400
     title = 'Action Category Name Existing'
     logger = "ERROR"
 
 
-class SubjectCategoryUnknown(AuthzMetadata):
+class SubjectCategoryUnknown(AdminMetaData):
     message_format = _("The given subject category is unknown.")
     code = 400
     title = 'Subject Category Unknown'
     logger = "ERROR"
 
 
-class ObjectCategoryUnknown(AuthzMetadata):
+class ObjectCategoryUnknown(AdminMetaData):
     message_format = _("The given object category is unknown.")
     code = 400
     title = 'Object Category Unknown'
     logger = "ERROR"
 
 
-class ActionCategoryUnknown(AuthzMetadata):
+class ActionCategoryUnknown(AdminMetaData):
     message_format = _("The given action category is unknown.")
     code = 400
     title = 'Action Category Unknown'
     logger = "ERROR"
 
 
-class SubjectUnknown(AuthzPerimeter):
+class SubjectUnknown(AdminPerimeter):
     message_format = _("The given subject is unknown.")
     code = 400
     title = 'Subject Unknown'
     logger = "ERROR"
 
 
-class ObjectUnknown(AuthzPerimeter):
+class ObjectUnknown(AdminPerimeter):
     message_format = _("The given object is unknown.")
     code = 400
     title = 'Object Unknown'
     logger = "ERROR"
 
 
-class ActionUnknown(AuthzPerimeter):
+class ActionUnknown(AdminPerimeter):
     message_format = _("The given action is unknown.")
     code = 400
     title = 'Action Unknown'
     logger = "ERROR"
 
 
-class SubjectNameExisting(AuthzPerimeter):
+class SubjectNameExisting(AdminPerimeter):
     message_format = _("The given subject name is existing.")
     code = 400
     title = 'Subject Name Existing'
     logger = "ERROR"
 
 
-class ObjectNameExisting(AuthzPerimeter):
+class ObjectNameExisting(AdminPerimeter):
     message_format = _("The given object name is existing.")
     code = 400
     title = 'Object Name Existing'
     logger = "ERROR"
 
 
-class ActionNameExisting(AuthzPerimeter):
+class ActionNameExisting(AdminPerimeter):
     message_format = _("The given action name is existing.")
     code = 400
     title = 'Action Name Existing'
     logger = "ERROR"
 
 
-class SubjectScopeUnknown(AuthzScope):
+class SubjectScopeUnknown(AdminScope):
     message_format = _("The given subject scope is unknown.")
     code = 400
     title = 'Subject Scope Unknown'
     logger = "ERROR"
 
 
-class ObjectScopeUnknown(AuthzScope):
+class ObjectScopeUnknown(AdminScope):
     message_format = _("The given object scope is unknown.")
     code = 400
     title = 'Object Scope Unknown'
     logger = "ERROR"
 
 
-class ActionScopeUnknown(AuthzScope):
+class ActionScopeUnknown(AdminScope):
     message_format = _("The given action scope is unknown.")
     code = 400
     title = 'Action Scope Unknown'
     logger = "ERROR"
 
 
-class SubjectScopeNameExisting(AuthzScope):
+class SubjectScopeNameExisting(AdminScope):
     message_format = _("The given subject scope name is existing.")
     code = 400
     title = 'Subject Scope Name Existing'
     logger = "ERROR"
 
 
-class ObjectScopeNameExisting(AuthzScope):
+class ObjectScopeNameExisting(AdminScope):
     message_format = _("The given object scope name is existing.")
     code = 400
     title = 'Object Scope Name Existing'
     logger = "ERROR"
 
 
-class ActionScopeNameExisting(AuthzScope):
+class ActionScopeNameExisting(AdminScope):
     message_format = _("The given action scope name is existing.")
     code = 400
     title = 'Action Scope Name Existing'
     logger = "ERROR"
 
 
-class SubjectAssignmentOutOfScope(AuthzScope):
-    message_format = _("The given subject scope value is out of scope.")
-    code = 400
-    title = 'Subject Assignment Out Of Scope'
-    logger = "WARNING"
-
-
-class ActionAssignmentOutOfScope(AuthzScope):
-    message_format = _("The given action scope value is out of scope.")
-    code = 400
-    title = 'Action Assignment Out Of Scope'
-    logger = "WARNING"
-
-
-class ObjectAssignmentOutOfScope(AuthzScope):
-    message_format = _("The given object scope value is out of scope.")
-    code = 400
-    title = 'Object Assignment Out Of Scope'
-    logger = "WARNING"
-
-
-class SubjectAssignmentUnknown(AuthzAssignment):
+class SubjectAssignmentUnknown(AdminAssignment):
     message_format = _("The given subject assignment value is unknown.")
     code = 400
     title = 'Subject Assignment Unknown'
     logger = "ERROR"
 
 
-class ObjectAssignmentUnknown(AuthzAssignment):
+class ObjectAssignmentUnknown(AdminAssignment):
     message_format = _("The given object assignment value is unknown.")
     code = 400
     title = 'Object Assignment Unknown'
     logger = "ERROR"
 
 
-class ActionAssignmentUnknown(AuthzAssignment):
+class ActionAssignmentUnknown(AdminAssignment):
     message_format = _("The given action assignment value is unknown.")
     code = 400
     title = 'Action Assignment Unknown'
     logger = "ERROR"
 
 
-class SubjectAssignmentExisting(AuthzAssignment):
+class SubjectAssignmentExisting(AdminAssignment):
     message_format = _("The given subject assignment value is existing.")
     code = 400
     title = 'Subject Assignment Existing'
     logger = "ERROR"
 
 
-class ObjectAssignmentExisting(AuthzAssignment):
+class ObjectAssignmentExisting(AdminAssignment):
     message_format = _("The given object assignment value is existing.")
     code = 400
     title = 'Object Assignment Existing'
     logger = "ERROR"
 
 
-class ActionAssignmentExisting(AuthzAssignment):
+class ActionAssignmentExisting(AdminAssignment):
     message_format = _("The given action assignment value is existing.")
     code = 400
     title = 'Action Assignment Existing'
     logger = "ERROR"
 
 
-class AggregationAlgorithmNotExisting(AuthzMetadata):
+class AggregationAlgorithmNotExisting(AdminMetaRule):
     message_format = _("The given aggregation algorithm is not existing.")
     code = 400
     title = 'Aggregation Algorithm Not Existing'
     logger = "ERROR"
 
 
-class AggregationAlgorithmUnknown(AuthzMetadata):
+class AggregationAlgorithmUnknown(AdminMetaRule):
     message_format = _("The given aggregation algorithm is unknown.")
     code = 400
     title = 'Aggregation Algorithm Unknown'
     logger = "ERROR"
 
 
-class SubMetaRuleUnknown(AuthzMetadata):
+class SubMetaRuleUnknown(AdminMetaRule):
     message_format = _("The given sub meta rule is unknown.")
     code = 400
     title = 'Sub Meta Rule Unknown'
     logger = "ERROR"
 
 
-class SubMetaRuleNameExisting(AuthzMetadata):
+class SubMetaRuleNameExisting(AdminMetaRule):
     message_format = _("The sub meta rule name is existing.")
     code = 400
     title = 'Sub Meta Rule Name Existing'
     logger = "ERROR"
 
 
-class SubMetaRuleExisting(AuthzMetadata):
+class SubMetaRuleExisting(AdminMetaRule):
     message_format = _("The sub meta rule is existing.")
     code = 400
     title = 'Sub Meta Rule Existing'
     logger = "ERROR"
 
 
-class RuleOKNotExisting(AuthzRule):
-    message_format = _("The positive rule for that request doen't exist.")
-    code = 400
-    title = 'Rule OK Not Existing'
-    logger = "ERROR"
-
-
-class RuleKOExisting(AuthzRule):
-    message_format = _("The request match a negative rule.")
-    code = 400
-    title = 'Rule KO Existing'
-    logger = "ERROR"
-
-
-class RuleExisting(AuthzRule):
+class RuleExisting(AdminRule):
     message_format = _("The rule is existing.")
     code = 400
     title = 'Rule Existing'
     logger = "ERROR"
 
 
-class RuleUnknown(AuthzRule):
+class RuleUnknown(AdminRule):
     message_format = _("The rule for that request doesn't exist.")
     code = 400
     title = 'Rule Unknown'
     logger = "ERROR"
 
-
-class AddedRuleExisting(AuthzRule):
-    message_format = _("The added rule for that request is existing.")
-    code = 400
-    title = 'Added Rule Existing'
-    logger = "ERROR"
-
-
-# Admin exceptions
-
-
-class AdminException(MoonError):
-    message_format = _("There is an authorization error requesting this IntraExtension.")
-    code = 403
-    title = 'Admin Exception'
-    logger = "AUTHZ"
-
-
-class AdminPerimeter(AuthzException):
-    title = 'Perimeter Exception'
-
-
-class AdminScope(AuthzException):
-    title = 'Scope Exception'
-
-
-class AdminMetadata(AuthzException):
-    title = 'Metadata Exception'
-
-
-class AdminAssignment(AuthzException):
-    title = 'Assignment Exception'
-
-
-class AdminRule(AuthzException):
-    title = 'Rule Exception'
-
-class AdminMetaRule(AuthzException):
-    title = 'MetaRule Exception'
-
-
-class SubjectReadNotAuthorized(AdminPerimeter):
-    title = 'Subject Read Not Authorized'
-
-
-class SubjectAddNotAuthorized(AdminPerimeter):
-    title = 'Subject Add Not Authorized'
-
-
-class SubjectDelNotAuthorized(AdminPerimeter):
-    title = 'Subject Del Not Authorized'
-
-
-class ObjectReadNotAuthorized(AdminPerimeter):
-    title = 'Object Read Not Authorized'
-
-
-class ObjectAddNotAuthorized(AdminPerimeter):
-    title = 'Object Add Not Authorized'
-
-
-class ObjectDelNotAuthorized(AdminPerimeter):
-    title = 'Object Del Not Authorized'
-
-
-class ActionReadNotAuthorized(AdminPerimeter):
-    title = 'Action Read Not Authorized'
-
-
-class ActionAddNotAuthorized(AdminPerimeter):
-    title = 'Action Add Not Authorized'
-
-
-class ActionDelNotAuthorized(AdminPerimeter):
-    title = 'Action Del Not Authorized'
-
-
-class SubjectScopeReadNotAuthorized(AuthzException):
-    title = 'Subject Scope Read Not Authorized'
-
-
-class SubjectScopeAddNotAuthorized(AuthzException):
-    title = 'Subject Scope Add Not Authorized'
-
-
-class SubjectScopeDelNotAuthorized(AuthzException):
-    title = 'Subject Scope Del Not Authorized'
-
-
-class ObjectScopeReadNotAuthorized(AuthzException):
-    title = 'Object Scope Read Not Authorized'
-
-
-class ObjectScopeAddNotAuthorized(AuthzException):
-    title = 'Object Scope Add Not Authorized'
-
-
-class ObjectScopeDelNotAuthorized(AuthzException):
-    title = 'Object Scope Del Not Authorized'
-
-
-class ActionScopeReadNotAuthorized(AuthzException):
-    title = 'Action Scope Read Not Authorized'
-
-
-class ActionScopeAddNotAuthorized(AuthzException):
-    title = 'Action Scope Add Not Authorized'
-
-
-class ActionScopeDelNotAuthorized(AuthzException):
-    title = 'Action Scope Del Not Authorized'
-
-
-class SubjectCategoryReadNotAuthorized(AdminMetadata):
-    title = 'Subject Category Read Not Authorized'
-    logger = "AUTHZ"
-
-
-class SubjectCategoryAddNotAuthorized(AdminMetadata):
-    title = 'Subject Category Add Not Authorized'
-
-
-class SubjectCategoryDelNotAuthorized(AdminMetadata):
-    title = 'Subject Category Del Not Authorized'
-
-
-class ObjectCategoryReadNotAuthorized(AdminMetadata):
-    title = 'Object Category Read Not Authorized'
-
-
-class ObjectCategoryAddNotAuthorized(AdminMetadata):
-    title = 'Object Category Add Not Authorized'
-
-
-class ObjectCategoryDelNotAuthorized(AdminMetadata):
-    title = 'Object Category Del Not Authorized'
-
-
-class ActionCategoryReadNotAuthorized(AdminMetadata):
-    title = 'Action Category Read Not Authorized'
-
-
-class ActionCategoryAddNotAuthorized(AdminMetadata):
-    title = 'Action Category Add Not Authorized'
-
-
-class ActionCategoryDelNotAuthorized(AdminMetadata):
-    title = 'Action Category Del Not Authorized'
-
-
-class SubjectAssignmentReadNotAuthorized(AdminAssignment):
-    title = 'Subject Assignment Read Not Authorized'
-
-
-class SubjectAssignmentAddNotAuthorized(AdminAssignment):
-    title = 'Subject Assignment Add Not Authorized'
-
-
-class SubjectAssignmentDelNotAuthorized(AdminAssignment):
-    title = 'Subject Assignment Del Not Authorized'
-
-
-class ObjectAssignmentReadNotAuthorized(AdminAssignment):
-    title = 'Object Assignment Read Not Authorized'
-
-
-class ObjectAssignmentAddNotAuthorized(AdminAssignment):
-    title = 'Object Assignment Add Not Authorized'
-
-
-class ObjectAssignmentDelNotAuthorized(AdminAssignment):
-    title = 'Object Assignment Del Not Authorized'
-
-
-class ActionAssignmentReadNotAuthorized(AdminAssignment):
-    title = 'Action Assignment Read Not Authorized'
-
-
-class ActionAssignmentAddNotAuthorized(AdminAssignment):
-    title = 'Action Assignment Add Not Authorized'
-
-
-class ActionAssignmentDelNotAuthorized(AdminAssignment):
-    title = 'Action Assignment Del Not Authorized'
-
-
-class RuleReadNotAuthorized(AdminRule):
-    title = 'Rule Read Not Authorized'
-
-
-class RuleAddNotAuthorized(AdminRule):
-    title = 'Rule Add Not Authorized'
-
-
-class RuleDelNotAuthorized(AdminRule):
-    title = 'Rule Del Not Authorized'
-
-
-class MetaRuleReadNotAuthorized(AdminRule):
-    title = 'MetaRule Read Not Authorized'
-
-
-class MetaRuleAddNotAuthorized(AdminRule):
-    title = 'MetaRule Add Not Authorized'
-
-
-class MetaRuleDelNotAuthorized(AdminRule):
-    title = 'MetaRule Del Not Authorized'