#NEWLINE# def validate_network_rbac_policy_change( self , resource , event , trigger , context , object_type , policy , **kwargs ) : #NEWLINE# #INDENT# 'Validates network RBAC policy changes.\n\n        On creation, verify that the creator is an admin or that it owns the\n        network it is sharing.\n\n        On update and delete, make sure the tenant losing access does not have\n        resources that depend on that access.\n        ' #NEWLINE# if ( ( object_type != 'network' ) or ( policy [ 'action' ] != 'access_as_shared' ) ) : #NEWLINE# #INDENT# return #NEWLINE# #UNINDENT# net = self . _get_network ( context , policy [ 'object_id' ] ) #NEWLINE# if ( event in ( events . BEFORE_CREATE , events . BEFORE_UPDATE ) ) : #NEWLINE# #INDENT# if ( ( not context . is_admin ) and ( net [ 'tenant_id' ] != context . tenant_id ) ) : #NEWLINE# #INDENT# msg = _ ( 'Only admins can manipulate policies on networks they do not own.' ) #NEWLINE# raise exc . InvalidInput ( error_message = msg ) #NEWLINE# #UNINDENT# #UNINDENT# tenant_to_check = None #NEWLINE# if ( event == events . BEFORE_UPDATE ) : #NEWLINE# #INDENT# new_tenant = kwargs [ 'policy_update' ] [ 'target_tenant' ] #NEWLINE# if ( policy [ 'target_tenant' ] != new_tenant ) : #NEWLINE# #INDENT# tenant_to_check = policy [ 'target_tenant' ] #NEWLINE# #UNINDENT# #UNINDENT# if ( event == events . BEFORE_DELETE ) : #NEWLINE# #INDENT# tenant_to_check = policy [ 'target_tenant' ] #NEWLINE# #UNINDENT# if tenant_to_check : #NEWLINE# #INDENT# self . ensure_no_tenant_ports_on_network ( net [ 'id' ] , net [ 'tenant_id' ] , tenant_to_check )