vm: add permissions to Instance

circle/dashboard/views.py

@@ -127,6 +127,8 @@ class VmDetailView(CheckedDetailView):
         self.object = self.get_object()
         self.object = self.get_object()
         if not self.object.has_level(request.user, 'owner'):
         if not self.object.has_level(request.user, 'owner'):
             raise PermissionDenied()
             raise PermissionDenied()
+        if not request.user.has_perm('vm.change_resources'):
+            raise PermissionDenied()
 
 
         resources = {
         resources = {
             'num_cores': request.POST.get('cpu-count'),
             'num_cores': request.POST.get('cpu-count'),
@@ -208,6 +210,8 @@ class VmDetailView(CheckedDetailView):
         object = self.get_object()
         object = self.get_object()
         if not object.has_level(request.user, 'owner'):
         if not object.has_level(request.user, 'owner'):
             raise PermissionDenied()
             raise PermissionDenied()
+        if not request.user.has_perm('vm.config_ports'):
+            raise PermissionDenied()
 
 
         port = request.POST.get("port")
         port = request.POST.get("port")
         proto = request.POST.get("proto")
         proto = request.POST.get("proto")

circle/vm/models/instance.py

@@ -215,6 +215,12 @@ class Instance(AclBase, VirtualMachineDescModel, TimeStampedModel):
         app_label = 'vm'
         app_label = 'vm'
         db_table = 'vm_instance'
         db_table = 'vm_instance'
         ordering = ['pk', ]
         ordering = ['pk', ]
+        permissions = (
+            ('access_console', _('Can access the graphical console of a VM.')),
+            ('change_resources', _('Can change resources of a running VM.')),
+            ('set_resources', _('Can change resources of a new VM.')),
+            ('config_ports', _('Can configure port forwards.')),
+        )
         verbose_name = _('instance')
         verbose_name = _('instance')
         verbose_name_plural = _('instances')
         verbose_name_plural = _('instances')