Basic Platform

Core Logic for Users to Query a Resource List

1. View the list of resources the user has access to via the API logic.cam.checkResource, which calls CAM to query all user groups the user has joined, named tce_project_${ProjectName}. This returns a list of associated projects and a tagList, where the key is tce_sp_project and the value is the project name.
2. If the user has the corresponding permissions, query the API to fetch resources by tags based on the tagList, and load the resources with the relevant tags using qcloud.tag.getResourcesByTags.
3. Based on the resource data obtained from the above steps, filter the resources (using deny or allow logic) against all resources under the root account to determine which resources should be displayed. For resources with the tag key tce_sp_project, when you verify the policy, the tag should correspond to the project name.

Adding Users and Assigning Permissions

1. Add users to the project-specific user group tce_project_${ProjectName}, then assign the corresponding policy permissions to the users.
2. On the Add Member page, only users not already part of the project can be added. For users already in the project, policies can only be edited via the table.

   Note:

   The policy list is maintained via the project's metadata, displaying the available policies that can be assigned. When you authorize users, CAM is queried. If the policy for the project does not exist, it is created and then assigned to the user. CAM policy naming convention: tce_sp_project_${ProjectName}${PolicyName}. CAM applies special handling to policies with the tce_project prefix. When policy names are displayed, the prefix is removed; that is, all policies starting with tce_sp_project should be listed.

Logic for Users to Query the Location Service to Obtain Product Deployment Information by Region

1. The user queries the full product list in all regions.
2. If the user specifies certain regions, those specified regions are filtered out from the full region configuration.
3. Select and apply appropriate policies according to different conditions:
   • If input.ProductID is a special product ID, a "full" list is supported.
   • If input.ProductID is empty, the full product list is returned. Process the region allowlist as follows:
     • If it is not a CMGT request, the WhitelistStrategy is applied.
   • If it is an operation side request, the DeploymentStrategy is applied.
   • By default, both DeploymentStrategy and WhitelistStrategy are applied.
     DeploymentStrategy: Filters out regions and availability zones (AZs) where the product or subproduct is not deployed, based on the deployment information of products and subproducts.
     WhitelistStrategy: Filters and updates the status of regions and AZs based on the allowlist configuration:

• No allowlist configured: Not restricted by allowlist; all access is allowed.
• Configured as full access: All UINs are allowed to access.
• Configured as in effect: Only UINs in the allowlist are allowed access.
• Configured as invalid: No UIN is allowed access.
  ==> Equivalent conversion:
• Configured as in effect: UINs not in the allowlist are denied access.
• Configured as invalid: All UINs are denied access.