Add delete notification to endpoint grouping

Add delete notification to endpoint grouping so that if a project
or endpoint group is deleted this will automatically force the
deletion of the related project endpoint group association.

Closes-Bug: 1365169
Change-Id: Ic67eaf52ec220bc4ace32a7625af643b3f0818d6

keystone/contrib/endpoint_filter/backends/sql.py

@@ -151,6 +151,8 @@ class EndpointFilter(object):
                                                       endpoint_group_id)
         with session.begin():
             session.delete(endpoint_group_ref)
+            self._delete_endpoint_group_association_by_endpoint_group(
+                session, endpoint_group_id)
 
     def get_endpoint_group_in_project(self, endpoint_group_id, project_id):
         session = sql.get_session()
@@ -207,3 +209,16 @@ class EndpointFilter(object):
         query = query.filter_by(endpoint_group_id=endpoint_group_id)
         endpoint_group_refs = query.all()
         return endpoint_group_refs
+
+    def _delete_endpoint_group_association_by_endpoint_group(
+            self, session, endpoint_group_id):
+        query = session.query(ProjectEndpointGroupMembership)
+        query = query.filter_by(endpoint_group_id=endpoint_group_id)
+        query.delete()
+
+    def delete_endpoint_group_association_by_project(self, project_id):
+        session = sql.get_session()
+        with session.begin():
+            query = session.query(ProjectEndpointGroupMembership)
+            query = query.filter_by(project_id=project_id)
+            query.delete()

keystone/contrib/endpoint_filter/controllers.py

@@ -247,6 +247,16 @@ class ProjectEndpointGroupV3Controller(_ControllerBase):
 
     def __init__(self):
         super(ProjectEndpointGroupV3Controller, self).__init__()
+        notifications.register_event_callback(
+            notifications.ACTIONS.deleted, 'project',
+            self._on_project_delete)
+
+    def _on_project_delete(self, service, resource_type,
+                           operation, payload):
+        project_id = payload['resource_info']
+        (self.endpoint_filter_api.
+            delete_endpoint_group_association_by_project(
+                project_id))
 
     @controller.protected()
     def get_endpoint_group_in_project(self, context, endpoint_group_id,

keystone/contrib/endpoint_filter/core.py

@@ -276,3 +276,14 @@ class Driver(object):
 
         """
         raise exception.NotImplemented()  # pragma: no cover
+
+    @abc.abstractmethod
+    def delete_endpoint_group_association_by_project(self, project_id):
+        """Remove endpoint group to project associations.
+
+        :param project_id: identity of the project to check
+        :type project_id: string
+        :returns: None
+
+        """
+        raise exception.NotImplemented()  # pragma: no cover

keystone/tests/test_associate_project_endpoint_extension.py

@@ -972,6 +972,49 @@ class EndpointGroupCRUDTestCase(TestExtensionCase):
         endpoints = self.assertValidEndpointListResponse(r)
         self.assertEqual(len(endpoints), 1)
 
+    def test_endpoint_group_project_cleanup_with_project(self):
+        # create endpoint group
+        endpoint_group_id = self._create_valid_endpoint_group(
+          self.DEFAULT_ENDPOINT_GROUP_URL, self.DEFAULT_ENDPOINT_GROUP_BODY)
+
+        # create new project and associate with endpoint_group
+        project_ref = self.new_project_ref(domain_id=self.domain_id)
+        r = self.post('/projects', body={'project': project_ref})
+        project = self.assertValidProjectResponse(r, project_ref)
+        url = self._get_project_endpoint_group_url(endpoint_group_id,
+                                                   project['id'])
+        self.put(url)
+
+        # check that we can recover the project endpoint group association
+        self.get(url)
+
+        # Now delete the project and then try and retrieve the project
+        # endpoint group association again
+        self.delete('/projects/%(project_id)s' % {
+            'project_id': project['id']})
+        self.get(url, expected_status=404)
+
+    def test_endpoint_group_project_cleanup_with_endpoint_group(self):
+        # create endpoint group
+        endpoint_group_id = self._create_valid_endpoint_group(
+          self.DEFAULT_ENDPOINT_GROUP_URL, self.DEFAULT_ENDPOINT_GROUP_BODY)
+
+        # create new project and associate with endpoint_group
+        project_ref = self.new_project_ref(domain_id=self.domain_id)
+        r = self.post('/projects', body={'project': project_ref})
+        project = self.assertValidProjectResponse(r, project_ref)
+        url = self._get_project_endpoint_group_url(endpoint_group_id,
+                                                   project['id'])
+        self.put(url)
+
+        # check that we can recover the project endpoint group association
+        self.get(url)
+
+        # now remove the project endpoint group association
+        self.delete('/OS-EP-FILTER/endpoint_groups/%(endpoint_group_id)s' % {
+            'endpoint_group_id': endpoint_group_id})
+        self.get(url, expected_status=404)
+
     def _create_valid_endpoint_group(self, url, body):
         r = self.post(url, body=body)
         return r.result['endpoint_group']['id']
@@ -979,11 +1022,17 @@ class EndpointGroupCRUDTestCase(TestExtensionCase):
     def _create_endpoint_group_project_association(self,
                                                    endpoint_group_id,
                                                    project_id):
-        url = ('/OS-EP-FILTER/endpoint_groups/%(endpoint_group_id)s'
+        url = self._get_project_endpoint_group_url(endpoint_group_id,
+                                                   project_id)
+        self.put(url)
+
+    def _get_project_endpoint_group_url(self,
+                                        endpoint_group_id,
+                                        project_id):
+        return ('/OS-EP-FILTER/endpoint_groups/%(endpoint_group_id)s'
                  '/projects/%(project_id)s' % {
                      'endpoint_group_id': endpoint_group_id,
                      'project_id': project_id})
-        self.put(url)
 
     def _create_endpoint_and_associations(self, project_id, service_id=None):
         """Creates an endpoint associated with service and project."""