1 # Copyright (C) The Arvados Authors. All rights reserved.
3 # SPDX-License-Identifier: AGPL-3.0
5 require 'can_be_an_owner'
6 require 'refresh_permission_view'
8 class User < ArvadosModel
11 include CommonApiTemplate
14 serialize :prefs, Hash
15 has_many :api_client_authorizations
18 with: /\A[A-Za-z][A-Za-z0-9]*\z/,
19 message: "must begin with a letter and contain only alphanumerics",
23 before_update :prevent_privilege_escalation
24 before_update :prevent_inactive_admin
25 before_update :verify_repositories_empty, :if => Proc.new { |user|
26 user.username.nil? and user.username_changed?
28 before_update :setup_on_activate
29 before_create :check_auto_admin
30 before_create :set_initial_username, :if => Proc.new { |user|
31 user.username.nil? and user.email
33 after_create :add_system_group_permission_link
34 after_create :invalidate_permissions_cache
35 after_create :auto_setup_new_user, :if => Proc.new { |user|
36 Rails.configuration.auto_setup_new_users and
37 (user.uuid != system_user_uuid) and
38 (user.uuid != anonymous_user_uuid)
40 after_create :send_admin_notifications
41 after_update :send_profile_created_notification
42 after_update :sync_repository_names, :if => Proc.new { |user|
43 (user.uuid != system_user_uuid) and
44 user.username_changed? and
45 (not user.username_was.nil?)
48 has_many :authorized_keys, :foreign_key => :authorized_user_uuid, :primary_key => :uuid
49 has_many :repositories, foreign_key: :owner_uuid, primary_key: :uuid
51 api_accessible :user, extend: :common do |t|
65 ALL_PERMISSIONS = {read: true, write: true, manage: true}
67 # Map numeric permission levels (see lib/create_permission_view.sql)
68 # back to read/write/manage flags.
72 {read: true, write: true},
73 {read: true, write: true, manage: true}]
76 "#{first_name} #{last_name}".strip
81 Rails.configuration.new_users_are_active ||
82 self.groups_i_can(:read).select { |x| x.match(/-f+$/) }.first)
85 def groups_i_can(verb)
86 my_groups = self.group_permissions.select { |uuid, mask| mask[verb] }.keys
88 my_groups << anonymous_group_uuid
94 return true if is_admin
95 actions.each do |action, target|
97 if target.respond_to? :uuid
98 target_uuid = target.uuid
101 target = ArvadosModel.find_by_uuid(target_uuid)
104 next if target_uuid == self.uuid
105 next if (group_permissions[target_uuid] and
106 group_permissions[target_uuid][action])
107 if target.respond_to? :owner_uuid
108 next if target.owner_uuid == self.uuid
109 next if (group_permissions[target.owner_uuid] and
110 group_permissions[target.owner_uuid][action])
112 sufficient_perms = case action
116 ['can_manage', 'can_write']
118 ['can_manage', 'can_write', 'can_read']
120 # (Skip this kind of permission opportunity
121 # if action is an unknown permission type)
124 # Check permission links with head_uuid pointing directly at
125 # the target object. If target is a Group, this is redundant
126 # and will fail except [a] if permission caching is broken or
127 # [b] during a race condition, where a permission link has
129 if Link.where(link_class: 'permission',
130 name: sufficient_perms,
131 tail_uuid: groups_i_can(action) + [self.uuid],
132 head_uuid: target_uuid).any?
141 def self.invalidate_permissions_cache(timestamp=nil)
142 if Rails.configuration.async_permissions_update
143 timestamp = DbCurrentTime::db_current_time.to_i if timestamp.nil?
144 connection.execute "NOTIFY invalidate_permissions_cache, '#{timestamp}'"
146 refresh_permission_view
150 def invalidate_permissions_cache(timestamp=nil)
151 User.invalidate_permissions_cache
154 # Return a hash of {user_uuid: group_perms}
155 def self.all_group_permissions
157 ActiveRecord::Base.connection.
158 exec_query("SELECT user_uuid, target_owner_uuid, perm_level, trashed
159 FROM #{PERMISSION_VIEW}
160 WHERE target_owner_uuid IS NOT NULL",
161 # "name" arg is a query label that appears in logs:
162 "all_group_permissions",
163 ).rows.each do |user_uuid, group_uuid, max_p_val, trashed|
164 all_perms[user_uuid] ||= {}
165 all_perms[user_uuid][group_uuid] = PERMS_FOR_VAL[max_p_val.to_i]
170 # Return a hash of {group_uuid: perm_hash} where perm_hash[:read]
171 # and perm_hash[:write] are true if this user can read and write
172 # objects owned by group_uuid.
173 def group_permissions
174 group_perms = {self.uuid => {:read => true, :write => true, :manage => true}}
175 ActiveRecord::Base.connection.
176 exec_query("SELECT target_owner_uuid, perm_level, trashed
177 FROM #{PERMISSION_VIEW}
179 AND target_owner_uuid IS NOT NULL",
180 # "name" arg is a query label that appears in logs:
181 "group_permissions for #{uuid}",
182 # "binds" arg is an array of [col_id, value] for '$1' vars:
184 ).rows.each do |group_uuid, max_p_val, trashed|
185 group_perms[group_uuid] = PERMS_FOR_VAL[max_p_val.to_i]
191 def setup(openid_prefix:, repo_name: nil, vm_uuid: nil)
192 oid_login_perm = create_oid_login_perm openid_prefix
193 repo_perm = create_user_repo_link repo_name
194 vm_login_perm = create_vm_login_permission_link(vm_uuid, username) if vm_uuid
195 group_perm = create_user_group_link
197 return [oid_login_perm, repo_perm, vm_login_perm, group_perm, self].compact
200 # delete user signatures, login, repo, and vm perms, and mark as inactive
202 # delete oid_login_perms for this user
203 Link.destroy_all(tail_uuid: self.email,
204 link_class: 'permission',
207 # delete repo_perms for this user
208 Link.destroy_all(tail_uuid: self.uuid,
209 link_class: 'permission',
212 # delete vm_login_perms for this user
213 Link.destroy_all(tail_uuid: self.uuid,
214 link_class: 'permission',
217 # delete "All users" group read permissions for this user
218 group = Group.where(name: 'All users').select do |g|
219 g[:uuid].match(/-f+$/)
221 Link.destroy_all(tail_uuid: self.uuid,
222 head_uuid: group[:uuid],
223 link_class: 'permission',
226 # delete any signatures by this user
227 Link.destroy_all(link_class: 'signature',
228 tail_uuid: self.uuid)
230 # delete user preferences (including profile)
233 # mark the user as inactive
234 self.is_active = false
238 def set_initial_username(requested: false)
239 if !requested.is_a?(String) || requested.empty?
240 email_parts = email.partition("@")
241 local_parts = email_parts.first.partition("+")
242 if email_parts.any?(&:empty?)
244 elsif not local_parts.first.empty?
245 requested = local_parts.first
247 requested = email_parts.first
250 requested.sub!(/^[^A-Za-z]+/, "")
251 requested.gsub!(/[^A-Za-z0-9]/, "")
252 unless requested.empty?
253 self.username = find_usable_username_from(requested)
257 def update_uuid(new_uuid:)
258 if !current_user.andand.is_admin
259 raise PermissionDeniedError
261 if uuid == system_user_uuid || uuid == anonymous_user_uuid
262 raise "update_uuid cannot update system accounts"
264 if self.class != self.class.resource_class_for_uuid(new_uuid)
265 raise "invalid new_uuid #{new_uuid.inspect}"
267 transaction(requires_new: true) do
271 save!(validate: false)
272 ActiveRecord::Base.descendants.reject(&:abstract_class?).each do |klass|
273 klass.columns.each do |col|
274 if col.name.end_with?('_uuid')
275 column = col.name.to_sym
276 klass.where(column => old_uuid).update_all(column => new_uuid)
285 def ensure_ownership_path_leads_to_user
289 def permission_to_update
291 current_user.andand.is_admin
293 # users must be able to update themselves (even if they are
294 # inactive) in order to create sessions
295 self == current_user or super
299 def permission_to_create
300 current_user.andand.is_admin or
301 (self == current_user and
302 self.is_active == Rails.configuration.new_users_are_active)
306 return if self.uuid.end_with?('anonymouspublic')
307 if (User.where("email = ?",self.email).where(:is_admin => true).count == 0 and
308 Rails.configuration.auto_admin_user and self.email == Rails.configuration.auto_admin_user) or
309 (User.where("uuid not like '%-000000000000000'").where(:is_admin => true).count == 0 and
310 Rails.configuration.auto_admin_first_user)
312 self.is_active = true
316 def find_usable_username_from(basename)
317 # If "basename" is a usable username, return that.
318 # Otherwise, find a unique username "basenameN", where N is the
319 # smallest integer greater than 1, and return that.
320 # Return nil if a unique username can't be found after reasonable
322 quoted_name = self.class.connection.quote_string(basename)
323 next_username = basename
325 while Rails.configuration.auto_setup_name_blacklist.include?(next_username)
327 next_username = "%s%i" % [basename, next_suffix]
329 0.upto(6).each do |suffix_len|
330 pattern = "%s%s" % [quoted_name, "_" * suffix_len]
332 where("username like '#{pattern}'").
334 order('username asc').
336 if other_user.username > next_username
338 elsif other_user.username == next_username
340 next_username = "%s%i" % [basename, next_suffix]
343 return next_username if (next_username.size <= pattern.size)
348 def prevent_privilege_escalation
349 if current_user.andand.is_admin
352 if self.is_active_changed?
353 if self.is_active != self.is_active_was
354 logger.warn "User #{current_user.uuid} tried to change is_active from #{self.is_admin_was} to #{self.is_admin} for #{self.uuid}"
355 self.is_active = self.is_active_was
358 if self.is_admin_changed?
359 if self.is_admin != self.is_admin_was
360 logger.warn "User #{current_user.uuid} tried to change is_admin from #{self.is_admin_was} to #{self.is_admin} for #{self.uuid}"
361 self.is_admin = self.is_admin_was
367 def prevent_inactive_admin
368 if self.is_admin and not self.is_active
369 # There is no known use case for the strange set of permissions
370 # that would result from this change. It's safest to assume it's
371 # a mistake and disallow it outright.
372 raise "Admin users cannot be inactive"
377 def search_permissions(start, graph, merged={}, upstream_mask=nil, upstream_path={})
378 nextpaths = graph[start]
379 return merged if !nextpaths
380 return merged if upstream_path.has_key? start
381 upstream_path[start] = true
382 upstream_mask ||= ALL_PERMISSIONS
383 nextpaths.each do |head, mask|
386 merged[head][k] ||= v if upstream_mask[k]
388 search_permissions(head, graph, merged, upstream_mask.select { |k,v| v && merged[head][k] }, upstream_path)
390 upstream_path.delete start
394 def create_oid_login_perm(openid_prefix)
395 # Check oid_login_perm
396 oid_login_perms = Link.where(tail_uuid: self.email,
397 head_uuid: self.uuid,
398 link_class: 'permission',
401 if !oid_login_perms.any?
402 # create openid login permission
403 oid_login_perm = Link.create(link_class: 'permission',
405 tail_uuid: self.email,
406 head_uuid: self.uuid,
408 "identity_url_prefix" => openid_prefix,
410 logger.info { "openid login permission: " + oid_login_perm[:uuid] }
412 oid_login_perm = oid_login_perms.first
415 return oid_login_perm
418 def create_user_repo_link(repo_name)
419 # repo_name is optional
421 logger.warn ("Repository name not given for #{self.uuid}.")
425 repo = Repository.where(owner_uuid: uuid, name: repo_name).first_or_create!
426 logger.info { "repo uuid: " + repo[:uuid] }
427 repo_perm = Link.where(tail_uuid: uuid, head_uuid: repo.uuid,
428 link_class: "permission",
429 name: "can_manage").first_or_create!
430 logger.info { "repo permission: " + repo_perm[:uuid] }
434 # create login permission for the given vm_uuid, if it does not already exist
435 def create_vm_login_permission_link(vm_uuid, repo_name)
436 # vm uuid is optional
439 vm = VirtualMachine.where(uuid: vm_uuid).first
441 logger.warn "Could not find virtual machine for #{vm_uuid.inspect}"
442 raise "No vm found for #{vm_uuid}"
445 logger.info { "vm uuid: " + vm[:uuid] }
447 tail_uuid: uuid, head_uuid: vm.uuid,
448 link_class: "permission", name: "can_login",
453 select { |link| link.properties["username"] == repo_name }.
457 create(login_attrs.merge(properties: {"username" => repo_name}))
459 logger.info { "login permission: " + login_perm[:uuid] }
463 # add the user to the 'All users' group
464 def create_user_group_link
465 return (Link.where(tail_uuid: self.uuid,
466 head_uuid: all_users_group[:uuid],
467 link_class: 'permission',
468 name: 'can_read').first or
469 Link.create(tail_uuid: self.uuid,
470 head_uuid: all_users_group[:uuid],
471 link_class: 'permission',
475 # Give the special "System group" permission to manage this user and
476 # all of this user's stuff.
477 def add_system_group_permission_link
478 return true if uuid == system_user_uuid
479 act_as_system_user do
480 Link.create(link_class: 'permission',
482 tail_uuid: system_group_uuid,
483 head_uuid: self.uuid)
487 # Send admin notifications
488 def send_admin_notifications
489 AdminNotifier.new_user(self).deliver_now
490 if not self.is_active then
491 AdminNotifier.new_inactive_user(self).deliver_now
495 # Automatically setup if is_active flag turns on
496 def setup_on_activate
497 return if [system_user_uuid, anonymous_user_uuid].include?(self.uuid)
498 if is_active && (new_record? || is_active_changed?)
499 setup(openid_prefix: Rails.configuration.default_openid_prefix)
503 # Automatically setup new user during creation
504 def auto_setup_new_user
505 setup(openid_prefix: Rails.configuration.default_openid_prefix)
507 create_vm_login_permission_link(Rails.configuration.auto_setup_new_users_with_vm_uuid,
509 repo_name = "#{username}/#{username}"
510 if Rails.configuration.auto_setup_new_users_with_repository and
511 Repository.where(name: repo_name).first.nil?
512 repo = Repository.create!(name: repo_name, owner_uuid: uuid)
513 Link.create!(tail_uuid: uuid, head_uuid: repo.uuid,
514 link_class: "permission", name: "can_manage")
519 # Send notification if the user saved profile for the first time
520 def send_profile_created_notification
521 if self.prefs_changed?
522 if self.prefs_was.andand.empty? || !self.prefs_was.andand['profile']
523 profile_notification_address = Rails.configuration.user_profile_notification_address
524 ProfileNotifier.profile_created(self, profile_notification_address).deliver_now if profile_notification_address
529 def verify_repositories_empty
530 unless repositories.first.nil?
531 errors.add(:username, "can't be unset when the user owns repositories")
536 def sync_repository_names
537 old_name_re = /^#{Regexp.escape(username_was)}\//
538 name_sub = "#{username}/"
539 repositories.find_each do |repo|
540 repo.name = repo.name.sub(old_name_re, name_sub)