1 require 'can_be_an_owner'
3 class User < ArvadosModel
6 include CommonApiTemplate
10 has_many :api_client_authorizations
11 before_update :prevent_privilege_escalation
12 before_update :prevent_inactive_admin
13 before_create :check_auto_admin
14 after_create :add_system_group_permission_link
15 after_create :send_admin_notifications
16 after_update :send_profile_created_notification
19 has_many :authorized_keys, :foreign_key => :authorized_user_uuid, :primary_key => :uuid
21 api_accessible :user, extend: :common do |t|
33 ALL_PERMISSIONS = {read: true, write: true, manage: true}
36 "#{first_name} #{last_name}".strip
41 Rails.configuration.new_users_are_active ||
42 self.groups_i_can(:read).select { |x| x.match /-f+$/ }.first)
45 def groups_i_can(verb)
46 my_groups = self.group_permissions.select { |uuid, mask| mask[verb] }.keys
48 my_groups << anonymous_group_uuid
54 return true if is_admin
55 actions.each do |action, target|
57 if target.respond_to? :uuid
58 target_uuid = target.uuid
61 target = ArvadosModel.find_by_uuid(target_uuid)
64 next if target_uuid == self.uuid
65 next if (group_permissions[target_uuid] and
66 group_permissions[target_uuid][action])
67 if target.respond_to? :owner_uuid
68 next if target.owner_uuid == self.uuid
69 next if (group_permissions[target.owner_uuid] and
70 group_permissions[target.owner_uuid][action])
77 def self.invalidate_permissions_cache
78 Rails.cache.delete_matched(/^groups_for_user_/)
81 # Return a hash of {group_uuid: perm_hash} where perm_hash[:read]
82 # and perm_hash[:write] are true if this user can read and write
83 # objects owned by group_uuid.
85 # The permission graph is built by repeatedly enumerating all
86 # permission links reachable from self.uuid, and then calling
89 Rails.cache.fetch "groups_for_user_#{self.uuid}" do
91 todo = {self.uuid => true}
93 # Build the equivalence class of permissions starting with
94 # self.uuid. On each iteration of this loop, todo contains
95 # the next set of uuids in the permission equivalence class
98 lookup_uuids = todo.keys
99 lookup_uuids.each do |uuid| done[uuid] = true end
102 # include all groups owned by the current set of uuids.
103 Group.where('owner_uuid in (?)', lookup_uuids).each do |group|
104 newgroups << [group.owner_uuid, group.uuid, 'can_manage']
106 # add any permission links from the current lookup_uuids to a
108 Link.where('tail_uuid in (?) and link_class = ? and (head_uuid like ? or head_uuid like ?)',
111 Group.uuid_like_pattern,
112 User.uuid_like_pattern).each do |link|
113 newgroups << [link.tail_uuid, link.head_uuid, link.name]
115 newgroups.each do |tail_uuid, head_uuid, perm_name|
116 unless done.has_key? head_uuid
117 todo[head_uuid] = true
119 link_permissions = {}
122 link_permissions = {read:true}
124 link_permissions = {read:true,write:true}
126 link_permissions = ALL_PERMISSIONS
128 permissions_from[tail_uuid] ||= {}
129 permissions_from[tail_uuid][head_uuid] ||= {}
130 link_permissions.each do |k,v|
131 permissions_from[tail_uuid][head_uuid][k] ||= v
135 search_permissions(self.uuid, permissions_from)
139 def self.setup(user, openid_prefix, repo_name=nil, vm_uuid=nil)
140 return user.setup_repo_vm_links(repo_name, vm_uuid, openid_prefix)
144 def setup_repo_vm_links(repo_name, vm_uuid, openid_prefix)
145 oid_login_perm = create_oid_login_perm openid_prefix
146 repo_perm = create_user_repo_link repo_name
147 vm_login_perm = create_vm_login_permission_link vm_uuid, repo_name
148 group_perm = create_user_group_link
150 return [oid_login_perm, repo_perm, vm_login_perm, group_perm, self].compact
153 # delete user signatures, login, repo, and vm perms, and mark as inactive
155 # delete oid_login_perms for this user
156 Link.destroy_all(tail_uuid: self.email,
157 link_class: 'permission',
160 # delete repo_perms for this user
161 Link.destroy_all(tail_uuid: self.uuid,
162 link_class: 'permission',
165 # delete vm_login_perms for this user
166 Link.destroy_all(tail_uuid: self.uuid,
167 link_class: 'permission',
170 # delete "All users" group read permissions for this user
171 group = Group.where(name: 'All users').select do |g|
172 g[:uuid].match /-f+$/
174 Link.destroy_all(tail_uuid: self.uuid,
175 head_uuid: group[:uuid],
176 link_class: 'permission',
179 # delete any signatures by this user
180 Link.destroy_all(link_class: 'signature',
181 tail_uuid: self.uuid)
183 # delete user preferences (including profile)
186 # mark the user as inactive
187 self.is_active = false
193 def ensure_ownership_path_leads_to_user
197 def permission_to_update
198 # users must be able to update themselves (even if they are
199 # inactive) in order to create sessions
200 self == current_user or super
203 def permission_to_create
204 current_user.andand.is_admin or
205 (self == current_user and
206 self.is_active == Rails.configuration.new_users_are_active)
210 if User.where("uuid not like '%-000000000000000'").where(:is_admin => true).count == 0 and Rails.configuration.auto_admin_user
211 if self.email == Rails.configuration.auto_admin_user
213 self.is_active = true
218 def prevent_privilege_escalation
219 if current_user.andand.is_admin
222 if self.is_active_changed?
223 if self.is_active != self.is_active_was
224 logger.warn "User #{current_user.uuid} tried to change is_active from #{self.is_admin_was} to #{self.is_admin} for #{self.uuid}"
225 self.is_active = self.is_active_was
228 if self.is_admin_changed?
229 if self.is_admin != self.is_admin_was
230 logger.warn "User #{current_user.uuid} tried to change is_admin from #{self.is_admin_was} to #{self.is_admin} for #{self.uuid}"
231 self.is_admin = self.is_admin_was
237 def prevent_inactive_admin
238 if self.is_admin and not self.is_active
239 # There is no known use case for the strange set of permissions
240 # that would result from this change. It's safest to assume it's
241 # a mistake and disallow it outright.
242 raise "Admin users cannot be inactive"
247 def search_permissions(start, graph, merged={}, upstream_mask=nil, upstream_path={})
248 nextpaths = graph[start]
249 return merged if !nextpaths
250 return merged if upstream_path.has_key? start
251 upstream_path[start] = true
252 upstream_mask ||= ALL_PERMISSIONS
253 nextpaths.each do |head, mask|
256 merged[head][k] ||= v if upstream_mask[k]
258 search_permissions(head, graph, merged, upstream_mask.select { |k,v| v && merged[head][k] }, upstream_path)
260 upstream_path.delete start
264 def create_oid_login_perm (openid_prefix)
265 login_perm_props = { "identity_url_prefix" => openid_prefix}
267 # Check oid_login_perm
268 oid_login_perms = Link.where(tail_uuid: self.email,
269 link_class: 'permission',
270 name: 'can_login').where("head_uuid = ?", self.uuid)
272 if !oid_login_perms.any?
273 # create openid login permission
274 oid_login_perm = Link.create(link_class: 'permission',
276 tail_uuid: self.email,
277 head_uuid: self.uuid,
278 properties: login_perm_props
280 logger.info { "openid login permission: " + oid_login_perm[:uuid] }
282 oid_login_perm = oid_login_perms.first
285 return oid_login_perm
288 def create_user_repo_link(repo_name)
289 # repo_name is optional
291 logger.warn ("Repository name not given for #{self.uuid}.")
295 # Check for an existing repository with the same name we're about to use.
296 repo = Repository.where(name: repo_name).first
299 logger.warn "Repository exists for #{repo_name}: #{repo[:uuid]}."
301 # Look for existing repository access for this repo
302 repo_perms = Link.where(tail_uuid: self.uuid,
303 head_uuid: repo[:uuid],
304 link_class: 'permission',
307 logger.warn "User already has repository access " +
308 repo_perms.collect { |p| p[:uuid] }.inspect
309 return repo_perms.first
313 # create repo, if does not already exist
314 repo ||= Repository.create(name: repo_name)
315 logger.info { "repo uuid: " + repo[:uuid] }
317 repo_perm = Link.create(tail_uuid: self.uuid,
318 head_uuid: repo[:uuid],
319 link_class: 'permission',
321 logger.info { "repo permission: " + repo_perm[:uuid] }
325 # create login permission for the given vm_uuid, if it does not already exist
326 def create_vm_login_permission_link(vm_uuid, repo_name)
329 # vm uuid is optional
331 vm = VirtualMachine.where(uuid: vm_uuid).first
334 logger.warn "Could not find virtual machine for #{vm_uuid.inspect}"
335 raise "No vm found for #{vm_uuid}"
341 logger.info { "vm uuid: " + vm[:uuid] }
343 login_perms = Link.where(tail_uuid: self.uuid,
344 head_uuid: vm[:uuid],
345 link_class: 'permission',
349 login_perms.each do |perm|
350 if perm.properties['username'] == repo_name
357 login_perm = perm_exists
359 login_perm = Link.create(tail_uuid: self.uuid,
360 head_uuid: vm[:uuid],
361 link_class: 'permission',
363 properties: {'username' => repo_name})
364 logger.info { "login permission: " + login_perm[:uuid] }
371 # add the user to the 'All users' group
372 def create_user_group_link
373 # Look up the "All users" group (we expect uuid *-*-fffffffffffffff).
374 group = Group.where(name: 'All users').select do |g|
375 g[:uuid].match /-f+$/
379 logger.warn "No 'All users' group with uuid '*-*-fffffffffffffff'."
380 raise "No 'All users' group with uuid '*-*-fffffffffffffff' is found"
382 logger.info { "\"All users\" group uuid: " + group[:uuid] }
384 group_perms = Link.where(tail_uuid: self.uuid,
385 head_uuid: group[:uuid],
386 link_class: 'permission',
390 group_perm = Link.create(tail_uuid: self.uuid,
391 head_uuid: group[:uuid],
392 link_class: 'permission',
394 logger.info { "group permission: " + group_perm[:uuid] }
396 group_perm = group_perms.first
403 # Give the special "System group" permission to manage this user and
404 # all of this user's stuff.
406 def add_system_group_permission_link
407 act_as_system_user do
408 Link.create(link_class: 'permission',
410 tail_uuid: system_group_uuid,
411 head_uuid: self.uuid)
415 # Send admin notifications
416 def send_admin_notifications
417 AdminNotifier.new_user(self).deliver
418 if not self.is_active then
419 AdminNotifier.new_inactive_user(self).deliver
423 # Send notification if the user saved profile for the first time
424 def send_profile_created_notification
425 if self.prefs_changed?
426 if self.prefs_was.andand.empty? || !self.prefs_was.andand['profile']
427 profile_notification_address = Rails.configuration.user_profile_notification_address
428 ProfileNotifier.profile_created(self, profile_notification_address).deliver if profile_notification_address