1 class Link < ArvadosModel
4 include CommonApiTemplate
5 serialize :properties, Hash
6 before_create :permission_to_attach_to_objects
7 before_update :permission_to_attach_to_objects
8 after_update :maybe_invalidate_permissions_cache
9 after_create :maybe_invalidate_permissions_cache
10 after_destroy :maybe_invalidate_permissions_cache
11 validate :name_links_are_obsolete
13 api_accessible :user, extend: :common do |t|
24 if k = ArvadosModel::resource_class_for_uuid(head_uuid)
30 if k = ArvadosModel::resource_class_for_uuid(tail_uuid)
37 def permission_to_attach_to_objects
38 # Anonymous users cannot write links
39 return false if !current_user
41 # All users can write links that don't affect permissions
42 return true if self.link_class != 'permission'
44 # Administrators can grant permissions
45 return true if current_user.is_admin
47 # All users can grant permissions on objects they own or can manage
48 head_obj = ArvadosModel.find_by_uuid(head_uuid)
49 return true if current_user.can?(manage: head_obj)
55 def maybe_invalidate_permissions_cache
56 if self.link_class == 'permission'
57 # Clearing the entire permissions cache can generate many
58 # unnecessary queries if many active users are not affected by
59 # this change. In such cases it would be better to search cached
60 # permissions for head_uuid and tail_uuid, and invalidate the
61 # cache for only those users. (This would require a browseable
63 User.invalidate_permissions_cache db_current_time.to_i
67 def name_links_are_obsolete
68 if link_class == 'name'
69 errors.add('name', 'Name links are obsolete')
76 # A user is permitted to create, update or modify a permission link
77 # if and only if they have "manage" permission on the object
78 # indicated by the permission link's head_uuid.
80 # All other links are treated as regular ArvadosModel objects.
82 def ensure_owner_uuid_is_permitted
83 if link_class == 'permission'
84 ob = ArvadosModel.find_by_uuid(head_uuid)
85 raise PermissionDeniedError unless current_user.can?(manage: ob)
86 # All permission links should be owned by the system user.
87 self.owner_uuid = system_user_uuid