10816: Use a recursive postgres query instead of building the permission graph in...
[arvados.git] / services / api / app / models / log.rb
1 class Log < ArvadosModel
2   include HasUuid
3   include KindAndEtag
4   include CommonApiTemplate
5   serialize :properties, Hash
6   before_validation :set_default_event_at
7   after_save :send_notify
8
9   api_accessible :user, extend: :common do |t|
10     t.add :id
11     t.add :object_uuid
12     t.add :object_owner_uuid
13     t.add :object_kind
14     t.add :event_at
15     t.add :event_type
16     t.add :summary
17     t.add :properties
18   end
19
20   def object_kind
21     if k = ArvadosModel::resource_class_for_uuid(object_uuid)
22       k.kind
23     end
24   end
25
26   def fill_object(thing)
27     self.object_uuid ||= thing.uuid
28     if respond_to? :object_owner_uuid=
29       # Skip this if the object_owner_uuid migration hasn't happened
30       # yet, i.e., we're in the process of migrating an old database.
31       self.object_owner_uuid = thing.owner_uuid
32     end
33     self.summary ||= "#{self.event_type} of #{thing.uuid}"
34     self
35   end
36
37   def fill_properties(age, etag_prop, attrs_prop)
38     self.properties.merge!({"#{age}_etag" => etag_prop,
39                              "#{age}_attributes" => attrs_prop})
40   end
41
42   def update_to(thing)
43     fill_properties('new', thing.andand.etag, thing.andand.logged_attributes)
44     case event_type
45     when "create"
46       self.event_at = thing.created_at
47     when "update"
48       self.event_at = thing.modified_at
49     when "delete"
50       self.event_at = db_current_time
51     end
52     self
53   end
54
55   def self.readable_by(*users_list)
56     if users_list.select { |u| u.is_admin }.any?
57       return self
58     end
59     user_uuids = users_list.map { |u| u.uuid }
60     uuid_list = user_uuids + users_list.flat_map { |u| u.groups_i_can(:read) }
61     uuid_list.uniq!
62     permitted = "(SELECT head_uuid FROM links WHERE link_class='permission' AND tail_uuid IN (:uuids))"
63     joins("LEFT JOIN container_requests ON container_requests.container_uuid=logs.object_uuid").
64       where("logs.object_uuid IN #{permitted} OR "+
65             "container_requests.uuid IN (:uuids) OR "+
66             "container_requests.owner_uuid IN (:uuids) OR "+
67             "logs.object_uuid IN (:uuids) OR "+
68             "logs.owner_uuid IN (:uuids) OR "+
69             "logs.object_owner_uuid IN (:uuids)",
70             uuids: uuid_list)
71   end
72
73   protected
74
75   def permission_to_create
76     true
77   end
78
79   def permission_to_update
80     current_user.andand.is_admin
81   end
82
83   alias_method :permission_to_delete, :permission_to_update
84
85   def set_default_event_at
86     self.event_at ||= db_current_time
87   end
88
89   def log_start_state
90     # don't log start state on logs
91   end
92
93   def log_change(event_type)
94     # Don't log changes to logs.
95   end
96
97   def ensure_valid_uuids
98     # logs can have references to deleted objects
99   end
100
101   def send_notify
102     connection.execute "NOTIFY logs, '#{self.id}'"
103   end
104
105 end