19146: Add can_write and can_manage response fields.

[arvados.git] / services / api / app / models / user.rb

diff --git a/services/api/app/models/user.rb b/services/api/app/models/user.rb
index 096f5a86a4816b3ef889533ceea7e07cfe9301ac..52b96f9c512699c8cc7f7f71b6bdd31804fd5902 100644 (file)
--- a/services/api/app/models/user.rb
+++ b/services/api/app/models/user.rb
@@ -21,6 +21,7 @@ class User < ArvadosModel
             uniqueness: true,
             allow_nil: true)
   validate :must_unsetup_to_deactivate
+  validate :identity_url_nil_if_empty
   before_update :prevent_privilege_escalation
   before_update :prevent_inactive_admin
   before_update :verify_repositories_empty, :if => Proc.new {
@@ -71,6 +72,8 @@ class User < ArvadosModel
     t.add :is_invited
     t.add :prefs
     t.add :writable_by
+    t.add :can_write
+    t.add :can_manage
   end
 
   ALL_PERMISSIONS = {read: true, write: true, manage: true}
@@ -86,7 +89,7 @@ class User < ArvadosModel
   VAL_FOR_PERM =
     {:read => 1,
      :write => 2,
-     :unfreeze => 2,
+     :unfreeze => 3,
      :manage => 3}
 
 
@@ -148,10 +151,12 @@ SELECT 1 FROM #{PERMISSION_VIEW}
           return false
         end
       elsif action == :unfreeze
-        # "unfreeze" permission means "could write if target weren't
-        # frozen", which is relevant when a user is un-freezing a
-        # project. If the permission query above allows :write, and
-        # the parent isn't also frozen, then un-freeze is allowed.
+        # "unfreeze" permission means "can write, but only if
+        # explicitly un-freezing at the same time" (see
+        # ArvadosModel#ensure_owner_uuid_is_permitted). If the
+        # permission query above passed the permission level of
+        # :unfreeze (which is the same as :manage), and the parent
+        # isn't also frozen, then un-freeze is allowed.
         if FrozenGroup.where(uuid: target_owner_uuid).any?
           return false
         end
@@ -826,4 +831,10 @@ SELECT target_uuid, perm_level
       repo.save!
     end
   end
+
+  def identity_url_nil_if_empty
+    if identity_url == ""
+      self.identity_url = nil
+    end
+  end
 end