serialize :prefs, Hash
has_many :api_client_authorizations
+ validates(:username,
+ format: {
+ with: /^[A-Za-z][A-Za-z0-9]*$/,
+ message: "must begin with a letter and contain only alphanumerics",
+ },
+ uniqueness: true,
+ allow_nil: true)
before_update :prevent_privilege_escalation
before_update :prevent_inactive_admin
+ before_update :verify_repositories_empty, :if => Proc.new { |user|
+ user.username.nil? and user.username_changed?
+ }
before_create :check_auto_admin
+ before_create :set_initial_username, :if => Proc.new { |user|
+ user.username.nil? and user.email
+ }
after_create :add_system_group_permission_link
- after_create :auto_setup_new_user
+ after_create :auto_setup_new_user, :if => Proc.new { |user|
+ Rails.configuration.auto_setup_new_users and
+ (user.uuid != system_user_uuid) and
+ (user.uuid != anonymous_user_uuid)
+ }
after_create :send_admin_notifications
after_update :send_profile_created_notification
-
+ after_update :sync_repository_names, :if => Proc.new { |user|
+ (user.uuid != system_user_uuid) and
+ user.username_changed? and
+ (not user.username_was.nil?)
+ }
has_many :authorized_keys, :foreign_key => :authorized_user_uuid, :primary_key => :uuid
+ has_many :repositories, foreign_key: :owner_uuid, primary_key: :uuid
api_accessible :user, extend: :common do |t|
t.add :email
+ t.add :username
t.add :full_name
t.add :first_name
t.add :last_name
t.add :is_admin
t.add :is_invited
t.add :prefs
+ t.add :writable_by
end
ALL_PERMISSIONS = {read: true, write: true, manage: true}
next if (group_permissions[target.owner_uuid] and
group_permissions[target.owner_uuid][action])
end
+ sufficient_perms = case action
+ when :manage
+ ['can_manage']
+ when :write
+ ['can_manage', 'can_write']
+ when :read
+ ['can_manage', 'can_write', 'can_read']
+ else
+ # (Skip this kind of permission opportunity
+ # if action is an unknown permission type)
+ end
+ if sufficient_perms
+ # Check permission links with head_uuid pointing directly at
+ # the target object. If target is a Group, this is redundant
+ # and will fail except [a] if permission caching is broken or
+ # [b] during a race condition, where a permission link has
+ # *just* been added.
+ if Link.where(link_class: 'permission',
+ name: sufficient_perms,
+ tail_uuid: groups_i_can(action) + [self.uuid],
+ head_uuid: target_uuid).any?
+ next
+ end
+ end
return false
end
true
end
- def self.invalidate_permissions_cache
- Rails.cache.delete_matched(/^groups_for_user_/)
+ def self.invalidate_permissions_cache(timestamp=nil)
+ if Rails.configuration.async_permissions_update
+ timestamp = DbCurrentTime::db_current_time.to_i if timestamp.nil?
+ connection.execute "NOTIFY invalidate_permissions_cache, '#{timestamp}'"
+ else
+ Rails.cache.delete_matched(/^groups_for_user_/)
+ end
end
# Return a hash of {group_uuid: perm_hash} where perm_hash[:read]
# The permission graph is built by repeatedly enumerating all
# permission links reachable from self.uuid, and then calling
# search_permissions
- def group_permissions
- Rails.cache.fetch "groups_for_user_#{self.uuid}" do
+ def calculate_group_permissions
permissions_from = {}
todo = {self.uuid => true}
done = {}
Group.where('owner_uuid in (?)', lookup_uuids).each do |group|
newgroups << [group.owner_uuid, group.uuid, 'can_manage']
end
- # add any permission links from the current lookup_uuids to a
- # User or Group.
- Link.where('tail_uuid in (?) and link_class = ? and (head_uuid like ? or head_uuid like ?)',
- lookup_uuids,
+ # add any permission links from the current lookup_uuids to a Group.
+ Link.where('link_class = ? and tail_uuid in (?) and ' \
+ '(head_uuid like ? or (name = ? and head_uuid like ?))',
'permission',
+ lookup_uuids,
Group.uuid_like_pattern,
+ 'can_manage',
User.uuid_like_pattern).each do |link|
newgroups << [link.tail_uuid, link.head_uuid, link.name]
end
end
end
end
- search_permissions(self.uuid, permissions_from)
+ perms = search_permissions(self.uuid, permissions_from)
+ Rails.cache.write "groups_for_user_#{self.uuid}", perms
+ perms
+ end
+
+ # Return a hash of {group_uuid: perm_hash} where perm_hash[:read]
+ # and perm_hash[:write] are true if this user can read and write
+ # objects owned by group_uuid.
+ def group_permissions
+ r = Rails.cache.read "groups_for_user_#{self.uuid}"
+ if r.nil?
+ if Rails.configuration.async_permissions_update
+ while r.nil?
+ sleep(0.1)
+ r = Rails.cache.read "groups_for_user_#{self.uuid}"
+ end
+ else
+ r = calculate_group_permissions
+ end
end
+ r
end
def self.setup(user, openid_prefix, repo_name=nil, vm_uuid=nil)
def setup_repo_vm_links(repo_name, vm_uuid, openid_prefix)
oid_login_perm = create_oid_login_perm openid_prefix
repo_perm = create_user_repo_link repo_name
- vm_login_perm = create_vm_login_permission_link vm_uuid, repo_name
+ vm_login_perm = create_vm_login_permission_link vm_uuid, username
group_perm = create_user_group_link
return [oid_login_perm, repo_perm, vm_login_perm, group_perm, self].compact
self.save!
end
+ def set_initial_username(requested: false)
+ if !requested.is_a?(String) || requested.empty?
+ email_parts = email.partition("@")
+ local_parts = email_parts.first.partition("+")
+ if email_parts.any?(&:empty?)
+ return
+ elsif not local_parts.first.empty?
+ requested = local_parts.first
+ else
+ requested = email_parts.first
+ end
+ end
+ requested.sub!(/^[^A-Za-z]+/, "")
+ requested.gsub!(/[^A-Za-z0-9]/, "")
+ unless requested.empty?
+ self.username = find_usable_username_from(requested)
+ end
+ end
+
protected
def ensure_ownership_path_leads_to_user
end
def permission_to_update
- # users must be able to update themselves (even if they are
- # inactive) in order to create sessions
- self == current_user or super
+ if username_changed?
+ current_user.andand.is_admin
+ else
+ # users must be able to update themselves (even if they are
+ # inactive) in order to create sessions
+ self == current_user or super
+ end
end
def permission_to_create
end
def check_auto_admin
- if User.where("uuid not like '%-000000000000000'").where(:is_admin => true).count == 0 and Rails.configuration.auto_admin_user
- if self.email == Rails.configuration.auto_admin_user
- self.is_admin = true
- self.is_active = true
+ return if self.uuid.end_with?('anonymouspublic')
+ if (User.where("email = ?",self.email).where(:is_admin => true).count == 0 and
+ Rails.configuration.auto_admin_user and self.email == Rails.configuration.auto_admin_user) or
+ (User.where("uuid not like '%-000000000000000'").where(:is_admin => true).count == 0 and
+ Rails.configuration.auto_admin_first_user)
+ self.is_admin = true
+ self.is_active = true
+ end
+ end
+
+ def find_usable_username_from(basename)
+ # If "basename" is a usable username, return that.
+ # Otherwise, find a unique username "basenameN", where N is the
+ # smallest integer greater than 1, and return that.
+ # Return nil if a unique username can't be found after reasonable
+ # searching.
+ quoted_name = self.class.connection.quote_string(basename)
+ next_username = basename
+ next_suffix = 1
+ while Rails.configuration.auto_setup_name_blacklist.include?(next_username)
+ next_suffix += 1
+ next_username = "%s%i" % [basename, next_suffix]
+ end
+ 0.upto(6).each do |suffix_len|
+ pattern = "%s%s" % [quoted_name, "_" * suffix_len]
+ self.class.
+ where("username like '#{pattern}'").
+ select(:username).
+ order('username asc').
+ each do |other_user|
+ if other_user.username > next_username
+ break
+ elsif other_user.username == next_username
+ next_suffix += 1
+ next_username = "%s%i" % [basename, next_suffix]
+ end
end
+ return next_username if (next_username.size <= pattern.size)
end
+ nil
end
def prevent_privilege_escalation
return
end
- # Check for an existing repository with the same name we're about to use.
- repo = Repository.where(name: repo_name).first
-
- if repo
- logger.warn "Repository exists for #{repo_name}: #{repo[:uuid]}."
-
- # Look for existing repository access for this repo
- repo_perms = Link.where(tail_uuid: self.uuid,
- head_uuid: repo[:uuid],
- link_class: 'permission',
- name: 'can_manage')
- if repo_perms.any?
- logger.warn "User already has repository access " +
- repo_perms.collect { |p| p[:uuid] }.inspect
- return repo_perms.first
- end
- end
-
- # create repo, if does not already exist
- repo ||= Repository.create(name: repo_name)
+ repo = Repository.where(owner_uuid: uuid, name: repo_name).first_or_create!
logger.info { "repo uuid: " + repo[:uuid] }
-
- repo_perm = Link.create(tail_uuid: self.uuid,
- head_uuid: repo[:uuid],
- link_class: 'permission',
- name: 'can_manage')
+ repo_perm = Link.where(tail_uuid: uuid, head_uuid: repo.uuid,
+ link_class: "permission",
+ name: "can_manage").first_or_create!
logger.info { "repo permission: " + repo_perm[:uuid] }
return repo_perm
end
# create login permission for the given vm_uuid, if it does not already exist
def create_vm_login_permission_link(vm_uuid, repo_name)
- begin
-
- # vm uuid is optional
- if vm_uuid
- vm = VirtualMachine.where(uuid: vm_uuid).first
+ # vm uuid is optional
+ if vm_uuid
+ vm = VirtualMachine.where(uuid: vm_uuid).first
- if not vm
- logger.warn "Could not find virtual machine for #{vm_uuid.inspect}"
- raise "No vm found for #{vm_uuid}"
- end
- else
- return
+ if not vm
+ logger.warn "Could not find virtual machine for #{vm_uuid.inspect}"
+ raise "No vm found for #{vm_uuid}"
end
+ else
+ return
+ end
- logger.info { "vm uuid: " + vm[:uuid] }
-
- login_perms = Link.where(tail_uuid: self.uuid,
- head_uuid: vm[:uuid],
- link_class: 'permission',
- name: 'can_login')
+ logger.info { "vm uuid: " + vm[:uuid] }
+ login_attrs = {
+ tail_uuid: uuid, head_uuid: vm.uuid,
+ link_class: "permission", name: "can_login",
+ }
- perm_exists = false
- login_perms.each do |perm|
- if perm.properties['username'] == repo_name
- perm_exists = perm
- break
- end
- end
+ login_perm = Link.
+ where(login_attrs).
+ select { |link| link.properties["username"] == repo_name }.
+ first
- if perm_exists
- login_perm = perm_exists
- else
- login_perm = Link.create(tail_uuid: self.uuid,
- head_uuid: vm[:uuid],
- link_class: 'permission',
- name: 'can_login',
- properties: {'username' => repo_name})
- logger.info { "login permission: " + login_perm[:uuid] }
- end
+ login_perm ||= Link.
+ create(login_attrs.merge(properties: {"username" => repo_name}))
- return login_perm
- end
+ logger.info { "login permission: " + login_perm[:uuid] }
+ login_perm
end
# add the user to the 'All users' group
def create_user_group_link
- # Look up the "All users" group (we expect uuid *-*-fffffffffffffff).
- group = Group.where(name: 'All users').select do |g|
- g[:uuid].match /-f+$/
- end.first
-
- if not group
- logger.warn "No 'All users' group with uuid '*-*-fffffffffffffff'."
- raise "No 'All users' group with uuid '*-*-fffffffffffffff' is found"
- else
- logger.info { "\"All users\" group uuid: " + group[:uuid] }
-
- group_perms = Link.where(tail_uuid: self.uuid,
- head_uuid: group[:uuid],
- link_class: 'permission',
- name: 'can_read')
-
- if !group_perms.any?
- group_perm = Link.create(tail_uuid: self.uuid,
- head_uuid: group[:uuid],
- link_class: 'permission',
- name: 'can_read')
- logger.info { "group permission: " + group_perm[:uuid] }
- else
- group_perm = group_perms.first
- end
-
- return group_perm
- end
+ return (Link.where(tail_uuid: self.uuid,
+ head_uuid: all_users_group[:uuid],
+ link_class: 'permission',
+ name: 'can_read').first or
+ Link.create(tail_uuid: self.uuid,
+ head_uuid: all_users_group[:uuid],
+ link_class: 'permission',
+ name: 'can_read'))
end
# Give the special "System group" permission to manage this user and
# all of this user's stuff.
- #
def add_system_group_permission_link
+ return true if uuid == system_user_uuid
act_as_system_user do
Link.create(link_class: 'permission',
name: 'can_manage',
# Automatically setup new user during creation
def auto_setup_new_user
- blacklisted_usernames = Rails.configuration.auto_setup_name_blacklist.split(', ')
-
- username = self.email.partition('@')[0] if self.email
-
- if !Rails.configuration.auto_setup_new_users ||
- !(/^[_.A-Za-z0-9][-\@_.A-Za-z0-9]*\$?$/.match(self.email)) ||
- blacklisted_usernames.include?(username)
- return true
- else
- username = derive_unique_username username
- # setup user
- setup_repo_vm_links(username, Rails.configuration.auto_setup_new_users_with_vm_uuid,
- Rails.configuration.default_openid_prefix)
- end
- end
-
- # Derive repo name and vm username using the string before @ in user's email
- # If a repo or vm login link with this username exists,
- # generate unique string by appending a random number
- def derive_unique_username username
- # If repo and vm login link are not being created, no need to generate a unique username
- vm_uuid = Rails.configuration.auto_setup_new_users_with_vm_uuid
- if !vm_uuid && !Rails.configuration.auto_setup_new_users_with_repository
- return username
- end
-
- # need a unique username
- found_unique_username = false
- while !found_unique_username
- repo = Repository.where(name: username).first
-
- if repo
- username = username + SecureRandom.random_number(1000000).to_s
- elsif vm_uuid
- login_props = {"username" => username}
-
- vm_login_perms = Link.where(head_uuid: vm_uuid,
- link_class: 'permission',
- name: 'can_login')
- perm_exists = false
- vm_login_perms.each do |perm|
- if perm.properties['username'] == username
- perm_exists = true
- break
- end
- end
-
- if perm_exists
- username = username + SecureRandom.random_number(1000000).to_s
- else
- found_unique_username = true
- end
- else
- found_unique_username = true
- end
+ setup_repo_vm_links(nil, nil, Rails.configuration.default_openid_prefix)
+ if username
+ create_vm_login_permission_link(Rails.configuration.auto_setup_new_users_with_vm_uuid,
+ username)
+ repo_name = "#{username}/#{username}"
+ if Rails.configuration.auto_setup_new_users_with_repository and
+ Repository.where(name: repo_name).first.nil?
+ repo = Repository.create!(name: repo_name, owner_uuid: uuid)
+ Link.create!(tail_uuid: uuid, head_uuid: repo.uuid,
+ link_class: "permission", name: "can_manage")
end
- return username
+ end
end
# Send notification if the user saved profile for the first time
end
end
+ def verify_repositories_empty
+ unless repositories.first.nil?
+ errors.add(:username, "can't be unset when the user owns repositories")
+ false
+ end
+ end
+
+ def sync_repository_names
+ old_name_re = /^#{Regexp.escape(username_was)}\//
+ name_sub = "#{username}/"
+ repositories.find_each do |repo|
+ repo.name = repo.name.sub(old_name_re, name_sub)
+ repo.save!
+ end
+ end
end
projects / arvados.git / blobdiff