- # Verify permission to write to old owner (unless owner_uuid was
- # nil -- or hasn't changed, in which case the following
- # "permission to write to new owner" block will take care of us)
+
+ if self.owner_uuid.nil?
+ errors.add :owner_uuid, "cannot be nil"
+ raise PermissionDeniedError
+ end
+
+ rsc_class = ArvadosModel::resource_class_for_uuid owner_uuid
+ unless rsc_class == User or rsc_class == Group
+ errors.add :owner_uuid, "must be set to User or Group"
+ raise PermissionDeniedError
+ end
+
+ # Verify "write" permission on old owner
+ # default fail unless one of:
+ # owner_uuid did not change
+ # previous owner_uuid is nil
+ # current user is the old owner
+ # current user is this object
+ # current user can_write old owner