18183: Merge branch 'main' into 18183-revoke-tokens-when-user-is-disabled

[arvados.git] / services / api / lib / whitelist_update.rb

diff --git a/services/api/lib/whitelist_update.rb b/services/api/lib/whitelist_update.rb
index 7413edf4bc902d0dc488c5ea2b3492792f6d338a..17aed4b48dba66b079431007408dae49ee6442cf 100644 (file)
--- a/services/api/lib/whitelist_update.rb
+++ b/services/api/lib/whitelist_update.rb
@@ -1,8 +1,32 @@
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: AGPL-3.0
+
 module WhitelistUpdate
   def check_update_whitelist permitted_fields
     attribute_names.each do |field|
-      if not permitted_fields.include? field.to_sym and self.send((field.to_s + "_changed?").to_sym)
-        errors.add field, "Illegal update of field #{field}"
+      if !permitted_fields.include?(field.to_sym) && really_changed(field)
+        errors.add field, "cannot be modified in state '#{self.state}' (#{send(field+"_was").inspect}, #{send(field).inspect})"
+      end
+    end
+  end
+
+  def really_changed(attr)
+    return false if !send(attr+"_changed?")
+    old = send(attr+"_was")
+    new = send(attr)
+    if (old.nil? || old == [] || old == {}) && (new.nil? || new == [] || new == {})
+      false
+    else
+      old != new
+    end
+  end
+
+  def validate_state_change
+    if self.state_changed?
+      unless state_transitions[self.state_was].andand.include? self.state
+        errors.add :state, "cannot change from #{self.state_was} to #{self.state}"
+        return false
       end
     end
   end