Merge branch 'master' into 1971-show-image-thumbnails

[arvados.git] / services / api / lib / current_api_client.rb

diff --git a/services/api/lib/current_api_client.rb b/services/api/lib/current_api_client.rb
index 96009977cddcff5a8d59b34a28d8ddb377787aec..401be16c7a263232f7dcb86c53179611964294e1 100644 (file)
--- a/services/api/lib/current_api_client.rb
+++ b/services/api/lib/current_api_client.rb
@@ -11,11 +11,15 @@ module CurrentApiClient
     Thread.current[:api_client_authorization]
   end
 
+  def current_api_base
+    Thread.current[:api_url_base]
+  end
+
   def current_default_owner
     # owner_uuid for newly created objects
     ((current_api_client_authorization &&
-      current_api_client_authorization.default_owner) ||
-     (current_user && current_user.default_owner) ||
+      current_api_client_authorization.default_owner_uuid) ||
+     (current_user && current_user.default_owner_uuid) ||
      (current_user && current_user.uuid) ||
      nil)
   end
@@ -25,12 +29,28 @@ module CurrentApiClient
     Thread.current[:api_client_ip_address]
   end
 
+  # Does the current API client authorization include any of ok_scopes?
+  def current_api_client_auth_has_scope(ok_scopes)
+    auth_scopes = current_api_client_authorization.andand.scopes || []
+    unless auth_scopes.index('all') or (auth_scopes & ok_scopes).any?
+      logger.warn "Insufficient auth scope: need #{ok_scopes}, #{current_api_client_authorization.inspect} has #{auth_scopes}"
+      return false
+    end
+    true
+  end
+
   def system_user_uuid
     [Server::Application.config.uuid_prefix,
      User.uuid_prefix,
      '000000000000000'].join('-')
   end
 
+  def system_group_uuid
+    [Server::Application.config.uuid_prefix,
+     Group.uuid_prefix,
+     '000000000000000'].join('-')
+  end
+
   def system_user
     if not $system_user
       real_current_user = Thread.current[:user]
@@ -51,7 +71,38 @@ module CurrentApiClient
     $system_user
   end
 
+  def system_group
+    if not $system_group
+      act_as_system_user do
+        ActiveRecord::Base.transaction do
+          $system_group = Group.
+            where(uuid: system_group_uuid).first_or_create do |g|
+            g.update_attributes(name: "System group",
+                                description: "System group")
+            User.all.collect(&:uuid).each do |user_uuid|
+              Link.create(link_class: 'permission',
+                          name: 'can_manage',
+                          tail_kind: 'arvados#group',
+                          tail_uuid: system_group_uuid,
+                          head_kind: 'arvados#user',
+                          head_uuid: user_uuid)
+            end
+          end
+        end
+      end
+    end
+    $system_group
+  end
+
   def act_as_system_user
-    Thread.current[:user] = system_user
+    if block_given?
+      user_was = Thread.current[:user]
+      Thread.current[:user] = system_user
+      ret = yield
+      Thread.current[:user] = user_was
+      ret
+    else
+      Thread.current[:user] = system_user
+    end
   end
 end