def self.searchable_columns operator
textonly_operator = !operator.match(/[<=>]/)
- self.columns.collect do |col|
- if [:string, :text].index(col.type)
- col.name
- elsif !textonly_operator and [:datetime, :integer].index(col.type)
- col.name
+ self.columns.select do |col|
+ case col.type
+ when :string, :text
+ true
+ when :datetime, :integer, :boolean
+ !textonly_operator
+ else
+ false
end
- end.compact
+ end.map(&:name)
end
def self.attribute_column attr
self.columns.select { |col| col.name == attr.to_s }.first
end
+ def self.attributes_required_columns
+ # This method returns a hash. Each key is the name of an API attribute,
+ # and it's mapped to a list of database columns that must be fetched
+ # to generate that attribute.
+ # This implementation generates a simple map of attributes to
+ # matching column names. Subclasses can override this method
+ # to specify that method-backed API attributes need to fetch
+ # specific columns from the database.
+ all_columns = columns.map(&:name)
+ api_column_map = Hash.new { |hash, key| hash[key] = [] }
+ methods.grep(/^api_accessible_\w+$/).each do |method_name|
+ next if method_name == :api_accessible_attributes
+ send(method_name).each_pair do |api_attr_name, col_name|
+ col_name = col_name.to_s
+ if all_columns.include?(col_name)
+ api_column_map[api_attr_name.to_s] |= [col_name]
+ end
+ end
+ end
+ api_column_map
+ end
+
# Return nil if current user is not allowed to see the list of
# writers. Otherwise, return a list of user_ and group_uuids with
# write permission. (If not returning nil, current_user is always in
sql_params += [uuid_list]
end
+ if sql_table == "collections" and users_list.any?
+ # There is a 'name' link going from a readable group to the collection.
+ name_links = "(SELECT head_uuid FROM links WHERE link_class='name' AND tail_uuid IN (#{sanitized_uuid_list}))"
+ sql_conds += ["#{sql_table}.uuid IN #{name_links}"]
+ end
+
# Link head points to this row, or to the owner of this row (the thing to be read)
#
# Link tail originates from this user, or a group that is readable by this
def ensure_owner_uuid_is_permitted
raise PermissionDeniedError if !current_user
- if respond_to? :owner_uuid=
+ if new_record? and respond_to? :owner_uuid=
self.owner_uuid ||= current_user.uuid
end
- if self.owner_uuid_changed?
- if new_record?
- return true
- elsif current_user.uuid == self.owner_uuid or
- current_user.can? write: self.owner_uuid
- # current_user is, or has :write permission on, the new owner
- else
- logger.warn "User #{current_user.uuid} tried to change owner_uuid of #{self.class.to_s} #{self.uuid} to #{self.owner_uuid} but does not have permission to write to #{self.owner_uuid}"
- raise PermissionDeniedError
- end
- end
- if new_record?
- return true
- elsif respond_to? :link_class and link_class == 'permission'
- # Users are permitted to modify permission links themselves
- # if they have "manage" permission on the destination object.
- if current_user.can_manage? head_uuid
- return true
- else
- raise PermissionDeniedError
- end
- elsif current_user.uuid == self.owner_uuid_was or
+ # Verify permission to write to old owner (unless owner_uuid was
+ # nil -- or hasn't changed, in which case the following
+ # "permission to write to new owner" block will take care of us)
+ unless !owner_uuid_changed? or
+ owner_uuid_was.nil? or
+ current_user.uuid == self.owner_uuid_was or
current_user.uuid == self.uuid or
current_user.can? write: self.owner_uuid_was
- # current user is, or has :write permission on, the previous owner
- return true
- else
- logger.warn "User #{current_user.uuid} tried to modify #{self.class.to_s} #{self.uuid} but does not have permission to write #{self.owner_uuid_was}"
+ logger.warn "User #{current_user.uuid} tried to modify #{self.class.to_s} #{uuid} but does not have permission to write old owner_uuid #{owner_uuid_was}"
+ errors.add :owner_uuid, "cannot be changed without write permission on old owner"
+ raise PermissionDeniedError
+ end
+ # Verify permission to write to new owner
+ unless current_user == self or current_user.can? write: owner_uuid
+ logger.warn "User #{current_user.uuid} tried to modify #{self.class.to_s} #{uuid} but does not have permission to write new owner_uuid #{owner_uuid}"
+ errors.add :owner_uuid, "cannot be changed without write permission on new owner"
raise PermissionDeniedError
end
end
nil
end
+ # ArvadosModel.find_by_uuid needs extra magic to allow it to return
+ # an object in any class.
+ def self.find_by_uuid uuid
+ if self == ArvadosModel
+ # If called directly as ArvadosModel.find_by_uuid rather than via subclass,
+ # delegate to the appropriate subclass based on the given uuid.
+ self.resource_class_for_uuid(uuid).find_by_uuid(uuid)
+ else
+ super
+ end
+ end
+
def log_start_state
@old_etag = etag
@old_attributes = logged_attributes
projects / arvados.git / blobdiff