Code review for 1844-blob-signature: documentation, slight refactoring (refs #1844)

[arvados.git] / services / api / app / models / user.rb

diff --git a/services/api/app/models/user.rb b/services/api/app/models/user.rb
index 68e23804c1f4479eeb1d82e5f536cd654428a694..a85a63df7d8d579ff94f1a8d830e4ebd1289a8dc 100644 (file)
--- a/services/api/app/models/user.rb
+++ b/services/api/app/models/user.rb
@@ -6,11 +6,12 @@ class User < ArvadosModel
   has_many :api_client_authorizations
   before_update :prevent_privilege_escalation
   before_update :prevent_inactive_admin
+  before_create :check_auto_admin
   after_create AdminNotifier
 
   has_many :authorized_keys, :foreign_key => :authorized_user_uuid, :primary_key => :uuid
 
-  api_accessible :superuser, :extend => :common do |t|
+  api_accessible :user, extend: :common do |t|
     t.add :email
     t.add :full_name
     t.add :first_name
@@ -18,6 +19,7 @@ class User < ArvadosModel
     t.add :identity_url
     t.add :is_active
     t.add :is_admin
+    t.add :is_invited
     t.add :prefs
   end
 
@@ -27,11 +29,18 @@ class User < ArvadosModel
     "#{first_name} #{last_name}"
   end
 
+  def is_invited
+    !!(self.is_active ||
+       Rails.configuration.new_users_are_active ||
+       self.groups_i_can(:read).select { |x| x.match /-f+$/ }.first)
+  end
+
   def groups_i_can(verb)
     self.group_permissions.select { |uuid, mask| mask[verb] }.keys
   end
 
   def can?(actions)
+    return true if is_admin
     actions.each do |action, target|
       target_uuid = target
       if target.respond_to? :uuid
@@ -40,10 +49,10 @@ class User < ArvadosModel
       next if target_uuid == self.uuid
       next if (group_permissions[target_uuid] and
                group_permissions[target_uuid][action])
-      if target.respond_to? :owner
-        next if target.owner == self.uuid
-        next if (group_permissions[target.owner] and
-                 group_permissions[target.owner][action])
+      if target.respond_to? :owner_uuid
+        next if target.owner_uuid == self.uuid
+        next if (group_permissions[target.owner_uuid] and
+                 group_permissions[target.owner_uuid][action])
       end
       return false
     end
@@ -54,6 +63,52 @@ class User < ArvadosModel
     Rails.cache.delete_matched(/^groups_for_user_/)
   end
 
+  # Return a hash of {group_uuid: perm_hash} where perm_hash[:read]
+  # and perm_hash[:write] are true if this user can read and write
+  # objects owned by group_uuid.
+  def group_permissions
+    Rails.cache.fetch "groups_for_user_#{self.uuid}" do
+      permissions_from = {}
+      todo = {self.uuid => true}
+      done = {}
+      while !todo.empty?
+        lookup_uuids = todo.keys
+        lookup_uuids.each do |uuid| done[uuid] = true end
+        todo = {}
+        newgroups = []
+        Group.where('owner_uuid in (?)', lookup_uuids).each do |group|
+          newgroups << [group.owner_uuid, group.uuid, 'can_manage']
+        end
+        Link.where('tail_uuid in (?) and link_class = ? and head_kind = ?',
+                   lookup_uuids,
+                   'permission',
+                   'arvados#group').each do |link|
+          newgroups << [link.tail_uuid, link.head_uuid, link.name]
+        end
+        newgroups.each do |tail_uuid, head_uuid, perm_name|
+          unless done.has_key? head_uuid
+            todo[head_uuid] = true
+          end
+          link_permissions = {}
+          case perm_name
+          when 'can_read'
+            link_permissions = {read:true}
+          when 'can_write'
+            link_permissions = {read:true,write:true}
+          when 'can_manage'
+            link_permissions = ALL_PERMISSIONS
+          end
+          permissions_from[tail_uuid] ||= {}
+          permissions_from[tail_uuid][head_uuid] ||= {}
+          link_permissions.each do |k,v|
+            permissions_from[tail_uuid][head_uuid][k] ||= v
+          end
+        end
+      end
+      search_permissions(self.uuid, permissions_from)
+    end
+  end
+
   protected
 
   def permission_to_update
@@ -68,6 +123,15 @@ class User < ArvadosModel
        self.is_active == Rails.configuration.new_users_are_active)
   end
 
+  def check_auto_admin
+    if User.where("uuid not like '%-000000000000000'").where(:is_admin => true).count == 0 and not Rails.configuration.auto_admin_user.nil?
+      if current_user.email == Rails.configuration.auto_admin_user
+        self.is_admin = true
+        self.is_active = true
+      end
+    end
+  end
+
   def prevent_privilege_escalation
     if current_user.andand.is_admin
       return true
@@ -97,42 +161,6 @@ class User < ArvadosModel
     true
   end
 
-  def group_permissions
-    Rails.cache.fetch "groups_for_user_#{self.uuid}" do
-      permissions_from = {}
-      todo = {self.uuid => true}
-      done = {}
-      while !todo.empty?
-        lookup_uuids = todo.keys
-        lookup_uuids.each do |uuid| done[uuid] = true end
-        todo = {}
-        Link.where('tail_uuid in (?) and link_class = ? and head_kind = ?',
-                   lookup_uuids,
-                   'permission',
-                   'arvados#group').each do |link|
-          unless done.has_key? link.head_uuid
-            todo[link.head_uuid] = true
-          end
-          link_permissions = {}
-          case link.name
-          when 'can_read'
-            link_permissions = {read:true}
-          when 'can_write'
-            link_permissions = {read:true,write:true}
-          when 'can_manage'
-            link_permissions = ALL_PERMISSIONS
-          end
-          permissions_from[link.tail_uuid] ||= {}
-          permissions_from[link.tail_uuid][link.head_uuid] ||= {}
-          link_permissions.each do |k,v|
-            permissions_from[link.tail_uuid][link.head_uuid][k] ||= v
-          end
-        end
-      end
-      search_permissions(self.uuid, permissions_from)
-    end
-  end
-
   def search_permissions(start, graph, merged={}, upstream_mask=nil, upstream_path={})
     nextpaths = graph[start]
     return merged if !nextpaths