+ def ensure_owner_uuid_is_permitted
+ raise PermissionDeniedError if !current_user
+
+ if new_record? and respond_to? :owner_uuid=
+ self.owner_uuid ||= current_user.uuid
+ end
+
+ if self.owner_uuid.nil?
+ errors.add :owner_uuid, "cannot be nil"
+ raise PermissionDeniedError
+ end
+
+ rsc_class = ArvadosModel::resource_class_for_uuid owner_uuid
+ unless rsc_class == User or rsc_class == Group
+ errors.add :owner_uuid, "must be set to User or Group"
+ raise PermissionDeniedError
+ end
+
+ # Verify "write" permission on old owner
+ # default fail unless one of:
+ # owner_uuid did not change
+ # previous owner_uuid is nil
+ # current user is the old owner
+ # current user is this object
+ # current user can_write old owner
+ unless !owner_uuid_changed? or
+ owner_uuid_was.nil? or
+ current_user.uuid == self.owner_uuid_was or
+ current_user.uuid == self.uuid or
+ current_user.can? write: self.owner_uuid_was
+ logger.warn "User #{current_user.uuid} tried to modify #{self.class.to_s} #{uuid} but does not have permission to write old owner_uuid #{owner_uuid_was}"
+ errors.add :owner_uuid, "cannot be changed without write permission on old owner"
+ raise PermissionDeniedError
+ end
+
+ # Verify "write" permission on new owner
+ # default fail unless one of:
+ # current_user is this object
+ # current user can_write new owner
+ unless current_user == self or current_user.can? write: owner_uuid
+ logger.warn "User #{current_user.uuid} tried to modify #{self.class.to_s} #{uuid} but does not have permission to write new owner_uuid #{owner_uuid}"
+ errors.add :owner_uuid, "cannot be changed without write permission on new owner"
+ raise PermissionDeniedError
+ end
+
+ true