X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/107377eaf36cba7130e7bc9f42111147049cbd0b..e843017b451f1270c58539512e227c4da5656e25:/services/api/app/controllers/arvados/v1/users_controller.rb

diff --git a/services/api/app/controllers/arvados/v1/users_controller.rb b/services/api/app/controllers/arvados/v1/users_controller.rb
index 04d0db789a..4a345f363b 100644
--- a/services/api/app/controllers/arvados/v1/users_controller.rb
+++ b/services/api/app/controllers/arvados/v1/users_controller.rb
@@ -1,51 +1,30 @@
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: AGPL-3.0
+
 class Arvados::V1::UsersController < ApplicationController
-  skip_before_filter :find_object_by_uuid, only:
-    [:activate, :event_stream, :current, :system]
-  skip_before_filter :render_404_if_no_object, only:
-    [:activate, :event_stream, :current, :system]
+  accept_attribute_as_json :prefs, Hash
+
+  skip_before_action :find_object_by_uuid, only:
+    [:activate, :current, :system, :setup, :merge]
+  skip_before_action :render_404_if_no_object, only:
+    [:activate, :current, :system, :setup, :merge]
+  before_action :admin_required, only: [:setup, :unsetup, :update_uuid]
 
   def current
-    @object = current_user
-    show
+    if current_user
+      @object = current_user
+      show
+    else
+      send_error("Not logged in", status: 401)
+    end
   end
+
   def system
     @object = system_user
     show
   end
 
-  class ChannelStreamer
-    Q_UPDATE_INTERVAL = 12
-    def initialize(opts={})
-      @opts = opts
-    end
-    def each
-      return unless @opts[:channel]
-      @redis = Redis.new(:timeout => 0)
-      @redis.subscribe(@opts[:channel]) do |event|
-        event.message do |channel, msg|
-          yield msg + "\n"
-        end
-      end
-    end
-  end
-      
-  def event_stream
-    channel = current_user.andand.uuid
-    if current_user.andand.is_admin
-      channel = params[:uuid] || channel
-    end
-    if client_accepts_plain_text_stream
-      self.response.headers['Last-Modified'] = Time.now.ctime.to_s
-      self.response_body = ChannelStreamer.new(channel: channel)
-    else
-      render json: {
-        href: url_for(uuid: channel),
-        comment: ('To retrieve the event stream as plain text, ' +
-                  'use a request header like "Accept: text/plain"')
-      }
-    end
-  end
-
   def activate
     if current_user.andand.is_admin && params[:uuid]
       @object = User.find params[:uuid]
@@ -59,22 +38,21 @@ class Arvados::V1::UsersController < ApplicationController
         raise ArgumentError.new "Cannot activate without being invited."
       end
       act_as_system_user do
-        required_uuids = Link.where(owner_uuid: system_user_uuid,
-                                    link_class: 'signature',
-                                    name: 'require',
-                                    tail_uuid: system_user_uuid,
-                                    head_kind: 'arvados#collection').
+        required_uuids = Link.where("owner_uuid = ? and link_class = ? and name = ? and tail_uuid = ? and head_uuid like ?",
+                                    system_user_uuid,
+                                    'signature',
+                                    'require',
+                                    system_user_uuid,
+                                    Collection.uuid_like_pattern).
           collect(&:head_uuid)
         signed_uuids = Link.where(owner_uuid: system_user_uuid,
                                   link_class: 'signature',
                                   name: 'click',
-                                  tail_kind: 'arvados#user',
                                   tail_uuid: @object.uuid,
-                                  head_kind: 'arvados#collection',
                                   head_uuid: required_uuids).
           collect(&:head_uuid)
         todo_uuids = required_uuids - signed_uuids
-        if todo_uuids == []
+        if todo_uuids.empty?
           @object.update_attributes is_active: true
           logger.info "User #{@object.uuid} activated"
         else
@@ -88,198 +66,193 @@ class Arvados::V1::UsersController < ApplicationController
     show
   end
 
-	# create user object and all the needed links
-  def create
-		if params[:openid_prefix]		# check if default openid_prefix needs to be overridden
-			openid_prefix = params[:openid_prefix]
-		else 
-			openid_prefix = 'https://www.google.com/accounts/o8/id'		# default openid prefix
-		end
-		login_perm_props = {identity_url_prefix: openid_prefix}
-
-		# check if only to probe the given user parameter
-		just_probe = (params[:just_probe] == 'true') ? true : false;
-
- 		@object = model_class.new resource_attrs
-
-		# If user_param is passed, lookup for user. If exists, skip create and create any missing links. 
-		if params[:user_param]
-			begin 
-	 			@object_found = find_user_from_user_param params[:user_param]
-		  end
+  # create user object and all the needed links
+  def setup
+    if params[:uuid]
+      @object = User.find_by_uuid(params[:uuid])
+      if !@object
+        return render_404_if_no_object
+      end
+    elsif !params[:user] || params[:user].empty?
+      raise ArgumentError.new "Required uuid or user"
+    elsif !params[:user]['email']
+      raise ArgumentError.new "Require user email"
+    elsif !params[:openid_prefix]
+      raise ArgumentError.new "Required openid_prefix parameter is missing."
+    else
+      @object = model_class.create! resource_attrs
+    end
 
-			if !@object_found
-				@object[:email] = params[:user_param]				
-  	 		need_to_create = true
-			else
-				@object = @object_found
-			end
-		else		# need to create user for the given :user data
-			need_to_create = true
-		end
+    # It's not always possible for the client to know the user's
+    # username when submitting this request: the username might have
+    # been assigned automatically in create!() above. If client
+    # provided a plain repository name, prefix it with the username
+    # now that we know what it is.
+    if params[:repo_name].nil?
+      full_repo_name = nil
+    elsif @object.username.nil?
+      raise ArgumentError.
+        new("cannot setup a repository because user has no username")
+    elsif params[:repo_name].index("/")
+      full_repo_name = params[:repo_name]
+    else
+      full_repo_name = "#{@object.username}/#{params[:repo_name]}"
+    end
 
-		# if just probing, return any object found	
-		if just_probe 	
-			show; return
-		end
+    @response = @object.setup(repo_name: full_repo_name,
+                              vm_uuid: params[:vm_uuid],
+                              openid_prefix: params[:openid_prefix])
 
-		# create if need be, and then create or update the links as needed 
-		if need_to_create
-			if @object.save		# save succeeded
-				oid_login_perm = Link.where(tail_uuid: @object[:email],
-                            				head_kind: 'arvados#user',
-                            				link_class: 'permission',
-                            				name: 'can_login')
+    # setup succeeded. send email to user
+    if params[:send_notification_email]
+      UserNotifier.account_is_setup(@object).deliver_now
+    end
 
-				if [] == oid_login_perm
-					# create openid login permission
-	      	oid_login_perm = Link.create(link_class: 'permission',
-	                                   name: 'can_login',
-  	                                 tail_kind: 'email',
-  	                                 tail_uuid: @object[:email],
-  	                                 head_kind: 'arvados#user',
-  	                                 head_uuid: @object[:uuid],
-  	                                 properties: login_perm_props
-  	                                )
-					logger.info { "openid login permission: " + oid_login_perm[:uuid] }
-				end
-  	  else
-  	   	raise "Save failed"
-  	 	end
-		end
+    send_json kind: "arvados#HashList", items: @response.as_api_response(nil)
+  end
 
-		# create links
-		create_user_repo_link params[:repo_name]
-		create_vm_login_permission_link params[:vm_uuid], params[:repo_name]
-		create_user_group_link 
+  # delete user agreements, vm, repository, login links; set state to inactive
+  def unsetup
+    reload_object_before_update
+    @object.unsetup
+    show
+  end
 
-		show
+  # Change UUID to a new (unused) uuid and transfer all owned/linked
+  # objects accordingly.
+  def update_uuid
+    @object.update_uuid(new_uuid: params[:new_uuid])
+    show
   end
 
-	protected 
+  def merge
+    if (params[:old_user_uuid] || params[:new_user_uuid])
+      if !current_user.andand.is_admin
+        return send_error("Must be admin to use old_user_uuid/new_user_uuid", status: 403)
+      end
+      if !params[:old_user_uuid] || !params[:new_user_uuid]
+        return send_error("Must supply both old_user_uuid and new_user_uuid", status: 422)
+      end
+      new_user = User.find_by_uuid(params[:new_user_uuid])
+      if !new_user
+        return send_error("User in new_user_uuid not found", status: 422)
+      end
+      @object = User.find_by_uuid(params[:old_user_uuid])
+      if !@object
+        return send_error("User in old_user_uuid not found", status: 422)
+      end
+    else
+      if !Thread.current[:api_client].andand.is_trusted
+        return send_error("supplied API token is not from a trusted client", status: 403)
+      elsif Thread.current[:api_client_authorization].scopes != ['all']
+        return send_error("cannot merge with a scoped token", status: 403)
+      end
 
-	# find the user from the given user parameter
-	def find_user_from_user_param(user_param)
-		found_object = User.find_by_uuid user_param
+      new_auth = ApiClientAuthorization.validate(token: params[:new_user_token])
+      if !new_auth
+        return send_error("invalid new_user_token", status: 401)
+      end
 
-		if !found_object
-			begin
-				if !user_param.match(/\w\@\w+\.\w+/)
-					logger.warn ("Given user param is not valid email format: #{user_param}")
-					raise ArgumentError.new "User param is not of valid email format. Stop"
-				else
-          found_objects = User.where('email=?', user_param)  
-       
-				 	if found_objects.size > 1
-						logger.warn ("Found #{found_objects.size} users with email #{user_param}. Stop.")
-						raise ArgumentError.new "Found #{found_objects.size} users with email #{user_param}. Stop."
-					elsif found_objects.size == 1
-						found_object = found_objects.first
-					end
+      if new_auth.user.uuid[0..4] == Rails.configuration.ClusterID
+        if !new_auth.api_client.andand.is_trusted
+          return send_error("supplied new_user_token is not from a trusted client", status: 403)
+        elsif new_auth.scopes != ['all']
+          return send_error("supplied new_user_token has restricted scope", status: 403)
         end
-   		end
-		end
-
-		return found_object
-	end
-	
-	# link the repo_name passed
-	def create_user_repo_link(repo_name)
-		if !repo_name
-			logger.warn ("Repository name not given for #{@object[:uuid]}. Skip creating the link")
-			return
-		end
-
-		# Check for an existing repository with the same name we're about to use.
-		repo = (repositories = Repository.where(name: repo_name)) != nil ? repositories.first : nil
-		if repo
-  		logger.warn "Repository already exists with name #{repo_name}: #{repo[:uuid]}. Will link to user."
+      end
+      new_user = new_auth.user
+      @object = current_user
+    end
 
-			# Look for existing repository access (perhaps using a different repository/user name).
-			repo_perms = Link.where(tail_uuid: @object[:uuid],
-    	                        head_kind: 'arvados#repository',
-    	                        head_uuid: repo[:uuid],
-    	                        link_class: 'permission',
-    	                        name: 'can_write')
-			if [] != repo_perms
-  			logger.warn "User already has repository access " + repo_perms.collect { |p| p[:uuid] }.inspect
-				return
-			end
-		end
+    if @object.uuid == new_user.uuid
+      return send_error("cannot merge user to self", status: 422)
+    end
 
-		repo ||= Repository.create(name: repo_name)		# create repo, if does not already exist
-		logger.info { "repo uuid: " + repo[:uuid] }
+    if !params[:new_owner_uuid]
+      return send_error("missing new_owner_uuid", status: 422)
+    end
 
-		repo_perm = Link.create(tail_kind: 'arvados#user',
-                            tail_uuid: @object[:uuid],
-                            head_kind: 'arvados#repository',
-                            head_uuid: repo[:uuid],
-                            link_class: 'permission',
-                            name: 'can_write')
-		logger.info { "repo permission: " + repo_perm[:uuid] }
-	end
+    if !new_user.can?(write: params[:new_owner_uuid])
+      return send_error("cannot move objects into supplied new_owner_uuid: new user does not have write permission", status: 403)
+    end
 
-	# create login permission for the given vm_uuid, if it does not already exist
-	def create_vm_login_permission_link(vm_uuid, repo_name)
-		# Look up the given virtual machine just to make sure it really exists.
-		begin
-			vm = (vms = VirtualMachine.where(uuid: vm_uuid)) != nil ? vms.first : nil
-  		#vm = VirtualMachine.where(uuid: vm_uuid)
+    redirect = params[:redirect_to_new_user]
+    if @object.uuid[0..4] != Rails.configuration.ClusterID && redirect
+      return send_error("cannot merge remote user to other with redirect_to_new_user=true", status: 422)
+    end
 
-			if [] == vm
-			  logger.warn "Could not look up virtual machine with uuid #{vm_uuid.inspect}"
-				return
-			end
+    if !redirect
+      return send_error("merge with redirect_to_new_user=false is not yet supported", status: 422)
+    end
 
-			logger.info { "vm uuid: " + vm[:uuid] }
+    act_as_system_user do
+      @object.merge(new_owner_uuid: params[:new_owner_uuid], redirect_to_user_uuid: redirect && new_user.uuid)
+    end
+    show
+  end
 
-			login_perm = Link.where(tail_uuid: @object[:uuid],
-                              head_uuid: vm[:uuid],
-                            	head_kind: 'arvados#virtualMachine',
-                            	link_class: 'permission',
-                            	name: 'can_login')
-			if [] == login_perm
-				login_perm = Link.create(tail_kind: 'arvados#user',
-        	                       tail_uuid: @object[:uuid],
-        	                       head_kind: 'arvados#virtualMachine',
-        	                       head_uuid: vm[:uuid],
-        	                       link_class: 'permission',
-        	                       name: 'can_login',
-        	                       properties: {username: repo_name})
-				logger.info { "login permission: " + login_perm[:uuid] }
-			end
-		end
-	end
+  protected
 
-	# add the user to the 'All users' group
-	def create_user_group_link
-		# Look up the "All users" group (we expect uuid *-*-fffffffffffffff).
-		group = Group.where(name: 'All users').select do |g|
-			g[:uuid].match /-f+$/
-		end.first
+  def self._merge_requires_parameters
+    {
+      new_owner_uuid: {
+        type: 'string', required: true,
+      },
+      new_user_token: {
+        type: 'string', required: false,
+      },
+      redirect_to_new_user: {
+        type: 'boolean', required: false,
+      },
+      old_user_uuid: {
+        type: 'string', required: false,
+      },
+      new_user_uuid: {
+        type: 'string', required: false,
+      }
+    }
+  end
 
-		if not group
-  		logger.warn "Could not look up the 'All users' group with uuid '*-*-fffffffffffffff'. Skip."
-			return
-		else
-			logger.info { "\"All users\" group uuid: " + group[:uuid] }
+  def self._setup_requires_parameters
+    {
+      user: {
+        type: 'object', required: false
+      },
+      openid_prefix: {
+        type: 'string', required: false
+      },
+      repo_name: {
+        type: 'string', required: false
+      },
+      vm_uuid: {
+        type: 'string', required: false
+      },
+      send_notification_email: {
+        type: 'boolean', required: false, default: false
+      },
+    }
+  end
 
-			group_perm = Link.where(tail_uuid: @object[:uuid],
-															head_uuid: group[:uuid],
-                            	head_kind: 'arvados#group',
-                            	link_class: 'permission',
-                            	name: 'can_read')
+  def self._update_uuid_requires_parameters
+    {
+      new_uuid: {
+        type: 'string', required: true,
+      },
+    }
+  end
 
-			if [] == group_perm
-				group_perm = Link.create(tail_kind: 'arvados#user',
-  	                             tail_uuid: @object[:uuid],
-  	                             head_kind: 'arvados#group',
-  	                             head_uuid: group[:uuid],
-  	                             link_class: 'permission',
-  	                             name: 'can_read')
-				logger.info { "group permission: " + group_perm[:uuid] }
-			end
-		end
-	end
- 
+  def apply_filters(model_class=nil)
+    return super if @read_users.any?(&:is_admin)
+    if params[:uuid] != current_user.andand.uuid
+      # Non-admin index/show returns very basic information about readable users.
+      safe_attrs = ["uuid", "is_active", "email", "first_name", "last_name", "username"]
+      if @select
+        @select = @select & safe_attrs
+      else
+        @select = safe_attrs
+      end
+      @filters += [['is_active', '=', true]]
+    end
+    super
+  end
 end