X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/35e245f09cfc5ace6259a671a1f12fd508750b13..2b5d9607892a48d32401ff59516e8d73234eee89:/services/api/app/models/user.rb diff --git a/services/api/app/models/user.rb b/services/api/app/models/user.rb index 218f1da59f..497a693bb8 100644 --- a/services/api/app/models/user.rb +++ b/services/api/app/models/user.rb @@ -7,6 +7,7 @@ class User < ArvadosModel before_update :prevent_privilege_escalation before_update :prevent_inactive_admin before_create :check_auto_admin + after_create :add_system_group_permission_link after_create AdminNotifier has_many :authorized_keys, :foreign_key => :authorized_user_uuid, :primary_key => :uuid @@ -79,10 +80,10 @@ class User < ArvadosModel Group.where('owner_uuid in (?)', lookup_uuids).each do |group| newgroups << [group.owner_uuid, group.uuid, 'can_manage'] end - Link.where('tail_uuid in (?) and link_class = ? and head_kind = ?', + Link.where('tail_uuid in (?) and link_class = ? and head_kind in (?)', lookup_uuids, 'permission', - 'arvados#group').each do |link| + ['arvados#group', 'arvados#user']).each do |link| newgroups << [link.tail_uuid, link.head_uuid, link.name] end newgroups.each do |tail_uuid, head_uuid, perm_name| @@ -111,64 +112,81 @@ class User < ArvadosModel def self.setup(user, openid_prefix, repo_name=nil, vm_uuid=nil) login_perm_props = {identity_url_prefix: openid_prefix} - if user[:uuid] - found = User.find_by_uuid user[:uuid] - end - - if !found - if !user[:email] - raise "No email found in the input. Aborting user creation." - end - if user.save - oid_login_perm = Link.where(tail_uuid: user[:email], - head_kind: 'arvados#user', - link_class: 'permission', - name: 'can_login') - - if !oid_login_perm.any? - # create openid login permission - oid_login_perm = Link.create(link_class: 'permission', - name: 'can_login', - tail_kind: 'email', - tail_uuid: user[:email], - head_kind: 'arvados#user', - head_uuid: user[:uuid], - properties: login_perm_props - ) - logger.info { "openid login permission: " + oid_login_perm[:uuid] } - end - else - raise "Save failed" - end + # Check oid_login_perm + oid_login_perms = Link.where(tail_uuid: user.email, + head_kind: 'arvados#user', + link_class: 'permission', + name: 'can_login') + + if !oid_login_perms.any? + # create openid login permission + oid_login_perm = Link.create(link_class: 'permission', + name: 'can_login', + tail_kind: 'email', + tail_uuid: user.email, + head_kind: 'arvados#user', + head_uuid: user.uuid, + properties: login_perm_props + ) + logger.info { "openid login permission: " + oid_login_perm[:uuid] } else - user = found + oid_login_perm = oid_login_perms.first end - response = {user: user, oid_login_perm: oid_login_perm} - - user.setup_links(repo_name, vm_uuid, openid_prefix, response) - - return response - end + return [oid_login_perm] + user.setup_repo_vm_links(repo_name, vm_uuid) + end # create links - def setup_links(repo_name, vm_uuid, openid_prefix, response) + def setup_repo_vm_links(repo_name, vm_uuid) repo_perm = create_user_repo_link repo_name - if repo_perm - response[:repo_perm] = repo_perm + vm_login_perm = create_vm_login_permission_link vm_uuid, repo_name + group_perm = create_user_group_link + + return [repo_perm, vm_login_perm, group_perm, self].compact + end + + # delete user signatures, login, repo, and vm perms, and mark as inactive + def unsetup + # delete oid_login_perms for this user + oid_login_perms = Link.where(tail_uuid: self.email, + head_kind: 'arvados#user', + link_class: 'permission', + name: 'can_login') + oid_login_perms.each do |perm| + Link.delete perm end - vm_login_perm = create_vm_login_permission_link vm_uuid, repo_name - if vm_login_perm - response[:vm_login_perm] = vm_login_perm + # delete repo_perms for this user + repo_perms = Link.where(tail_uuid: self.uuid, + head_kind: 'arvados#repository', + link_class: 'permission', + name: 'can_write') + repo_perms.each do |perm| + Link.delete perm end - group_perm = create_user_group_links - if group_perm - response[:group_perm] = group_perm + # delete vm_login_perms for this user + vm_login_perms = Link.where(tail_uuid: self.uuid, + head_kind: 'arvados#virtualMachine', + link_class: 'permission', + name: 'can_login') + vm_login_perms.each do |perm| + Link.delete perm end - end + + # delete any signatures by this user + signed_uuids = Link.where(link_class: 'signature', + tail_kind: 'arvados#user', + tail_uuid: self.uuid) + signed_uuids.each do |sign| + Link.delete sign + end + + # mark the user as inactive + self.is_active = false + self.save! + end protected @@ -240,6 +258,7 @@ class User < ArvadosModel end def create_user_repo_link(repo_name) + # repo_name is optional if not repo_name logger.warn ("Repository name not given for #{self.uuid}.") return @@ -258,7 +277,7 @@ class User < ArvadosModel link_class: 'permission', name: 'can_write') if repo_perms.any? - logger.warn "User already has repository access " + + logger.warn "User already has repository access " + repo_perms.collect { |p| p[:uuid] }.inspect return repo_perms.first end @@ -280,23 +299,28 @@ class User < ArvadosModel # create login permission for the given vm_uuid, if it does not already exist def create_vm_login_permission_link(vm_uuid, repo_name) - # Look up the given virtual machine just to make sure it really exists. begin - vm = VirtualMachine.where(uuid: vm_uuid).first - if not vm - logger.warn "Could not find virtual machine for #{vm_uuid.inspect}" + # vm uuid is optional + if vm_uuid + vm = VirtualMachine.where(uuid: vm_uuid).first + + if not vm + logger.warn "Could not find virtual machine for #{vm_uuid.inspect}" + raise "No vm found for #{vm_uuid}" + end + else return end logger.info { "vm uuid: " + vm[:uuid] } - login_perm = Link.where(tail_uuid: self.uuid, + login_perms = Link.where(tail_uuid: self.uuid, head_uuid: vm[:uuid], head_kind: 'arvados#virtualMachine', link_class: 'permission', name: 'can_login') - if !login_perm.any? + if !login_perms.any? login_perm = Link.create(tail_kind: 'arvados#user', tail_uuid: self.uuid, head_kind: 'arvados#virtualMachine', @@ -305,6 +329,8 @@ class User < ArvadosModel name: 'can_login', properties: {username: repo_name}) logger.info { "login permission: " + login_perm[:uuid] } + else + login_perm = login_perms.first end return login_perm @@ -312,7 +338,7 @@ class User < ArvadosModel end # add the user to the 'All users' group - def create_user_group_links + def create_user_group_link # Look up the "All users" group (we expect uuid *-*-fffffffffffffff). group = Group.where(name: 'All users').select do |g| g[:uuid].match /-f+$/ @@ -320,17 +346,17 @@ class User < ArvadosModel if not group logger.warn "No 'All users' group with uuid '*-*-fffffffffffffff'." - return + raise "No 'All users' group with uuid '*-*-fffffffffffffff' is found" else logger.info { "\"All users\" group uuid: " + group[:uuid] } - group_perm = Link.where(tail_uuid: self.uuid, + group_perms = Link.where(tail_uuid: self.uuid, head_uuid: group[:uuid], head_kind: 'arvados#group', link_class: 'permission', name: 'can_read') - if !group_perm.any? + if !group_perms.any? group_perm = Link.create(tail_kind: 'arvados#user', tail_uuid: self.uuid, head_kind: 'arvados#group', @@ -338,10 +364,23 @@ class User < ArvadosModel link_class: 'permission', name: 'can_read') logger.info { "group permission: " + group_perm[:uuid] } + else + group_perm = group_perms.first end return group_perm end end + # Give the special "System group" permission to manage this user and + # all of this user's stuff. + # + def add_system_group_permission_link + Link.create(link_class: 'permission', + name: 'can_manage', + tail_kind: 'arvados#group', + tail_uuid: system_group_uuid, + head_kind: 'arvados#user', + head_uuid: self.uuid) + end end