X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/5923d0fa912c73e3725e52c869d72793304ae44a..1471ad4b235e168ccee4fa351b0025b2b380d7ac:/services/api/app/controllers/arvados/v1/users_controller.rb diff --git a/services/api/app/controllers/arvados/v1/users_controller.rb b/services/api/app/controllers/arvados/v1/users_controller.rb index 131ee5236b..d2126ec5f7 100644 --- a/services/api/app/controllers/arvados/v1/users_controller.rb +++ b/services/api/app/controllers/arvados/v1/users_controller.rb @@ -1,11 +1,15 @@ +# Copyright (C) The Arvados Authors. All rights reserved. +# +# SPDX-License-Identifier: AGPL-3.0 + class Arvados::V1::UsersController < ApplicationController accept_attribute_as_json :prefs, Hash skip_before_filter :find_object_by_uuid, only: - [:activate, :current, :system, :setup] + [:activate, :current, :system, :setup, :merge] skip_before_filter :render_404_if_no_object, only: - [:activate, :current, :system, :setup] - before_filter :admin_required, only: [:setup, :unsetup] + [:activate, :current, :system, :setup, :merge] + before_filter :admin_required, only: [:setup, :unsetup, :update_uuid] def current if current_user @@ -64,49 +68,44 @@ class Arvados::V1::UsersController < ApplicationController # create user object and all the needed links def setup - @object = nil if params[:uuid] - @object = User.find_by_uuid params[:uuid] + @object = User.find_by_uuid(params[:uuid]) if !@object return render_404_if_no_object end - object_found = true + elsif !params[:user] + raise ArgumentError.new "Required uuid or user" + elsif !params[:user]['email'] + raise ArgumentError.new "Require user email" + elsif !params[:openid_prefix] + raise ArgumentError.new "Required openid_prefix parameter is missing." else - if !params[:user] - raise ArgumentError.new "Required uuid or user" - else - if params[:user]['uuid'] - @object = User.find_by_uuid params[:user]['uuid'] - if @object - object_found = true - end - end - - if !@object - if !params[:user]['email'] - raise ArgumentError.new "Require user email" - end - - if !params[:openid_prefix] - raise ArgumentError.new "Required openid_prefix parameter is missing." - end - - @object = model_class.create! resource_attrs - end - end + @object = model_class.create! resource_attrs end - if object_found - @response = @object.setup_repo_vm_links params[:repo_name], - params[:vm_uuid], params[:openid_prefix] + # It's not always possible for the client to know the user's + # username when submitting this request: the username might have + # been assigned automatically in create!() above. If client + # provided a plain repository name, prefix it with the username + # now that we know what it is. + if params[:repo_name].nil? + full_repo_name = nil + elsif @object.username.nil? + raise ArgumentError. + new("cannot setup a repository because user has no username") + elsif params[:repo_name].index("/") + full_repo_name = params[:repo_name] else - @response = User.setup @object, params[:openid_prefix], - params[:repo_name], params[:vm_uuid] + full_repo_name = "#{@object.username}/#{params[:repo_name]}" end + @response = @object.setup(repo_name: full_repo_name, + vm_uuid: params[:vm_uuid], + openid_prefix: params[:openid_prefix]) + # setup succeeded. send email to user - if params[:send_notification_email] == true || params[:send_notification_email] == 'true' - UserNotifier.account_is_setup(@object).deliver + if params[:send_notification_email] + UserNotifier.account_is_setup(@object).deliver_now end send_json kind: "arvados#HashList", items: @response.as_api_response(nil) @@ -119,8 +118,67 @@ class Arvados::V1::UsersController < ApplicationController show end + # Change UUID to a new (unused) uuid and transfer all owned/linked + # objects accordingly. + def update_uuid + @object.update_uuid(new_uuid: params[:new_uuid]) + show + end + + def merge + if !Thread.current[:api_client].andand.is_trusted + return send_error("supplied API token is not from a trusted client", status: 403) + elsif Thread.current[:api_client_authorization].scopes != ['all'] + return send_error("cannot merge with a scoped token", status: 403) + end + + new_auth = ApiClientAuthorization.validate(token: params[:new_user_token]) + if !new_auth + return send_error("invalid new_user_token", status: 401) + end + if !new_auth.api_client.andand.is_trusted + return send_error("supplied new_user_token is not from a trusted client", status: 403) + elsif new_auth.scopes != ['all'] + return send_error("supplied new_user_token has restricted scope", status: 403) + end + new_user = new_auth.user + + if current_user.uuid == new_user.uuid + return send_error("cannot merge user to self", status: 422) + end + + if !new_user.can?(write: params[:new_owner_uuid]) + return send_error("cannot move objects into supplied new_owner_uuid: new user does not have write permission", status: 403) + end + + redirect = params[:redirect_to_new_user] + if !redirect + return send_error("merge with redirect_to_new_user=false is not yet supported", status: 422) + end + + @object = current_user + act_as_system_user do + @object.merge(new_owner_uuid: params[:new_owner_uuid], redirect_to_user_uuid: redirect && new_user.uuid) + end + show + end + protected + def self._merge_requires_parameters + { + new_owner_uuid: { + type: 'string', required: true, + }, + new_user_token: { + type: 'string', required: true, + }, + redirect_to_new_user: { + type: 'boolean', required: false, + }, + } + end + def self._setup_requires_parameters { user: { @@ -141,11 +199,19 @@ class Arvados::V1::UsersController < ApplicationController } end + def self._update_uuid_requires_parameters + { + new_uuid: { + type: 'string', required: true, + }, + } + end + def apply_filters(model_class=nil) - return super if @read_users.any? &:is_admin + return super if @read_users.any?(&:is_admin) if params[:uuid] != current_user.andand.uuid # Non-admin index/show returns very basic information about readable users. - safe_attrs = ["uuid", "is_active", "email", "first_name", "last_name"] + safe_attrs = ["uuid", "is_active", "email", "first_name", "last_name", "username"] if @select @select = @select & safe_attrs else