X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/6403b8728d3120d6cb22583b3963d2a030e88aa3..32002eb6e87a391d1fad2b1b206dbc74d6659fc5:/services/api/app/models/arvados_model.rb?ds=sidebyside diff --git a/services/api/app/models/arvados_model.rb b/services/api/app/models/arvados_model.rb index f95a35e739..308da7fa11 100644 --- a/services/api/app/models/arvados_model.rb +++ b/services/api/app/models/arvados_model.rb @@ -36,6 +36,12 @@ class ArvadosModel < ActiveRecord::Base end end + class AlreadyLockedError < StandardError + def http_status + 403 + end + end + class UnauthorizedError < StandardError def http_status 401 @@ -90,16 +96,26 @@ class ArvadosModel < ActiveRecord::Base api_column_map end - # Return nil if current user is not allowed to see the list of - # writers. Otherwise, return a list of user_ and group_uuids with - # write permission. (If not returning nil, current_user is always in - # the list because can_manage permission is needed to see the list - # of writers.) + # If current user can manage the object, return an array of uuids of + # users and groups that have permission to write the object. The + # first two elements are always [self.owner_uuid, current user's + # uuid]. + # + # If current user can write but not manage the object, return + # [self.owner_uuid, current user's uuid]. + # + # If current user cannot write this object, just return + # [self.owner_uuid]. def writable_by unless (owner_uuid == current_user.uuid or current_user.is_admin or - current_user.groups_i_can(:manage).index(owner_uuid)) - return nil + (current_user.groups_i_can(:manage) & [uuid, owner_uuid]).any?) + if ((current_user.groups_i_can(:write) + [current_user.uuid]) & + [uuid, owner_uuid]).any? + return [owner_uuid, current_user.uuid] + else + return [owner_uuid] + end end [owner_uuid, current_user.uuid] + permissions.collect do |p| if ['can_write', 'can_manage'].index p.name @@ -124,74 +140,71 @@ class ArvadosModel < ActiveRecord::Base end # Check if any of the users are admin. If so, we're done. - if users_list.select { |u| u.is_admin }.empty? + if users_list.select { |u| u.is_admin }.any? + return self + end + + # Collect the uuids for each user and any groups readable by each user. + user_uuids = users_list.map { |u| u.uuid } + uuid_list = user_uuids + users_list.flat_map { |u| u.groups_i_can(:read) } + sql_conds = [] + sql_params = [] + sql_table = kwargs.fetch(:table_name, table_name) + or_object_uuid = '' + + # This row is owned by a member of users_list, or owned by a group + # readable by a member of users_list + # or + # This row uuid is the uuid of a member of users_list + # or + # A permission link exists ('write' and 'manage' implicitly include + # 'read') from a member of users_list, or a group readable by users_list, + # to this row, or to the owner of this row (see join() below). + sql_conds += ["#{sql_table}.uuid in (?)"] + sql_params += [user_uuids] + + if uuid_list.any? + sql_conds += ["#{sql_table}.owner_uuid in (?)"] + sql_params += [uuid_list] - # Collect the uuids for each user and any groups readable by each user. - user_uuids = users_list.map { |u| u.uuid } - uuid_list = user_uuids + users_list.flat_map { |u| u.groups_i_can(:read) } sanitized_uuid_list = uuid_list. collect { |uuid| sanitize(uuid) }.join(', ') - sql_conds = [] - sql_params = [] - sql_table = kwargs.fetch(:table_name, table_name) - or_object_uuid = '' - - # This row is owned by a member of users_list, or owned by a group - # readable by a member of users_list - # or - # This row uuid is the uuid of a member of users_list - # or - # A permission link exists ('write' and 'manage' implicitly include - # 'read') from a member of users_list, or a group readable by users_list, - # to this row, or to the owner of this row (see join() below). permitted_uuids = "(SELECT head_uuid FROM links WHERE link_class='permission' AND tail_uuid IN (#{sanitized_uuid_list}))" + sql_conds += ["#{sql_table}.uuid IN #{permitted_uuids}"] + end - sql_conds += ["#{sql_table}.owner_uuid in (?)", - "#{sql_table}.uuid in (?)", - "#{sql_table}.uuid IN #{permitted_uuids}"] - sql_params += [uuid_list, user_uuids] - - if sql_table == "links" and users_list.any? - # This row is a 'permission' or 'resources' link class - # The uuid for a member of users_list is referenced in either the head - # or tail of the link - sql_conds += ["(#{sql_table}.link_class in (#{sanitize 'permission'}, #{sanitize 'resources'}) AND (#{sql_table}.head_uuid IN (?) OR #{sql_table}.tail_uuid IN (?)))"] - sql_params += [user_uuids, user_uuids] - end - - if sql_table == "logs" and users_list.any? - # Link head points to the object described by this row - sql_conds += ["#{sql_table}.object_uuid IN #{permitted_uuids}"] + if sql_table == "links" and users_list.any? + # This row is a 'permission' or 'resources' link class + # The uuid for a member of users_list is referenced in either the head + # or tail of the link + sql_conds += ["(#{sql_table}.link_class in (#{sanitize 'permission'}, #{sanitize 'resources'}) AND (#{sql_table}.head_uuid IN (?) OR #{sql_table}.tail_uuid IN (?)))"] + sql_params += [user_uuids, user_uuids] + end - # This object described by this row is owned by this user, or owned by a group readable by this user - sql_conds += ["#{sql_table}.object_owner_uuid in (?)"] - sql_params += [uuid_list] - end + if sql_table == "logs" and users_list.any? + # Link head points to the object described by this row + sql_conds += ["#{sql_table}.object_uuid IN #{permitted_uuids}"] - # Link head points to this row, or to the owner of this row (the thing to be read) - # - # Link tail originates from this user, or a group that is readable by this - # user (the identity with authorization to read) - # - # Link class is 'permission' ('write' and 'manage' implicitly include 'read') - where(sql_conds.join(' OR '), *sql_params) - else - # At least one user is admin, so don't bother to apply any restrictions. - self + # This object described by this row is owned by this user, or owned by a group readable by this user + sql_conds += ["#{sql_table}.object_owner_uuid in (?)"] + sql_params += [uuid_list] end + + # Link head points to this row, or to the owner of this row (the + # thing to be read) + # + # Link tail originates from this user, or a group that is readable + # by this user (the identity with authorization to read) + # + # Link class is 'permission' ('write' and 'manage' implicitly + # include 'read') + where(sql_conds.join(' OR '), *sql_params) end def logged_attributes attributes end - def has_permission? perm_type, target_uuid - Link.where(link_class: "permission", - name: perm_type, - tail_uuid: uuid, - head_uuid: target_uuid).any? - end - protected def ensure_ownership_path_leads_to_user @@ -240,7 +253,7 @@ class ArvadosModel < ActiveRecord::Base rsc_class = ArvadosModel::resource_class_for_uuid owner_uuid unless rsc_class == User or rsc_class == Group - errors.add :owner_uuid, "can only be set to User or Group" + errors.add :owner_uuid, "must be set to User or Group" raise PermissionDeniedError end @@ -419,6 +432,7 @@ class ArvadosModel < ActiveRecord::Base def self.uuid_prefixes unless @@prefixes_hash @@prefixes_hash = {} + Rails.application.eager_load! ActiveRecord::Base.descendants.reject(&:abstract_class?).each do |k| if k.respond_to?(:uuid_prefix) @@prefixes_hash[k.uuid_prefix] = k @@ -432,6 +446,10 @@ class ArvadosModel < ActiveRecord::Base "_____-#{uuid_prefix}-_______________" end + def self.uuid_regex + %r/[a-z0-9]{5}-#{uuid_prefix}-[a-z0-9]{15}/ + end + def ensure_valid_uuids specials = [system_user_uuid] @@ -481,7 +499,6 @@ class ArvadosModel < ActiveRecord::Base end resource_class = nil - Rails.application.eager_load! uuid.match HasUuid::UUID_REGEX do |re| return uuid_prefixes[re[1]] if uuid_prefixes[re[1]] end @@ -506,15 +523,14 @@ class ArvadosModel < ActiveRecord::Base end def log_start_state - @old_etag = etag - @old_attributes = logged_attributes + @old_attributes = Marshal.load(Marshal.dump(attributes)) + @old_logged_attributes = Marshal.load(Marshal.dump(logged_attributes)) end def log_change(event_type) log = Log.new(event_type: event_type).fill_object(self) yield log log.save! - connection.execute "NOTIFY logs, '#{log.id}'" log_start_state end @@ -527,14 +543,14 @@ class ArvadosModel < ActiveRecord::Base def log_update log_change('update') do |log| - log.fill_properties('old', @old_etag, @old_attributes) + log.fill_properties('old', etag(@old_attributes), @old_logged_attributes) log.update_to self end end def log_destroy log_change('destroy') do |log| - log.fill_properties('old', @old_etag, @old_attributes) + log.fill_properties('old', etag(@old_attributes), @old_logged_attributes) log.update_to nil end end