X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/9fd58497a867ae3846a5c4761eb724d1d1b91fc7..9fd9565ea0411b43943076add49d5bca2da8e379:/services/api/app/models/api_client_authorization.rb

diff --git a/services/api/app/models/api_client_authorization.rb b/services/api/app/models/api_client_authorization.rb
index 3b73f408c3..b9442d64e7 100644
--- a/services/api/app/models/api_client_authorization.rb
+++ b/services/api/app/models/api_client_authorization.rb
@@ -30,7 +30,7 @@ class ApiClientAuthorization < ArvadosModel
     self.user.andand.uuid
   end
   def owner_uuid_was
-    self.user_id_changed? ? User.find(self.user_id_was).andand.uuid : self.user.andand.uuid
+    self.user_id_changed? ? User.where(id: self.user_id_was).first.andand.uuid : self.user.andand.uuid
   end
   def owner_uuid_changed?
     self.user_id_changed?
@@ -62,12 +62,28 @@ class ApiClientAuthorization < ArvadosModel
   end
   def modified_at=(x) end
 
+  def scopes_allow?(req_s)
+    scopes.each do |scope|
+      return true if (scope == 'all') or (scope == req_s) or
+        ((scope.end_with? '/') and (req_s.start_with? scope))
+    end
+    false
+  end
+
+  def scopes_allow_request?(request)
+    scopes_allow? [request.request_method, request.path].join(' ')
+  end
+
   def logged_attributes
     attrs = attributes.dup
     attrs.delete('api_token')
     attrs
   end
 
+  def self.default_orders
+    ["#{table_name}.id desc"]
+  end
+
   protected
 
   def permission_to_create