X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/b19eea5a71ff3fa6259df25bc0726bd1e152d89b..07dbd859d0b05d79680570c00c43a722102d7ea3:/services/api/app/models/user.rb diff --git a/services/api/app/models/user.rb b/services/api/app/models/user.rb index 5f94db0bb2..dd447ca51a 100644 --- a/services/api/app/models/user.rb +++ b/services/api/app/models/user.rb @@ -10,6 +10,7 @@ class User < ArvadosModel include KindAndEtag include CommonApiTemplate include CanBeAnOwner + extend CurrentApiClient serialize :prefs, Hash has_many :api_client_authorizations @@ -20,6 +21,7 @@ class User < ArvadosModel }, uniqueness: true, allow_nil: true) + validate :must_unsetup_to_deactivate before_update :prevent_privilege_escalation before_update :prevent_inactive_admin before_update :verify_repositories_empty, :if => Proc.new { |user| @@ -186,18 +188,20 @@ class User < ArvadosModel end # create links - def setup(openid_prefix:, repo_name: nil, vm_uuid: nil) - oid_login_perm = create_oid_login_perm openid_prefix + def setup(repo_name: nil, vm_uuid: nil) repo_perm = create_user_repo_link repo_name vm_login_perm = create_vm_login_permission_link(vm_uuid, username) if vm_uuid group_perm = create_user_group_link - return [oid_login_perm, repo_perm, vm_login_perm, group_perm, self].compact + return [repo_perm, vm_login_perm, group_perm, self].compact end # delete user signatures, login, repo, and vm perms, and mark as inactive def unsetup # delete oid_login_perms for this user + # + # note: these permission links are obsolete, they have no effect + # on anything and they are not created for new users. Link.where(tail_uuid: self.email, link_class: 'permission', name: 'can_login').destroy_all @@ -233,6 +237,37 @@ class User < ArvadosModel self.save! end + def must_unsetup_to_deactivate + if self.is_active_changed? && + self.is_active_was == true && + !self.is_active + + group = Group.where(name: 'All users').select do |g| + g[:uuid].match(/-f+$/) + end.first + + # When a user is set up, they are added to the "All users" + # group. A user that is part of the "All users" group is + # allowed to self-activate. + # + # It doesn't make sense to deactivate a user (set is_active = + # false) without first removing them from the "All users" group, + # because they would be able to immediately reactivate + # themselves. + # + # The 'unsetup' method removes the user from the "All users" + # group (and also sets is_active = false) so send a message + # explaining the correct way to deactivate a user. + # + if Link.where(tail_uuid: self.uuid, + head_uuid: group[:uuid], + link_class: 'permission', + name: 'can_read').any? + errors.add :is_active, "cannot be set to false directly, use the 'Deactivate' button on Workbench, or the 'unsetup' API call" + end + end + end + def set_initial_username(requested: false) if !requested.is_a?(String) || requested.empty? email_parts = email.partition("@") @@ -271,45 +306,87 @@ class User < ArvadosModel end end - # Move this user's (i.e., self's) owned items into new_owner_uuid. - # Also redirect future uses of this account to - # redirect_to_user_uuid, i.e., when a caller authenticates to this - # account in the future, the account redirect_to_user_uuid account - # will be used instead. + # Move this user's (i.e., self's) owned items to new_owner_uuid and + # new_user_uuid (for things normally owned directly by the user). + # + # If redirect_auth is true, also reassign auth tokens and ssh keys, + # and redirect this account to redirect_to_user_uuid, i.e., when a + # caller authenticates to this account in the future, the account + # redirect_to_user_uuid account will be used instead. # # current_user must have admin privileges, i.e., the caller is # responsible for checking permission to do this. - def merge(new_owner_uuid:, redirect_to_user_uuid:) + def merge(new_owner_uuid:, new_user_uuid:, redirect_to_new_user:) raise PermissionDeniedError if !current_user.andand.is_admin - raise "not implemented" if !redirect_to_user_uuid + raise "Missing new_owner_uuid" if !new_owner_uuid + raise "Missing new_user_uuid" if !new_user_uuid transaction(requires_new: true) do reload raise "cannot merge an already merged user" if self.redirect_to_user_uuid - new_user = User.where(uuid: redirect_to_user_uuid).first + new_user = User.where(uuid: new_user_uuid).first raise "user does not exist" if !new_user raise "cannot merge to an already merged user" if new_user.redirect_to_user_uuid - # Existing API tokens are updated to authenticate to the new - # user. - ApiClientAuthorization. - where(user_id: id). - update_all(user_id: new_user.id) + # If 'self' is a remote user, don't transfer authorizations + # (i.e. ability to access the account) to the new user, because + # that gives the remote site the ability to access the 'new' + # user account that takes over the 'self' account. + # + # If 'self' is a local user, it is okay to transfer + # authorizations, even if the 'new' user is a remote account, + # because the remote site does not gain the ability to access an + # account it could not before. + + if redirect_to_new_user and self.uuid[0..4] == Rails.configuration.ClusterID + # Existing API tokens and ssh keys are updated to authenticate + # to the new user. + ApiClientAuthorization. + where(user_id: id). + update_all(user_id: new_user.id) + + user_updates = [ + [AuthorizedKey, :owner_uuid], + [AuthorizedKey, :authorized_user_uuid], + [Link, :owner_uuid], + [Link, :tail_uuid], + [Link, :head_uuid], + ] + else + # Destroy API tokens and ssh keys associated with the old + # user. + ApiClientAuthorization.where(user_id: id).destroy_all + AuthorizedKey.where(owner_uuid: uuid).destroy_all + AuthorizedKey.where(authorized_user_uuid: uuid).destroy_all + user_updates = [ + [Link, :owner_uuid], + [Link, :tail_uuid] + ] + end # References to the old user UUID in the context of a user ID # (rather than a "home project" in the project hierarchy) are # updated to point to the new user. - [ - [AuthorizedKey, :owner_uuid], - [AuthorizedKey, :authorized_user_uuid], - [Repository, :owner_uuid], - [Link, :owner_uuid], - [Link, :tail_uuid], - [Link, :head_uuid], - ].each do |klass, column| + user_updates.each do |klass, column| klass.where(column => uuid).update_all(column => new_user.uuid) end + # Need to update repository names to new username + if username + old_repo_name_re = /^#{Regexp.escape(username)}\// + Repository.where(:owner_uuid => uuid).each do |repo| + repo.owner_uuid = new_user.uuid + repo_name_sub = "#{new_user.username}/" + name = repo.name.sub(old_repo_name_re, repo_name_sub) + while (conflict = Repository.where(:name => name).first) != nil + repo_name_sub += "migrated" + name = repo.name.sub(old_repo_name_re, repo_name_sub) + end + repo.name = name + repo.save! + end + end + # References to the merged user's "home project" are updated to # point to new_owner_uuid. ActiveRecord::Base.descendants.reject(&:abstract_class?).each do |klass| @@ -322,13 +399,35 @@ class User < ArvadosModel klass.where(owner_uuid: uuid).update_all(owner_uuid: new_owner_uuid) end - update_attributes!(redirect_to_user_uuid: new_user.uuid) + if redirect_to_new_user + update_attributes!(redirect_to_user_uuid: new_user.uuid, username: nil) + end invalidate_permissions_cache end end + def redirects_to + user = self + redirects = 0 + while (uuid = user.redirect_to_user_uuid) + break if uuid.empty? + nextuser = User.unscoped.find_by_uuid(uuid) + if !nextuser + raise Exception.new("user uuid #{user.uuid} redirects to nonexistent uuid '#{uuid}'") + end + user = nextuser + redirects += 1 + if redirects > 15 + raise "Starting from #{self.uuid} redirect_to_user_uuid exceeded maximum number of redirects" + end + end + user + end + def self.register info - # login info should have fields: + # login info expected fields, all can be optional but at minimum + # must supply either 'identity_url' or 'email' + # # email # first_name # last_name @@ -345,61 +444,24 @@ class User < ArvadosModel # Only local users can create sessions, hence uuid_like_pattern # here. user = User.unscoped.where('identity_url = ? and uuid like ?', - info['identity_url'], + identity_url, User.uuid_like_pattern).first - if user - while (uuid = user.redirect_to_user_uuid) - user = User.unscoped.find_by_uuid(uuid) - if !user - raise Exception.new("user uuid #{user.uuid} redirects to nonexistent uuid #{uuid}") - end - end - primary_user = user - end - - # Don't think this is necessary if admin can just create a user - # record with the desired email. - # - # if not user - # # Check for permission to log in to an existing User record with - # # a different identity_url - # Link.where("link_class = ? and name = ? and tail_uuid = ? and head_uuid like ?", - # 'permission', - # 'can_login', - # info['email'], - # User.uuid_like_pattern).each do |link| - # if prefix = link.properties['identity_url_prefix'] - # if prefix == info['identity_url'][0..prefix.size-1] - # user = User.find_by_uuid(link.head_uuid) - # break if user - # end - # end - # end - # end + primary_user = user.redirects_to if user end if !primary_user - # identity url is unset or didn't find anything. + # identity url is unset or didn't find matching record. emails = [info['email']] + (info['alternate_emails'] || []) emails.select! {|em| !em.nil? && !em.empty?} - emails.each do |em| - # Go through each email address, try to find a user record - # corresponding to one of the addresses supplied. - - user = User.unscoped.where('email = ? and uuid like ?', - em, - User.uuid_like_pattern).first - next if !user - - while (uuid = user.redirect_to_user_uuid) - user = User.unscoped.find_by_uuid(uuid) - if !user - raise Exception.new("user uuid #{user.uuid} redirects to nonexistent uuid #{uuid}") - end - end - primary_user = user - break + User.unscoped.where('email in (?) and uuid like ?', + emails, + User.uuid_like_pattern).each do |user| + if !primary_user + primary_user = user.redirects_to + elsif primary_user.uuid != user.redirects_to.uuid + raise "Ambiguous email address, directs to both #{primary_user.uuid} and #{user.redirects_to.uuid}" + end end end @@ -409,13 +471,17 @@ class User < ArvadosModel :is_admin => false, :is_active => Rails.configuration.Users.NewUsersAreActive) - primary_user.set_initial_username(requested: info['username']) if info['username'] + primary_user.set_initial_username(requested: info['username']) if info['username'] && !info['username'].blank? + primary_user.identity_url = info['identity_url'] if identity_url end - primary_user.email = info['email'] - primary_user.identity_url = info['identity_url'] - primary_user.first_name = info['first_name'] - primary_user.last_name = info['last_name'] + primary_user.email = info['email'] if info['email'] + primary_user.first_name = info['first_name'] if info['first_name'] + primary_user.last_name = info['last_name'] if info['last_name'] + + if (!primary_user.email or primary_user.email.empty?) and (!primary_user.identity_url or primary_user.identity_url.empty?) + raise "Must have supply at least one of 'email' or 'identity_url' to User.register" + end act_as_system_user do primary_user.save! @@ -442,7 +508,7 @@ class User < ArvadosModel end def permission_to_update - if username_changed? || redirect_to_user_uuid_changed? + if username_changed? || redirect_to_user_uuid_changed? || email_changed? current_user.andand.is_admin else # users must be able to update themselves (even if they are @@ -547,30 +613,6 @@ class User < ArvadosModel merged end - def create_oid_login_perm(openid_prefix) - # Check oid_login_perm - oid_login_perms = Link.where(tail_uuid: self.email, - head_uuid: self.uuid, - link_class: 'permission', - name: 'can_login') - - if !oid_login_perms.any? - # create openid login permission - oid_login_perm = Link.create!(link_class: 'permission', - name: 'can_login', - tail_uuid: self.email, - head_uuid: self.uuid, - properties: { - "identity_url_prefix" => openid_prefix, - }) - logger.info { "openid login permission: " + oid_login_perm[:uuid] } - else - oid_login_perm = oid_login_perms.first - end - - return oid_login_perm - end - def create_user_repo_link(repo_name) # repo_name is optional if not repo_name @@ -652,13 +694,13 @@ class User < ArvadosModel def setup_on_activate return if [system_user_uuid, anonymous_user_uuid].include?(self.uuid) if is_active && (new_record? || is_active_changed?) - setup(openid_prefix: Rails.configuration.default_openid_prefix) + setup end end # Automatically setup new user during creation def auto_setup_new_user - setup(openid_prefix: Rails.configuration.default_openid_prefix) + setup if username create_vm_login_permission_link(Rails.configuration.Users.AutoSetupNewUsersWithVmUUID, username)