X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/d9aa5decc6edce30285df049277de2cf2c138c26..549f4a1deddb41f6abbc493a660d9fb0976da91a:/services/api/app/models/arvados_model.rb diff --git a/services/api/app/models/arvados_model.rb b/services/api/app/models/arvados_model.rb index 006eb90e12..2df6686f28 100644 --- a/services/api/app/models/arvados_model.rb +++ b/services/api/app/models/arvados_model.rb @@ -1,4 +1,5 @@ -require 'assign_uuid' +require 'has_uuid' + class ArvadosModel < ActiveRecord::Base self.abstract_class = true @@ -14,12 +15,12 @@ class ArvadosModel < ActiveRecord::Base before_save :ensure_ownership_path_leads_to_user before_destroy :ensure_owner_uuid_is_permitted before_destroy :ensure_permission_to_destroy - before_create :update_modified_by_fields before_update :maybe_update_modified_by_fields after_create :log_create after_update :log_update after_destroy :log_destroy + after_find :convert_serialized_symbols_to_strings validate :ensure_serialized_attribute_type validate :normalize_collection_uuids validate :ensure_valid_uuids @@ -90,6 +91,13 @@ class ArvadosModel < ActiveRecord::Base # Get rid of troublesome nils users_list.compact! + # Load optional keyword arguments, if they exist. + if users_list.last.is_a? Hash + kwargs = users_list.pop + else + kwargs = {} + end + # Check if any of the users are admin. If so, we're done. if users_list.select { |u| u.is_admin }.empty? @@ -100,6 +108,7 @@ class ArvadosModel < ActiveRecord::Base collect { |uuid| sanitize(uuid) }.join(', ') sql_conds = [] sql_params = [] + sql_table = kwargs.fetch(:table_name, table_name) or_object_uuid = '' # This row is owned by a member of users_list, or owned by a group @@ -112,25 +121,25 @@ class ArvadosModel < ActiveRecord::Base # to this row, or to the owner of this row (see join() below). permitted_uuids = "(SELECT head_uuid FROM links WHERE link_class='permission' AND tail_uuid IN (#{sanitized_uuid_list}))" - sql_conds += ["#{table_name}.owner_uuid in (?)", - "#{table_name}.uuid in (?)", - "#{table_name}.uuid IN #{permitted_uuids}"] + sql_conds += ["#{sql_table}.owner_uuid in (?)", + "#{sql_table}.uuid in (?)", + "#{sql_table}.uuid IN #{permitted_uuids}"] sql_params += [uuid_list, user_uuids] - if self == Link and users_list.any? + if sql_table == "links" and users_list.any? # This row is a 'permission' or 'resources' link class # The uuid for a member of users_list is referenced in either the head # or tail of the link - sql_conds += ["(#{table_name}.link_class in (#{sanitize 'permission'}, #{sanitize 'resources'}) AND (#{table_name}.head_uuid IN (?) OR #{table_name}.tail_uuid IN (?)))"] + sql_conds += ["(#{sql_table}.link_class in (#{sanitize 'permission'}, #{sanitize 'resources'}) AND (#{sql_table}.head_uuid IN (?) OR #{sql_table}.tail_uuid IN (?)))"] sql_params += [user_uuids, user_uuids] end - if self == Log and users_list.any? + if sql_table == "logs" and users_list.any? # Link head points to the object described by this row - sql_conds += ["#{table_name}.object_uuid IN #{permitted_uuids}"] + sql_conds += ["#{sql_table}.object_uuid IN #{permitted_uuids}"] # This object described by this row is owned by this user, or owned by a group readable by this user - sql_conds += ["#{table_name}.object_owner_uuid in (?)"] + sql_conds += ["#{sql_table}.object_owner_uuid in (?)"] sql_params += [uuid_list] end @@ -187,9 +196,13 @@ class ArvadosModel < ActiveRecord::Base def ensure_owner_uuid_is_permitted raise PermissionDeniedError if !current_user - self.owner_uuid ||= current_user.uuid + if respond_to? :owner_uuid= + self.owner_uuid ||= current_user.uuid + end if self.owner_uuid_changed? - if current_user.uuid == self.owner_uuid or + if new_record? + return true + elsif current_user.uuid == self.owner_uuid or current_user.can? write: self.owner_uuid # current_user is, or has :write permission on, the new owner else @@ -259,6 +272,38 @@ class ArvadosModel < ActiveRecord::Base true end + def self.has_symbols? x + if x.is_a? Hash + x.each do |k,v| + return true if has_symbols?(k) or has_symbols?(v) + end + false + elsif x.is_a? Array + x.each do |k| + return true if has_symbols?(k) + end + false + else + (x.class == Symbol) + end + end + + def self.recursive_stringify x + if x.is_a? Hash + Hash[x.collect do |k,v| + [recursive_stringify(k), recursive_stringify(v)] + end] + elsif x.is_a? Array + x.collect do |k| + recursive_stringify k + end + elsif x.is_a? Symbol + x.to_s + else + x + end + end + def ensure_serialized_attribute_type # Specifying a type in the "serialize" declaration causes rails to # raise an exception if a different data type is retrieved from @@ -268,13 +313,31 @@ class ArvadosModel < ActiveRecord::Base # developer. self.class.serialized_attributes.each do |colname, attr| if attr.object_class - unless self.attributes[colname].is_a? attr.object_class - self.errors.add colname.to_sym, "must be a #{attr.object_class.to_s}" + if self.attributes[colname].class != attr.object_class + self.errors.add colname.to_sym, "must be a #{attr.object_class.to_s}, not a #{self.attributes[colname].class.to_s}" + elsif self.class.has_symbols? attributes[colname] + self.errors.add colname.to_sym, "must not contain symbols: #{attributes[colname].inspect}" end end end end + def convert_serialized_symbols_to_strings + # ensure_serialized_attribute_type should prevent symbols from + # getting into the database in the first place. If someone managed + # to get them into the database (perhaps using an older version) + # we'll convert symbols to strings when loading from the + # database. (Otherwise, loading and saving an object with existing + # symbols in a serialized field will crash.) + self.class.serialized_attributes.each do |colname, attr| + if self.class.has_symbols? attributes[colname] + attributes[colname] = self.class.recursive_stringify attributes[colname] + self.send(colname + '=', + self.class.recursive_stringify(attributes[colname])) + end + end + end + def foreign_key_attributes attributes.keys.select { |a| a.match /_uuid$/ } end