X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/dc021c3b57dcdebe464c148d55f9990a74e8246b..3a6b1a17f1b073e381b053b52e3cb0bb9c81d249:/services/api/app/models/user.rb diff --git a/services/api/app/models/user.rb b/services/api/app/models/user.rb index 310c2ca698..52d36ac577 100644 --- a/services/api/app/models/user.rb +++ b/services/api/app/models/user.rb @@ -3,7 +3,6 @@ # SPDX-License-Identifier: AGPL-3.0 require 'can_be_an_owner' -require 'refresh_permission_view' class User < ArvadosModel include HasUuid @@ -22,31 +21,39 @@ class User < ArvadosModel uniqueness: true, allow_nil: true) validate :must_unsetup_to_deactivate + validate :identity_url_nil_if_empty before_update :prevent_privilege_escalation before_update :prevent_inactive_admin - before_update :verify_repositories_empty, :if => Proc.new { |user| - user.username.nil? and user.username_changed? + before_update :verify_repositories_empty, :if => Proc.new { + username.nil? and username_changed? } - before_update :setup_on_activate + after_update :setup_on_activate + before_create :check_auto_admin - before_create :set_initial_username, :if => Proc.new { |user| - user.username.nil? and user.email + before_create :set_initial_username, :if => Proc.new { + username.nil? and email } + after_create :after_ownership_change after_create :setup_on_activate after_create :add_system_group_permission_link - after_create :invalidate_permissions_cache - after_create :auto_setup_new_user, :if => Proc.new { |user| + after_create :auto_setup_new_user, :if => Proc.new { Rails.configuration.Users.AutoSetupNewUsers and - (user.uuid != system_user_uuid) and - (user.uuid != anonymous_user_uuid) + (uuid != system_user_uuid) and + (uuid != anonymous_user_uuid) and + (uuid[0..4] == Rails.configuration.ClusterID) } after_create :send_admin_notifications + + before_update :before_ownership_change + after_update :after_ownership_change after_update :send_profile_created_notification - after_update :sync_repository_names, :if => Proc.new { |user| - (user.uuid != system_user_uuid) and - user.username_changed? and - (not user.username_was.nil?) + after_update :sync_repository_names, :if => Proc.new { + (uuid != system_user_uuid) and + saved_change_to_username? and + (not username_before_last_save.nil?) } + before_destroy :clear_permissions + after_destroy :remove_self_from_permissions has_many :authorized_keys, :foreign_key => :authorized_user_uuid, :primary_key => :uuid has_many :repositories, foreign_key: :owner_uuid, primary_key: :uuid @@ -65,6 +72,8 @@ class User < ArvadosModel t.add :is_invited t.add :prefs t.add :writable_by + t.add :can_write + t.add :can_manage end ALL_PERMISSIONS = {read: true, write: true, manage: true} @@ -77,6 +86,13 @@ class User < ArvadosModel {read: true, write: true}, {read: true, write: true, manage: true}] + VAL_FOR_PERM = + {:read => 1, + :write => 2, + :unfreeze => 3, + :manage => 3} + + def full_name "#{first_name} #{last_name}".strip end @@ -88,7 +104,7 @@ class User < ArvadosModel end def groups_i_can(verb) - my_groups = self.group_permissions.select { |uuid, mask| mask[verb] }.keys + my_groups = self.group_permissions(VAL_FOR_PERM[verb]).keys if verb == :read my_groups << anonymous_group_uuid end @@ -96,7 +112,6 @@ class User < ArvadosModel end def can?(actions) - return true if is_admin actions.each do |action, target| unless target.nil? if target.respond_to? :uuid @@ -107,60 +122,97 @@ class User < ArvadosModel end end next if target_uuid == self.uuid - next if (group_permissions[target_uuid] and - group_permissions[target_uuid][action]) - if target.respond_to? :owner_uuid - next if target.owner_uuid == self.uuid - next if (group_permissions[target.owner_uuid] and - group_permissions[target.owner_uuid][action]) + + if action == :write && target && !target.new_record? && + target.respond_to?(:frozen_by_uuid) && + target.frozen_by_uuid_was + # Just an optimization to skip the PERMISSION_VIEW and + # FrozenGroup queries below + return false end - sufficient_perms = case action - when :manage - ['can_manage'] - when :write - ['can_manage', 'can_write'] - when :read - ['can_manage', 'can_write', 'can_read'] - else - # (Skip this kind of permission opportunity - # if action is an unknown permission type) - end - if sufficient_perms - # Check permission links with head_uuid pointing directly at - # the target object. If target is a Group, this is redundant - # and will fail except [a] if permission caching is broken or - # [b] during a race condition, where a permission link has - # *just* been added. - if Link.where(link_class: 'permission', - name: sufficient_perms, - tail_uuid: groups_i_can(action) + [self.uuid], - head_uuid: target_uuid).any? - next + + target_owner_uuid = target.owner_uuid if target.respond_to? :owner_uuid + + user_uuids_subquery = USER_UUIDS_SUBQUERY_TEMPLATE % {user: "$1", perm_level: "$3"} + + if !is_admin && !ActiveRecord::Base.connection. + exec_query(%{ +SELECT 1 FROM #{PERMISSION_VIEW} + WHERE user_uuid in (#{user_uuids_subquery}) and + ((target_uuid = $2 and perm_level >= $3) + or (target_uuid = $4 and perm_level >= $3 and traverse_owned)) +}, + # "name" arg is a query label that appears in logs: + "user_can_query", + [[nil, self.uuid], + [nil, target_uuid], + [nil, VAL_FOR_PERM[action]], + [nil, target_owner_uuid]] + ).any? + return false + end + + if action == :write + if FrozenGroup.where(uuid: [target_uuid, target_owner_uuid]).any? + # self or parent is frozen + return false + end + elsif action == :unfreeze + # "unfreeze" permission means "can write, but only if + # explicitly un-freezing at the same time" (see + # ArvadosModel#ensure_owner_uuid_is_permitted). If the + # permission query above passed the permission level of + # :unfreeze (which is the same as :manage), and the parent + # isn't also frozen, then un-freeze is allowed. + if FrozenGroup.where(uuid: target_owner_uuid).any? + return false end end - return false end true end - def self.invalidate_permissions_cache(async=false) - refresh_permission_view(async) + def before_ownership_change + if owner_uuid_changed? and !self.owner_uuid_was.nil? + MaterializedPermission.where(user_uuid: owner_uuid_was, target_uuid: uuid).delete_all + update_permissions self.owner_uuid_was, self.uuid, REVOKE_PERM + end + end + + def after_ownership_change + if saved_change_to_owner_uuid? + update_permissions self.owner_uuid, self.uuid, CAN_MANAGE_PERM + end + end + + def clear_permissions + MaterializedPermission.where("user_uuid = ? and target_uuid != ?", uuid, uuid).delete_all + end + + def forget_cached_group_perms + @group_perms = nil end - def invalidate_permissions_cache - User.invalidate_permissions_cache + def remove_self_from_permissions + MaterializedPermission.where("target_uuid = ?", uuid).delete_all + check_permissions_against_full_refresh end # Return a hash of {user_uuid: group_perms} + # + # note: this does not account for permissions that a user gains by + # having can_manage on another user. def self.all_group_permissions all_perms = {} ActiveRecord::Base.connection. - exec_query("SELECT user_uuid, target_owner_uuid, perm_level, trashed + exec_query(%{ +SELECT user_uuid, target_uuid, perm_level FROM #{PERMISSION_VIEW} - WHERE target_owner_uuid IS NOT NULL", + WHERE traverse_owned +}, # "name" arg is a query label that appears in logs: - "all_group_permissions", - ).rows.each do |user_uuid, group_uuid, max_p_val, trashed| + "all_group_permissions"). + rows.each do |user_uuid, group_uuid, max_p_val| all_perms[user_uuid] ||= {} all_perms[user_uuid][group_uuid] = PERMS_FOR_VAL[max_p_val.to_i] end @@ -170,30 +222,81 @@ class User < ArvadosModel # Return a hash of {group_uuid: perm_hash} where perm_hash[:read] # and perm_hash[:write] are true if this user can read and write # objects owned by group_uuid. - def group_permissions - group_perms = {self.uuid => {:read => true, :write => true, :manage => true}} - ActiveRecord::Base.connection. - exec_query("SELECT target_owner_uuid, perm_level, trashed - FROM #{PERMISSION_VIEW} - WHERE user_uuid = $1 - AND target_owner_uuid IS NOT NULL", - # "name" arg is a query label that appears in logs: - "group_permissions for #{uuid}", - # "binds" arg is an array of [col_id, value] for '$1' vars: - [[nil, uuid]], - ).rows.each do |group_uuid, max_p_val, trashed| - group_perms[group_uuid] = PERMS_FOR_VAL[max_p_val.to_i] + def group_permissions(level=1) + @group_perms ||= {} + if @group_perms.empty? + user_uuids_subquery = USER_UUIDS_SUBQUERY_TEMPLATE % {user: "$1", perm_level: 1} + + ActiveRecord::Base.connection. + exec_query(%{ +SELECT target_uuid, perm_level + FROM #{PERMISSION_VIEW} + WHERE user_uuid in (#{user_uuids_subquery}) and perm_level >= 1 +}, + # "name" arg is a query label that appears in logs: + "User.group_permissions", + # "binds" arg is an array of [col_id, value] for '$1' vars: + [[nil, uuid]]). + rows.each do |group_uuid, max_p_val| + @group_perms[group_uuid] = PERMS_FOR_VAL[max_p_val.to_i] + end + end + + case level + when 1 + @group_perms + when 2 + @group_perms.select {|k,v| v[:write] } + when 3 + @group_perms.select {|k,v| v[:manage] } + else + raise "level must be 1, 2 or 3" end - group_perms end # create links - def setup(repo_name: nil, vm_uuid: nil) - repo_perm = create_user_repo_link repo_name - vm_login_perm = create_vm_login_permission_link(vm_uuid, username) if vm_uuid - group_perm = create_user_group_link + def setup(repo_name: nil, vm_uuid: nil, send_notification_email: nil) + newly_invited = Link.where(tail_uuid: self.uuid, + head_uuid: all_users_group_uuid, + link_class: 'permission', + name: 'can_read').empty? + + # Add can_read link from this user to "all users" which makes this + # user "invited", and (depending on config) a link in the opposite + # direction which makes this user visible to other users. + group_perms = add_to_all_users_group + + # Add git repo + repo_perm = if (!repo_name.nil? || Rails.configuration.Users.AutoSetupNewUsersWithRepository) and !username.nil? + repo_name ||= "#{username}/#{username}" + create_user_repo_link repo_name + end + + # Add virtual machine + if vm_uuid.nil? and !Rails.configuration.Users.AutoSetupNewUsersWithVmUUID.empty? + vm_uuid = Rails.configuration.Users.AutoSetupNewUsersWithVmUUID + end + + vm_login_perm = if vm_uuid && username + create_vm_login_permission_link(vm_uuid, username) + end + + # Send welcome email + if send_notification_email.nil? + send_notification_email = Rails.configuration.Mail.SendUserSetupNotificationEmail + end + + if newly_invited and send_notification_email and !Rails.configuration.Users.UserSetupMailText.empty? + begin + UserNotifier.account_is_setup(self).deliver_now + rescue => e + logger.warn "Failed to send email to #{self.email}: #{e}" + end + end - return [repo_perm, vm_login_perm, group_perm, self].compact + forget_cached_group_perms + + return [repo_perm, vm_login_perm, *group_perms, self].compact end # delete user signatures, login, repo, and vm perms, and mark as inactive @@ -217,11 +320,8 @@ class User < ArvadosModel name: 'can_login').destroy_all # delete "All users" group read permissions for this user - group = Group.where(name: 'All users').select do |g| - g[:uuid].match(/-f+$/) - end.first Link.where(tail_uuid: self.uuid, - head_uuid: group[:uuid], + head_uuid: all_users_group_uuid, link_class: 'permission', name: 'can_read').destroy_all @@ -229,23 +329,33 @@ class User < ArvadosModel Link.where(link_class: 'signature', tail_uuid: self.uuid).destroy_all + # delete tokens for this user + ApiClientAuthorization.where(user_id: self.id).destroy_all + # delete ssh keys for this user + AuthorizedKey.where(owner_uuid: self.uuid).destroy_all + AuthorizedKey.where(authorized_user_uuid: self.uuid).destroy_all + # delete user preferences (including profile) self.prefs = {} # mark the user as inactive + self.is_admin = false # can't be admin and inactive self.is_active = false + forget_cached_group_perms self.save! end def must_unsetup_to_deactivate - if self.is_active_changed? && - self.is_active_was == true && + if !self.new_record? && + self.uuid[0..4] == Rails.configuration.Login.LoginCluster && + self.uuid[0..4] != Rails.configuration.ClusterID + # OK to update our local record to whatever the LoginCluster + # reports, because self-activate is not allowed. + return + elsif self.is_active_changed? && + self.is_active_was && !self.is_active - group = Group.where(name: 'All users').select do |g| - g[:uuid].match(/-f+$/) - end.first - # When a user is set up, they are added to the "All users" # group. A user that is part of the "All users" group is # allowed to self-activate. @@ -260,7 +370,7 @@ class User < ArvadosModel # explaining the correct way to deactivate a user. # if Link.where(tail_uuid: self.uuid, - head_uuid: group[:uuid], + head_uuid: all_users_group_uuid, link_class: 'permission', name: 'can_read').any? errors.add :is_active, "cannot be set to false directly, use the 'Deactivate' button on Workbench, or the 'unsetup' API call" @@ -287,25 +397,6 @@ class User < ArvadosModel end end - def update_uuid(new_uuid:) - if !current_user.andand.is_admin - raise PermissionDeniedError - end - if uuid == system_user_uuid || uuid == anonymous_user_uuid - raise "update_uuid cannot update system accounts" - end - if self.class != self.class.resource_class_for_uuid(new_uuid) - raise "invalid new_uuid #{new_uuid.inspect}" - end - transaction(requires_new: true) do - reload - old_uuid = self.uuid - self.uuid = new_uuid - save!(validate: false) - change_all_uuid_refs(old_uuid: old_uuid, new_uuid: new_uuid) - end - end - # Move this user's (i.e., self's) owned items to new_owner_uuid and # new_user_uuid (for things normally owned directly by the user). # @@ -328,6 +419,9 @@ class User < ArvadosModel raise "user does not exist" if !new_user raise "cannot merge to an already merged user" if new_user.redirect_to_user_uuid + self.clear_permissions + new_user.clear_permissions + # If 'self' is a remote user, don't transfer authorizations # (i.e. ability to access the account) to the new user, because # that gives the remote site the ability to access the 'new' @@ -402,7 +496,12 @@ class User < ArvadosModel if redirect_to_new_user update_attributes!(redirect_to_user_uuid: new_user.uuid, username: nil) end - invalidate_permissions_cache + skip_check_permissions_against_full_refresh do + update_permissions self.uuid, self.uuid, CAN_MANAGE_PERM + update_permissions new_user.uuid, new_user.uuid, CAN_MANAGE_PERM + update_permissions new_user.owner_uuid, new_user.uuid, CAN_MANAGE_PERM + end + update_permissions self.owner_uuid, self.uuid, CAN_MANAGE_PERM end end @@ -410,10 +509,12 @@ class User < ArvadosModel user = self redirects = 0 while (uuid = user.redirect_to_user_uuid) - user = User.unscoped.find_by_uuid(uuid) - if !user - raise Exception.new("user uuid #{user.uuid} redirects to nonexistent uuid #{uuid}") + break if uuid.empty? + nextuser = User.unscoped.find_by_uuid(uuid) + if !nextuser + raise Exception.new("user uuid #{user.uuid} redirects to nonexistent uuid '#{uuid}'") end + user = nextuser redirects += 1 if redirects > 15 raise "Starting from #{self.uuid} redirect_to_user_uuid exceeded maximum number of redirects" @@ -490,6 +591,13 @@ class User < ArvadosModel protected + def self.attributes_required_columns + super.merge( + 'can_write' => ['owner_uuid', 'uuid'], + 'can_manage' => ['owner_uuid', 'uuid'], + ) + end + def change_all_uuid_refs(old_uuid:, new_uuid:) ActiveRecord::Base.descendants.reject(&:abstract_class?).each do |klass| klass.columns.each do |col| @@ -656,16 +764,26 @@ class User < ArvadosModel login_perm end - # add the user to the 'All users' group - def create_user_group_link - return (Link.where(tail_uuid: self.uuid, - head_uuid: all_users_group[:uuid], + def add_to_all_users_group + resp = [Link.where(tail_uuid: self.uuid, + head_uuid: all_users_group_uuid, link_class: 'permission', - name: 'can_read').first or + name: 'can_read').first || Link.create(tail_uuid: self.uuid, - head_uuid: all_users_group[:uuid], + head_uuid: all_users_group_uuid, link_class: 'permission', - name: 'can_read')) + name: 'can_read')] + if Rails.configuration.Users.ActivatedUsersAreVisibleToOthers + resp += [Link.where(tail_uuid: all_users_group_uuid, + head_uuid: self.uuid, + link_class: 'permission', + name: 'can_read').first || + Link.create(tail_uuid: all_users_group_uuid, + head_uuid: self.uuid, + link_class: 'permission', + name: 'can_read')] + end + return resp end # Give the special "System group" permission to manage this user and @@ -691,7 +809,8 @@ class User < ArvadosModel # Automatically setup if is_active flag turns on def setup_on_activate return if [system_user_uuid, anonymous_user_uuid].include?(self.uuid) - if is_active && (new_record? || is_active_changed?) + if is_active && + (new_record? || saved_change_to_is_active? || will_save_change_to_is_active?) setup end end @@ -699,23 +818,12 @@ class User < ArvadosModel # Automatically setup new user during creation def auto_setup_new_user setup - if username - create_vm_login_permission_link(Rails.configuration.Users.AutoSetupNewUsersWithVmUUID, - username) - repo_name = "#{username}/#{username}" - if Rails.configuration.Users.AutoSetupNewUsersWithRepository and - Repository.where(name: repo_name).first.nil? - repo = Repository.create!(name: repo_name, owner_uuid: uuid) - Link.create!(tail_uuid: uuid, head_uuid: repo.uuid, - link_class: "permission", name: "can_manage") - end - end end # Send notification if the user saved profile for the first time def send_profile_created_notification - if self.prefs_changed? - if self.prefs_was.andand.empty? || !self.prefs_was.andand['profile'] + if saved_change_to_prefs? + if prefs_before_last_save.andand.empty? || !prefs_before_last_save.andand['profile'] profile_notification_address = Rails.configuration.Users.UserProfileNotificationAddress ProfileNotifier.profile_created(self, profile_notification_address).deliver_now if profile_notification_address and !profile_notification_address.empty? end @@ -730,11 +838,17 @@ class User < ArvadosModel end def sync_repository_names - old_name_re = /^#{Regexp.escape(username_was)}\// + old_name_re = /^#{Regexp.escape(username_before_last_save)}\// name_sub = "#{username}/" repositories.find_each do |repo| repo.name = repo.name.sub(old_name_re, name_sub) repo.save! end end + + def identity_url_nil_if_empty + if identity_url == "" + self.identity_url = nil + end + end end