X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/de10e681e82e0cb987ffb95109a6c09a13f49944..2b5d9607892a48d32401ff59516e8d73234eee89:/services/api/app/models/user.rb diff --git a/services/api/app/models/user.rb b/services/api/app/models/user.rb index 4858a9b57c..497a693bb8 100644 --- a/services/api/app/models/user.rb +++ b/services/api/app/models/user.rb @@ -7,6 +7,7 @@ class User < ArvadosModel before_update :prevent_privilege_escalation before_update :prevent_inactive_admin before_create :check_auto_admin + after_create :add_system_group_permission_link after_create AdminNotifier has_many :authorized_keys, :foreign_key => :authorized_user_uuid, :primary_key => :uuid @@ -79,10 +80,10 @@ class User < ArvadosModel Group.where('owner_uuid in (?)', lookup_uuids).each do |group| newgroups << [group.owner_uuid, group.uuid, 'can_manage'] end - Link.where('tail_uuid in (?) and link_class = ? and head_kind = ?', + Link.where('tail_uuid in (?) and link_class = ? and head_kind in (?)', lookup_uuids, 'permission', - 'arvados#group').each do |link| + ['arvados#group', 'arvados#user']).each do |link| newgroups << [link.tail_uuid, link.head_uuid, link.name] end newgroups.each do |tail_uuid, head_uuid, perm_name| @@ -111,36 +112,21 @@ class User < ArvadosModel def self.setup(user, openid_prefix, repo_name=nil, vm_uuid=nil) login_perm_props = {identity_url_prefix: openid_prefix} - if user[:uuid] - found = User.find_by_uuid user[:uuid] - end - - if !found - if !user[:email] - raise "No email found in the input. Aborting user creation." - end - - if !user.save - raise "Save failed" - end - else - user = found - end # Check oid_login_perm - oid_login_perms = Link.where(tail_uuid: user[:email], - head_kind: 'arvados#user', - link_class: 'permission', - name: 'can_login') + oid_login_perms = Link.where(tail_uuid: user.email, + head_kind: 'arvados#user', + link_class: 'permission', + name: 'can_login') if !oid_login_perms.any? # create openid login permission oid_login_perm = Link.create(link_class: 'permission', name: 'can_login', tail_kind: 'email', - tail_uuid: user[:email], + tail_uuid: user.email, head_kind: 'arvados#user', - head_uuid: user[:uuid], + head_uuid: user.uuid, properties: login_perm_props ) logger.info { "openid login permission: " + oid_login_perm[:uuid] } @@ -148,31 +134,59 @@ class User < ArvadosModel oid_login_perm = oid_login_perms.first end - # create repo, vm, and group links - response = {user: user, oid_login_perm: oid_login_perm} - - user.setup_links(repo_name, vm_uuid, openid_prefix, response) - - return response - end + return [oid_login_perm] + user.setup_repo_vm_links(repo_name, vm_uuid) + end # create links - def setup_links(repo_name, vm_uuid, openid_prefix, response) + def setup_repo_vm_links(repo_name, vm_uuid) repo_perm = create_user_repo_link repo_name - if repo_perm - response[:repo_perm] = repo_perm + vm_login_perm = create_vm_login_permission_link vm_uuid, repo_name + group_perm = create_user_group_link + + return [repo_perm, vm_login_perm, group_perm, self].compact + end + + # delete user signatures, login, repo, and vm perms, and mark as inactive + def unsetup + # delete oid_login_perms for this user + oid_login_perms = Link.where(tail_uuid: self.email, + head_kind: 'arvados#user', + link_class: 'permission', + name: 'can_login') + oid_login_perms.each do |perm| + Link.delete perm end - vm_login_perm = create_vm_login_permission_link vm_uuid, repo_name - if vm_login_perm - response[:vm_login_perm] = vm_login_perm + # delete repo_perms for this user + repo_perms = Link.where(tail_uuid: self.uuid, + head_kind: 'arvados#repository', + link_class: 'permission', + name: 'can_write') + repo_perms.each do |perm| + Link.delete perm end - group_perm = create_user_group_links - if group_perm - response[:group_perm] = group_perm + # delete vm_login_perms for this user + vm_login_perms = Link.where(tail_uuid: self.uuid, + head_kind: 'arvados#virtualMachine', + link_class: 'permission', + name: 'can_login') + vm_login_perms.each do |perm| + Link.delete perm end - end + + # delete any signatures by this user + signed_uuids = Link.where(link_class: 'signature', + tail_kind: 'arvados#user', + tail_uuid: self.uuid) + signed_uuids.each do |sign| + Link.delete sign + end + + # mark the user as inactive + self.is_active = false + self.save! + end protected @@ -263,7 +277,7 @@ class User < ArvadosModel link_class: 'permission', name: 'can_write') if repo_perms.any? - logger.warn "User already has repository access " + + logger.warn "User already has repository access " + repo_perms.collect { |p| p[:uuid] }.inspect return repo_perms.first end @@ -286,9 +300,9 @@ class User < ArvadosModel # create login permission for the given vm_uuid, if it does not already exist def create_vm_login_permission_link(vm_uuid, repo_name) begin - + # vm uuid is optional - if vm_uuid + if vm_uuid vm = VirtualMachine.where(uuid: vm_uuid).first if not vm @@ -296,7 +310,7 @@ class User < ArvadosModel raise "No vm found for #{vm_uuid}" end else - return + return end logger.info { "vm uuid: " + vm[:uuid] } @@ -324,7 +338,7 @@ class User < ArvadosModel end # add the user to the 'All users' group - def create_user_group_links + def create_user_group_link # Look up the "All users" group (we expect uuid *-*-fffffffffffffff). group = Group.where(name: 'All users').select do |g| g[:uuid].match /-f+$/ @@ -350,7 +364,7 @@ class User < ArvadosModel link_class: 'permission', name: 'can_read') logger.info { "group permission: " + group_perm[:uuid] } - else + else group_perm = group_perms.first end @@ -358,4 +372,15 @@ class User < ArvadosModel end end + # Give the special "System group" permission to manage this user and + # all of this user's stuff. + # + def add_system_group_permission_link + Link.create(link_class: 'permission', + name: 'can_manage', + tail_kind: 'arvados#group', + tail_uuid: system_group_uuid, + head_kind: 'arvados#user', + head_uuid: self.uuid) + end end