20300: Merge branch 'main' into 20300-rails7

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>

diff --cc .licenseignore
index 7d595a3349432ca18750f75db730cb3f1ced7d54,efa6b1972ecb32588fac1e2fbc6a47eaa72791ef..eb959c8f95cda561610905cf9ce8c2c568eec79e
--- 1/.licenseignore
--- 2/.licenseignore
+++ b/.licenseignore
@@@ -98,23 -98,20 +98,40 @@@ SECURITY.m
  lib/crunchstat/testdata/*
  lib/controller/localdb/testdata/*.pub
  sdk/ruby-google-api-client/*
 +services/api/bin/rails
 +services/api/bin/rake
 +services/api/bin/setup
 +services/api/bin/yarn
 +services/api/storage.yml
 +services/api/test.rb.example
 +services/api/config/boot.rb
 +services/api/config/environment.rb
 +services/api/config/initializers/application_controller_renderer.rb
 +services/api/config/initializers/assets.rb
 +services/api/config/initializers/backtrace_silencers.rb
 +services/api/config/initializers/content_security_policy.rb
 +services/api/config/initializers/cookies_serializer.rb
 +services/api/config/initializers/filter_parameter_logging.rb
 +services/api/config/initializers/mime_types.rb
 +services/api/config/initializers/new_framework_defaults_*.rb
 +services/api/config/initializers/permissions_policy.rb
 +services/api/config/initializers/wrap_parameters.rb
 +services/api/config/locales/en.yml
 +services/api/config.ru
+ services/workbench2/*.d.ts
+ services/workbench2/*.css
+ services/workbench2/*.scss
+ services/workbench2/README.md
+ services/workbench2/public/*
+ services/workbench2/.yarnrc
+ services/workbench2/.npmrc
+ services/workbench2/src/lib/cwl-svg/*
+ services/workbench2/tools/arvados_config.yml
+ services/workbench2/cypress/fixtures/files/5mb.bin
+ services/workbench2/cypress/fixtures/files/cat.png
+ services/workbench2/cypress/fixtures/files/banner.html
+ services/workbench2/cypress/fixtures/files/tooltips.txt
+ services/workbench2/cypress/fixtures/webdav-propfind-outputs.xml
+ services/workbench2/.yarn/releases/*
+ services/workbench2/package.json
+ services/workbench2/yarn.lock

diff --cc services/api/app/models/group.rb
index b6970459b6514db02b2c251561ed61d84ca83aae,0c9248b819e81091867b126d20f5c2797e0d8e64..d4c81fe9d1d9cf2c558d644bf45bf2f495dc9ef6
--- 1/services/api/app/models/group.rb
--- 2/services/api/app/models/group.rb
+++ b/services/api/app/models/group.rb
@@@ -163,63 -163,70 +163,70 @@@ class Group < ArvadosMode
      #   Remove groups that don't belong from trash
      #   Add/update groups that do belong in the trash
  
-     temptable = "group_subtree_#{rand(2**64).to_s(10)}"
-     ActiveRecord::Base.connection.exec_query(
-       "create temporary table #{temptable} on commit drop " +
-       "as select * from project_subtree_with_trash_at($1, LEAST($2, $3)::timestamp)",
+     frozen_descendants = ActiveRecord::Base.connection.exec_query(%{
+ with temptable as (select * from project_subtree_with_trash_at($1, LEAST($2, $3)::timestamp))
+       select uuid from frozen_groups, temptable where uuid = target_uuid
+ },
        "Group.update_trash.select",
 -      [[nil, self.uuid],
 -       [nil, TrashedGroup.find_by_group_uuid(self.owner_uuid).andand.trash_at],
 -       [nil, self.trash_at]])
 +      [self.uuid,
 +       TrashedGroup.find_by_group_uuid(self.owner_uuid).andand.trash_at,
 +       self.trash_at])
-     frozen_descendants = ActiveRecord::Base.connection.exec_query(
-       "select uuid from frozen_groups, #{temptable} where uuid = target_uuid",
-       "Group.update_trash.check_frozen")
      if frozen_descendants.any?
        raise ArgumentError.new("cannot trash project containing frozen project #{frozen_descendants[0]["uuid"]}")
      end
-     ActiveRecord::Base.connection.exec_delete(
-       "delete from trashed_groups where group_uuid in (select target_uuid from #{temptable} where trash_at is NULL)",
-       "Group.update_trash.delete")
-     ActiveRecord::Base.connection.exec_query(
-       "insert into trashed_groups (group_uuid, trash_at) "+
-       "select target_uuid as group_uuid, trash_at from #{temptable} where trash_at is not NULL " +
-       "on conflict (group_uuid) do update set trash_at=EXCLUDED.trash_at",
-       "Group.update_trash.insert")
-     ActiveRecord::Base.connection.exec_query(
-       "select container_uuid from container_requests where " +
-       "owner_uuid in (select target_uuid from #{temptable}) and " +
-       "requesting_container_uuid is NULL and state = 'Committed' and container_uuid is not NULL",
-       "Group.update_trash.update_priorities").each do |container_uuid|
+ 
+     ActiveRecord::Base.connection.exec_query(%{
+ with temptable as (select * from project_subtree_with_trash_at($1, LEAST($2, $3)::timestamp)),
+ 
+ delete_rows as (delete from trashed_groups where group_uuid in (select target_uuid from temptable where trash_at is NULL)),
+ 
+ insert_rows as (insert into trashed_groups (group_uuid, trash_at)
+   select target_uuid as group_uuid, trash_at from temptable where trash_at is not NULL
+   on conflict (group_uuid) do update set trash_at=EXCLUDED.trash_at)
+ 
+ select container_uuid from container_requests where
+   owner_uuid in (select target_uuid from temptable) and
+   requesting_container_uuid is NULL and state = 'Committed' and container_uuid is not NULL
+ },
+       "Group.update_trash.select",
 -      [[nil, self.uuid],
 -       [nil, TrashedGroup.find_by_group_uuid(self.owner_uuid).andand.trash_at],
 -       [nil, self.trash_at]]).each do |container_uuid|
++      [self.uuid,
++       TrashedGroup.find_by_group_uuid(self.owner_uuid).andand.trash_at,
++       self.trash_at]).each do |container_uuid|
        update_priorities container_uuid["container_uuid"]
      end
    end
  
    def update_frozen
      return unless saved_change_to_frozen_by_uuid? || saved_change_to_owner_uuid?
-     temptable = "group_subtree_#{rand(2**64).to_s(10)}"
-     ActiveRecord::Base.connection.exec_query(
-       "create temporary table #{temptable} on commit drop as select * from project_subtree_with_is_frozen($1,$2)",
-       "Group.update_frozen.select",
-       [self.uuid,
-        !self.frozen_by_uuid.nil?])
+ 
      if frozen_by_uuid
-       rows = ActiveRecord::Base.connection.exec_query(
-         "select cr.uuid, cr.state from container_requests cr, #{temptable} frozen " +
-         "where cr.owner_uuid = frozen.uuid and frozen.is_frozen " +
-         "and cr.state not in ($1, $2) limit 1",
-         "Group.update_frozen.check_container_requests",
-         [ContainerRequest::Uncommitted,
-          ContainerRequest::Final])
+       rows = ActiveRecord::Base.connection.exec_query(%{
+ with temptable as (select * from project_subtree_with_is_frozen($1,$2))
+ 
+ select cr.uuid, cr.state from container_requests cr, temptable frozen
+   where cr.owner_uuid = frozen.uuid and frozen.is_frozen
+   and cr.state not in ($3, $4) limit 1
+ },
+                                                       "Group.update_frozen.check_container_requests",
 -                                                      [[nil, self.uuid],
 -                                                       [nil, !self.frozen_by_uuid.nil?],
 -                                                       [nil, ContainerRequest::Uncommitted],
 -                                                       [nil, ContainerRequest::Final]])
++                                                      [self.uuid,
++                                                       !self.frozen_by_uuid.nil?,
++                                                       ContainerRequest::Uncommitted,
++                                                       ContainerRequest::Final])
        if rows.any?
          raise ArgumentError.new("cannot freeze project containing container request #{rows.first['uuid']} with state = #{rows.first['state']}")
        end
      end
-     ActiveRecord::Base.connection.exec_delete(
-       "delete from frozen_groups where uuid in (select uuid from #{temptable} where not is_frozen)",
-       "Group.update_frozen.delete")
-     ActiveRecord::Base.connection.exec_query(
-       "insert into frozen_groups (uuid) select uuid from #{temptable} where is_frozen on conflict do nothing",
-       "Group.update_frozen.insert")
+ 
+ ActiveRecord::Base.connection.exec_query(%{
+ with temptable as (select * from project_subtree_with_is_frozen($1,$2)),
+ 
+ delete_rows as (delete from frozen_groups where uuid in (select uuid from temptable where not is_frozen))
+ 
+ insert into frozen_groups (uuid) select uuid from temptable where is_frozen on conflict do nothing
+ }, "Group.update_frozen.update",
 -                                         [[nil, self.uuid],
 -                                          [nil, !self.frozen_by_uuid.nil?]])
++                                         [self.uuid,
++                                          !self.frozen_by_uuid.nil?])
+ 
    end
  
    def before_ownership_change

diff --cc services/api/lib/update_permissions.rb
index b06a19747c77693e9f94f93fc9b16fc8b60bceba,5c8072b48a5594b18200725feb0ab5515b72c963..c40d66f2ebf6d35d56bc66013516d83a017866f5
--- 1/services/api/lib/update_permissions.rb
--- 2/services/api/lib/update_permissions.rb
+++ b/services/api/lib/update_permissions.rb
@@@ -145,7 -142,11 +142,11 @@@ where #{PERMISSION_VIEW}.user_uuid=EXCL
         (#{PERMISSION_VIEW}.perm_level != EXCLUDED.perm_level or
          #{PERMISSION_VIEW}.traverse_owned != EXCLUDED.traverse_owned);
  },
-                                              "update_permissions.insert"
+                                              'update_permissions.select',
 -                                             [[nil, perm_origin_uuid],
 -                                              [nil, starting_uuid],
 -                                              [nil, perm_level],
 -                                              [nil, edge_id]]
++                                             [perm_origin_uuid,
++                                              starting_uuid,
++                                              perm_level,
++                                              edge_id]
  
      if perm_level>0
        check_permissions_against_full_refresh