16007: Still WIP trying to figure out what to do with links to users

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <peter.amstutz@curii.com>

diff --git a/services/api/app/models/group.rb b/services/api/app/models/group.rb
index 3ba7c4b96a2da4e9706ab9d91eb80b076dd2765a..d9ef342b3798c4a21194d66e862a75a53dad23aa 100644 (file)
--- a/services/api/app/models/group.rb
+++ b/services/api/app/models/group.rb
@@ -21,7 +21,7 @@ class Group < ArvadosModel
   after_create :update_permissions
   after_create :update_trash
 
-  after_update :update_permissions
+  after_update :update_permissions, :if => :owner_uuid_changed?
   after_update :update_trash
 
   after_destroy :clear_permissions_and_trash
@@ -45,7 +45,7 @@ class Group < ArvadosModel
   end
 
   def update_trash
-    if trash_at_changed? or owner_uuid_changed? or (new_record? and !trash_at.nil?)
+    if trash_at_changed? or owner_uuid_changed?
       # The group was added or removed from the trash.
       #
       # Strategy:
@@ -76,9 +76,7 @@ on conflict (group_uuid) do update set trash_at=EXCLUDED.trash_at;
   end
 
   def update_permissions
-    if new_record? or owner_uuid_changed?
-      User.update_permissions self.owner_uuid, self.uuid, 3
-    end
+    User.update_permissions self.owner_uuid, self.uuid, 3
   end
 
   def clear_permissions_and_trash

diff --git a/services/api/app/models/user.rb b/services/api/app/models/user.rb
index be130a99d8e9ee0b22e5603adb9739cdc6d1db73..d2ca8102e398444df6b5d09b268cd47f8f24e7c4 100644 (file)
--- a/services/api/app/models/user.rb
+++ b/services/api/app/models/user.rb
@@ -40,7 +40,7 @@ class User < ArvadosModel
     (user.uuid != anonymous_user_uuid)
   }
   after_create :send_admin_notifications
-  after_update :update_permissions
+  after_update :update_permissions, :if => :owner_uuid_changed?
   after_update :send_profile_created_notification
   after_update :sync_repository_names, :if => Proc.new { |user|
     (user.uuid != system_user_uuid) and
@@ -145,17 +145,19 @@ class User < ArvadosModel
   end
 
   def update_permissions
-    if owner_uuid_changed?
-#       puts "Update permissions for #{uuid} #{new_record?}"
-#     User.printdump %{
-# select * from materialized_permissions where user_uuid='#{uuid}'
-# }
-#     puts "---"
+
+      puts "Update permissions for #{uuid}"
+    User.printdump %{
+select * from materialized_permissions where user_uuid='#{uuid}'
+}
+    puts "---"
     User.update_permissions self.owner_uuid, self.uuid, 3
-#    User.printdump %{
-#select * from materialized_permissions where user_uuid='#{uuid}'
-#}
-    end
+
+  puts "post-update"
+   User.printdump %{
+select * from materialized_permissions where user_uuid='#{uuid}'
+}
+   puts "<<<"
   end
 
   def self.printdump qr
@@ -192,15 +194,16 @@ from search_permission_graph('#{uuid}', 3) as g
     # 4. Upsert each permission in our subset (user, group, val)
 
     ## testinging
-#     puts "What's in there now for #{starting_uuid}"
-#     printdump %{
-# select * from materialized_permissions where user_uuid='#{starting_uuid}'
-# }
+    puts "__ update_permissions __"
+    puts "What's in there now for #{starting_uuid}"
+    printdump %{
+select * from materialized_permissions where user_uuid='#{starting_uuid}'
+}
 
-#     puts "search_permission_graph #{perm_origin_uuid} #{starting_uuid}, #{perm_level}"
-#     printdump %{
-# select '#{perm_origin_uuid}'::varchar as perm_origin_uuid, target_uuid, val, traverse_owned from search_permission_graph('#{starting_uuid}', #{perm_level})
-# }
+    puts "search_permission_graph #{perm_origin_uuid} #{starting_uuid}, #{perm_level}"
+    printdump %{
+select '#{perm_origin_uuid}'::varchar as perm_origin_uuid, target_uuid, val, traverse_owned from search_permission_graph('#{starting_uuid}', #{perm_level})
+}
 
 #     puts "Perms out"
 #     printdump %{
@@ -233,10 +236,11 @@ as select * from compute_permission_subgraph($1, $2, $3)
     q1 = ActiveRecord::Base.connection.exec_query %{
 select * from #{temptable_perms}
 }
-    # puts "recomputed perms was #{perm_origin_uuid} #{starting_uuid}, #{perm_level}"
-    # q1.each do |r|
-    #   puts r
-    # end
+    puts "recomputed perms was #{perm_origin_uuid} #{starting_uuid}, #{perm_level}"
+    q1.each do |r|
+      puts r
+    end
+    puts "<<<<"
 
     ActiveRecord::Base.connection.exec_query %{
 delete from materialized_permissions where

diff --git a/services/api/db/migrate/20200501150153_permission_table.rb b/services/api/db/migrate/20200501150153_permission_table.rb
index aa36df1767259243bc6f48561234436209d31544..07c155517f77842378f913f16b800a2c6e86ef98 100644 (file)
--- a/services/api/db/migrate/20200501150153_permission_table.rb
+++ b/services/api/db/migrate/20200501150153_permission_table.rb
@@ -93,7 +93,9 @@ WITH RECURSIVE edges(tail_uuid, head_uuid, val) as (
           where links.link_class='permission'
         ),
         traverse_graph(target_uuid, val, traverse_owned) as (
-            values (starting_uuid, starting_perm, true)
+            values (starting_uuid, starting_perm,
+                     (starting_uuid like '_____-j7d0g-_______________' or
+                      (starting_uuid like '_____-tpzed-_______________' and starting_perm >= 3)))
           union
             (select edges.head_uuid,
                     least(edges.val, traverse_graph.val),
@@ -131,19 +133,28 @@ perm_from_start(perm_origin_uuid, target_uuid, val, traverse_owned) as (
                         END) as ps
       where links.link_class='permission' and
         links.tail_uuid not in (select target_uuid from perm_from_start) and
-        links.head_uuid in (select target_uuid from perm_from_start))
+        links.head_uuid in (select target_uuid from perm_from_start)),
 
-select materialized_permissions.user_uuid,
-       u.target_uuid,
-       max(least(u.val, materialized_permissions.perm_level)),
-       bool_or(u.traverse_owned)
-  from ((select * from perm_from_start) union (select * from additional_perms)) as u
-  join materialized_permissions on (u.perm_origin_uuid = materialized_permissions.target_uuid)
-  where materialized_permissions.traverse_owned
-  group by materialized_permissions.user_uuid, u.target_uuid
-union
-  select target_uuid as user_uuid, target_uuid, 3, true
-    from perm_from_start where target_uuid like '_____-tpzed-_______________'
+  identity_perms(perm_origin_uuid, target_uuid, val, traverse_owned) as (
+    select target_uuid as perm_origin_uuid, target_uuid, 3, true
+      from perm_from_start where target_uuid like '_____-tpzed-_______________'),
+
+  all_perms(perm_origin_uuid, target_uuid, val, traverse_owned) as (
+      select * from perm_from_start
+    union
+      select * from additional_perms
+    union
+      select * from identity_perms
+  )
+
+  select materialized_permissions.user_uuid,
+         u.target_uuid,
+         max(least(u.val, materialized_permissions.perm_level)),
+         bool_or(u.traverse_owned)
+    from all_perms as u
+    join materialized_permissions on (u.perm_origin_uuid = materialized_permissions.target_uuid)
+    where materialized_permissions.traverse_owned
+    group by user_uuid, u.target_uuid
 $$;
      }