Merge branch '19146-can-write-manage'

refs #19146

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>

diff --combined services/api/app/models/user.rb
index 1d1d83662c17f68b6611486624714555c6b854e2,141bccef21d63d94b1644b2c99f7f8ffd8a752d4..52d36ac57735f0c16d4b0ed6271a50681e08e05b
--- 1/services/api/app/models/user.rb
--- 2/services/api/app/models/user.rb
+++ b/services/api/app/models/user.rb
@@@ -72,6 -72,8 +72,8 @@@ class User < ArvadosMode
      t.add :is_invited
      t.add :prefs
      t.add :writable_by
+     t.add :can_write
+     t.add :can_manage
    end
  
    ALL_PERMISSIONS = {read: true, write: true, manage: true}
@@@ -110,6 -112,7 +112,6 @@@
    end
  
    def can?(actions)
 -    return true if is_admin
      actions.each do |action, target|
        unless target.nil?
          if target.respond_to? :uuid
@@@ -121,11 -124,19 +123,19 @@@
        end
        next if target_uuid == self.uuid
  
+       if action == :write && target && !target.new_record? &&
+          target.respond_to?(:frozen_by_uuid) &&
+          target.frozen_by_uuid_was
+         # Just an optimization to skip the PERMISSION_VIEW and
+         # FrozenGroup queries below
+         return false
+       end
+ 
        target_owner_uuid = target.owner_uuid if target.respond_to? :owner_uuid
  
        user_uuids_subquery = USER_UUIDS_SUBQUERY_TEMPLATE % {user: "$1", perm_level: "$3"}
  
 -      unless ActiveRecord::Base.connection.
 +      if !is_admin && !ActiveRecord::Base.connection.
          exec_query(%{
  SELECT 1 FROM #{PERMISSION_VIEW}
    WHERE user_uuid in (#{user_uuids_subquery}) and
@@@ -581,6 -592,13 +591,13 @@@ SELECT target_uuid, perm_leve
  
    protected
  
+   def self.attributes_required_columns
+     super.merge(
+                 'can_write' => ['owner_uuid', 'uuid'],
+                 'can_manage' => ['owner_uuid', 'uuid'],
+                 )
+   end
+ 
    def change_all_uuid_refs(old_uuid:, new_uuid:)
      ActiveRecord::Base.descendants.reject(&:abstract_class?).each do |klass|
        klass.columns.each do |col|