after_update :call_update_permissions
after_create :call_update_permissions
before_destroy :clear_permissions
- after_destroy :clear_permissions
+ after_destroy :check_permissions
api_accessible :user, extend: :common do |t|
t.add :tail_uuid
def clear_permissions
if self.link_class == 'permission'
- update_permissions tail_uuid, head_uuid, 0, false
+ update_permissions tail_uuid, head_uuid, 0
end
end
def check_permissions
if self.link_class == 'permission'
- update_permissions tail_uuid, head_uuid, 0, true
+ #check_permissions_against_full_refresh
end
end
user.username_changed? and
(not user.username_was.nil?)
}
- after_destroy :clear_permissions
+ before_destroy :clear_permissions
+ after_destroy :check_permissions
has_many :authorized_keys, :foreign_key => :authorized_user_uuid, :primary_key => :uuid
has_many :repositories, foreign_key: :owner_uuid, primary_key: :uuid
def before_ownership_change
if owner_uuid_changed? and !self.owner_uuid_was.nil?
MaterializedPermission.where(user_uuid: owner_uuid_was, target_uuid: uuid).delete_all
- update_permissions self.owner_uuid_was, self.uuid, 0, false
+ update_permissions self.owner_uuid_was, self.uuid, 0
end
end
end
def clear_permissions
+ update_permissions self.owner_uuid, self.uuid, 0
MaterializedPermission.where("user_uuid = ? or target_uuid = ?", uuid, uuid).delete_all
end
+ def check_permissions
+ check_permissions_against_full_refresh
+ end
+
# Return a hash of {user_uuid: group_perms}
def self.all_group_permissions
all_perms = {}
raise "user does not exist" if !new_user
raise "cannot merge to an already merged user" if new_user.redirect_to_user_uuid
- update_permissions self.owner_uuid, self.uuid, 0
+ self.clear_permissions
# If 'self' is a remote user, don't transfer authorizations
# (i.e. ability to access the account) to the new user, because
if redirect_to_new_user
update_attributes!(redirect_to_user_uuid: new_user.uuid, username: nil)
end
- update_permissions self.owner_uuid, self.uuid, 3
+ update_permissions self.owner_uuid, self.uuid, 3, false
update_permissions new_user.owner_uuid, new_user.uuid, 3
end
end
end
-def update_permissions perm_origin_uuid, starting_uuid, perm_level, check=false
+def update_permissions perm_origin_uuid, starting_uuid, perm_level, check=true
# Update a subset of the permission graph
# perm_level is the inherited permission
# perm_level is a number from 0-3
},
"update_permissions.insert"
- if check
- #
- # For validation/debugging, this checks contents of the
- # incrementally-updated 'materialized_permission' against a
- # from-scratch permission refresh.
- #
+ if check and perm_level>0
+ check_permissions_against_full_refresh
+ end
+end
+
+
+def check_permissions_against_full_refresh
+ #
+ # For debugging, this checks contents of the
+ # incrementally-updated 'materialized_permission' against a
+ # from-scratch permission refresh.
+ #
- q1 = ActiveRecord::Base.connection.exec_query %{
+ q1 = ActiveRecord::Base.connection.exec_query %{
select user_uuid, target_uuid, perm_level, traverse_owned from #{PERMISSION_VIEW}
order by user_uuid, target_uuid
}
- q2 = ActiveRecord::Base.connection.exec_query %{
+ q2 = ActiveRecord::Base.connection.exec_query %{
select users.uuid as user_uuid, g.target_uuid, g.val as perm_level, g.traverse_owned
from users, lateral search_permission_graph(users.uuid, 3) as g where g.val > 0
order by users.uuid, target_uuid
}
- if q1.count != q2.count
- puts "Didn't match incremental+: #{q1.count} != full refresh-: #{q2.count}"
- end
+ if q1.count != q2.count
+ puts "Didn't match incremental+: #{q1.count} != full refresh-: #{q2.count}"
+ end
- if q1.count > q2.count
- q1.each_with_index do |r, i|
- if r != q2[i]
- puts "+#{r}\n-#{q2[i]}"
- raise "Didn't match"
- end
+ if q1.count > q2.count
+ q1.each_with_index do |r, i|
+ if r != q2[i]
+ puts "+#{r}\n-#{q2[i]}"
+ raise "Didn't match"
end
- else
- q2.each_with_index do |r, i|
- if r != q1[i]
- puts "+#{q1[i]}\n-#{r}"
- raise "Didn't match"
- end
+ end
+ else
+ q2.each_with_index do |r, i|
+ if r != q1[i]
+ puts "+#{q1[i]}\n-#{r}"
+ raise "Didn't match"
end
end
end