Merge branch 'master' into 3036-collection-uuids

Conflicts:
	sdk/python/arvados/commands/put.py
	services/api/app/controllers/application_controller.rb
	services/api/app/controllers/arvados/v1/collections_controller.rb
	services/api/app/models/arvados_model.rb
	services/api/test/fixtures/groups.yml
	services/api/test/fixtures/links.yml

diff --cc services/api/app/controllers/application_controller.rb
Simple merge

diff --cc services/api/app/controllers/arvados/v1/collections_controller.rb
Simple merge

diff --cc services/api/app/models/arvados_model.rb
index 205f54ab7ff4598d7185719db56aaa82e15d417a,16bafcaf5f4ff1bde48a2acf11a20e909a4bfce1..be427bf0217fb4f7907f1d08d4bf08795cf2c020
--- 1/services/api/app/models/arvados_model.rb
--- 2/services/api/app/models/arvados_model.rb
+++ b/services/api/app/models/arvados_model.rb
@@@ -124,61 -124,71 +124,65 @@@ class ArvadosModel < ActiveRecord::Bas
      end
  
      # Check if any of the users are admin.  If so, we're done.
-     if users_list.select { |u| u.is_admin }.empty?
+     if users_list.select { |u| u.is_admin }.any?
+       return self
+     end
+ 
+     # Collect the uuids for each user and any groups readable by each user.
+     user_uuids = users_list.map { |u| u.uuid }
+     uuid_list = user_uuids + users_list.flat_map { |u| u.groups_i_can(:read) }
+     sql_conds = []
+     sql_params = []
+     sql_table = kwargs.fetch(:table_name, table_name)
+     or_object_uuid = ''
+ 
+     # This row is owned by a member of users_list, or owned by a group
+     # readable by a member of users_list
+     # or
+     # This row uuid is the uuid of a member of users_list
+     # or
+     # A permission link exists ('write' and 'manage' implicitly include
+     # 'read') from a member of users_list, or a group readable by users_list,
+     # to this row, or to the owner of this row (see join() below).
+     sql_conds += ["#{sql_table}.uuid in (?)"]
+     sql_params += [user_uuids]
+ 
+     if uuid_list.any?
+       sql_conds += ["#{sql_table}.owner_uuid in (?)"]
+       sql_params += [uuid_list]
  
-       # Collect the uuids for each user and any groups readable by each user.
-       user_uuids = users_list.map { |u| u.uuid }
-       uuid_list = user_uuids + users_list.flat_map { |u| u.groups_i_can(:read) }
        sanitized_uuid_list = uuid_list.
          collect { |uuid| sanitize(uuid) }.join(', ')
-       sql_conds = []
-       sql_params = []
-       sql_table = kwargs.fetch(:table_name, table_name)
-       or_object_uuid = ''
- 
-       # This row is owned by a member of users_list, or owned by a group
-       # readable by a member of users_list
-       # or
-       # This row uuid is the uuid of a member of users_list
-       # or
-       # A permission link exists ('write' and 'manage' implicitly include
-       # 'read') from a member of users_list, or a group readable by users_list,
-       # to this row, or to the owner of this row (see join() below).
        permitted_uuids = "(SELECT head_uuid FROM links WHERE link_class='permission' AND tail_uuid IN (#{sanitized_uuid_list}))"
+       sql_conds += ["#{sql_table}.uuid IN #{permitted_uuids}"]
+     end
  
-       sql_conds += ["#{sql_table}.owner_uuid in (?)",
-                     "#{sql_table}.uuid in (?)",
-                     "#{sql_table}.uuid IN #{permitted_uuids}"]
-       sql_params += [uuid_list, user_uuids]
- 
-       if sql_table == "links" and users_list.any?
-         # This row is a 'permission' or 'resources' link class
-         # The uuid for a member of users_list is referenced in either the head
-         # or tail of the link
-         sql_conds += ["(#{sql_table}.link_class in (#{sanitize 'permission'}, #{sanitize 'resources'}) AND (#{sql_table}.head_uuid IN (?) OR #{sql_table}.tail_uuid IN (?)))"]
-         sql_params += [user_uuids, user_uuids]
-       end
- 
-       if sql_table == "logs" and users_list.any?
-         # Link head points to the object described by this row
-         sql_conds += ["#{sql_table}.object_uuid IN #{permitted_uuids}"]
+     if sql_table == "links" and users_list.any?
+       # This row is a 'permission' or 'resources' link class
+       # The uuid for a member of users_list is referenced in either the head
+       # or tail of the link
+       sql_conds += ["(#{sql_table}.link_class in (#{sanitize 'permission'}, #{sanitize 'resources'}) AND (#{sql_table}.head_uuid IN (?) OR #{sql_table}.tail_uuid IN (?)))"]
+       sql_params += [user_uuids, user_uuids]
+     end
  
-         # This object described by this row is owned by this user, or owned by a group readable by this user
-         sql_conds += ["#{sql_table}.object_owner_uuid in (?)"]
-         sql_params += [uuid_list]
-       end
+     if sql_table == "logs" and users_list.any?
+       # Link head points to the object described by this row
+       sql_conds += ["#{sql_table}.object_uuid IN #{permitted_uuids}"]
  
-       # Link head points to this row, or to the owner of this row (the thing to be read)
-       #
-       # Link tail originates from this user, or a group that is readable by this
-       # user (the identity with authorization to read)
-       #
-       # Link class is 'permission' ('write' and 'manage' implicitly include 'read')
-       where(sql_conds.join(' OR '), *sql_params)
-     else
-       # At least one user is admin, so don't bother to apply any restrictions.
-       self
+       # This object described by this row is owned by this user, or owned by a group readable by this user
+       sql_conds += ["#{sql_table}.object_owner_uuid in (?)"]
+       sql_params += [uuid_list]
      end
 -    if sql_table == "collections" and users_list.any?
 -      # There is a 'name' link going from a readable group to the collection.
 -      name_links = "(SELECT head_uuid FROM links WHERE link_class='name' AND tail_uuid IN (#{sanitized_uuid_list}))"
 -      sql_conds += ["#{sql_table}.uuid IN #{name_links}"]
 -    end
 -
+ 
+     # Link head points to this row, or to the owner of this row (the
+     # thing to be read)
+     #
+     # Link tail originates from this user, or a group that is readable
+     # by this user (the identity with authorization to read)
+     #
+     # Link class is 'permission' ('write' and 'manage' implicitly
+     # include 'read')
+     where(sql_conds.join(' OR '), *sql_params)
    end
  
    def logged_attributes

diff --cc services/api/app/models/link.rb
index 808489e1c2b93084e40e85deb04a3b1aa3a06b45,f4a7de29e276d065849911ef04c1c78770cc97f6..d9b8f6f09b191230b6635fd8cd0b1cadf9ccf5ab
--- 1/services/api/app/models/link.rb
--- 2/services/api/app/models/link.rb
+++ b/services/api/app/models/link.rb
@@@ -79,9 -81,17 +79,10 @@@ class Link < ArvadosMode
      end
    end
  
 -  def name_link_owner_is_tail
 -    if link_class == 'name'
 -      self.owner_uuid = tail_uuid
 -      ensure_owner_uuid_is_permitted
 -    end
 -  end
 -
    # A user is permitted to create, update or modify a permission link
-   # if and only if they have "manage" permission on the destination
-   # object.
+   # if and only if they have "manage" permission on the object
+   # indicated by the permission link's head_uuid.
+   #
    # All other links are treated as regular ArvadosModel objects.
    #
    def ensure_owner_uuid_is_permitted

diff --cc services/api/db/structure.sql
index af4bf6a9f23145bd989d169446186007b550afb0,2d0c76f09d8c663f03cd01df0dce351af1f9cee8..06e327ffdf8a08862f96131575a35f3b89c92fb3
--- 1/services/api/db/structure.sql
--- 2/services/api/db/structure.sql
+++ b/services/api/db/structure.sql
@@@ -2016,12 -1975,4 +2016,12 @@@ INSERT INTO schema_migrations (version
  
  INSERT INTO schema_migrations (version) VALUES ('20140709172343');
  
 -INSERT INTO schema_migrations (version) VALUES ('20140714184006');
 +INSERT INTO schema_migrations (version) VALUES ('20140714184006');
 +
 +INSERT INTO schema_migrations (version) VALUES ('20140811184643');
 +
 +INSERT INTO schema_migrations (version) VALUES ('20140815171049');
 +
 +INSERT INTO schema_migrations (version) VALUES ('20140817035914');
 +
- INSERT INTO schema_migrations (version) VALUES ('20140818125735');
++INSERT INTO schema_migrations (version) VALUES ('20140818125735');

diff --cc services/api/lib/current_api_client.rb
Simple merge

diff --cc services/api/test/fixtures/groups.yml
Simple merge

diff --cc services/api/test/fixtures/links.yml
Simple merge

diff --cc services/api/test/functional/arvados/v1/links_controller_test.rb
Simple merge

diff --cc services/api/test/unit/link_test.rb
Simple merge