-
Notifications
You must be signed in to change notification settings - Fork 12
/
iiFolderStatusTransitions.r
353 lines (332 loc) · 12.2 KB
/
iiFolderStatusTransitions.r
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
# \file iiFolderStatusTransitions.r
# \brief Status transitions for folders in the research space.
# \author Paul Frederiks
# \author Lazlo Westerhof
# \copyright Copyright (c) 2015-2019 Utrecht University. All rights reserved.
# \license GPLv3, see LICENSE.
# \brief iiFolderStatus
#
# \param[in] folder Path of folder
# \param[out] folderStatus Current status of folder
#
iiFolderStatus(*folder, *folderStatus) {
*folderStatusKey = IISTATUSATTRNAME;
*folderStatus = FOLDER;
foreach(*row in SELECT META_COLL_ATTR_VALUE WHERE COLL_NAME = *folder AND META_COLL_ATTR_NAME = *folderStatusKey) {
*folderStatus = *row.META_COLL_ATTR_VALUE;
}
}
# \brief Schedule copy-to-vault (asynchronously).
#
iiScheduleCopyToVault() {
delay ("<INST_NAME>irods_rule_engine_plugin-irods_rule_language-instance</INST_NAME><PLUSET>1s</PLUSET>") {
msiExecCmd("scheduled-copytovault.sh", "", "", "", 0, *out);
}
}
# \brief Schedule copy-to-vault for just one coll (asynchronously).
#
# \param[in] folder Path of folder
#
iiScheduleCollCopyToVault(*coll) {
delay ("<INST_NAME>irods_rule_engine_plugin-irods_rule_language-instance</INST_NAME><PLUSET>1s</PLUSET>") {
msiExecCmd("scheduled-copytovault.sh", "'*coll'", "", "", 0, *out);
}
}
# \brief iiFolderDatamanagerAction
#
# \param[in] folder
# \param[out] newFolderStatus Status to set as datamanager. Either ACCEPTED or REJECTED
# \param[out] status status of the action
# \param[out] statusInfo Informative message when action was not successful
#
iiFolderDatamanagerAction(*folder, *newFolderStatus, *status, *statusInfo) {
*status = "Unknown";
*statusInfo = "An internal error has occurred";
# Check if folder is a research group.
*groupName = "";
*err = errorcode(rule_collection_group_name(*folder, *groupName));
if (*err < 0) {
*status = "NoResearchGroup";
*statusInfo = "*folder is not accessible possibly due to insufficient rights or as it is not part of a research group. Therefore, the requested action can not be performed";
succeed;
} else {
# Research group, determine datamanager group.
uuGroupGetCategory(*groupName, *category, *subcategory);
*datamanagerGroup = "datamanager-*category";
}
*actor = uuClientFullName;
*aclKv.actor = *actor;
*err = errorcode(msiSudoObjAclSet("recursive", "write", *datamanagerGroup, *folder, *aclKv));
if (*err < 0) {
*status = "PermissionDenied";
iiCanDatamanagerAclSet(*folder, *actor, *datamanagerGroup, 0, "write", *allowed, *reason);
if (*allowed) {
*statusInfo = "Could not acquire datamanager access to *folder.";
} else {
*statusInfo = *reason;
}
succeed;
}
if (*newFolderStatus == REJECTED) {
# get permission to unlock ancestors, too
uuChopPath(*folder, *parent, *child);
while(*parent != "/$rodsZoneClient/home") {
msiSudoObjAclSet("", "write", *datamanagerGroup, *parent, *aclKv);
uuChopPath(*parent, *coll, *child);
*parent = *coll;
}
}
*folderStatusStr = IISTATUSATTRNAME ++ "=" ++ *newFolderStatus;
msiString2KeyValPair(*folderStatusStr, *folderStatusKvp);
*err = errormsg(msiSetKeyValuePairsToObj(*folderStatusKvp, *folder, "-C"), *msg);
if (*err < 0) {
iiFolderStatus(*folder, *currentFolderStatus);
iiCanTransitionFolderStatus(*folder, *currentFolderStatus, *newFolderStatus, *actor, *allowed, *reason);
if (!*allowed) {
*status = "PermissionDenied";
*statusInfo = *reason;
} else {
if (*err == -818000) {
*status = "PermissionDenied";
*statusInfo = "User is not permitted to modify folder status";
} else {
*status = "Unrecoverable";
*statusInfo = "*err - *msg";
}
}
}
*err = errormsg(msiSudoObjAclSet("recursive", "read", *datamanagerGroup, *folder, *aclKv), *msg);
if (*err < 0) {
*status = "FailedToRemoveTemporaryAccess";
iiCanDatamanagerAclSet(*folder, *actor, *datamanagerGroup, 0, "read", *allowed, *reason);
if (*allowed) {
*statusInfo = "*err - *msg";
} else {
*statusInfo = *reason;
}
succeed;
}
if (*newFolderStatus == REJECTED) {
# remove permission to modify ancestors
uuChopPath(*folder, *parent, *child);
while(*parent != "/$rodsZoneClient/home") {
msiSudoObjAclSet("", "read", *datamanagerGroup, *parent, *aclKv);
uuChopPath(*parent, *coll, *child);
*parent = *coll;
}
}
if (*status == "Unknown") {
*status = "Success";
*statusInfo = "";
}
}
# \brief iiFolderLockChange
#
# \param[in] rootCollection The COLL_NAME of the collection the dataset resides in
# \param[in] lockIt Boolean, true if the object should be locked.
# if false, the lock is removed (if allowed)
# \param[out] status Zero if no errors, non-zero otherwise
#
iiFolderLockChange(*rootCollection, *lockIt, *status){
msiString2KeyValPair("", *buffer);
msiAddKeyVal(*buffer, IILOCKATTRNAME, *rootCollection)
#DEBUG writeLine("ServerLog", "iiFolderLockChange: *buffer");
if (*lockIt == "lock") {
#DEBUG writeLine("serverLog", "iiFolderLockChange: recursive locking of *rootCollection");
*direction = "forward";
uuTreeWalk(*direction, *rootCollection, "iiAddMetadataToItem", *buffer, *error);
if (*error == 0) {
uuChopPath(*rootCollection, *parent, *child);
while(*parent != "/$rodsZoneClient/home") {
uuChopPath(*parent, *coll, *child);
iiAddMetadataToItem(*coll, *child, true, *buffer, *error);
*parent = *coll;
}
}
} else {
#DEBUG writeLine("serverLog", "iiFolderLockChange: recursive unlocking of *rootCollection");
*direction="reverse";
uuTreeWalk(*direction, *rootCollection, "iiRemoveMetadataFromItem", *buffer, *error);
if (*error == 0) {
uuChopPath(*rootCollection, *parent, *child);
while(*parent != "/$rodsZoneClient/home") {
uuChopPath(*parent, *coll, *child);
iiRemoveMetadataFromItem(*coll, *child, true, *buffer, *error);
*parent = *coll;
}
}
}
*status = "*error";
}
# \brief Return objectType string based on boolean itemIsCollection.
#
# \param[in] itemIsCollection boolean usually returned by treewalk when item is a Collection
# \returnvalue iRODS objectType string. "-C" for Collection, "-d" for DataObject
#
iitypeabbreviation(*itemIsCollection) = if *itemIsCollection then "-C" else "-d"
# \brief For use by uuTreewalk to add metadata.
#
# \param[in] itemParent full iRODS path to the parent of this object
# \param[in] itemName basename of collection or dataobject
# \param[in] itemIsCollection true if the item is a collection
# \param[in,out] buffer in/out Key-Value variable
# \param[out] error errorcode in case of failure
#
iiAddMetadataToItem(*itemParent, *itemName, *itemIsCollection, *buffer, *error) {
*objPath = "*itemParent/*itemName";
*objType = iitypeabbreviation(*itemIsCollection);
#DEBUG writeLine("serverLog", "iiAddMetadataToItem: Setting *buffer on *objPath");
*error = errorcode(msiAssociateKeyValuePairsToObj(*buffer, *objPath, *objType));
}
# \brief For use by uuTreeWalk to remove metadata.
#
# \param[in] itemParent full iRODS path to the parent of this object
# \param[in] itemName basename of collection or dataobject
# \param[in] itemIsCollection true if the item is a collection
# \param[in,out] buffer in/out Key-Value variable
# \param[out] error errorcode in case of failure
#
iiRemoveMetadataFromItem(*itemParent, *itemName, *itemIsCollection, *buffer, *error) {
*objPath = "*itemParent/*itemName";
*objType = iitypeabbreviation(*itemIsCollection);
#DEBUG writeLine("serverLog", "iiRemoveMetadataKeyFromItem: Removing *buffer on *objPath");
*error = errormsg(msiRemoveKeyValuePairsFromObj(*buffer, *objPath, *objType), *msg);
if (*error < 0) {
writeLine("serverLog", "iiRemoveMetadataFromItem: removing *buffer from *objPath failed with errorcode: *error");
writeLine("serverLog", *msg);
if (*error == -819000) {
# This happens when metadata was already removed or never there.
writeLine("serverLog", "iiRemoveMetadaFromItem: -819000 detected. Keep on trucking, this happens if metadata was already removed");
*error = 0;
}
}
}
# \brief Check validity of requested folder status transition in a research area.
#
# \param[in] fromstatus folder status before requested transition
# \param[in] tostatus folder status after requested transition
#
iiIsStatusTransitionLegal(*fromstatus, *tostatus) {
*legal = false;
# IIFOLDERTRANSTIONS should be defined in iiConstants.r and lists all the legal status transitions
foreach(*legaltransition in IIFOLDERTRANSITIONS) {
(*legalfrom, *legalto) = *legaltransition;
if (*legalfrom == *fromstatus && *legalto == *tostatus) {
*legal = true;
break;
}
}
*legal;
}
# \brief Return a list of locks on an object.
#
# \param[in] objPath path of collection or data object
# \param[out] locks list of locks with the rootCollection of each lock as value
#
iiGetLocks(*objPath, *locks) {
*locks = list();
*lockattrname = IILOCKATTRNAME;
msiGetObjType(*objPath, *objType);
if (*objType == '-d') {
uuChopPath(*objPath, *collection, *dataName);
foreach (*row in SELECT META_DATA_ATTR_VALUE
WHERE COLL_NAME = *collection
AND DATA_NAME = *dataName
AND META_DATA_ATTR_NAME = *lockattrname
) {
*rootCollection= *row.META_DATA_ATTR_VALUE;
*locks = cons(*rootCollection, *locks);
}
} else {
foreach (*row in SELECT META_COLL_ATTR_VALUE
WHERE COLL_NAME = *objPath
AND META_COLL_ATTR_NAME = *lockattrname
) {
*rootCollection = *row.META_COLL_ATTR_VALUE;
*locks = cons(*rootCollection, *locks);
}
}
}
# \brief Check if a research folder status transition is legal.
#
# \param[in] folder
# \param[in] transitionFrom current status to transition from
# \param[in] transitionTo new status to transition to
# \param[out] allowed boolean to indicate if the action is allowed
# \param[out] reason reason the action is not allowed
#
iiCanTransitionFolderStatus(*folder, *transitionFrom, *transitionTo, *actor, *allowed, *reason) {
*allowed = false;
*reason = "Unknown error";
if (iiIsStatusTransitionLegal(*transitionFrom, *transitionTo)) {
*allowed = true;
*reason = "Legal status transition. *transitionFrom -> *transitionTo";
} else {
if (*transitionFrom == FOLDER) {
*reason = "Illegal status transition. Current folder has no status.";
} else {
*reason = "Illegal status transition. Current status is *transitionFrom.";
}
succeed;
}
if (*transitionTo == SUBMITTED) {
*metadataJsonPath = *folder ++ "/" ++ IIJSONMETADATA;
if (!uuFileExists(*metadataJsonPath)) {
*allowed = false;
*reason = "Metadata missing, unable to submit this folder.";
succeed;
} else {
*status = "";
*statusInfo = "";
rule_meta_validate(*metadataJsonPath, *status, *statusInfo);
if (*status != "0") {
*allowed = false;
*reason = "Metadata is invalid, please check metadata form.";
succeed;
}
}
}
if (*transitionTo == ACCEPTED || *transitionTo == REJECTED) {
*groupName = "";
*err1 = errorcode(rule_collection_group_name(*folder, *groupName));
*err2 = errorcode(uuGroupGetCategory(*groupName, *category, *subcategory));
*err3 = errorcode(uuGroupExists("datamanager-*category", *datamanagerExists));
if (*err1 < 0 || *err2 < 0 || *err3 < 0) {
*allowed = false;
*reason = "Could not determine if datamanager-*category exists";
succeed;
}
if (*datamanagerExists) {
uuGroupGetMemberType("datamanager-*category", *actor, *userTypeIfDatamanager);
if (*userTypeIfDatamanager == "normal" || *userTypeIfDatamanager == "manager") {
*allowed = true;
*reason = "Folder is *transitionTo by *actor from datamanager-*category";
} else {
*allowed = false;
*reason = "Only a member of datamanager-*category is allowed to accept or reject a submitted folder";
succeed;
}
} else {
*allowed = true;
*reason = "When no datamanager group exists, submitted folders are automatically accepted";
}
}
# Note: The folders will not transition to SECURED status.
if (*transitionFrom == ACCEPTED && *transitionTo == FOLDER) {
*allowed = false;
*reason = "Only a rodsadmin is allowed to secure a folder to the vault";
succeed;
}
if (*allowed) {
iiGetLocks(*folder, *locks);
if (size(*locks) > 0) {
foreach(*rootCollection in *locks) {
if (*rootCollection != *folder) {
*allowed = false;
*reason = "Found lock(s) starting from *rootCollection";
break;
}
}
}
}
}