opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-10-29 17:42:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Changes to access controls, mostly cosmetic.

Browse Source
This commit is contained in:
Daniel Blankenberg
2008-08-05 16:35:14 -04:00
parent 375203a4e0
commit 4a2efcffd1
11 changed files with 238 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/galaxy/model/__init__.py
+114 -98
View File
@@ -27,38 +27,16 @@ def set_datatypes_registry( d_registry ):
datatypes_registry = d_registry
class User( object ):
def __init__( self, email=None, password=None, groups = [], roles = [], default_groups = [], default_roles = [] ):
def __init__( self, email=None, password=None ):
self.email = email
self.password = password
self.external = False
# Relationships
self.histories = []
if not groups:
groups.append( GalaxyGroup.get( GalaxyGroup.public_id ) )
default_groups.append( groups[-1] )
default_groups.append( self.create_private_group() )
group_id_added = []
for group in groups:
if group.id not in group_id_added:
group.add_user( self )
group_id_added.append( group.id )
group_id_added = []
for group in default_groups:
if group.id not in group_id_added:
user_group_assoc = DefaultUserGroupAssociation( self, group )
user_group_assoc.flush()
group_id_added.append( group.id )
role_id_added = []
for role in roles:
if role.id not in role_id_added:
role.add_user( self )
role_id_added.append( role.id )
role_id_added = []
for role in default_roles:
if role.id not in role_id_added:
role_group_assoc = DefaultUserRoleAssociation( self, role )
role_group_assoc.flush()
role_id_added.append( role.id )
self.set_default_access()
self.add_group( Group.get_public_group() )
def set_password_cleartext( self, cleartext ):
"""Set 'self.password' to the digest of 'cleartext'."""
self.password = sha.new( cleartext ).hexdigest()
@@ -66,28 +44,42 @@ class User( object ):
"""Check if 'cleartext' matches 'self.password' when hashed."""
return self.password == sha.new( cleartext ).hexdigest()
def create_private_group( self ):
#create roles for user modification of role
user_permission = Permission( "%s role modification" % self.email, list( Role.access_actions.__dict__.values() ) )
user_permission.flush()
user_role = Role( "%s role modification" % self.email )
user_role.flush()
user_role.add_permission( user_permission )
#add role to user
user_role.add_user( self )
user_role.add_control_role( user_role )
#create private group
group = GalaxyGroup( self.email, priority = 10 )
group = Group( self.email, priority = 10 )
group.flush()
#create dataset permissions
dataset_permission = Permission( "%s dataset access" % self.email, list( Dataset.access_actions.__dict__.values() ) )
dataset_permission.flush()
#create private dataset access role
role = AccessRole( "%s dataset access" % self.email, list( Dataset.access_actions.__dict__.values() ), priority = 1 )
role = Role( "%s dataset access" % self.email, priority = 10 )
role.add_permission( dataset_permission )
role.flush()
#add control role to role
role.add_control_role( user_role )
#add role to group
group.add_role( role )
#create roles for user modification of role
user_role = AccessRole( "%s role modification" % self.email, list( AccessRole.access_actions.__dict__.values() ) )
user_role.flush()
#add role to user
user_role.add_user( self )
#add role to role
role.add_role( user_role )
#create roles for user modification of group
group_role = AccessRole( "%s group modification" % self.email, list( GalaxyGroup.access_actions.__dict__.values() ) )
group_permission = Permission( "%s group modification" % self.email, list( Group.access_actions.__dict__.values() ) )
group_permission.flush()
group_role = Role( "%s group modification" % self.email )
group_role.flush()
#add control role to role
group_role.add_control_role( user_role )
group_role.add_permission( group_permission )
#add role to group
group.add_access_role( group_role )
group.add_control_role( group_role )
#associate role and user
group_role.add_user( self )
@@ -102,6 +94,9 @@ class User( object ):
def has_role( self, check_role ):
return bool( UserRoleAssociation.get_by( role_id = check_role.id, user_id = self.id ) )
def set_default_access( self, groups = None, roles = None, history = False, dataset = False ):
if groups is None and roles is None:
groups = [ Group.get_public_group(), self.create_private_group() ]
roles = []
if groups is not None:
for assoc in self.default_groups: #this is the association not the actual group
assoc.delete()
@@ -181,7 +176,7 @@ class JobToOutputDatasetAssociation( object ):
self.name = name
self.dataset = dataset
class AccessRole( object ):
class Permission( object ):
dataset_actions = Bunch( VIEW = 'dataset_view', #viewing/downloading
USE = 'dataset_use', #use in jobs
ADD_ROLE = 'dataset_add_role', #dataset can be added to roles
@@ -200,14 +195,21 @@ class AccessRole( object ):
ADD_ROLE = 'group_add_role', #add role to group
REMOVE_ROLE = 'group_remove_role', #remove role from group
ADD_USER = 'group_add_user' ) #add users to group
access_actions = role_actions
def __init__( self, name, actions, priority = 0 ):
def __init__( self, name = None, actions = [] ):
self.name = name
if not isinstance( actions, list ):
actions = [ actions ]
self.actions = actions
def add_action( self, action ):
if action not in self.actions:
return self.actions.append( action )
raise 'action (%s) already exists in permissions list (%s: %s).' % ( action, self.id, self.actions )
def remove_action( self, action ):
return self.actions.remove( action )
class Role( object ):
access_actions = Permission.role_actions
def __init__( self, name, priority = 0 ):
self.name = name
self.priority = priority
def add_user( self, user ):
assoc = UserRoleAssociation( user, self )
@@ -217,18 +219,27 @@ class AccessRole( object ):
assoc = GroupRoleAssociation( group, self )
assoc.flush()
return assoc
def add_role( self, role ):
assoc = RoleRoleAssociation( role, self )
def add_permission( self, permission ):
assoc = RolePermissionAssociation( self, permission )
assoc.flush()
return assoc
def add_dataset( self, dataset ):
assoc = RoleDatasetAssociation( self, dataset )
assoc.flush()
return assoc
def add_control_role( self, role ):
assoc = RoleControlRoleAssociation( role, self )
assoc.flush()
return assoc
class GalaxyGroup( object ):
class Group( object ):
public_id = None
access_actions = AccessRole.group_actions
access_actions = Permission.group_actions
@classmethod
def get_public_group( cls ):
return Group.get( cls.public_id )
def __init__( self, name, priority = 0 ):
self.name = name
self.priority = priority
@@ -238,26 +249,31 @@ class GalaxyGroup( object ):
return assoc
def add_role( self, role ):
return role.add_group( self )
def add_access_role( self, role ):
assoc = GroupRoleAccessAssociation( self, role )
assoc.flush()
return assoc
def add_dataset( self, dataset ):
assoc = GroupDatasetAssociation( self, dataset )
assoc.flush()
return assoc
def add_control_role( self, role ):
assoc = GroupControlRoleAssociation( self, role )
assoc.flush()
return assoc
class RolePermissionAssociation( object ):
def __init__( self, role, permission ):
self.role = role
self.permission = permission
class UserGroupAssociation( object ):
def __init__( self, user, group ):
self.user = user
self.group = group
class RoleRoleAssociation( object ):
class RoleControlRoleAssociation( object ):
def __init__( self, role, target_role ):
self.role = role
self.target_role = target_role
class GroupRoleAccessAssociation( object ):
class GroupControlRoleAssociation( object ):
def __init__( self, group, role ):
self.group = group
self.role = role
@@ -328,10 +344,10 @@ class Dataset( object ):
EMPTY = 'empty',
ERROR = 'error',
DISCARDED = 'discarded' )
access_actions = AccessRole.dataset_actions
access_actions = Permission.dataset_actions
file_path = "/tmp/"
engine = None
def __init__( self, id=None, state=None, external_filename=None, extra_files_path=None, file_size=None, purgable=True, access_groups=[], access_roles=[] ):
def __init__( self, id=None, state=None, external_filename=None, extra_files_path=None, file_size=None, purgable=True ):
self.id = id
self.state = state
self.deleted = False
@@ -340,14 +356,7 @@ class Dataset( object ):
self.external_filename = external_filename
self._extra_files_path = extra_files_path
self.file_size = file_size
if access_groups or access_roles:
#self.flush()
for group in access_groups:
group.add_dataset( self )
group.flush()
for role in access_roles:
role.add_dataset( self )
role.flush()
def get_file_name( self ):
if not self.external_filename:
assert self.id is not None, "ID must be set before filename used (commit the object)"
@@ -416,20 +425,23 @@ class Dataset( object ):
#if dataset is in public group, we always return true for viewing and using
#this may need to change when the ability to alter groups and roles is allowed
if action in [ self.access_actions.USE, self.access_actions.VIEW ] and GroupDatasetAssociation.get_by( group_id = GalaxyGroup.public_id, dataset_id = self.id ):
if action in [ self.access_actions.USE, self.access_actions.VIEW ] and GroupDatasetAssociation.get_by( group_id = Group.public_id, dataset_id = self.id ):
return True
elif user is not None:
#loop through permissions and if allowed return true:
#check roles associated directly with dataset first
for role_dataset_assoc in self.roles:
if action in role_dataset_assoc.role.actions and user.has_role( role_dataset_assoc.role ):
return True
if user.has_role( role_dataset_assoc.role ):
for permission in role_dataset_assoc.role.permissions:
if action in permission.permission.actions:
return True
#check roles associated with dataset through groups
for group_dataset_assoc in self.groups:
if user.has_group( group_dataset_assoc.group ):
for group_role_assoc in group_dataset_assoc.group.roles:
if action in group_role_assoc.role.actions:
return True
for permission in group_role_assoc.role.permissions:
if action in permission.permission.actions:
return True
return False #no user and dataset not in public group, or user lacks permission
def guess_derived_groups_roles( self, other_datasets = [] ):
"""Returns a list of output roles and groups based upon itself and provided datasets"""
@@ -490,7 +502,22 @@ class Dataset( object ):
return group.add_dataset( self )
def add_role( self, role ):
return role.add_dataset( self )
def set_groups( self, groups ):
for assoc in self.groups:
assoc.delete()
assoc.flush()
for group in groups:
if not isinstance( group, Group ):
group = group.group
self.add_group( group )
def set_roles( self, roles ):
for assoc in self.roles:
assoc.delete()
assoc.flush()
for role in roles:
if not isinstance( role, Role ):
role = role.role
self.add_role( role )
def has_group( self, group ):
return bool( GroupDatasetAssociation.get_by( group_id = group.id, dataset_id = self.id ) )
def has_role( self, role ):
@@ -512,7 +539,7 @@ class HistoryDatasetAssociation( object ):
def __init__( self, id=None, hid=None, name=None, info=None, blurb=None, peek=None, extension=None,
dbkey=None, metadata=None, history=None, dataset=None, deleted=False, designation=None,
parent_id=None, copied_from_history_dataset_association = None, validation_errors=None,
visible=True, create_dataset = False, access_groups = [], access_roles = [] ):
visible=True, create_dataset = False ):
self.name = name or "Unnamed dataset"
self.id = id
self.hid = hid
@@ -528,7 +555,7 @@ class HistoryDatasetAssociation( object ):
# Relationships
self.history = history
if not dataset and create_dataset:
dataset = Dataset( access_groups = access_groups, access_roles = access_roles )
dataset = Dataset()
dataset.flush()
self.dataset = dataset
self.parent_id = parent_id
@@ -684,7 +711,7 @@ class HistoryDatasetAssociation( object ):
class History( object ):
def __init__( self, id=None, name=None, user=None, default_roles = [], default_groups = [] ):
def __init__( self, id=None, name=None, user=None ):
self.id = id
self.name = name or "Unnamed history"
self.deleted = False
@@ -695,17 +722,7 @@ class History( object ):
self.datasets = []
self.galaxy_sessions = []
if not default_roles:
if user:
default_roles = user.default_roles
if not default_groups:
if user:
default_groups = user.default_groups
else:
default_groups = [ GalaxyGroup.get( GalaxyGroup.public_id ) ]
self.set_default_access( roles = default_roles, groups = default_groups )
self.set_default_access()
def _next_hid( self ):
# TODO: override this with something in the database that ensures
@@ -760,6 +777,13 @@ class History( object ):
return des
def set_default_access( self, groups = None, roles = None, dataset = False ):
if groups is None and roles is None:
if self.user:
groups = self.user.default_groups
roles = self.user.default_roles
else:
groups = [ Group.get_public_group() ]
roles = []
if groups is not None:
for assoc in self.default_groups: #this is the association not the actual group
assoc.delete()
@@ -778,20 +802,12 @@ class History( object ):
for data in self.datasets:
for hda in data.dataset.history_associations:
if self.user and hda.history not in self.user.histories:
data.dataset.set_groups( [ Group.get_public_group() ] )
data.dataset.set_roles( [] )
break
else:
if groups is not None:
for assoc in data.dataset.groups: #this is the association not the actual group
assoc.delete()
assoc.flush()
for group in groups:
group.add_dataset( data )
if roles is not None:
for assoc in data.dataset.roles: #this is the association not the actual group
assoc.delete()
assoc.flush()
for role in roles:
role.add_dataset( data )
data.dataset.set_groups( groups )
data.dataset.set_roles( roles )
lib/galaxy/model/mapping.py
+76 -46
View File
@@ -114,7 +114,7 @@ ValidationError.table = Table( "validation_error", metadata,
Column( "err_type", TrimmedString( 64 ) ),
Column( "attributes", TEXT ) )
GalaxyGroup.table = Table( "galaxy_group", metadata,
Group.table = Table( "galaxy_group", metadata,
Column( "id", Integer, primary_key=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ),
@@ -128,25 +128,38 @@ UserGroupAssociation.table = Table( "user_group_association", metadata,
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ) )
AccessRole.table = Table( "access_role", metadata,
Permission.table = Table( "permission", metadata,
Column( "id", Integer, primary_key=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ),
Column( "name", TEXT ),
Column( "actions", JSONType(), default=[] ) )
Role.table = Table( "role", metadata,
Column( "id", Integer, primary_key=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ),
Column( "name", TEXT ),
Column( "actions", JSONType(), default=[] ),
Column( "priority", Integer ) )
RolePermissionAssociation.table = Table( "role_permission_association", metadata,
Column( "id", Integer, primary_key=True ),
Column( "role_id", Integer, ForeignKey( "role.id" ), index=True ),
Column( "permission_id", Integer, ForeignKey( "permission.id" ), index=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ) )
UserRoleAssociation.table = Table( "user_role_association", metadata,
Column( "id", Integer, primary_key=True ),
Column( "user_id", Integer, ForeignKey( "galaxy_user.id" ), index=True ),
Column( "role_id", Integer, ForeignKey( "access_role.id" ), index=True ),
Column( "role_id", Integer, ForeignKey( "role.id" ), index=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ) )
GroupRoleAssociation.table = Table( "group_role_association", metadata,
Column( "id", Integer, primary_key=True ),
Column( "group_id", Integer, ForeignKey( "galaxy_group.id" ), index=True ),
Column( "role_id", Integer, ForeignKey( "access_role.id" ), index=True ),
Column( "role_id", Integer, ForeignKey( "role.id" ), index=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ) )
@@ -159,21 +172,21 @@ GroupDatasetAssociation.table = Table( "group_dataset_association", metadata,
RoleDatasetAssociation.table = Table( "role_dataset_association", metadata,
Column( "id", Integer, primary_key=True ),
Column( "role_id", Integer, ForeignKey( "access_role.id" ), index=True ),
Column( "role_id", Integer, ForeignKey( "role.id" ), index=True ),
Column( "dataset_id", Integer, ForeignKey( "dataset.id" ), index=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ) )
RoleRoleAssociation.table = Table( "role_role_association", metadata,
RoleControlRoleAssociation.table = Table( "role_control_role_association", metadata,
Column( "id", Integer, primary_key=True ),
Column( "role_id", Integer, ForeignKey( "access_role.id" ), index=True ),
Column( "target_role_id", Integer, ForeignKey( "access_role.id" ), index=True ),
Column( "role_id", Integer, ForeignKey( "role.id" ), index=True ),
Column( "target_role_id", Integer, ForeignKey( "role.id" ), index=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ) )
GroupRoleAccessAssociation.table = Table( "group_role_access_association", metadata,
GroupControlRoleAssociation.table = Table( "group_control_role_association", metadata,
Column( "id", Integer, primary_key=True ),
Column( "role_id", Integer, ForeignKey( "access_role.id" ), index=True ),
Column( "role_id", Integer, ForeignKey( "role.id" ), index=True ),
Column( "group_id", Integer, ForeignKey( "galaxy_group.id" ), index=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ) )
@@ -181,7 +194,7 @@ GroupRoleAccessAssociation.table = Table( "group_role_access_association", metad
DefaultUserRoleAssociation.table = Table( "default_user_role_association", metadata,
Column( "id", Integer, primary_key=True ),
Column( "role_id", Integer, ForeignKey( "access_role.id" ), index=True ),
Column( "role_id", Integer, ForeignKey( "role.id" ), index=True ),
Column( "user_id", Integer, ForeignKey( "galaxy_user.id" ), index=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ) )
@@ -195,7 +208,7 @@ DefaultUserGroupAssociation.table = Table( "default_user_group_association", met
DefaultHistoryRoleAssociation.table = Table( "default_history_role_association", metadata,
Column( "id", Integer, primary_key=True ),
Column( "role_id", Integer, ForeignKey( "access_role.id" ), index=True ),
Column( "role_id", Integer, ForeignKey( "role.id" ), index=True ),
Column( "history_id", Integer, ForeignKey( "history.id" ), index=True ),
Column( "create_time", DateTime, default=now ),
Column( "update_time", DateTime, default=now, onupdate=now ) )
@@ -391,55 +404,62 @@ assign_mapper( context, User, User.table,
collection_class=ordering_list( 'order_index' ) )
) )
assign_mapper( context, GalaxyGroup, GalaxyGroup.table,
assign_mapper( context, Group, Group.table,
properties=dict( users=relation( UserGroupAssociation ),
datasets=relation( GroupDatasetAssociation ) ) )
assign_mapper( context, UserGroupAssociation, UserGroupAssociation.table,
properties=dict( user=relation( User, backref = "groups" ),
group=relation( GalaxyGroup, backref = "users" ) ) )
group=relation( Group, backref = "users" ) ) )
assign_mapper( context, UserRoleAssociation, UserRoleAssociation.table,
properties=dict( role=relation( AccessRole, backref = "users" ),
properties=dict( role=relation( Role, backref = "users" ),
user=relation( User, backref = "roles" ) ) )
assign_mapper( context, GroupRoleAssociation, GroupRoleAssociation.table,
properties=dict( role=relation( AccessRole, backref = "groups" ),
group=relation( GalaxyGroup, backref = "roles" ) ) )
properties=dict( role=relation( Role, backref = "groups" ),
group=relation( Group, backref = "roles" ) ) )
assign_mapper( context, Permission, Permission.table )
assign_mapper( context, Role, Role.table )
assign_mapper( context, RolePermissionAssociation, RolePermissionAssociation.table,
properties=dict( role=relation( Role, backref = "permissions" ),
permission=relation( Permission, backref = "roles" ) ) )
assign_mapper( context, AccessRole, AccessRole.table )
assign_mapper( context, GroupDatasetAssociation, GroupDatasetAssociation.table,
properties=dict( dataset=relation( Dataset, backref = "groups" ),
group=relation( GalaxyGroup, backref = "datasets" ) ) )
group=relation( Group, backref = "datasets" ) ) )
assign_mapper( context, RoleDatasetAssociation, RoleDatasetAssociation.table,
properties=dict( dataset=relation( Dataset, backref = "roles" ),
role=relation( AccessRole ) ) )
role=relation( Role ) ) )
assign_mapper( context, RoleRoleAssociation, RoleRoleAssociation.table,
properties=dict( role=relation( AccessRole, primaryjoin=( ( RoleRoleAssociation.table.c.role_id == AccessRole.table.c.id ) ) ),
target_role=relation( AccessRole, primaryjoin=( RoleRoleAssociation.table.c.target_role_id == AccessRole.table.c.id ), backref="roles" ) ) )
assign_mapper( context, RoleControlRoleAssociation, RoleControlRoleAssociation.table,
properties=dict( role=relation( Role, primaryjoin=( ( RoleControlRoleAssociation.table.c.role_id == Role.table.c.id ) ) ),
target_role=relation( Role, primaryjoin=( RoleControlRoleAssociation.table.c.target_role_id == Role.table.c.id ), backref="roles" ) ) )
assign_mapper( context, GroupRoleAccessAssociation, GroupRoleAccessAssociation.table,
properties=dict( role=relation( AccessRole, backref="access_groups" ),
group=relation( GalaxyGroup, backref="access_roles" ) ) )
assign_mapper( context, GroupControlRoleAssociation, GroupControlRoleAssociation.table,
properties=dict( role=relation( Role, backref="access_groups" ),
group=relation( Group, backref="access_roles" ) ) )
assign_mapper( context, DefaultUserRoleAssociation, DefaultUserRoleAssociation.table,
properties=dict( user=relation( User, backref = "default_roles" ),
role=relation( AccessRole ) ) )
role=relation( Role ) ) )
assign_mapper( context, DefaultUserGroupAssociation, DefaultUserGroupAssociation.table,
properties=dict( user=relation( User, backref = "default_groups" ),
group=relation( GalaxyGroup ) ) )
group=relation( Group ) ) )
assign_mapper( context, DefaultHistoryRoleAssociation, DefaultHistoryRoleAssociation.table,
properties=dict( history=relation( History, backref = "default_roles" ),
role=relation( AccessRole ) ) )
role=relation( Role ) ) )
assign_mapper( context, DefaultHistoryGroupAssociation, DefaultHistoryGroupAssociation.table,
properties=dict( history=relation( History, backref = "default_groups" ),
group=relation( GalaxyGroup ) ) )
group=relation( Group ) ) )
assign_mapper( context, JobToInputDatasetAssociation, JobToInputDatasetAssociation.table,
properties=dict( job=relation( Job ), dataset=relation( HistoryDatasetAssociation ) ) )
@@ -555,32 +575,42 @@ def init( file_path, url, engine_options={}, create_tables=False ):
result.context = context
result.create_tables = create_tables
#set up default table entries here, currently only exist for access controls
if result.AccessRole.count() == 0:
if result.Role.count() == 0:
log.warning( "There were no access roles located, setting up default (public) access roles." )
#create public group
public_group = result.GalaxyGroup( 'public' )
public_group = result.Group( 'public' )
public_group.flush()
#create public_all role
public_role = result.AccessRole( 'public', [ result.Dataset.access_actions.USE, result.Dataset.access_actions.VIEW, result.GalaxyGroup.access_actions.ADD_DATASET, result.GalaxyGroup.access_actions.REMOVE_DATASET ] )
public_role = result.Role( 'public' )
public_role.flush()
public_group.add_role( public_role )
permission = result.Permission( 'public', [ result.Dataset.access_actions.USE, result.Dataset.access_actions.VIEW, result.Group.access_actions.ADD_DATASET, result.Group.access_actions.REMOVE_DATASET ] )
permission.flush()
public_role.add_permission( permission )
#store public group id
GalaxyGroup.public_id = public_group.id #we use the id instead of the object, because of alchemy sessions
#add all datasets to public group
for dataset in result.Dataset.select():
public_group.add_dataset( dataset )
Group.public_id = public_group.id #we use the id instead of the object, because of alchemy sessions
#loop through all current users and associate with the public group
#and create and associate with user's own group
for user in result.User.select():
public_group.add_user( user )
private_group = user.create_private_group()
user.set_default_access( groups = [ public_group, private_group ], roles = [], history = True, dataset = True )
#loop through all histories and set up rbac on users, histories and datasets
for history in result.History.select():
if history.user:
if not history.user.default_groups:
history.user.set_default_access( history = True, dataset = True )
history.user.add_group( public_group )
history.user.flush()
else:
history.set_default_access( dataset = True )
history.flush()
#add all datasets which aren't in a history to the public group
orphans = result.Dataset.get_by( history_id = None )
if orphans:
for dataset in orphans:
dataset.set_groups( [ public_group ] )
dataset.set_roles( [] )
else:
#retrieve from database and store public group id, assume first created group is public
GalaxyGroup.public_id = result.GalaxyGroup.select( order_by = asc( result.GalaxyGroup.table.c.create_time ) )[0].id #we use the id instead of the object, because of alchemy sessions
log.debug( "Public Group identified as id = %s." % ( GalaxyGroup.public_id ) )
Group.public_id = result.Group.select( order_by = asc( result.Group.table.c.create_time ) )[0].id #we use the id instead of the object, because of alchemy sessions
log.debug( "Public Group identified as id = %s." % ( Group.public_id ) )
return result
def get_suite():
lib/galaxy/tools/__init__.py
+6 -2
View File
@@ -1084,7 +1084,9 @@ class Tool:
if visible == "visible": visible = True
else: visible = False
ext = fields.pop(0).lower()
child_dataset = self.app.model.HistoryDatasetAssociation( extension=ext, parent_id=outdata.id, designation=designation, visible=visible, dbkey=outdata.dbkey, create_dataset=True, access_groups=outdata.dataset.groups, access_roles=outdata.dataset.roles )
child_dataset = self.app.model.HistoryDatasetAssociation( extension=ext, parent_id=outdata.id, designation=designation, visible=visible, dbkey=outdata.dbkey, create_dataset=True )
child_dataset.dataset.set_groups( outdata.dataset.groups )
child_dataset.dataset.set_roles( outdata.dataset.roles )
# Move data from temp location to dataset location
shutil.move( filename, child_dataset.file_name )
child_dataset.flush()
@@ -1120,7 +1122,9 @@ class Tool:
else: visible = False
ext = fields.pop(0).lower()
# Create new primary dataset
primary_data = self.app.model.HistoryDatasetAssociation( extension=ext, designation=designation, visible=visible, dbkey=outdata.dbkey, create_dataset=True, access_groups=outdata.dataset.groups, access_roles=outdata.dataset.roles )
primary_data = self.app.model.HistoryDatasetAssociation( extension=ext, designation=designation, visible=visible, dbkey=outdata.dbkey, create_dataset=True )
primary_data.dataset.set_groups( outdata.dataset.groups )
primary_data.dataset.set_roles( outdata.dataset.roles )
primary_data.flush()
# Move data from temp location to dataset location
shutil.move( filename, primary_data.file_name )
lib/galaxy/tools/actions/__init__.py
+3 -1
View File
@@ -129,7 +129,9 @@ class DefaultToolAction( object ):
ext = output.format
if ext == "input":
ext = input_ext
data = trans.app.model.HistoryDatasetAssociation( extension=ext, create_dataset=True, access_groups=output_access_groups, access_roles=output_access_roles )
data = trans.app.model.HistoryDatasetAssociation( extension=ext, create_dataset=True )
data.dataset.set_groups( output_access_groups )
data.dataset.set_roles( output_access_roles )
# Commit the dataset immediately so it gets database assigned unique id
data.flush()
# Create an empty file immediately
lib/galaxy/tools/actions/upload.py
+6 -2
View File
@@ -65,7 +65,9 @@ class UploadToolAction( object ):
return dict( output=data_list[0] )
def upload_empty(self, trans, err_code, err_msg):
data = trans.app.model.HistoryDatasetAssociation( create_dataset = True, access_groups = [ group.group for group in trans.history.default_groups ], access_roles = [ role.role for role in trans.history.default_roles ] )
data = trans.app.model.HistoryDatasetAssociation( create_dataset = True )
data.dataset.set_groups( trans.history.default_groups )
data.dataset.set_roles( trans.history.default_roles )
data.name = err_code
data.extension = "txt"
data.dbkey = "?"
@@ -158,7 +160,9 @@ class UploadToolAction( object ):
if info is None:
info = 'uploaded %s file' %data_type
data = trans.app.model.HistoryDatasetAssociation( history = trans.history, extension = ext, create_dataset = True, access_groups = [ group.group for group in trans.history.default_groups ], access_roles = [ role.role for role in trans.history.default_roles ] )
data = trans.app.model.HistoryDatasetAssociation( history = trans.history, extension = ext, create_dataset = True )
data.dataset.set_groups( trans.history.default_groups )
data.dataset.set_roles( trans.history.default_roles )
data.name = file_name
data.dbkey = dbkey
data.info = info
lib/galaxy/tools/parameters/basic.py
+22 -9
View File
@@ -979,21 +979,34 @@ class DataToolParameter( ToolParameter ):
displayed as radio buttons and multiple selects as a set of checkboxes
>>> # Mock up a history (not connected to database)
>>> from galaxy.model import History, HistoryDatasetAssociation, User, AccessRole, GalaxyGroup, GroupRoleAssociation
>>> from galaxy.model import History, HistoryDatasetAssociation, User, Role, Permission, Group, GroupRoleAssociation
>>> from galaxy.util.bunch import Bunch
>>> hist = History()
>>> hist.flush()
>>> role = AccessRole( 'test', list( AccessRole.dataset_actions.__dict__.values() ) )
>>> permission = Permission( 'test', list( Permission.dataset_actions.__dict__.values() ) )
>>> permission.flush()
>>> role = Role( 'test' )
>>> role.flush()
>>> group = GalaxyGroup( 'test' )
>>> assoc = role.add_permission( permission )
>>> group = Group( 'test' )
>>> group.flush()
>>> GalaxyGroup.public_id = group.id
>>> Group.public_id = group.id
>>> GroupRoleAssociation( group, role ).flush()
>>> hist.add_dataset( HistoryDatasetAssociation( id=1, extension='txt', create_dataset=True, access_groups=[ group ] ) )
>>> hist.add_dataset( HistoryDatasetAssociation( id=2, extension='bed', create_dataset=True, access_groups=[ group ] ) )
>>> hist.add_dataset( HistoryDatasetAssociation( id=3, extension='fasta', create_dataset=True, access_groups=[ group ] ) )
>>> hist.add_dataset( HistoryDatasetAssociation( id=4, extension='png', create_dataset=True, access_groups=[ group ] ) )
>>> hist.add_dataset( HistoryDatasetAssociation( id=5, extension='interval', create_dataset=True, access_groups=[ group ] ) )
>>> dataset1 = HistoryDatasetAssociation( id=1, extension='txt', create_dataset=True )
>>> dataset1.dataset.set_groups( [ group ] )
>>> dataset2 = HistoryDatasetAssociation( id=2, extension='bed', create_dataset=True )
>>> dataset2.dataset.set_groups( [ group ] )
>>> dataset3 = HistoryDatasetAssociation( id=3, extension='fasta', create_dataset=True )
>>> dataset3.dataset.set_groups( [ group ] )
>>> dataset4 = HistoryDatasetAssociation( id=4, extension='png', create_dataset=True )
>>> dataset4.dataset.set_groups( [ group ] )
>>> dataset5 = HistoryDatasetAssociation( id=5, extension='interval', create_dataset=True )
>>> dataset5.dataset.set_groups( [ group ] )
>>> hist.add_dataset( dataset1 )
>>> hist.add_dataset( dataset2 )
>>> hist.add_dataset( dataset3 )
>>> hist.add_dataset( dataset4 )
>>> hist.add_dataset( dataset5 )
>>> p = DataToolParameter( None, XML( '<param name="blah" type="data" format="interval"/>' ) )
>>> print p.name
blah
lib/galaxy/web/controllers/async.py
+3 -1
View File
@@ -103,7 +103,9 @@ class ASync( BaseController ):
#data.state = jobs.JOB_OK
#history.datasets.add_dataset( data )
data = trans.app.model.HistoryDatasetAssociation( create_dataset = True, extension = GALAXY_TYPE, access_groups = [ group.group for group in trans.history.default_groups ], access_roles = [ role.role for role in trans.history.default_roles ] )
data = trans.app.model.HistoryDatasetAssociation( create_dataset = True, extension = GALAXY_TYPE )
data.dataset.set_groups( trans.history.default_groups )
data.dataset.set_roles( trans.history.default_roles )
data.name = GALAXY_NAME
data.dbkey = GALAXY_BUILD
data.info = GALAXY_INFO
lib/galaxy/web/controllers/root.py
+5 -3
View File
@@ -265,7 +265,7 @@ class RootController( BaseController ):
if not trans.user:
return trans.show_error_message( "You must be logged in if you want to change dataset permissions." )
private_dataset = 'private_dataset'
public_group = trans.app.model.GalaxyGroup.get( trans.app.model.GalaxyGroup.public_id )
public_group = trans.app.model.Group.get_public_group()
if private_dataset in kwd and data.dataset.has_group( public_group ):
#check user has permision and then remove public group
if data.dataset.allow_action( trans.user, data.dataset.access_actions.REMOVE_GROUP ):
@@ -599,7 +599,9 @@ class RootController( BaseController ):
copy_access_from = trans.app.model.HistoryDatasetAssociation.get( copy_access_from )
roles = copy_access_from.dataset.roles
groups = copy_access_from.dataset.groups
data = trans.app.model.HistoryDatasetAssociation( name = name, info = info, extension = ext, dbkey = dbkey, create_dataset = True, access_groups = groups, access_roles = roles )
data = trans.app.model.HistoryDatasetAssociation( name = name, info = info, extension = ext, dbkey = dbkey, create_dataset = True )
data.dataset.set_groups( groups )
data.dataset.set_roles( roles )
data.flush()
data_file = open( data.file_name, "wb" )
file_data.file.seek( 0 )
@@ -633,7 +635,7 @@ class RootController( BaseController ):
#collect groups as entered by user
for name, value in kwd.items():
if name.startswith( "group_" ):
group = trans.app.model.GalaxyGroup.get( name.replace( "group_", "", 1 ) )
group = trans.app.model.Group.get( name.replace( "group_", "", 1 ) )
if not group:
return trans.show_error_message( 'You have specified an invalid group.' )
if value == 'in':
lib/galaxy/web/controllers/user.py
+1 -1
View File
@@ -179,7 +179,7 @@ class User( BaseController ):
#collect groups as entered by user
for name, value in kwd.items():
if name.startswith( "group_" ):
group = trans.app.model.GalaxyGroup.get( name.replace( "group_", "", 1 ) )
group = trans.app.model.Group.get( name.replace( "group_", "", 1 ) )
if not group:
return trans.show_error_message( 'You have specified an invalid group.' )
if value == 'in':
lib/galaxy/web/framework/__init__.py
+1 -1
View File
@@ -433,7 +433,7 @@ class UniverseWebTransaction( base.DefaultWebTransaction ):
if history is not None and user is not None:
if not history.user:
#This user will now aquire previously unowned history, let set permissions to user's default
history.set_default_access( roles = [ role.role for role in user.default_roles ], groups = [ group.group for group in user.default_groups ], dataset = True )
history.set_default_access( roles = user.default_roles, groups = user.default_groups, dataset = True )
history.user_id = user.id
history.flush()
self.__history = history
templates/dataset/edit_attributes.mako
+1 -1
View File
@@ -144,7 +144,7 @@
Private Dataset:
</label>
<% checked = "" %>
%if not data.dataset.has_group( trans.app.model.GalaxyGroup.get( trans.app.model.GalaxyGroup.public_id ) ):
%if not data.dataset.has_group( trans.app.model.Group.get_public_group() ):
<% checked = " checked" %>
%endif
<div style="float: left; width: 250px; margin-right: 10px;">