On 11/03/2011 06:22 AM, Tomas Sedovic wrote:
On 11/03/2011 01:52 AM, Chris Alfonso wrote:
> This introduces a new default self service permissing HWP Global User
> ---
> ...1102125644_alter_metadata_object_value_limit.rb | 5 +++++
> src/db/seeds.rb | 13
> ++++++++++---
> 2 files changed, 15 insertions(+), 3 deletions(-)
> create mode 100644
> src/db/migrate/20111102125644_alter_metadata_object_value_limit.rb
>
> diff --git
> a/src/db/migrate/20111102125644_alter_metadata_object_value_limit.rb
> b/src/db/migrate/20111102125644_alter_metadata_object_value_limit.rb
> new file mode 100644
> index 0000000..2f1ab16
> --- /dev/null
> +++ b/src/db/migrate/20111102125644_alter_metadata_object_value_limit.rb
> @@ -0,0 +1,5 @@
> +class AlterMetadataObjectValueLimit< ActiveRecord::Migration
> + def self.up
> + execute "ALTER TABLE metadata_objects ALTER COLUMN value TYPE
> varchar(510)"
> + end
> +end
> diff --git a/src/db/seeds.rb b/src/db/seeds.rb
> index 9febfc4..6bf0f28 100644
> --- a/src/db/seeds.rb
> +++ b/src/db/seeds.rb
> @@ -60,8 +60,7 @@ roles =
> {"Provider Account User" => [false, {ProviderAccount =>
> [VIEW,USE]}],
> "Provider Account Owner" => [true, {ProviderAccount =>
> [VIEW,USE,MOD, VPRM,GPRM]}]},
> Catalog =>
> - {"Catalog User" => [false, {Catalog => [VIEW,
USE]}],
> - "Catalog Administrator" => [true, {Catalog =>
> [VIEW,USE,MOD,VPRM,GPRM]}]},
> + {"Catalog Administrator" => [true, {Catalog =>
> [VIEW,USE,MOD,VPRM,GPRM]}]},
> CatalogEntry =>
> {"CatalogEntry User" => [false, {CatalogEntry
> => [VIEW,USE]}],
> "CatalogEntry Owner" => [true, {CatalogEntry
> => [VIEW,USE,MOD,VPRM,GPRM]}]},
> @@ -70,6 +69,7 @@ roles =
> "Provider Administrator" => [false, {Provider =>
> [VIEW, MOD,CRE,VPRM,GPRM],
> ProviderAccount =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM]}],
> "HWP Administrator" => [false, {HardwareProfile =>
> [VIEW, MOD,CRE,VPRM,GPRM]}],
> + "HWP Global User" => [false, {HardwareProfile
> => [VIEW]}],
> "Realm Administrator" => [false, {Realm => [
> USE,MOD,CRE,VPRM,GPRM]}],
> "Pool Creator" => [false, {Pool =>
> [ CRE]}],
> "Pool Administrator" => [false, {Pool =>
> [VIEW, MOD,CRE,VPRM,GPRM],
> @@ -79,6 +79,7 @@ roles =
> PoolFamily =>
> [VIEW, MOD,CRE,VPRM,GPRM]}],
> "CatalogEntry Administrator" => [false, {CatalogEntry =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM]}],
> "CatalogEntry Global User" => [false, {CatalogEntry=>
> [VIEW,USE]}],
> + "Catalog Global User" => [false, {Catalog => [VIEW,
> USE]}],
> "Pool Global User" => [false, {Pool
> => [VIEW],
> Instance
> => [ CRE],
> Deployment
> => [ CRE],
> @@ -124,7 +125,9 @@ default_quota = Quota.create
> default_pool = Pool.find_by_name("Default")
> default_role = Role.find_by_name("Pool User")
> default_catalog_entry_role = Role.find_by_name("CatalogEntry Global
> User")
> +default_catalog_global_user_role = Role.find_by_name("Catalog Global
> User")
> default_pool_global_user_role = Role.find_by_name("Pool Global User")
> +default_hwp_global_user_role = Role.find_by_name("HWP Global User")
>
> settings = {"allow_self_service_logins" => "true",
> "self_service_default_quota" => default_quota,
> @@ -132,11 +135,15 @@ settings = {"allow_self_service_logins" =>
> "true",
> "self_service_default_role" => default_role,
> "self_service_default_catalog_entry_obj" =>
> BasePermissionObject.general_permission_scope,
> "self_service_default_catalog_entry_role" =>
> default_catalog_entry_role,
> + "self_service_default_catalog_global_user_obj" =>
> BasePermissionObject.general_permission_scope,
> + "self_service_default_catalog_global_user_role" =>
> default_catalog_global_user_role,
> "self_service_default_pool_global_user_obj" =>
> BasePermissionObject.general_permission_scope,
> "self_service_default_pool_global_user_role" =>
> default_pool_global_user_role,
> + "self_service_default_hwp_global_user_obj" =>
> BasePermissionObject.general_permission_scope,
> + "self_service_default_hwp_global_user_role" =>
> default_hwp_global_user_role,
> # perm list in the format:
> # "[resource1_key, resource1_role], [resource2_key,
> resource2_role], ..."
> - "self_service_perms_list" =>
> "[self_service_default_pool,self_service_default_role],
> [self_service_default_catalog_entry_obj,self_service_default_catalog_entry_role],
>
[self_service_default_pool_global_user_obj,self_service_default_pool_global_user_role]"}
>
> + "self_service_perms_list" =>
> "[self_service_default_pool,self_service_default_role],
> [self_service_default_catalog_entry_obj,self_service_default_catalog_entry_role],
>
[self_service_default_catalog_global_user_obj,self_service_default_catalog_global_user_role],
>
[self_service_default_pool_global_user_obj,self_service_default_pool_global_user_role],[self_service_default_hwp_global_user_obj,self_service_default_hwp_global_user_role]"}
>
> settings.each_pair do |key, value|
> MetadataObject.set(key, value)
> end
Hi Chris,
This is looking good and works as expected.
However, it only works when you run the full `rake dc:setup` (which
invokes `db:seeds` which in turn sets the default permissions up).
If you have an existing setup and run just the migrations after
applying the patch, the permission issue is still there.
Would you please add a new migration that correct the permissions as
well? I know it's a duplicated work, but it's not a good idea to ask
users to trash all their data to fix a bug.
Thomas
Be careful with the migration though -- any migration that modifies or
adds data needs to only do it if db:seed has already run (i.e. when
db:migrate is run on a new db before db:seed, data migrations (as
opposed to schema migrations) shouldn't do anything. In this case, in
the migration, don't add any new roles or privileges unless there are
already roles and privileges in the database.
Scott