On 03/11/11 09:10 -0400, Scott Seago wrote:
On 11/03/2011 06:22 AM, Tomas Sedovic wrote:
>On 11/03/2011 01:52 AM, Chris Alfonso wrote:
>>This introduces a new default self service permissing HWP Global User
>>---
>> ...1102125644_alter_metadata_object_value_limit.rb | 5 +++++
>> src/db/seeds.rb | 13
>>++++++++++---
>> 2 files changed, 15 insertions(+), 3 deletions(-)
>> create mode 100644
>>src/db/migrate/20111102125644_alter_metadata_object_value_limit.rb
>>
>>diff --git a/src/db/migrate/20111102125644_alter_metadata_object_value_limit.rb
b/src/db/migrate/20111102125644_alter_metadata_object_value_limit.rb
>>new file mode 100644
>>index 0000000..2f1ab16
>>--- /dev/null
>>+++ b/src/db/migrate/20111102125644_alter_metadata_object_value_limit.rb
>>@@ -0,0 +1,5 @@
>>+class AlterMetadataObjectValueLimit< ActiveRecord::Migration
>>+ def self.up
>>+ execute "ALTER TABLE metadata_objects ALTER COLUMN value
>>TYPE varchar(510)"
>>+ end
>>+end
>>diff --git a/src/db/seeds.rb b/src/db/seeds.rb
>>index 9febfc4..6bf0f28 100644
>>--- a/src/db/seeds.rb
>>+++ b/src/db/seeds.rb
>>@@ -60,8 +60,7 @@ roles =
>> {"Provider Account User" => [false, {ProviderAccount =>
>>[VIEW,USE]}],
>> "Provider Account Owner" => [true, {ProviderAccount =>
>>[VIEW,USE,MOD, VPRM,GPRM]}]},
>> Catalog =>
>>- {"Catalog User" => [false, {Catalog => [VIEW,
USE]}],
>>- "Catalog Administrator" => [true, {Catalog =>
>>[VIEW,USE,MOD,VPRM,GPRM]}]},
>>+ {"Catalog Administrator" => [true, {Catalog =>
>>[VIEW,USE,MOD,VPRM,GPRM]}]},
>> CatalogEntry =>
>> {"CatalogEntry User" => [false, {CatalogEntry
>>=> [VIEW,USE]}],
>> "CatalogEntry Owner" => [true, {CatalogEntry
>>=> [VIEW,USE,MOD,VPRM,GPRM]}]},
>>@@ -70,6 +69,7 @@ roles =
>> "Provider Administrator" => [false, {Provider =>
>>[VIEW, MOD,CRE,VPRM,GPRM],
>> ProviderAccount =>
>>[VIEW,USE,MOD,CRE,VPRM,GPRM]}],
>> "HWP Administrator" => [false, {HardwareProfile =>
>>[VIEW, MOD,CRE,VPRM,GPRM]}],
>>+ "HWP Global User" => [false,
>>{HardwareProfile => [VIEW]}],
>> "Realm Administrator" => [false, {Realm => [
>>USE,MOD,CRE,VPRM,GPRM]}],
>> "Pool Creator" => [false, {Pool => [
>>CRE]}],
>> "Pool Administrator" => [false, {Pool =>
>>[VIEW, MOD,CRE,VPRM,GPRM],
>>@@ -79,6 +79,7 @@ roles =
>> PoolFamily =>
>>[VIEW, MOD,CRE,VPRM,GPRM]}],
>> "CatalogEntry Administrator" => [false, {CatalogEntry =>
>>[VIEW,USE,MOD,CRE,VPRM,GPRM]}],
>> "CatalogEntry Global User" => [false, {CatalogEntry=>
>>[VIEW,USE]}],
>>+ "Catalog Global User" => [false, {Catalog =>
>>[VIEW, USE]}],
>> "Pool Global User" => [false, {Pool
>>=> [VIEW],
>> Instance
>>=> [ CRE],
>> Deployment
>>=> [ CRE],
>>@@ -124,7 +125,9 @@ default_quota = Quota.create
>> default_pool = Pool.find_by_name("Default")
>> default_role = Role.find_by_name("Pool User")
>> default_catalog_entry_role = Role.find_by_name("CatalogEntry
>>Global User")
>>+default_catalog_global_user_role = Role.find_by_name("Catalog
>>Global User")
>> default_pool_global_user_role = Role.find_by_name("Pool Global User")
>>+default_hwp_global_user_role = Role.find_by_name("HWP Global User")
>>
>> settings = {"allow_self_service_logins" => "true",
>> "self_service_default_quota" => default_quota,
>>@@ -132,11 +135,15 @@ settings = {"allow_self_service_logins" =>
>>"true",
>> "self_service_default_role" => default_role,
>> "self_service_default_catalog_entry_obj" =>
>>BasePermissionObject.general_permission_scope,
>> "self_service_default_catalog_entry_role" =>
>>default_catalog_entry_role,
>>+ "self_service_default_catalog_global_user_obj" =>
>>BasePermissionObject.general_permission_scope,
>>+ "self_service_default_catalog_global_user_role" =>
>>default_catalog_global_user_role,
>> "self_service_default_pool_global_user_obj" =>
>>BasePermissionObject.general_permission_scope,
>> "self_service_default_pool_global_user_role" =>
>>default_pool_global_user_role,
>>+ "self_service_default_hwp_global_user_obj" =>
>>BasePermissionObject.general_permission_scope,
>>+ "self_service_default_hwp_global_user_role" =>
>>default_hwp_global_user_role,
>> # perm list in the format:
>> # "[resource1_key, resource1_role], [resource2_key,
>>resource2_role], ..."
>>- "self_service_perms_list" =>
>>"[self_service_default_pool,self_service_default_role],
[self_service_default_catalog_entry_obj,self_service_default_catalog_entry_role],
[self_service_default_pool_global_user_obj,self_service_default_pool_global_user_role]"}
>>
>>+ "self_service_perms_list" =>
>>"[self_service_default_pool,self_service_default_role],
[self_service_default_catalog_entry_obj,self_service_default_catalog_entry_role],
[self_service_default_catalog_global_user_obj,self_service_default_catalog_global_user_role],
[self_service_default_pool_global_user_obj,self_service_default_pool_global_user_role],[self_service_default_hwp_global_user_obj,self_service_default_hwp_global_user_role]"}
>>
>> settings.each_pair do |key, value|
>> MetadataObject.set(key, value)
>> end
>
>Hi Chris,
>
>This is looking good and works as expected.
>
>However, it only works when you run the full `rake dc:setup` (which
>invokes `db:seeds` which in turn sets the default permissions up).
>
>If you have an existing setup and run just the migrations after
>applying the patch, the permission issue is still there.
>
>Would you please add a new migration that correct the permissions
>as well? I know it's a duplicated work, but it's not a good idea to
>ask users to trash all their data to fix a bug.
>
>Thomas
Thanks for looking at this Thomas. I was concerned about existing data as
well, so I asked the question about migrations so I asked a bunch of folks in a status
meeting yesterday the question "Do we need to support an upgrade path and migrate
data for any features we develop?" The answer I received was, until we have a GA
release, we should not spend time on migrations. I can do either, but I was opperating
under the impression that existing data migrations were out of scope and clean installs
for the time being is all we need to focus on.
- Chris
Be careful with the migration though -- any migration that modifies
or adds data needs to only do it if db:seed has already run (i.e.
when db:migrate is run on a new db before db:seed, data migrations
(as opposed to schema migrations) shouldn't do anything. In this
case, in the migration, don't add any new roles or privileges unless
there are already roles and privileges in the database.
Scott