Changeset 38132 for trunk/pstamp/scripts/pstampparse.pl

Timestamp:

Apr 16, 2015, 12:59:04 PM (11 years ago)

Author:

bills

Message:

migrate from prototype access control code to database based storage of the information

File:

• trunk/pstamp/scripts/pstampparse.pl (modified) (8 diffs)

trunk/pstamp/scripts/pstampparse.pl

@@ -55 +55 @@
 die "invalid mode '$mode'" unless ($mode eq "list_uri") or ($mode eq "queue_job");
 die "--file is required"   unless defined($request_file_name);
-
-if ($mode ne "list_uri") {
-    die "req_id is required"  if !$req_id;
+die "req_id is required"  unless defined $req_id;
+if ($mode ne 'list_uri') {
     die "outdir is required"  if !$outdir;
-#    die "product is required" if !$product;
 } else {
-    # mode eq 'list_uri' (used for parser testing)
-    # these values won't be used for anything but should be defined to avoid errors
-    $req_id  = 0;
-    $outdir  = "nowhere";
-    $product = "dummy";
+    $outdir = "somewhere" if !$outdir
 }
 
@@ -97 +91 @@
 
 $product = 'NULL' unless $product;
+
+
+# look up some defaults
+my $defaultAccessLevel = metadataLookupS32($ipprc->{_siteConfig}, 'PSTAMP_DEFAULT_ACCESS_LEVEL');
+if (!defined $defaultAccessLevel) {
+    warn("cannot find 'PSTAMP_DEFAULT_ACCESS_LEVEL' in site config");
+    exit ($PS_EXIT_CONFIG_ERROR);
+}
 
 # look up the default data store product.
@@ -187 +189 @@
 
 # Adjust the label for requests coming in over the web upload interface
+# XXX: do this later based on the user information
 
 my $label_changed = 0;
+# see below
+if (0) {
 if ($label and $label eq "WEB.UP") {
     my $lcname = lc($req_name);
@@ -215 +220 @@
     print "Setting label for $req_name to $label\n" if $label_changed;
 }
+}
 
 # product passed in is either one specific to the submitting pstampDataStore or the default
@@ -224 +230 @@
 # XXX perhaps do this prior to label setting above after domain/user table is implemented
 my $productForUser;
-my $accessLevel = getUsersAccessLevel($email, \$label, \$productForUser);
+my $labelForUser = $label;
+my $accessLevel = getUsersAccessLevel($email, \$labelForUser, \$productForUser);
 if ($accessLevel < 0) {
     print STDERR "Data access is forbidden.\n";
@@ -230 +237 @@
 }
 
+if ($label and $label eq 'WEB.UP') {
+    if ($labelForUser) {
+        $label = $labelForUser;
+        $label_changed = 1;
+    }
+}
+
+# XXX: Think through when and if we change the product.
 # if the product is the system default, set it to the product for the user@domain
 if ($productIsDefault or $product eq 'NULL') {
@@ -1238 +1253 @@
 }
 
-# Prototype function for setting access level.
-# XXX: Implement something more flexible using the database.
+# get user's access level default label and output product
 sub getUsersAccessLevel {
     my $email = shift;
@@ -1245 +1259 @@
     my $r_product = shift;
 
+    # $r_label is a copy of the initial label. We change it to a user specific one
+    # if one is found.
     my $label = $$r_label;
 
+    # default settings
+    $$r_label   =  undef;
+    $$r_product =  undef;
     my $level = -1;
 
     if (!$email) {
-        # No email provided. Eventually this will be forbidden.
-        # For now in order to temporarily continue to support the version 1 request format
+        # No email provided. 
+        # For now in order to temporarily continue to support the version 1 request format.
         # set the access rights based on the assigned label.
+        # Before deployment this will be forbidden.
         if ($label eq 'IFA' or $label eq 'QUB' or $label =~ 'MOPS') {
-            $level = 0;
+            $level = 2;
         } else {
-            # access rights PS1 data only
-            $level = 1;
+            $level = $defaultAccessLevel;
+        }
+        return $level
+    }
+
+    # we've got an email check the domain
+    my ($user, $domain) = split '@', $email;
+    unless ($user and $domain) {
+        print STDERR "Error $email is not an acceptable email adddress.\n";
+        return -1;
+    } 
+
+my $have_access_tables = 1;
+if ($have_access_tables) {
+
+    my $cmd = "$pstamptool -listuser -user $user -domain $domain";
+    my $results = runToolAndParse($cmd, $verbose);
+    my $userinfo = $results->[0];
+    if ($userinfo) {
+        $level = $userinfo->{accessLevelMax};
+        if ($userinfo->{userProduct}) {
+            $$r_product = $userinfo->{userProduct};
+        } elsif ($userinfo->{domainProduct}) {
+            $$r_product = $userinfo->{domainProduct};
+        }
+        if ($userinfo->{userLabel}) {
+            $$r_label = $userinfo->{userLabel};
+        } elsif ($userinfo->{domainLabel}) {
+            $$r_label = $userinfo->{domainLabel};
         }
     } else {
-        # we've got an email check the domain
-        my ($user, $domain) = split '@', $email;
-        unless ($user and $domain) {
-            print STDERR "Error $email is not an acceptable email adddress.\n";
-        } else {
-            $domain = lc($domain);
-            if ($domain eq 'ifa.hawaii.edu' or $domain eq 'qub.ac.uk') {
-                $level = 2;
-            } else {
-                # XXX check for special users
-                # access rights PS1 data only
-                $level = 1;
-            }
-
-            # 
-            if ($user eq 'bills' and $domain eq 'ifa.hawaii.edu') {
-                $$r_product = 'bills-results';
-            }
-        }
-
-    }
+        my $cmd = "$pstamptool -listdomain -domain $domain";
+        my $results = runToolAndParse($cmd, $verbose);
+        my $domaininfo = $results->[0];
+        if ($domaininfo) {
+            $level = $domaininfo->{accessLevelMax};
+            if ($domaininfo->{defaultProduct}) {
+                $$r_product = $domaininfo->{defaultProduct};
+            }
+            if ($domaininfo->{defaultLabel}) {
+                $$r_label = $domaininfo->{defaultLabel};
+            }
+    } else {
+            # no specific user or domain information found in the database. Use the defaults
+            $level = $defaultAccessLevel;
+            $$r_label =  undef;
+            $$r_product =  undef;
+        }
+    }
+} else {    # XXX: delete this prototype before committing this file starting here
+    # !$have_access_tables 
+    $domain = lc($domain);
+    if ($domain eq 'ifa.hawaii.edu' or $domain eq 'qub.ac.uk') {
+        $level = 2;
+    } else {
+        # access rights PS1 data only
+        $level = $defaultAccessLevel;
+    }
+
+    if ($user eq 'bills' and $domain eq 'ifa.hawaii.edu') {
+        $$r_product = 'bills-results';
+    }
+    # XXX end of code to delete
+
+}
 
     return $level;