[#561] implementation: get_maximum_permissions_for_path

.github/workflows/main.yml

@@ -15,7 +15,7 @@ jobs:
 
     strategy:
       matrix:
-        python-version: ['3.9']
+        python-version: ['3.10']
 
     steps:
     - uses: actions/checkout@v4

.github/workflows/run-test-programs-single-node.yml

@@ -20,7 +20,7 @@ jobs:
           working-directory: ./test_harness/single_node
     strategy:
       matrix:
-        python: ['3.9','3.13']
+        python: ['3.10','3.15']
         irods_server: ['4.3.5','5.0.2']
 
     steps:

.github/workflows/run-test-suite-multiple-node.yml

@@ -14,7 +14,7 @@ jobs:
           working-directory: ./test_harness/multiple_node
     strategy:
       matrix:
-        python: ['3.9','3.13']
+        python: ['3.10','3.15']
         irods_server: ['4.3.5','5.0.2']
 
     steps:

.github/workflows/run-test-suite-single-node.yml

@@ -14,7 +14,7 @@ jobs:
           working-directory: ./test_harness/single_node
     strategy:
       matrix:
-        python: ['3.9','3.13']
+        python: ['3.10','3.15']
         irods_server: ['4.3.5','5.0.2']
 
     steps:

irods/access.py

@@ -20,7 +20,6 @@
     "null",
 )
 
-
 class _Access_LookupMeta(type):
     @staticmethod
     def _codes():

irods/manager/access_manager.py

@@ -1,24 +1,29 @@
 """The access manager is a collection of methods useful for managing iRODS ACLs."""
 
 import logging
 from os.path import basename, dirname
+import typing
 
 from irods.access import iRODSAccess
 from irods.api_number import api_number
 from irods.collection import iRODSCollection
 from irods.column import In
 from irods.data_object import irods_basename, irods_dirname, iRODSDataObject
+from irods.exception import CAT_NO_ROWS_FOUND
 from irods.manager import Manager
 from irods.message import JSON_Message, ModAclRequest, iRODSMessage
 from irods.models import (
     Collection,
     CollectionAccess,
     CollectionUser,
     DataAccess,
     DataObject,
+    Group,
     User,
 )
-from irods.user import iRODSUser
+from irods.query import SpecificQuery
+from irods.user import iRODSUser, iRODSGroup
+
 
 logger = logging.getLogger(__name__)
 
@@ -35,7 +40,138 @@
     return [iRODSUser(session.users, i) for i in session.query(User.id, User.name, User.type, User.zone).filter(*cond)]
 
 
+class QueryParameterError(ValueError):
+    pass
+
+# This is the alias where we expect to find a specific query
+alias_for_get_maximum_permission_for_path = 'get_maximum_permission_for_path'
+
+class _iRODSPermission(typing.NamedTuple):
+    as_string: str
+    as_integer: int
+
 class AccessManager(Manager):
+    def get_maximum_permission_for_path(self,
+        user : [iRODSUser|iRODSGroup],
+        collection : [str|iRODSCollection|None]=None,
+        data_object : [str|iRODSDataObject|None]=None,
+        specific_query : [SpecificQuery|str|None]='',
+    ) -> _iRODSPermission|None:
+        """
+        Return the highest permission the named user/group has with respect to the
+        given data object or collection.  In calculating this result, all ACLs and
+        group memberships are factored in.
+
+        Only one of 'data_object' or 'collection' may be specified.
+
+        Args:
+            user: an iRODSUser or iRODSGroup object for whom the permission is to be calculated.
+            collection: an iRODS logical path or iRODSCollection.
+            data_object: an iRODS logical path or iRODSDataObject.
+            specific_query (default ""): a SpecificQuery object or an alias specifying
+                the specific query used for the calculation.  The default value of "" will be
+                interpreted to mean the designated specific query preconfigured for this express
+                purpose.  If the server does not cache a query under that alias, or if None is
+                given as a value, then the calculation will be done via a general query.
+
+        Returns:
+            a named tuple representing the permission results in terms of both the symbolic
+            string (<retval>.as_string) and integer code (<retval>.as_integer).  If no ACLs
+            exist granting permission for the named user or group, then None is returned.
+        """
+        ses = self.sess
+
+        # Convert user or group to object.  Need to know if we are dealing with a rodsadmin
+        if isinstance(user, (iRODSUser, iRODSGroup)):
+            pass
+        else:
+            msg = "'user' argument should be of type iRODSUser or iRODSGroup."
+            raise QueryParameterError(msg)
+
+        _specific_query = None
+
+        if specific_query == '':
+            specific_query = alias_for_get_maximum_permission_for_path
+
+        if isinstance(specific_query, SpecificQuery):
+            _specific_query = specific_query
+        elif isinstance(specific_query, str):
+            _specific_query = SpecificQuery(ses, alias=specific_query)
+        logger=logging.getLogger('issue_561_query_type_detection')
+        # Dispatch to the available/chosen query method.
+        if _specific_query is not None:
+            logger.debug('SPECIFIC')
+            def denullify(s):
+                return s if s else "x"
+            _specific_query.reset_for_new_query(
+                args=[
+                    user.name,
+                    getattr(user,'zone',ses.zone),
+                    denullify(collection.path if isinstance(collection, iRODSCollection) else collection),
+                    denullify(data_object.path if isinstance(data_object, iRODSDataObject) else data_object),
+                ]
+            )
+            max_permission = self._get_maximum_permission_for_path_via_SpecificQuery(_specific_query)
+            res = [max_permission]
+        else:
+            logger.debug('GENERAL')
+            res = None
+            groups = {g[Group.id] for g in ses.query(Group, User).filter(Group.id != user.id, User.id == user.id)}
+            groups |= {user.id}
+
+            if data_object:
+                if isinstance(data_object, str):
+                    collN = irods_dirname(data_object)
+                    dataN = irods_basename(data_object)
+                    join_criteria = [DataObject.name == dataN, Collection.name == collN]
+                elif isinstance(data_object, iRODSDataObject):
+                    join_criteria = [ DataAccess.data_id == data_object.id]
+                else:
+                    msg="'data_object' parameter must be full logical path or data object"
+                    raise ValueError(msg)
+
+                q = ses.query(DataAccess.type).filter(
+                    In(DataAccess.user_id, groups),
+                    *join_criteria
+                ).order_by(DataAccess.type,order='desc')
+
+                res = [_[DataAccess.type] for _ in q]
+
+            elif collection:
+                if isinstance(collection, str):
+                    join_criteria = [Collection.name == collection]
+                elif isinstance(collection, iRODSCollection):
+                    join_criteria = [CollectionAccess.access_id == collection.id] # TODO: access_id is not an accurate name, should be coll_id
+                else:
+                    msg="'collection' parameter must be full logical path or collection object"
+                    raise ValueError(msg)
+
+                q=ses.query(CollectionAccess).filter(
+                        In(CollectionAccess.user_id, groups),
+                        *join_criteria
+                    ).order_by(CollectionAccess.type,order='desc')
+
+                res = [_[CollectionAccess.type] for _ in q]
+
+            else:
+                msg = 'Need a collection or data object'
+                raise QueryParameterError(msg)
+
+        res = res[0] if res else None
+        return _iRODSPermission(iRODSAccess.strings[res], as_integer=res) if isinstance(res, int) else None
+
+    @staticmethod
+    def _get_maximum_permission_for_path_via_SpecificQuery(spec_query):
+        try:
+            row = next(iter(
+                spec_query.execute()
+            ))
+        except (StopIteration, CAT_NO_ROWS_FOUND):
+            row = {}
+
+        highest_perm = row.get(0)
+        return None if highest_perm is None else int(highest_perm)
+
     @staticmethod
     def _to_acl_operation_json(op_input: iRODSAccess):
         return {

irods/manager/user_manager.py

@@ -16,6 +16,7 @@
     UserDoesNotExist,
     GroupDoesNotExist,
     NoResultFound,
+    MultipleResultsFound,
     CAT_SQL_ERR,
 )
 from irods.api_number import api_number
@@ -281,12 +282,19 @@
 
 class GroupManager(UserManager):
     def get(self, name, user_zone=""):
+        if user_zone not in ("", local_zone:=self.sess.zone):
+            msg = 'Specified user_zone must be local, since remote groups are not listed locally.'
+            raise GroupDoesNotExist(msg)
+
         query = self.sess.query(Group).filter(Group.name == name)
 
         try:
             result = query.one()
+        except MultipleResultsFound:
+            result = query.filter(User.name == name, User.zone == local_zone).one()
         except NoResultFound:
             raise GroupDoesNotExist()
+
         return iRODSGroup(self, result)
 
     def _api_info(self, group_admin_flag):

irods/query.py

@@ -1,4 +1,5 @@
 from collections import OrderedDict
+import uuid
 
 from irods import MAX_SQL_ROWS
 from irods.models import Model
@@ -290,6 +291,11 @@
         self._columns = columns
         self._args = args or []
 
+    def reset_for_new_query(self, args=None):
+        self._continue_index = 0
+        if args is not None:
+            self._args = args
+
     def register(self):
         if not self._sql:
             raise ValueError("Empty query")
@@ -363,7 +369,9 @@
                 yield result
 
 
+
+
 # Record a copy of the original value of IRODS_QUERY_LIMIT for possible future access.
 import irods.helpers as helpers
 
 cached_values = helpers.create_value_cache(globals())