cartodb/app/models/carto/permission.rb

require 'active_record'
require_dependency 'cartodb/errors'

class Carto::Permission < ActiveRecord::Base
  DEFAULT_ACL_VALUE = [].freeze

  ACCESS_READONLY   = 'r'.freeze
  ACCESS_READWRITE  = 'rw'.freeze
  ACCESS_NONE       = 'n'.freeze
  SORTED_ACCESSES   = [ACCESS_READWRITE, ACCESS_READONLY, ACCESS_NONE].freeze

  TYPE_USER         = 'user'.freeze
  TYPE_ORGANIZATION = 'org'.freeze
  TYPE_GROUP        = 'group'.freeze

  belongs_to :owner, -> { select(Carto::User::DEFAULT_SELECT) }, class_name: Carto::User
  has_one :visualization, inverse_of: :permission, class_name: Carto::Visualization, foreign_key: :permission_id

  validate :not_w_permission_to_viewers

  after_update :update_changes
  after_destroy :update_changes_deletion

  def acl
    JSON.parse(access_control_list, symbolize_names: true)
  end

  def user_has_read_permission?(user)
    owner?(user) || permitted?(user, ACCESS_READONLY)
  end

  def user_has_write_permission?(user)
    owner?(user) || permitted?(user, ACCESS_READWRITE)
  end

  # Explicitly remove columns from AR schema
  DELETED_COLUMNS = ['entity_id', 'entity_type'].freeze
  def self.columns
    super.reject { |c| DELETED_COLUMNS.include?(c.name) }
  end

  def entities_with_read_permission
    entities = acl.map do |entry|
      entity_id = entry[:id]
      case entry[:type]
      when TYPE_USER
        Carto::User.where(id: entity_id).first
      when TYPE_ORGANIZATION
        Carto::Organization.where(id: entity_id).first
      when TYPE_GROUP
        Carto::Group.where(id: entity_id).first
      end
    end
    entities.compact.uniq
  end

  def entity_type
    ENTITY_TYPE_VISUALIZATION
  end

  def entity_id
    visualization.try(:id)
  end

  def is_owner?(subject)
    owner_id == subject.id
  end

  # Format:
  # [
  #   {
  #     type:         string,
  #     entity:
  #     {
  #       id:         uuid,
  #       username:   string,
  #       avatar_url: string,   (optional)
  #     },
  #     access:       string
  #   }
  # ]
  #
  # type is from TYPE_xxxxx constants
  # access is from ACCESS_xxxxx constants
  #
  # @param value Array
  # @throws CartoDB::PermissionError
  def acl=(value)
    incoming_acl = value.nil? ? DEFAULT_ACL_VALUE : value
    raise CartoDB::PermissionError.new('ACL is not an array') unless incoming_acl.is_a? Array
    incoming_acl.map do |item|
      unless item.is_a?(Hash) && acl_has_required_fields?(item) && acl_has_valid_access?(item)
        raise CartoDB::PermissionError.new('Wrong ACL entry format')
      end
    end

    acl_items = incoming_acl.map do |item|
      {
        type:   item[:type],
        id:     item[:entity][:id],
        access: item[:access]
      }
    end

    cleaned_acl = acl_items.select { |i| i[:id] } # Cleaning, see #5668

    if @old_acl.nil?
      @old_acl = acl
    end

    self.access_control_list = ::JSON.dump(cleaned_acl)
  end

  def owner=(value)
    self.owner_id = value.id
    self.owner_username = value.username
  end

  def permission_for_user(user)
    return ACCESS_READWRITE if owner?(user)

    accesses = acl_entries_for_user(user).map do |entry|
      entry[:access]
    end

    higher_access(accesses)
  end

  def permitted?(user, permission_type)
    SORTED_ACCESSES.index(permission_for_user(user)) <= SORTED_ACCESSES.index(permission_type)
  end

  def entity
    visualization
  end

  def notify_permissions_change(permissions_changes)
    permissions_changes.each do |c, v|
      # At the moment we just check users permissions
      if c == TYPE_USER
        v.each do |affected_id, perm|
          # Perm is an array. For the moment just one type of permission can
          # be applied to a type of object. But with an array this is open
          # to more than one permission change at a time
          perm.each do |p|
            if visualization.derived?
              if p['action'] == 'grant'
                # At this moment just inform as read grant
                if p['type'].include?('r')
                  ::Resque.enqueue(::Resque::UserJobs::Mail::ShareVisualization, entity.id, affected_id)
                end
              elsif p['action'] == 'revoke'
                if p['type'].include?('r')
                  ::Resque.enqueue(::Resque::UserJobs::Mail::UnshareVisualization,
                                   entity.name, owner_username, affected_id)
                end
              end
            elsif visualization.canonical?
              if p['action'] == 'grant'
                # At this moment just inform as read grant
                if p['type'].include?('r')
                  ::Resque.enqueue(::Resque::UserJobs::Mail::ShareTable, entity.id, affected_id)
                end
              elsif p['action'] == 'revoke'
                if p['type'].include?('r')
                  ::Resque.enqueue(::Resque::UserJobs::Mail::UnshareTable, entity.name, owner_username, affected_id)
                end
              end
            end
          end
        end
      end
    end
  rescue => e
    CartoDB::Logger.error(message: "Problem sending notification mail", exception: e)
  end

  def set_user_permission(subject, access)
    set_subject_permission(subject.id, access, TYPE_USER)
  end

  def set_group_permission(group, access)
    # You only want to switch it off when request is a permission request coming from database
    @update_db_group_permission = false

    granted_access = granted_access_for_group(group)
    if granted_access == access
      raise ModelAlreadyExistsError.new("Group #{group.name} already has #{access} access")
    elsif granted_access == ACCESS_NONE
      set_subject_permission(group.id, access, TYPE_GROUP)
    else
      # Remove group entry from acl in order to add new (or none if ACCESS_NONE)
      new_acl = inputable_acl.reject { |entry| entry[:entity][:id] == group.id }

      unless access == ACCESS_NONE
        acl_entry = {
          type: TYPE_GROUP,
          entity: {
            id: group.id,
            name: group.name
          },
          access: access
        }
        new_acl << acl_entry
      end

      self.acl = new_acl
    end
  end

  def remove_group_permission(group)
    # You only want to switch it off when request is a permission request coming from database
    @update_db_group_permission = false

    set_group_permission(group, ACCESS_NONE)
  end

  def remove_user_permission(user)
    granted_access = granted_access_for_user(user)
    if granted_access != ACCESS_NONE
      self.acl = inputable_acl.select { |entry| entry[:entity][:id] != user.id }
    end
  end

  # acl write method expects entries to have entity, although they're not
  # stored.
  # TODO: fix this, since this is coupled to representation.
  def inputable_acl
    acl.map do |entry|
      {
        type: entry[:type],
        entity: {
          id: entry[:id],
          avatar_url: '',
          username: '',
          name: ''
        },
        access: entry[:access]
      }
    end
  end

  private

  def real_entity_type
    entity.type
  end

  def not_w_permission_to_viewers
    viewer_writers = users_with_permissions(ACCESS_READWRITE).select(&:viewer)
    unless viewer_writers.empty?
      errors.add(:access_control_list, "grants write to viewers: #{viewer_writers.map(&:username).join(',')}")
    end
  end

  def users_with_permissions(access)
    user_ids = relevant_user_acl_entries(acl).select { |e| access == e[:access] }.map { |e| e[:id] }
    user_ids.empty? ? [] : Carto::User.where(id: user_ids).all
  end

  ENTITY_TYPE_VISUALIZATION = 'vis'.freeze

  ALLOWED_ENTITY_KEYS = [:id, :username, :name, :avatar_url].freeze

  def owner?(user)
    owner_id == user.id
  end

  def higher_access(accesses)
    return ACCESS_NONE if accesses.empty?
    index = SORTED_ACCESSES.index do |access|
      accesses.include?(access)
    end
    SORTED_ACCESSES[index]
  end

  def acl_entries_for_user(user)
    acl.select do |entry|
      (
        acl_entry_is_for_user_id?(entry, user.id) ||
        acl_entry_is_for_organization_id(entry, user.organization_id) ||
        (!user.groups.nil? && acl_entry_is_for_a_user_group(entry, user.groups.map(&:id)))
      )
    end
  end

  def acl_entry_is_for_user_id?(entry, user_id)
    entry[:type] == TYPE_USER && entry[:id] == user_id
  end

  def acl_entry_is_for_organization_id(entry, organization_id)
    entry[:type] == TYPE_ORGANIZATION && entry[:id] == organization_id
  end

  def acl_entry_is_for_a_user_group(entry, group_ids)
    entry[:type] == TYPE_GROUP && group_ids.include?(entry[:id])
  end

  def acl_has_required_fields?(acl_item)
    acl_item[:entity].present? && acl_item[:type].present? && acl_item[:access].present? &&
      acl_has_valid_entity_field?(acl_item)
  end

  def acl_has_valid_entity_field?(acl_item)
    acl_item[:entity].keys - ALLOWED_ENTITY_KEYS == []
  end

  def acl_has_valid_access?(acl_item)
    valid_access = [ACCESS_READONLY, ACCESS_NONE]
    if entity.table?
      valid_access << ACCESS_READWRITE
    end
    valid_access.include?(acl_item[:access])
  end

  def update_changes
    if !@old_acl.nil?
      notify_permissions_change(CartoDB::Permission.compare_new_acl(@old_acl, acl))
      Carto::DbPermissionService.shared_entities_revokes(@old_acl, acl, entity.table) if entity.table?
    end
    update_shared_entities
    # Notify change, caches should be invalidated
    entity.table.update_cdb_tablemetadata if entity && entity.table
  end

  def update_changes_deletion
    # Hack. I need to set the new acl as empty so all the old acls are
    # considered revokes
    # We need to pass the current acl as old_acl and the new_acl as something
    # empty to recreate a revoke by deletion
    notify_permissions_change(CartoDB::Permission.compare_new_acl(acl, []))
  end

  def update_shared_entities
    e = entity
    # First clean previous sharings
    destroy_shared_entities
    revoke_previous_permissions(e)

    # Create user entities for the new ACL
    users = relevant_user_acl_entries(acl)
    # Avoid entries without recipient id. See #5668.
    users.select { |u| u[:id] }.each do |user|
      shared_entity = Carto::SharedEntity.create(
        recipient_id:   user[:id],
        recipient_type: Carto::SharedEntity::RECIPIENT_TYPE_USER,
        entity_id:      entity.id,
        entity_type:    Carto::SharedEntity::ENTITY_TYPE_VISUALIZATION
      )

      if e.table?
        grant_db_permission(e, user[:access], shared_entity)
      end
    end

    org = relevant_org_acl_entry(acl)
    if org
      shared_entity = Carto::SharedEntity.create(
        recipient_id:   org[:id],
        recipient_type: Carto::SharedEntity::RECIPIENT_TYPE_ORGANIZATION,
        entity_id:      entity.id,
        entity_type:    Carto::SharedEntity::ENTITY_TYPE_VISUALIZATION
      )

      if e.table?
        grant_db_permission(e, org[:access], shared_entity)
      end
    end

    groups = relevant_groups_acl_entries(acl)
    groups.each do |group|
      Carto::SharedEntity.create(
        recipient_id:   group[:id],
        recipient_type: Carto::SharedEntity::RECIPIENT_TYPE_GROUP,
        entity_id:      entity.id,
        entity_type:    Carto::SharedEntity::ENTITY_TYPE_VISUALIZATION
      )

      # You only want to switch it off when request is a permission request coming from database
      if e.table? && @update_db_group_permission != false
        Carto::Group.find(group[:id]).grant_db_permission(e.table, group[:access])
      end
    end

    e.invalidate_after_commit
  end

  def destroy_shared_entities
    Carto::SharedEntity.where(entity_id: entity.id).each(&:destroy)
  end

  def revoke_previous_permissions(entity)
    users = relevant_user_acl_entries(@old_acl.nil? ? [] : @old_acl)
    org = relevant_org_acl_entry(@old_acl.nil? ? [] : @old_acl)
    groups = relevant_groups_acl_entries(@old_acl.nil? ? [] : @old_acl)
    case entity.class.name
    when Carto::Visualization.to_s
      if entity.table
        if org
          entity.table.remove_organization_access
        end
        users.each do |user|
          # Cleaning, see #5668
          u = Carto::User.find(user[:id])
          entity.table.remove_access(u) if u
        end
        # update_db_group_permission check is needed to avoid updating db requests
        if @update_db_group_permission != false
          groups.each do |group|
            Carto::Group.find(group[:id]).grant_db_permission(entity.table, ACCESS_NONE)
          end
        end
        check_related_visualizations(entity.table)
      end
    else
      raise CartoDB::PermissionError.new("Unsupported entity type trying to grant permission: #{entity.class.name}")
    end
  end

  def relevant_user_acl_entries(acl_list)
    relevant_acl_entries(acl_list, TYPE_USER)
  end

  def relevant_org_acl_entry(acl_list)
    relevant_acl_entries(acl_list, TYPE_ORGANIZATION).first
  end

  def relevant_groups_acl_entries(acl_list)
    relevant_acl_entries(acl_list, TYPE_GROUP)
  end

  def relevant_acl_entries(acl_list, type)
    acl_list.select { |entry| entry[:type] == type && entry[:access] != ACCESS_NONE }.map do |entry|
      { id: entry[:id], access: entry[:access] }
    end
  end

  def check_related_visualizations(table)
    fully_dependent_visualizations = table.fully_dependent_visualizations.to_a
    partially_dependent_visualizations = table.partially_dependent_visualizations.to_a
    table_visualization = table.table_visualization
    partially_dependent_visualizations.each do |visualization|
      # check permissions, if the owner does not have permissions
      # to see the table the layers using this table are removed
      perm = visualization.permission
      unless table_visualization.has_permission?(perm.owner, ACCESS_READONLY)
        visualization.unlink_from(table)
      end
    end

    fully_dependent_visualizations.each do |visualization|
      # check permissions, if the owner does not have permissions
      # to see the table the visualization is removed
      perm = visualization.permission
      unless table_visualization.has_permission?(perm.owner, ACCESS_READONLY)
        visualization.delete
      end
    end
  end

  def grant_db_permission(entity, access, shared_entity)
    if shared_entity.recipient_type == Carto::SharedEntity::RECIPIENT_TYPE_ORGANIZATION
      permission_strategy = CartoDB::OrganizationPermission.new
    else
      u = Carto::User.find(shared_entity[:recipient_id])
      permission_strategy = CartoDB::UserPermission.new(u)
    end

    case entity.class.name
    when Carto::Visualization.to_s
      # assert database permissions for non canonical tables are assigned
      # its canonical vis
      if not entity.table
        raise CartoDB::PermissionError.new('Trying to change permissions to a table without ownership')
      end
      table = entity.table

      # check ownership
      if not owner_id == entity.permission.owner_id
        raise CartoDB::PermissionError.new('Trying to change permissions to a table without ownership')
      end
      # give permission
      if access == ACCESS_READONLY
        permission_strategy.add_read_permission(table)
      elsif access == ACCESS_READWRITE
        permission_strategy.add_read_write_permission(table)
      end
    else
      raise CartoDB::PermissionError.new('Unsupported entity type trying to grant permission')
    end
  end

  def set_subject_permission(subject_id, access, type)
    new_acl = inputable_acl

    new_acl << {
      type: type,
      entity: {
        id: subject_id,
        avatar_url: '',
        username: '',
        name: ''
      },
      access: access
    }

    self.acl = new_acl
  end

  def granted_access_for_user(user)
    granted_access_for_entry_type(TYPE_USER, user)
  end

  def granted_access_for_group(group)
    granted_access_for_entry_type(TYPE_GROUP, group)
  end

  def granted_access_for_entry_type(type, entity)
    permission = nil

    acl.map do |entry|
      if entry[:type] == type && entry[:id] == entity.id
        permission = entry[:access]
      end
    end
    permission = ACCESS_NONE if permission.nil?
    permission
  end

end