uuGroupPolicyChecks.r

# \file
# \brief     Group operation policy check rules.
# \author    Chris Smeele
# \author    Ton Smeele
# \author    Lazlo Westerhof
# \copyright Copyright (c) 2015 - 2021, Utrecht University. All rights reserved
# \license   GPLv3, see LICENSE

# For every Group Management action (GroupAdd, GroupUserChangeRole, etc.) there
# is a corresponding function in this file that will tell you if someone (the
# *actor) is allowed to perform that action with the supplied parameters.
#
# The result is returned in the output parameters *allowed and *reason. For
# calling rules to be able to receive these output parameters, it is imperative
# that the rules in this file DO NOT FAIL.
#
# Context: The rules in this file are called by:
# - Group Manager implementations of Sudo policies (see uuGroupPolicies.r)
# - Group Manager actions, to figure out the reason for denying a Sudo action.

# Utility functions {{{

# \brief Check if a user name is valid.
#
# User names must:
#
# - contain zero or one '@' signs, but not at the beginning or the end of the name
# - contain only lowercase letters and dots if no '@' sign is present
# - contain only lowercase letters, numbers, hyphens, underscores and dots if an '@' sign is present
# - may contain a zone name after a '#' sign
#
# \param[in] name
#
uuUserNameIsValid(*name)
	= *name like regex ``([a-z.]+|[a-z0-9_.-]+@[a-z0-9_.-]+)(#[a-zA-Z0-9_-]+)?``;

# \brief Check if a group name is valid for creation by a priv-group-add member.
#
# Group names must:
#
# - be prefixed with 'research-' or 'deposit-'
# - contain only lowercase characters, numbers and hyphens
# - not start or end with a hyphen
#
# NB: Update the category name check below if you change the second half of this pattern.
#
# NB: Datamanager is missing in this list. uuGroupNameIsDatamanager is for the specific datamanager case.
#
# \param[in] name
#
uuGroupNameIsValid(*name)
	= *name like regex ``(research|deposit)-([a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])``;

uuGroupNameIsDatamanager(*name)
	= *name like regex ``(datamanager)-([a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])``;

# \brief Check if a category name is valid.
#
# This must be exactly the same as the part of the group name check after the group prefix.
#
# \param[in] name
#
uuGroupCategoryNameIsValid(*name)
	= *name like regex ``([a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])``;

# \brief Check if a subcategory name is valid.
#
# Subcategory names must:
#
# - contain only letters, numbers, spaces, commas, periods, underscores and hyphens
#
# \param[in] name
#
uuGroupSubcategoryNameIsValid(*name)
	= *name like regex ``[a-zA-Z0-9 ,.()_-]+``;

# \brief Check if co_identifier is valid.
#
# CO Identifier must:
#
# - contain only letters, numbers, and hyphens
#
# \param[in] name
# \param[out] valid
#
uuGroupCOIdentifierIsValid(*name, *valid) {
	if (*name like regex ``[0-9a-f]{8}\-[0-9a-f]{4}\-4[0-9a-f]{3}\-[89ab][0-9a-f]{3}\-[0-9a-f]{12}`` || *name == '') {
		*valid = true;
	}
	else {
		*valid = false;
	}
}

# \brief Check if a data classification is valid in combination with a group name.
#
# The valid set of classifications depends on the group prefix.
#
# \param[in]  groupName
# \param[in]  dataClassification
# \param[out] valid
#
uuGroupDataClassificationIsValid(*groupName, *dataClassification, *valid) {
	uuChop(*groupName, *prefix, *base, "-", true);
	if (*prefix == "research" || *prefix == "intake") {
		uuListContains(list("critical", "sensitive", "basic", "public", "unspecified"), *dataClassification, *valid);
	} else {
		*valid = (*dataClassification == "");
	}
}

# \brief Check if a schema-id is valid.
#
# \param[in]  schema_id
# \param[out] valid
#
uuGroupSchemaIdIsValid(*schema_id, *valid) {
    # Check validity of schema_id
    *schema_coll = "/$rodsZoneClient/yoda/schemas/" ++ *schema_id;
    *coll = "";
    foreach(*row in SELECT COLL_NAME WHERE COLL_NAME = *schema_coll) {
        *coll = *row.COLL_NAME;
        succeed;
    }

    if (*coll != "") {
        *valid = true;
    } else {
        *valid = false;
    }
}

# \brief Check if indicated expiration date is valid
#
# \param[in]  expiration_date
# \param[out] valid
#
uuGroupExpirationDateIsValid(*expiration_date, *valid) {
    *result = "";
    rule_group_expiration_date_validate(*expiration_date, *result);
    *valid = bool(*result);
}

# \brief Check if actor is a group manager in a group in the category
#
# \param[in]  actor
# \param[in]  category
# \param[out] isGroupManager
#
uuGroupIsGroupManagerInCategory(*actor, *category, *isGroupManager) {
	*isGroupManager = false;

	uuUserGetGroups(*actor, false, *groups);

	foreach (*actorGroup in *groups) {
		uuGroupGetCategory(*actorGroup, *agCategory, *agSubcategory);
		if (*agCategory == *category) {
			uuGroupUserIsManager(*actorGroup, *actor, *isGroupManager);
			if (*isGroupManager) {
				break;
			}
		}
	}
}

# }}}

# \brief Group Policy: Can the user create a new group?
#
# \param[in]  actor       the user whose privileges are checked
# \param[in]  groupName   the new group name
# \param[in]  category
# \param[in]  subcategory
# \param[in]  schema_id
# \param[in]  expiration_date
# \param[in]  description
# \param[in]  dataClassification
# \param[in]  co_identifier
# \param[out] allowed     whether the action is allowed
# \param[out] reason      the reason why the action was disallowed, set if allowed is false
#
uuGroupPolicyCanGroupAdd(*actor, *groupName, *category, *subcategory, *expiration_date, *schema_id, *description, *dataClassification, *co_identifier, *allowed, *reason) {
    # Rodsadmin exception.
	uuGetUserType(*actor, *actorUserType);
	*allowed = 0;
	*reason  = "";

	uuGroupUserExists("priv-group-add", *actor, false, *hasPrivGroupAdd);
	uuGroupUserExists("priv-category-add", *actor, false, *hasPrivCatAdd);
	if (*hasPrivGroupAdd || *actorUserType == "rodsadmin") {
		if (uuGroupNameIsValid(*groupName)) {
			uuUserNameIsAvailable(*groupName, *nameAvailable, *existingType);
			if (*nameAvailable) {

				uuGroupDataClassificationIsValid(*groupName, *dataClassification, *dataclasValid);

				if (*dataclasValid) {

					uuChop(*groupName, *prefix, *base, "-", true);

					# For research groups: Make sure their ro and
					# vault groups do not exist yet.
					*roName = "read-*base";
					uuGroupExists(*roName, *roExists);

					*vaultName = "vault-*base";
					uuGroupExists(*vaultName, *vaultExists);
					# Extra check for situations that a vault path is already present
					uuGroupVaultPathExists(*vaultName, *vaultPathExists);

					if (*roExists || *vaultExists || *vaultPathExists) {
						*reason = "This group name is not available.";
					} else {
						uuGroupSchemaIdIsValid(*schema_id, *schemaIdValid);
						if (*schemaIdValid) {
							# Check expiration date
							uuGroupExpirationDateIsValid(*expiration_date, *expirationDateValid);
							if (*expirationDateValid) {
							    # Last check.
								uuGroupCOIdentifierIsValid(*co_identifier, *coIdentifierValid);
								if(*coIdentifierValid) {
									uuGroupPolicyCanUseCategory(*actor, *category, *allowed, *reason);
								}
								else{
									*reason = "Invalid SRAM CO Identifier when adding group: '*co_identifier'";
								}
							} else {
							    *reason = "Invalid expiration date when adding group: '*expiration_date'";
							}

						} else {
							# schema not valid -> report error
							*reason = "Invalid schema-id used when adding group: '*schema_id'";
						}
					}
				} else {
					*reason = "The chosen data classification is invalid for this type of group.";
				}
			} else {
				if (*existingType == "rodsuser") {
					*existingType = "user";
				} else if (*existingType == "rodsgroup") {
					*existingType = "group";
				}
				*reason = "The name '*groupName' is already in use by another *existingType.";
			}
		} else if (uuGroupNameIsDatamanager(*groupName)) {
			if ((*hasPrivGroupAdd && *hasPrivCatAdd) || *actorUserType == "rodsadmin") {
				# Special case for a datamanager group.
				uuUserNameIsAvailable(*groupName, *nameAvailable, *existingType);
				if (*nameAvailable) {
					# The category for which the datamanager group is paired with must already exist
					# And actor must be a group manager in at least one group
					# in the category for them to be allowed to create a datamanager group
					*isManagerInCategory = false;

					uuGroupIsGroupManagerInCategory(*actor, *category, *isManagerInCategory)
					if (*isManagerInCategory) {
						*allowed = 1
					}
					else {
						*reason = "You must be a manager of a group in category '*category' to create a datamanager- group"
					}
				} else {
					if (*existingType == "rodsuser") {
						*existingType = "user";
					} else if (*existingType == "rodsgroup") {
						*existingType = "group";
					}
					*reason = "The name '*groupName' is already in use by another *existingType.";
				}

			} else {
				*reason = "You must have priv-group-add and priv-cat-add to add a datamanger group"
			}
		} else {
			*reason = "Group names must start with one of 'research-', 'deposit-', or 'datamanager-' and may only contain lowercase letters (a-z) and hyphens (-).";
		}
	} else {
		*reason = "You cannot create groups because you are not a member of the priv-group-add group.";
	}
}

# \brief Group Policy: Can the user create a group with / modify a group to use a certain category?
#
# This is a utility function for other check functions, there is no
# corresponding group action for this rule.
#
# \param[in]  actor        the user whose privileges are checked
# \param[in]  categoryName the category name
# \param[out] allowed      whether the action is allowed
# \param[out] reason       the reason why the action was disallowed, set if allowed is false
#
uuGroupPolicyCanUseCategory(*actor, *categoryName, *allowed, *reason) {
	uuGetUserType(*actor, *actorUserType);
	*allowed = 0;
	*reason  = "";

	uuGroupCategoryExists(*categoryName, *categoryExists);
	if (*categoryExists) {
		*isManagerInCategory = false;

		uuUserGetGroups(*actor, false, *groups);

		foreach (*actorGroup in *groups) {
			uuGroupGetCategory(*actorGroup, *agCategory, *agSubcategory);
			if (*agCategory == *categoryName) {
				uuGroupUserIsManager(*actorGroup, *actor, *isManagerInCategory);
				if (*isManagerInCategory) {
					break;
				}
			}
		}
		if (*isManagerInCategory || *actorUserType == "rodsadmin") {
			*allowed = 1;
		} else {
			*reason = "You cannot use this group category because you are not a group manager in the *categoryName category.";
		}
	} else {
		uuGroupUserExists("priv-category-add", *actor, false, *hasPriv);
		if (*hasPriv || *actorUserType == "rodsadmin") {
			if (uuGroupCategoryNameIsValid(*categoryName)) {
				*allowed = 1;
			} else {
				*reason = "Category names may only contain lowercase letters (a-z), numbers, and hyphens (-), and may not start or end with a hyphen.";
			}
		} else {
			*reason = "You cannot use this group category because you are not a member of the priv-category-add group.";
		}
	}
}

# \brief Group Policy: Can the user set a certain group attribute to a certain value?
#
# Available attributes are: category, subcategory and description.
#
# \param[in]  actor     the user whose privileges are checked
# \param[in]  groupName the group name
# \param[in]  attribute the group attribute to set (one of 'category', 'subcategory', 'description', 'data_classification', 'schema_id', 'expiration_date')
# \param[in]  value     the new value
# \param[out] allowed   whether the action is allowed
# \param[out] reason    the reason why the action was disallowed, set if allowed is false
#
uuGroupPolicyCanGroupModify(*actor, *groupName, *attribute, *value, *allowed, *reason) {
	uuGetUserType(*actor, *actorUserType);
	*allowed = 0;
	*reason  = "";

	uuGroupUserIsManager(*groupName, *actor, *isManager);
	if (*isManager || *actorUserType == "rodsadmin") {
		if (*attribute == "category") {
			if (*groupName like "datamanager-*" && *groupName != "datamanager-*value") {
				*reason = "The category of a datamanager group cannot be changed.";
			} else {
				uuGroupPolicyCanUseCategory(*actor, *value, *allowed, *reason);
			}

		} else if (*attribute == "subcategory") {
			if (uuGroupSubcategoryNameIsValid(*value)) {
				*allowed = 1;
			} else {
				*reason = "Subcategory names may only contain letters (a-z), numbers, spaces, commas, periods, parentheses, hyphens (-) and underscores (_).";
			}
		} else if (*attribute == "description") {
			*allowed = 1;
		} else if (*attribute == "data_classification") {
			uuGroupDataClassificationIsValid(*groupName, *value, *dataClassValid);
			if (*dataClassValid) {
				*allowed = 1;
			} else {
				*reason = "The chosen data classification is invalid for this type of group.";
			}
		} else if (*attribute == "schema_id") {
			uuGroupSchemaIdIsValid(*value, *schemaIdValid);
			if (*schemaIdValid) {
				*allowed = 1;
			} else {
				*reason = "The chosen schema id is invalid for this group.";
			}
		} else if (*attribute == "expiration_date") {
			uuGroupExpirationDateIsValid(*value, *expirationDateValid);
			if (*expirationDateValid) {
				*allowed = 1;
			} else {
				*reason = "The chosen expiration date is invalid.";
			}
		} else if (*attribute == "co_identifier") {
			uuGroupCOIdentifierIsValid(*value, *coIdentifierValid);
			if(*coIdentifierValid) {
				*allowed = 1;
			}
			else{
				*reason = "The CO Identifier is invalid";
			}
		} else {
			*reason = "Invalid group attribute name.";
		}
	} else {
		*reason = "You are not a manager of group *groupName.";
	}
}

# \brief Group Policy: Can the user remove a group?
#
# \param[in]  actor     the user whose privileges are checked
# \param[in]  groupName the group name
# \param[out] allowed   whether the action is allowed
# \param[out] reason    the reason why the action was disallowed, set if allowed is false
#
uuGroupPolicyCanGroupRemove(*actor, *groupName, *allowed, *reason) {
	uuGetUserType(*actor, *actorUserType);
	*allowed = 0;
	*reason  = "";

	uuGroupUserIsManager(*groupName, *actor, *isManager);
	# Only a rodsadmin or a privileged group manager in
	# that category can remove a datamanager-group.
	#                          v These groups are user-removable v
	if (*groupName like regex "(grp|intake|research|deposit|vault)-.*" ) {
		if (*isManager || *actorUserType == "rodsadmin") {
			*homeCollection = "/$rodsZoneClient/home/*groupName";
			*homeCollectionIsEmpty = true;

			foreach (*row in SELECT DATA_NAME WHERE COLL_NAME = '*homeCollection') {
				*homeCollectionIsEmpty = false; break;
			}
			foreach (*row in SELECT COLL_ID WHERE COLL_PARENT_NAME LIKE '*homeCollection') {
				*homeCollectionIsEmpty = false; break;
			}

			if (*homeCollectionIsEmpty) {
				if (*groupName like regex "(research)-.*") {
					# Research groups can only be removed when no vault packages exist
					uuChop(*groupName, *prefix, *base, "-", true);
					*vaultName = "vault-*base";
					*zoneName = $rodsZoneClient;
					*vaultIsEmpty = true;

					# Check whether vault still holds data
					msiMakeGenQuery("COLL_NAME", "COLL_NAME like '/*zoneName/home/*vaultName/%'", *genQIn);
					msiExecGenQuery(*genQIn, *genQOut);
					foreach(*genQOut){
						*vaultIsEmpty = false;
											break;
					}
					if (*vaultIsEmpty) {
						*allowed = 1;
					} else {
						*reason = "There are still datapackages in the vault for group: *groupName. Please remove these first before removing this group.";
					}
				} else {
					*allowed = 1;
				}
			} else {
				*reason = "The group's directory is not empty. Please remove all of its files and subdirectories before removing this group.";
			}
		} else {
			*reason = "You are not a manager of group *groupName.";
		}
	} else if (*groupName like regex "(datamanager)-.*") {
		# Confirm actor is a manager of at least one group in the category
		# and has the privileges
		uuGroupGetCategory(*groupName, *category, *agSubcategory);
		uuGroupIsGroupManagerInCategory(*actor, *category, *isManagerInCategory)
		if (*isManagerInCategory) {
			uuGroupUserExists("priv-group-add", *actor, false, *hasPrivGroupAdd);
			uuGroupUserExists("priv-category-add", *actor, false, *hasPrivCatAdd);
			if (*hasPrivGroupAdd && *hasPrivCatAdd) {
				*allowed = 1
			}
			else {
				*reason = "You must have group and category add privileges to delete this datamanager- group";
			}
		}
		else {
			*reason = "You must be a manager of a group in category '*category' to delete this datamanager- group"
		}
	} else {
		*reason = "'*groupName' is not a regular group. You can only remove groups that have one of the following prefixes: grp, intake, research, vault.";
	}
}

# \brief Group Policy: Can the user add a new user to a certain group?
#
# \param[in]  actor     the user whose privileges are checked
# \param[in]  groupName the group name
# \param[in]  newMember the user to add to the group
# \param[out] allowed   whether the action is allowed
# \param[out] reason    the reason why the action was disallowed, set if allowed is false
#
uuGroupPolicyCanGroupUserAdd(*actor, *groupName, *newMember, *allowed, *reason) {
	uuGetUserType(*actor, *actorUserType);
	*allowed = 0;
	*reason  = "";

	uuGroupGetMemberCount(*groupName, *members);

	if (int(*members) == 0 && *newMember == *actor) {
		# Special case for empty groups.
		# This is run if a group has just been created. We then allow
		# the group creator (already set in the 'manager' field by the
		# postproc of GroupAdd) to add himself to the group.
		*isCreator = false;
		foreach (
			*manager in
			SELECT META_USER_ATTR_VALUE
			WHERE  USER_GROUP_NAME      = '*groupName'
			  AND  META_USER_ATTR_NAME  = 'manager'
			  AND  META_USER_ATTR_VALUE = '*newMember'
		) {
			*isCreator = true;
		}
		if (*isCreator || *actorUserType == "rodsadmin") {
			*allowed = 1;
		} else {
			*reason = "You are not a manager of group '*groupName'.";
		}
	} else {
		uuGroupUserIsManager(*groupName, *actor, *isManager);
		if (*isManager || *actorUserType == "rodsadmin") {
			uuGroupUserExists(*groupName, *newMember, false, *isAlreadyAMember);
			if (*isAlreadyAMember) {
				*reason = "User '*newMember' is already a member of group '*groupName'.";
			} else {
				if (uuUserNameIsValid(*newMember)) {
					*allowed = 1;
				} else {
					*reason = "The new member's name is invalid.";
				}
			}
		} else {
			*reason = "You are not a manager of group *groupName.";
		}
	}
}

# \brief Group Policy: Can the user remove a user from a certain group?
#
# \param[in]  actor     the user whose privileges are checked
# \param[in]  groupName the group name
# \param[in]  member    the user to remove from the group
# \param[out] allowed   whether the action is allowed
# \param[out] reason    the reason why the action was disallowed, set if allowed is false
#
uuGroupPolicyCanGroupUserRemove(*actor, *groupName, *member, *allowed, *reason) {
	uuGetUserType(*actor, *actorUserType);
	*allowed = 0;
	*reason  = "";

	uuGroupUserIsManager(*groupName, *actor, *isManager);
	if (*isManager || *actorUserType == "rodsadmin") {
		if (*member == *actor) {
			# This also ensures that groups always have at least one manager.
			*reason = "You cannot remove yourself from group *groupName.";
		} else {
			*allowed = 1;
		}
	} else {
		*reason = "You are not a manager of group *groupName.";
	}
}

# \brief Group Policy: Can the user change a group member's role?
#
# \param[in]  actor     the user whose privileges are checked
# \param[in]  groupName
# \param[in]  member    the target group member
# \param[in]  newRole   the member's new role
# \param[out] allowed   whether the action is allowed
# \param[out] reason    the reason why the action was disallowed, set if allowed is false
#
uuGroupPolicyCanGroupUserChangeRole(*actor, *groupName, *member, *newRole, *allowed, *reason) {
	uuGetUserType(*actor, *actorUserType);
	*allowed = 0;
	*reason = "";

	uuGroupUserExists(*groupName, *member, true, *exists);

	if (*exists) {
		if (   (*newRole == "normal" || *newRole == "manager")
			|| (*newRole == "reader" && *groupName like regex "(intake|research|deposit)-.*")) {

			uuGroupUserIsManager(*groupName, *actor, *isManager);
			if (*isManager || *actorUserType == "rodsadmin") {
				if (*member == *actor) {
					*reason = "You cannot change your own role in group *groupName.";
				} else {
					*allowed = 1;
				}
			} else {
				*reason = "You are not a manager of group *groupName.";
			}
		} else {
			*reason = "'*newRole' is not a valid member role for group *groupName.";
		}
	} else {
		*reason = "'*member' is not a member of group *groupName.";
	}
}

# \brief User Policy: Can the user set a certain user attribute to a certain value?
#
# \param[in]  actor     the user whose privileges are checked
# \param[in]  userName  the user name
# \param[in]  attribute the user attribute to set
# \param[out] allowed   whether the action is allowed
# \param[out] reason    the reason why the action was disallowed, set if allowed is false
#
uuUserPolicyCanUserModify(*actor, *userName, *attribute, *allowed, *reason) {
	uuGetUserType(*actor, *actorUserType);
	*allowed = 0;
	*reason  = "";

    # User setting: mail notifications
    if (*attribute == "org_settings_mail_notifications") {
        if (*actor == *userName || *actorUserType == "rodsadmin") {
            *allowed = 1;
        } else {
            *reason = "Cannot modify settings of other user.";
        }
	# User setting: Number of items
	} else if (*attribute == "org_settings_number_of_items") {
        if (*actor == *userName || *actorUserType == "rodsadmin") {
            *allowed = 1;
        } else {
            *reason = "Cannot modify settings of other user.";
        }
    # User setting: Initial list to be presented in group manager: Tree or flat list
    } else if (*attribute == "org_settings_group_manager_view") {
        if (*actor == *userName || *actorUserType == "rodsadmin") {
            *allowed = 1;
        } else {
            *reason = "Cannot modify settings of other user.";
        }
    # User setting: Color mode
    } else if (*attribute == "org_settings_color_mode") {
        if (*actor == *userName || *actorUserType == "rodsadmin") {
            *allowed = 1;
        } else {
            *reason = "Cannot modify settings of other user.";
        }
    # User SRAM invitation
    } else if (*attribute == "org_sram_invited") {
        *allowed = 1;
    # User notifications
    } else if (trimr(*attribute, "_") == "org_notification") {
        *allowed = 1;
    } else {
        *reason = "Invalid user attribute name.";
    }
}