Bug: Root cannot view data

[cxallan]

When attempting to expand Project nodes in OMERO.web as the root user, the following exception is thrown:

Traceback (most recent call last):

  File "/home/omero/slave/workspace/OMERO-merge-green/src/dist/lib/python/django/core/handlers/base.py", line 111, in get_response
    response = callback(request, *callback_args, **callback_kwargs)

  File "/home/omero/slave/workspace/OMERO-merge-green/src/dist/lib/python/omeroweb/decorators.py", line 377, in wrapped
    retval = f(request, *args, **kwargs)

  File "/home/omero/slave/workspace/OMERO-merge-green/src/dist/lib/python/omeroweb/decorators.py", line 414, in wrapper
    context = f(request, *args, **kwargs)

  File "/home/omero/slave/workspace/OMERO-merge-green/src/dist/lib/python/omeroweb/webclient/views.py", line 762, in load_metadata_details
    projects = c_type == "project" and list(conn.getObjects("Project", [c_id])) or list()

  File "/home/omero/slave/workspace/OMERO-merge-green/src/dist/lib/python/omero/gateway/__init__.py", line 2537, in getObjects
    result = self.getQueryService().findAllByQuery(query, params, self.SERVICE_OPTS)

  File "/home/omero/slave/workspace/OMERO-merge-green/src/dist/lib/python/omero/gateway/__init__.py", line 3327, in __call__
    return self.handle_exception(e, *args, **kwargs)

  File "/home/omero/slave/workspace/OMERO-merge-green/src/dist/lib/python/omeroweb/webclient/webclient_gateway.py", line 1876, in handle_exception
    e, *args, **kwargs)

  File "/home/omero/slave/workspace/OMERO-merge-green/src/dist/lib/python/omero/gateway/__init__.py", line 3324, in __call__
    return self.f(*args, **kwargs)

  File "/home/omero/slave/workspace/OMERO-merge-green/src/dist/lib/python/omero_api_IQuery_ice.py", line 139, in findAllByQuery
    return _M_omero.api.IQuery._op_findAllByQuery.invoke(self, ((query, params), _ctx))

InternalException: exception ::omero::InternalException
{
    serverStackTrace = ome.conditions.InternalException: No permissions: Details:{;perm=rw----user=0;group=0;create=27045;update=27045}
	at ome.security.basic.CurrentDetails.applyContext(CurrentDetails.java:413)
	at ome.security.basic.BasicACLVoter.postProcess(BasicACLVoter.java:361)
	at ome.tools.hibernate.ProxyCleanupFilter.filter(ProxyCleanupFilter.java:119)
	at ome.util.ContextFilter.filter(ContextFilter.java:160)
	at ome.util.ContextFilter.doFilter(ContextFilter.java:84)
	at ome.util.ContextFilter.filter(ContextFilter.java:121)
	at ome.tools.hibernate.ProxyCleanupFilter.filter(ProxyCleanupFilter.java:166)
	at ome.util.ContextFilter.filter(ContextFilter.java:162)
	at ome.tools.hibernate.ProxyCleanupFilter$Interceptor.invoke(ProxyCleanupFilter.java:244)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
	at ome.services.util.ServiceHandler.invoke(ServiceHandler.java:116)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
	at $Proxy75.findAllByQuery(Unknown Source)
	at sun.reflect.GeneratedMethodAccessor428.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
	at ome.security.basic.BasicSecurityWiring.invoke(BasicSecurityWiring.java:98)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
	at ome.services.blitz.fire.AopContextInitializer.invoke(AopContextInitializer.java:43)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
	at $Proxy75.findAllByQuery(Unknown Source)
	at sun.reflect.GeneratedMethodAccessor440.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
	at ome.services.blitz.util.IceMethodInvoker.invoke(IceMethodInvoker.java:179)
	at ome.services.throttling.Callback.run(Callback.java:56)
	at ome.services.throttling.InThreadThrottlingStrategy.callInvokerOnRawArgs(InThreadThrottlingStrategy.java:56)
	at ome.services.blitz.impl.AbstractAmdServant.callInvokerOnRawArgs(AbstractAmdServant.java:150)
	at ome.services.blitz.impl.QueryI.findAllByQuery_async(QueryI.java:66)
	at sun.reflect.GeneratedMethodAccessor439.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
	at omero.cmd.CallContext.invoke(CallContext.java:59)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
	at $Proxy76.findAllByQuery_async(Unknown Source)
	at omero.api._IQueryTie.findAllByQuery_async(_IQueryTie.java:92)
	at omero.api._IQueryDisp.___findAllByQuery(_IQueryDisp.java:366)
	at omero.api._IQueryDisp.__dispatch(_IQueryDisp.java:496)
	at IceInternal.Incoming.invoke(Incoming.java:159)
	at Ice.ConnectionI.invokeAll(ConnectionI.java:2037)
	at Ice.ConnectionI.message(ConnectionI.java:972)
	at IceInternal.ThreadPool.run(ThreadPool.java:577)
	at IceInternal.ThreadPool.access$100(ThreadPool.java:12)
	at IceInternal.ThreadPool$EventHandlerThread.run(ThreadPool.java:971)

    serverExceptionClass = ome.conditions.InternalException
    message = No permissions: Details:{;perm=rw----user=0;group=0;create=27045;update=27045}
}

There is no problem expanding or interacting with the data in OMERO.insight.

[cxallan]

Test case up on my 9632_root_cannot_view branch:

• ​https://github.com/chris-allan/openmicroscopy/commits/9632_root_cannot_view

Passing to Josh for review to see if this is an issue we can resolve in the services stack or if we need to be making changes to OMERO.web.

[jmoore]

This reproduces easily against gretzky, but not my local server. I've found at least one bug which may be the cause. Just rebuilding and dropping my DB to try to reproduce. (May be caused by the default group, etc. of the root user)

[jmoore]

Fix pushed as ​https://github.com/openmicroscopy/openmicroscopy/pull/369 for review.

[jmoore <josh@…>]

(In [1b0fef7d98348bd29773a5cb9b7fab296883e069/ome.git] on branch develop) Test case for admin querying with "omero.group = -1". (See #9632)

[jmoore <josh@…>]

(In [1cbf3b9c5a3b8433de2b02896ea9190be63ca6a6/ome.git] on branch develop) Fix bad comparison of getCurrentGroupId (See #9632)

[jmoore <josh@…>]

(In [e88ec6c878bf977c71f8528aaa679f45e1c7cc19/ome.git] on branch develop) Load perms for system groups as well (Fix #9632)

Data that was 1) in the system group and 2) queried via omero.group=-1
was causing an internal exception. The short-circuit block at the top of
allowLoad was failing to cache permissions for core groups.

[jmoore <josh@…>]

(In [4ce9217a38e610aa10e266253c4bc8eb812591d0/ome.git] on branch develop) Handle systypes and null details separately (See #9632)

Neither of these types will have a group so
short-circuiting the if/else will prevent a
WARN statement.