Bug: canEdit group "-1" objects

[wmoore]

If I retrieve objects using omero.group:"-1" then canEdit, canAnnotate, canDelete etc return False, when they should return True.

I can work around this in some cases: E.g. ​http://github.com/will-moore/openmicroscopy/commit/3806c5340467dab6df391bc1bb372f733776e1c0

However, it is more problematic in other areas (see below).

Test for this will be committed below.

[wmoore]

Test pushed to ​https://github.com/will-moore/openmicroscopy/commits/canEdit_group-1_9505

Workaround this issue is ​https://github.com/will-moore/openmicroscopy/commit/47eada486b7e1248ebb3337c04e82ab8b5ba947d

[jmoore]

Thanks for the test, Will.

[jmoore]

With later work (from another branch) the error I get is:

======================================================================
ERROR: Should be able to Annotate and Edit object retrieved with omero.group:'-1'
----------------------------------------------------------------------
Traceback (most recent call last):
  File "test/gatewaytest/chmod.py", line 333, in testGroupMinusOne
    self.assertCanEdit(p, True)
  File "test/gatewaytest/chmod.py", line 153, in assertCanEdit
    rv = update.saveObject(link, self.gateway.SERVICE_OPTS)
  File "/Users/moore/git/components/tools/OmeroPy/build/lib/omero/gateway/__init__.py", line 3303, in __call__
    return self.handle_exception(e, *args, **kwargs)
  File "/Users/moore/git/components/tools/OmeroPy/build/lib/omero/gateway/__init__.py", line 3300, in __call__
    return self.f(*args, **kwargs)
  File "/Users/moore/git/components/tools/OmeroPy/build/lib/omero_api_IUpdate_ice.py", line 89, in saveObject
    return _M_omero.api.IUpdate._op_saveObject.invoke(self, ((obj, ), _ctx))
ApiUsageException: exception ::omero::ApiUsageException
{
    serverStackTrace = ome.conditions.ApiUsageException: No valid permissions available! DUMMY permissions are not intended for copying. Make sure that you have not passed omero.group=-1 for a save without context

which makes more sense. Basically, the context doesn't know what group you are in when it's trying to save. Do you think it would be possible to not pass -1 on the saveObject?

[wmoore]

This is certainly OK (makes sense). If I comment out the canEdit checks, then the test fails on canAnnotate(), so there are still other issues to resolve.

I'll commit changes to assertCanEdit(), unless you already have something for that?

[cneves]

There is a difference between being able to and actually doing it, right? If I'm an admin I should get True to all can* methods even if I passed the -1 group on object retrieval (which is the only way to get multiple objects off of multiple groups in one go). That's not to say that user can save without setting the actual group, though.

[wmoore]

Carlos - that's correct exactly. I'm updating the test to reflect that:

• get the object using omero.group '-1'
• check value of canEdit()
• set the group to the same group as the object and test if I can actually Edit it

[Will Moore <will@…>]

(In [47eada486b7e1248ebb3337c04e82ab8b5ba947d/ome.git] on branch develop) setGroupContext=True for load_metadata_details. See #9397, #9505

[wmoore]

Updated test as described above ​https://github.com/will-moore/openmicroscopy/commit/10040e359d0997f31432533d01c1bc2bcba31292 and opened PR ​https://github.com/openmicroscopy/openmicroscopy/pull/309

[wmoore]

Test updated - back to jmoore...

[wmoore]

See also #9526 as a use case waiting on this fix.

[jmoore]

Tests on ​https://github.com/openmicroscopy/openmicroscopy/pull/309 - I will hopefully be committing fixes this afternoon to the same PR.

[jmoore <josh@…>]

(In [cd9f9c899d62ad53e5d126c062b82b3419c9a249/ome.git] on branch develop) gatewaytest for canEdit etc when get with omero.group:'-1'. See #9505

[jmoore <josh@…>]

(In [edce3f6cddc91e5513f71a57b49f152d42109796/ome.git] on branch develop) chmod.py assertCanEdit() uses object's group ctx to save(). See #9505

[jmoore <josh@…>]

(In [b4a378fa1c0357354e1abf1d8a885dfc330d8678/ome.git] on branch develop) Properly copy restrictions (See #9505)

Restrictions on objects like Project were being
improperly copied (to some extent from DUMMY
Permissions).

[jmoore <josh@…>]

(In [f6dc5c1bdfc4c4df86ac45027c410e84d068edee/ome.git] on branch develop) Copy Permissions before assigning on applyContext (Fix #9505)

The group permissions object which was being cached in the
BasicEventContext? was being assigned directly to multiple
objects causing the restrictions value to be overwritten.