Also use policy check for rodsadmins.

UtrechtUniversity · Oct 3, 2023 · bab70ef · bab70ef
1 parent 6899d56
commit bab70ef
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 51 deletions.
diff --git a/uuGroupPolicies.r b/uuGroupPolicies.r
@@ -130,31 +130,6 @@ uuGroupPreSudoGroupRemove(*groupName, *policyKv) {
 	fail;
 }
 
-# Specific handling for rodsadmin when removing a group
-uuGroupPreSudoGroupRemoveForAdmin(*groupName, *policyKv) {
-
-        *prefix = "";
-        *base = "";
-
-        uuChop(*groupName, *prefix, *base, "-", true);
-        *vaultName = "vault-*base";
-        *zoneName = $rodsZoneClient;
-        *vaultIsEmpty = true;
-
-        # Check whether vault still holds data
-        msiMakeGenQuery("COLL_NAME",
-            "COLL_NAME like '/*zoneName/home/*vaultName/%'", *genQIn);
-        msiExecGenQuery(*genQIn, *genQOut);
-        foreach(*genQOut){
-            *vaultIsEmpty = false; break;
-        }
-        if (*vaultIsEmpty) {
-            succeed;
-        }
-
-        fail;
-}
-
 uuGroupPreSudoGroupMemberAdd(*groupName, *userName, *policyKv) {
 
 	*groupToCheck = *groupName

diff --git a/uuGroupPolicyChecks.r b/uuGroupPolicyChecks.r
@@ -203,7 +203,7 @@ uuGroupPolicyCanGroupAdd(*actor, *groupName, *category, *subcategory, *expiratio
 							} else {
 							    *reason = "Invalid expiration date when adding group: '*expiration_date'";
 							}
-							
+
 						} else {
 							# schema not valid -> report error
 							*reason = "Invalid schema-id used when adding group: '*schema_id'";
@@ -376,28 +376,27 @@ uuGroupPolicyCanGroupRemove(*actor, *groupName, *allowed, *reason) {
 			}
 
 			if (*homeCollectionIsEmpty) {
-                                if (*groupName like regex "(research)-.*") {
-                                    # Research groups an only be removed when nu vault packages exist
-                                    uuChop(*groupName, *prefix, *base, "-", true);
-                                    *vaultName = "vault-*base";
-                                    *zoneName = $rodsZoneClient;
-                                    *vaultIsEmpty = true;
-
-                                    # Check whether vault still holds data 
-                                    msiMakeGenQuery("COLL_NAME",
-                                        "COLL_NAME like '/*zoneName/home/*vaultName/%'", *genQIn);
-                                    msiExecGenQuery(*genQIn, *genQOut);
-                                    foreach(*genQOut){
-                                        *vaultIsEmpty = false; break;
-                                    }
-                                    if (*vaultIsEmpty) { 
-                                        *allowed = 1;
-                                    } else {
-                                        *reason = "There are still datapackages in the vault for group: *groupName. Please remove these first before removing this group.";
-                                    }
-                                } else {
-				    *allowed = 1;
-                                }
+          if (*groupName like regex "(research)-.*") {
+              # Research groups an only be removed when no vault packages are present.
+              uuChop(*groupName, *prefix, *base, "-", true);
+              *vaultName = "vault-*base";
+              *zoneName = $rodsZoneClient;
+              *vaultIsEmpty = true;
+
+              # Check whether vault still holds data
+              msiMakeGenQuery("COLL_NAME", "COLL_NAME like '/*zoneName/home/*vaultName/%'", *genQIn);
+              msiExecGenQuery(*genQIn, *genQOut);
+              foreach(*genQOut){
+                  *vaultIsEmpty = false; break;
+              }
+              if (*vaultIsEmpty) {
+                  *allowed = 1;
+              } else {
+                  *reason = "Cannot remove group, there are data packages in the vault for group: *groupName.";
+              }
+          } else {
+              *allowed = 1;
+          }
 			} else {
 				*reason = "The group's directory is not empty. Please remove all of its files and subdirectories before removing this group.";
 			}

diff --git a/uuSudoPolicies.r b/uuSudoPolicies.r
@@ -58,9 +58,7 @@ acPreSudoGroupAdd(*groupName, *initialAttr, *initialValue, *initialUnit, *policy
 acPreSudoGroupRemove(*groupName, *policyKv) {
 	writeLine("serverLog", "In acPreSudoGroupRemove, group is <*groupName>, actor is <$userNameClient#$rodsZoneClient>");
 	uuGetUserType(uuClientFullName, *userType);
-	if (*userType != "rodsadmin") { fail; }
-        # So we're an admin. Now check whether the vault has no datapackages left for this research group
-        uuGroupPreSudoGroupRemoveForAdmin(*groupName, *policyKv);
+	fail;
 }
 
 acPreSudoGroupMemberAdd(*groupName, *userName, *policyKv) {