From 7a811847ec02bdbc3bc5e8adc7913cb8e03067cd Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Fri, 20 Mar 2026 19:06:28 -0400 Subject: [PATCH 01/10] add SYS_INTERNAL_ERR --- irods/exception.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/irods/exception.py b/irods/exception.py index b9551fdc..4dbbd66d 100644 --- a/irods/exception.py +++ b/irods/exception.py @@ -650,6 +650,10 @@ class SYS_INVALID_INPUT_PARAM(SystemException): code = -130000 +class SYS_INTERNAL_ERR(SystemException): + code = -154000 + + class SYS_BAD_INPUT(iRODSException): code = -158000 From 228bf860d906d6bde877b13fb6faf747de54dd12 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Thu, 19 Mar 2026 02:40:53 -0400 Subject: [PATCH 02/10] [_505,sq] atomic ACLs endpoint --- irods/access.py | 5 ++++- irods/manager/access_manager.py | 30 +++++++++++++++++++++++++- irods/test/access_test.py | 37 +++++++++++++++++++++++++++++++++ 3 files changed, 70 insertions(+), 2 deletions(-) diff --git a/irods/access.py b/irods/access.py index 465585dd..3c0d206d 100644 --- a/irods/access.py +++ b/irods/access.py @@ -102,7 +102,7 @@ def __eq__(self, other): def __hash__(self): return hash((self.access_name, iRODSPath(self.path), self.user_name, self.user_zone)) - def copy(self, decanonicalize=False): + def copy(self, decanonicalize=False, ref_zone=''): other = copy.deepcopy(self) if decanonicalize: replacement_string = { @@ -112,6 +112,9 @@ def copy(self, decanonicalize=False): "modify_object": "write", }.get(self.access_name) other.access_name = replacement_string if replacement_string is not None else self.access_name + if '' != ref_zone == other.user_zone: + other.user_zone = '' + return other def __repr__(self): diff --git a/irods/manager/access_manager.py b/irods/manager/access_manager.py index bf32dc28..58cec810 100644 --- a/irods/manager/access_manager.py +++ b/irods/manager/access_manager.py @@ -2,7 +2,7 @@ from irods.manager import Manager from irods.api_number import api_number -from irods.message import ModAclRequest, iRODSMessage +from irods.message import ModAclRequest, iRODSMessage, JSON_Message from irods.data_object import iRODSDataObject, irods_dirname, irods_basename from irods.collection import iRODSCollection from irods.models import ( @@ -14,6 +14,7 @@ CollectionAccess, ) from irods.access import iRODSAccess +import irods.exception as ex from irods.column import In from irods.user import iRODSUser @@ -36,6 +37,33 @@ def users_by_ids(session, ids=()): class AccessManager(Manager): + + def _ACL_operation(self, op_input: iRODSAccess): + return { + "acl": op_input.access_name, + "entity_name": op_input.user_name, + **( + {} if not (z := op_input.user_zone) + else {"zone": z} + ) + } + + def _call_atomic_acl_api(self, logical_path : str, *operations, admin=False): + request_text = {"logical_path": logical_path} + request_text["admin_mode"] = admin + request_text["operations"] = [self._ACL_operation(op) for op in operations] + + with self.sess.pool.get_connection() as conn: + request_msg = iRODSMessage( + "RODS_API_REQ", + JSON_Message(request_text, conn.server_version), + int_info=20005, + ) + conn.send(request_msg) + response = conn.recv() + response_msg = response.get_json_encoded_struct() + logger.debug("in atomic ACL api, server responded with: %r", response_msg) + def get(self, target, report_raw_acls=True, **kw): if report_raw_acls: diff --git a/irods/test/access_test.py b/irods/test/access_test.py index fadc6a7d..5bf397d8 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -497,6 +497,43 @@ def test_iRODSAccess_cannot_be_constructed_using_unsupported_type__issue_558(sel self.sess, ) + def test_atomic_acls_505(self): + #import pdb;pdb.set_trace() + ses = self.sess + zone = user1 = user2 = group = None + try: + zone = ses.zones.create("twilight","remote") + user1 = ses.users.create("test_user_505", "rodsuser") + user2 = ses.users.create("rod_serling_505#twilight", "rodsuser") + group = ses.groups.create("test_group_505") + ses.acls._call_atomic_acl_api( + self.coll_path, + a1:=iRODSAccess("write", "", user1.name, user1.zone), + a2:=iRODSAccess("read", "", user2.name, user2.zone), + a3:=iRODSAccess("read", "", group.name), + ) + + accesses = ses.acls.get(self.coll) + + # For purposes of equality tests, assign the path name of interest into each ACL. + for p in (a1, a2, a3): + p.path = self.coll_path + + # Assert that the ACLs we added are among those listed for the object in the catalog. + normalize = lambda access: access.copy(decanonicalize=True, ref_zone=ses.zone) + self.assertLess( + set(normalize(_) for _ in (a1,a2,a3)), + set(normalize(_) for _ in accesses) + ) + finally: + if user1: + user1.remove() + if user2: + user2.remove() + if group: + group.remove() + if zone: + zone.remove() if __name__ == "__main__": # let the tests find the parent irods lib From d277eb72b225d6a3bc99288e14d04da1aa50c82f Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Sat, 21 Mar 2026 00:45:03 -0400 Subject: [PATCH 03/10] ruff1 --- irods/test/access_test.py | 1 - 1 file changed, 1 deletion(-) diff --git a/irods/test/access_test.py b/irods/test/access_test.py index 5bf397d8..88e1db70 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -498,7 +498,6 @@ def test_iRODSAccess_cannot_be_constructed_using_unsupported_type__issue_558(sel ) def test_atomic_acls_505(self): - #import pdb;pdb.set_trace() ses = self.sess zone = user1 = user2 = group = None try: From 64b870120e278588138632a201f867c39455813c Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Mon, 23 Mar 2026 13:39:07 -0400 Subject: [PATCH 04/10] [_505] create ACLOperation based on iRODSAccess --- irods/access.py | 53 ++++++++++++++++++++++++++++++++++++--- irods/test/access_test.py | 23 ++++++++--------- 2 files changed, 60 insertions(+), 16 deletions(-) diff --git a/irods/access.py b/irods/access.py index 3c0d206d..88e27f58 100644 --- a/irods/access.py +++ b/irods/access.py @@ -91,6 +91,13 @@ def __init__(self, access_name, path, user_name="", user_zone="", user_type=None self.user_zone = user_zone self.user_type = user_type + def __lt__(self, other): + return ( + self.access_name < other.access_name + and self.user_name < other.user_name + and self.user_zone < other.user_zone + ) and iRODSPath(self.path) < iRODSPath(other.path) + def __eq__(self, other): return ( self.access_name == other.access_name @@ -102,8 +109,9 @@ def __eq__(self, other): def __hash__(self): return hash((self.access_name, iRODSPath(self.path), self.user_name, self.user_zone)) - def copy(self, decanonicalize=False, ref_zone=''): + def copy(self, decanonicalize=False, implied_zone=''): other = copy.deepcopy(self) + if decanonicalize: replacement_string = { "read object": "read", @@ -112,8 +120,10 @@ def copy(self, decanonicalize=False, ref_zone=''): "modify_object": "write", }.get(self.access_name) other.access_name = replacement_string if replacement_string is not None else self.access_name - if '' != ref_zone == other.user_zone: - other.user_zone = '' + + # Useful if we wish to force an explicitly specified local zone to null length for equality testing: + if '' != implied_zone == other.user_zone: + other.user_zone = '' return other @@ -124,6 +134,43 @@ def __repr__(self): return f"" +class ACLOperation(iRODSAccess): + + def __init__(self, access_name: str, user_name: str="", user_zone: str=""): + super().__init__( + access_name=access_name, + path="", + user_name=user_name, + user_zone=user_zone, + ) + + def __eq__(self, other): + return ( + self.access_name, + self.user_name, + self.user_zone, + ) == ( + other.access_name, + other.user_name, + other.user_zone, + ) + + def __lt__(self, other): + return ( + self.access_name, + self.user_name, + self.user_zone, + ) < ( + other.access_name, + other.user_name, + other.user_zone, + ) + + def __repr__(self): + return f"" + class _iRODSAccess_pre_4_3_0(iRODSAccess): codes = collections.OrderedDict( (key.replace("_", " "), value) diff --git a/irods/test/access_test.py b/irods/test/access_test.py index 88e1db70..5ac481a1 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -4,7 +4,7 @@ import sys import unittest -from irods.access import iRODSAccess +from irods.access import iRODSAccess, ACLOperation from irods.collection import iRODSCollection from irods.column import In, Like from irods.exception import UserDoesNotExist @@ -507,23 +507,20 @@ def test_atomic_acls_505(self): group = ses.groups.create("test_group_505") ses.acls._call_atomic_acl_api( self.coll_path, - a1:=iRODSAccess("write", "", user1.name, user1.zone), - a2:=iRODSAccess("read", "", user2.name, user2.zone), - a3:=iRODSAccess("read", "", group.name), + a1:=ACLOperation("write", user1.name, user1.zone), + a2:=ACLOperation("read", user2.name, user2.zone), + a3:=ACLOperation("read", group.name), ) - accesses = ses.acls.get(self.coll) + normalize = lambda access: access.copy(decanonicalize=True, implied_zone=ses.zone) - # For purposes of equality tests, assign the path name of interest into each ACL. - for p in (a1, a2, a3): - p.path = self.coll_path + accesses = [normalize(acl) for acl in ses.acls.get(self.coll)] # Assert that the ACLs we added are among those listed for the object in the catalog. - normalize = lambda access: access.copy(decanonicalize=True, ref_zone=ses.zone) - self.assertLess( - set(normalize(_) for _ in (a1,a2,a3)), - set(normalize(_) for _ in accesses) - ) + self.assertIn(normalize(a1), accesses) + self.assertIn(normalize(a2), accesses) + self.assertIn(normalize(a3), accesses) + finally: if user1: user1.remove() From 1803ddade2e29aaf75b47542bb293a0be5e7586d Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Mon, 23 Mar 2026 13:45:04 -0400 Subject: [PATCH 05/10] [_505] test local users both with and without zone --- irods/test/access_test.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/irods/test/access_test.py b/irods/test/access_test.py index 5ac481a1..b3d16ce4 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -499,17 +499,19 @@ def test_iRODSAccess_cannot_be_constructed_using_unsupported_type__issue_558(sel def test_atomic_acls_505(self): ses = self.sess - zone = user1 = user2 = group = None + zone = user1 = user2 = user3 = group = None try: zone = ses.zones.create("twilight","remote") user1 = ses.users.create("test_user_505", "rodsuser") user2 = ses.users.create("rod_serling_505#twilight", "rodsuser") + user3 = ses.users.create("local_test_user_505", "rodsuser") group = ses.groups.create("test_group_505") ses.acls._call_atomic_acl_api( self.coll_path, - a1:=ACLOperation("write", user1.name, user1.zone), + a1:=ACLOperation("write", user1.name, user1.zone), a2:=ACLOperation("read", user2.name, user2.zone), - a3:=ACLOperation("read", group.name), + a3:=ACLOperation("read", user3.name, user3.zone), + a4:=ACLOperation("read", group.name), ) normalize = lambda access: access.copy(decanonicalize=True, implied_zone=ses.zone) @@ -520,12 +522,15 @@ def test_atomic_acls_505(self): self.assertIn(normalize(a1), accesses) self.assertIn(normalize(a2), accesses) self.assertIn(normalize(a3), accesses) + self.assertIn(normalize(a4), accesses) finally: if user1: user1.remove() if user2: user2.remove() + if user3: + user3.remove() if group: group.remove() if zone: From d419d0e501bbe53a67133a26320b9022ffaf15dd Mon Sep 17 00:00:00 2001 From: Daniel Moore Date: Tue, 24 Mar 2026 00:46:53 -0400 Subject: [PATCH 06/10] Update irods/manager/access_manager.py Co-authored-by: Kory Draughn --- irods/manager/access_manager.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/irods/manager/access_manager.py b/irods/manager/access_manager.py index 58cec810..2f19b7a7 100644 --- a/irods/manager/access_manager.py +++ b/irods/manager/access_manager.py @@ -49,9 +49,11 @@ def _ACL_operation(self, op_input: iRODSAccess): } def _call_atomic_acl_api(self, logical_path : str, *operations, admin=False): - request_text = {"logical_path": logical_path} - request_text["admin_mode"] = admin - request_text["operations"] = [self._ACL_operation(op) for op in operations] + request_text = { + "logical_path": logical_path, + "admin_mode": admin + "operations": [self._ACL_operation(op) for op in operations] + } with self.sess.pool.get_connection() as conn: request_msg = iRODSMessage( From a746e2ae35dfb31b6b26c3b0cb8892261770f9c9 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Tue, 24 Mar 2026 15:34:14 -0400 Subject: [PATCH 07/10] correct __lt__ comparison function --- irods/access.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/irods/access.py b/irods/access.py index 88e27f58..84e29318 100644 --- a/irods/access.py +++ b/irods/access.py @@ -93,10 +93,16 @@ def __init__(self, access_name, path, user_name="", user_zone="", user_type=None def __lt__(self, other): return ( - self.access_name < other.access_name - and self.user_name < other.user_name - and self.user_zone < other.user_zone - ) and iRODSPath(self.path) < iRODSPath(other.path) + self.access_name, + self.user_name, + self.user_zone, + iRODSPath(self.path) + ) < ( + other.access_name, + other.user_name, + other.user_zone, + iRODSPath(other.path) + ) def __eq__(self, other): return ( From ef0fe69d887056725c40b5879e1d30ad82021b26 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Tue, 24 Mar 2026 15:50:12 -0400 Subject: [PATCH 08/10] correction to dict literal --- irods/manager/access_manager.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/irods/manager/access_manager.py b/irods/manager/access_manager.py index 2f19b7a7..4ece4aab 100644 --- a/irods/manager/access_manager.py +++ b/irods/manager/access_manager.py @@ -51,7 +51,7 @@ def _ACL_operation(self, op_input: iRODSAccess): def _call_atomic_acl_api(self, logical_path : str, *operations, admin=False): request_text = { "logical_path": logical_path, - "admin_mode": admin + "admin_mode": admin, "operations": [self._ACL_operation(op) for op in operations] } From b70413d2116eb7dd2e1b609a2e1f1d819dffc5ad Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Tue, 24 Mar 2026 16:02:12 -0400 Subject: [PATCH 09/10] api_number --- irods/api_number.py | 1 + irods/manager/access_manager.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/irods/api_number.py b/irods/api_number.py index fe614ffc..03ac3de8 100644 --- a/irods/api_number.py +++ b/irods/api_number.py @@ -177,6 +177,7 @@ "ATOMIC_APPLY_METADATA_OPERATIONS_APN": 20002, "GET_FILE_DESCRIPTOR_INFO_APN": 20000, "REPLICA_CLOSE_APN": 20004, + "ATOMIC_APPLY_ACL_OPERATIONS_APN": 20005, "TOUCH_APN": 20007, "AUTH_PLUG_REQ_AN": 1201, "AUTHENTICATION_APN": 110000, diff --git a/irods/manager/access_manager.py b/irods/manager/access_manager.py index 4ece4aab..ff784e5e 100644 --- a/irods/manager/access_manager.py +++ b/irods/manager/access_manager.py @@ -59,7 +59,7 @@ def _call_atomic_acl_api(self, logical_path : str, *operations, admin=False): request_msg = iRODSMessage( "RODS_API_REQ", JSON_Message(request_text, conn.server_version), - int_info=20005, + int_info=api_number["ATOMIC_APPLY_ACL_OPERATIONS_APN"], ) conn.send(request_msg) response = conn.recv() From 8a656a0db86555cd05423e8a44c34fc937680e04 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Tue, 24 Mar 2026 17:44:57 -0400 Subject: [PATCH 10/10] rename interface method --- irods/manager/access_manager.py | 2 +- irods/test/access_test.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/irods/manager/access_manager.py b/irods/manager/access_manager.py index ff784e5e..58ac26f8 100644 --- a/irods/manager/access_manager.py +++ b/irods/manager/access_manager.py @@ -48,7 +48,7 @@ def _ACL_operation(self, op_input: iRODSAccess): ) } - def _call_atomic_acl_api(self, logical_path : str, *operations, admin=False): + def apply_atomic_acl_operations(self, logical_path : str, *operations, admin=False): request_text = { "logical_path": logical_path, "admin_mode": admin, diff --git a/irods/test/access_test.py b/irods/test/access_test.py index b3d16ce4..22e25c12 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -506,7 +506,7 @@ def test_atomic_acls_505(self): user2 = ses.users.create("rod_serling_505#twilight", "rodsuser") user3 = ses.users.create("local_test_user_505", "rodsuser") group = ses.groups.create("test_group_505") - ses.acls._call_atomic_acl_api( + ses.acls.apply_atomic_acl_operations( self.coll_path, a1:=ACLOperation("write", user1.name, user1.zone), a2:=ACLOperation("read", user2.name, user2.zone),