From 7a811847ec02bdbc3bc5e8adc7913cb8e03067cd Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Fri, 20 Mar 2026 19:06:28 -0400 Subject: [PATCH 01/20] add SYS_INTERNAL_ERR --- irods/exception.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/irods/exception.py b/irods/exception.py index b9551fdc1..4dbbd66de 100644 --- a/irods/exception.py +++ b/irods/exception.py @@ -650,6 +650,10 @@ class SYS_INVALID_INPUT_PARAM(SystemException): code = -130000 +class SYS_INTERNAL_ERR(SystemException): + code = -154000 + + class SYS_BAD_INPUT(iRODSException): code = -158000 From 228bf860d906d6bde877b13fb6faf747de54dd12 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Thu, 19 Mar 2026 02:40:53 -0400 Subject: [PATCH 02/20] [_505,sq] atomic ACLs endpoint --- irods/access.py | 5 ++++- irods/manager/access_manager.py | 30 +++++++++++++++++++++++++- irods/test/access_test.py | 37 +++++++++++++++++++++++++++++++++ 3 files changed, 70 insertions(+), 2 deletions(-) diff --git a/irods/access.py b/irods/access.py index 465585ddc..3c0d206d6 100644 --- a/irods/access.py +++ b/irods/access.py @@ -102,7 +102,7 @@ def __eq__(self, other): def __hash__(self): return hash((self.access_name, iRODSPath(self.path), self.user_name, self.user_zone)) - def copy(self, decanonicalize=False): + def copy(self, decanonicalize=False, ref_zone=''): other = copy.deepcopy(self) if decanonicalize: replacement_string = { @@ -112,6 +112,9 @@ def copy(self, decanonicalize=False): "modify_object": "write", }.get(self.access_name) other.access_name = replacement_string if replacement_string is not None else self.access_name + if '' != ref_zone == other.user_zone: + other.user_zone = '' + return other def __repr__(self): diff --git a/irods/manager/access_manager.py b/irods/manager/access_manager.py index bf32dc283..58cec8100 100644 --- a/irods/manager/access_manager.py +++ b/irods/manager/access_manager.py @@ -2,7 +2,7 @@ from irods.manager import Manager from irods.api_number import api_number -from irods.message import ModAclRequest, iRODSMessage +from irods.message import ModAclRequest, iRODSMessage, JSON_Message from irods.data_object import iRODSDataObject, irods_dirname, irods_basename from irods.collection import iRODSCollection from irods.models import ( @@ -14,6 +14,7 @@ CollectionAccess, ) from irods.access import iRODSAccess +import irods.exception as ex from irods.column import In from irods.user import iRODSUser @@ -36,6 +37,33 @@ def users_by_ids(session, ids=()): class AccessManager(Manager): + + def _ACL_operation(self, op_input: iRODSAccess): + return { + "acl": op_input.access_name, + "entity_name": op_input.user_name, + **( + {} if not (z := op_input.user_zone) + else {"zone": z} + ) + } + + def _call_atomic_acl_api(self, logical_path : str, *operations, admin=False): + request_text = {"logical_path": logical_path} + request_text["admin_mode"] = admin + request_text["operations"] = [self._ACL_operation(op) for op in operations] + + with self.sess.pool.get_connection() as conn: + request_msg = iRODSMessage( + "RODS_API_REQ", + JSON_Message(request_text, conn.server_version), + int_info=20005, + ) + conn.send(request_msg) + response = conn.recv() + response_msg = response.get_json_encoded_struct() + logger.debug("in atomic ACL api, server responded with: %r", response_msg) + def get(self, target, report_raw_acls=True, **kw): if report_raw_acls: diff --git a/irods/test/access_test.py b/irods/test/access_test.py index fadc6a7dc..5bf397d87 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -497,6 +497,43 @@ def test_iRODSAccess_cannot_be_constructed_using_unsupported_type__issue_558(sel self.sess, ) + def test_atomic_acls_505(self): + #import pdb;pdb.set_trace() + ses = self.sess + zone = user1 = user2 = group = None + try: + zone = ses.zones.create("twilight","remote") + user1 = ses.users.create("test_user_505", "rodsuser") + user2 = ses.users.create("rod_serling_505#twilight", "rodsuser") + group = ses.groups.create("test_group_505") + ses.acls._call_atomic_acl_api( + self.coll_path, + a1:=iRODSAccess("write", "", user1.name, user1.zone), + a2:=iRODSAccess("read", "", user2.name, user2.zone), + a3:=iRODSAccess("read", "", group.name), + ) + + accesses = ses.acls.get(self.coll) + + # For purposes of equality tests, assign the path name of interest into each ACL. + for p in (a1, a2, a3): + p.path = self.coll_path + + # Assert that the ACLs we added are among those listed for the object in the catalog. + normalize = lambda access: access.copy(decanonicalize=True, ref_zone=ses.zone) + self.assertLess( + set(normalize(_) for _ in (a1,a2,a3)), + set(normalize(_) for _ in accesses) + ) + finally: + if user1: + user1.remove() + if user2: + user2.remove() + if group: + group.remove() + if zone: + zone.remove() if __name__ == "__main__": # let the tests find the parent irods lib From fb6e37366a48fea4914449a972ab2ef8c157af59 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Sat, 21 Mar 2026 00:45:03 -0400 Subject: [PATCH 03/20] misc corrections / ruff lint and format --- README.md | 28 +++++++++ irods/access.py | 102 ++++++++++++++++++++++++++------ irods/api_number.py | 1 + irods/manager/access_manager.py | 22 ++++--- irods/test/access_test.py | 36 +++++------ 5 files changed, 141 insertions(+), 48 deletions(-) diff --git a/README.md b/README.md index 5bd193205..dc3aed6a4 100644 --- a/README.md +++ b/README.md @@ -2118,6 +2118,34 @@ membership, this can be achieved with another query. `.permissions` was therefore removed in v2.0.0 in favor of `.acls`. +Atomic ACLs +----------- + +A list of permissions may be added to an object atomically using +the AccessManager's apply_atomic_operations method: +``` +from irods.access import ACLOperation +from irods.helpers import home_collection +session = irods.helpers.make_session() +myCollection = session.collections.create(f"{home_collection(session).path}/newCollection") + +session.acls.apply_atomic_operations(myCollection.path, + *[ACLOperation("read", "public"), + ACLOperation("write", "bob", "otherZone") + ]) +``` +ACLOperation objects form a linear order with iRODSAccess objects, and +indeed are subclassed from them as well, allowing equivalency testing: + +Thus, for example: +``` +ACLOperation('read','public') in sess.acls.get(object) +``` +is a valid operation. Consequently, any client application that habitually +caches object permissions could use similar code to check new ACLOperations against the cache +and conceivably be able to optimize size of an atomic ACLs request by eliminating +any ACLOperations that might have been redundant. + Quotas (v2.0.0) --------------- diff --git a/irods/access.py b/irods/access.py index 3c0d206d6..e2d9f5e24 100644 --- a/irods/access.py +++ b/irods/access.py @@ -5,6 +5,22 @@ from irods.path import iRODSPath +_ichmod_listed_permissions = ( + "own", + "delete_object", + "write", + "modify_object", + "create_object", + "delete_metadata", + "modify_metadata", + "create_metadata", + "read", + "read_object", + "read_metadata", + "null", +) + + class _Access_LookupMeta(type): def __getitem__(self, key): return self.codes[key] @@ -28,6 +44,7 @@ def to_int(cls, key): def to_string(cls, key): return cls.strings[key] + # noqa: RUF012 - Cannot change in minor release codes = collections.OrderedDict( (key_, value_) for key_, value_ in sorted( @@ -55,24 +72,10 @@ def to_string(cls, key): ).items(), key=lambda _: _[1], ) - if key_ - in ( - # These are copied from ichmod help text. - "own", - "delete_object", - "write", - "modify_object", - "create_object", - "delete_metadata", - "modify_metadata", - "create_metadata", - "read", - "read_object", - "read_metadata", - "null", - ) + if key_ in _ichmod_listed_permissions ) + # noqa: RUF012 - Cannot change in minor release strings = collections.OrderedDict((number, string) for string, number in codes.items()) def __init__(self, access_name, path, user_name="", user_zone="", user_type=None): @@ -91,6 +94,14 @@ def __init__(self, access_name, path, user_name="", user_zone="", user_type=None self.user_zone = user_zone self.user_type = user_type + def __lt__(self, other): + return (self.access_name, self.user_name, self.user_zone, iRODSPath(self.path)) < ( + other.access_name, + other.user_name, + other.user_zone, + iRODSPath(other.path), + ) + def __eq__(self, other): return ( self.access_name == other.access_name @@ -102,8 +113,9 @@ def __eq__(self, other): def __hash__(self): return hash((self.access_name, iRODSPath(self.path), self.user_name, self.user_zone)) - def copy(self, decanonicalize=False, ref_zone=''): + def copy(self, decanonicalize=False, implied_zone=''): other = copy.deepcopy(self) + if decanonicalize: replacement_string = { "read object": "read", @@ -112,8 +124,10 @@ def copy(self, decanonicalize=False, ref_zone=''): "modify_object": "write", }.get(self.access_name) other.access_name = replacement_string if replacement_string is not None else self.access_name - if '' != ref_zone == other.user_zone: - other.user_zone = '' + + # Useful if we wish to force an explicitly specified local zone to an implicit zone spec in the copy, for equality testing: + if '' != implied_zone == other.user_zone: + other.user_zone = '' return other @@ -124,6 +138,56 @@ def __repr__(self): return f"" +class ACLOperation(iRODSAccess): + def __init__(self, access_name: str, user_name: str = "", user_zone: str = ""): + super().__init__( + access_name=access_name, + path="", + user_name=user_name, + user_zone=user_zone, + ) + + def __eq__(self, other): + return ( + self.access_name, + self.user_name, + self.user_zone, + ) == ( + other.access_name, + other.user_name, + other.user_zone, + ) + + def __lt__(self, other): + return ( + self.access_name, + self.user_name, + self.user_zone, + ) < ( + other.access_name, + other.user_name, + other.user_zone, + ) + + def __repr__(self): + return f"" + + +( + _ichmod_synonym_mapping := { + # syn : canonical + "write": "modify_object", + "read": "read_object", + } +).update((key.replace("_", " "), key) for key in iRODSAccess.codes.keys()) + + +all_permissions = { + **iRODSAccess.codes, + **{key: iRODSAccess.codes[_ichmod_synonym_mapping[key]] for key in _ichmod_synonym_mapping}, +} + + class _iRODSAccess_pre_4_3_0(iRODSAccess): codes = collections.OrderedDict( (key.replace("_", " "), value) diff --git a/irods/api_number.py b/irods/api_number.py index fe614ffce..03ac3de86 100644 --- a/irods/api_number.py +++ b/irods/api_number.py @@ -177,6 +177,7 @@ "ATOMIC_APPLY_METADATA_OPERATIONS_APN": 20002, "GET_FILE_DESCRIPTOR_INFO_APN": 20000, "REPLICA_CLOSE_APN": 20004, + "ATOMIC_APPLY_ACL_OPERATIONS_APN": 20005, "TOUCH_APN": 20007, "AUTH_PLUG_REQ_AN": 1201, "AUTHENTICATION_APN": 110000, diff --git a/irods/manager/access_manager.py b/irods/manager/access_manager.py index 58cec8100..d63e5e2d8 100644 --- a/irods/manager/access_manager.py +++ b/irods/manager/access_manager.py @@ -14,7 +14,6 @@ CollectionAccess, ) from irods.access import iRODSAccess -import irods.exception as ex from irods.column import In from irods.user import iRODSUser @@ -37,27 +36,26 @@ def users_by_ids(session, ids=()): class AccessManager(Manager): - - def _ACL_operation(self, op_input: iRODSAccess): + @staticmethod + def _to_acl_operation_json(op_input: iRODSAccess): return { "acl": op_input.access_name, "entity_name": op_input.user_name, - **( - {} if not (z := op_input.user_zone) - else {"zone": z} - ) + **({} if not (z := op_input.user_zone) else {"zone": z}), } - def _call_atomic_acl_api(self, logical_path : str, *operations, admin=False): - request_text = {"logical_path": logical_path} - request_text["admin_mode"] = admin - request_text["operations"] = [self._ACL_operation(op) for op in operations] + def apply_atomic_operations(self, logical_path: str, *operations, admin=False): + request_text = { + "logical_path": logical_path, + "admin_mode": admin, + "operations": [self._to_acl_operation_json(op) for op in operations], + } with self.sess.pool.get_connection() as conn: request_msg = iRODSMessage( "RODS_API_REQ", JSON_Message(request_text, conn.server_version), - int_info=20005, + int_info=api_number["ATOMIC_APPLY_ACL_OPERATIONS_APN"], ) conn.send(request_msg) response = conn.recv() diff --git a/irods/test/access_test.py b/irods/test/access_test.py index 5bf397d87..3c65566e6 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -4,7 +4,7 @@ import sys import unittest -from irods.access import iRODSAccess +from irods.access import iRODSAccess, ACLOperation from irods.collection import iRODSCollection from irods.column import In, Like from irods.exception import UserDoesNotExist @@ -498,43 +498,45 @@ def test_iRODSAccess_cannot_be_constructed_using_unsupported_type__issue_558(sel ) def test_atomic_acls_505(self): - #import pdb;pdb.set_trace() ses = self.sess - zone = user1 = user2 = group = None + zone = user1 = user2 = user3 = group = None try: - zone = ses.zones.create("twilight","remote") + zone = ses.zones.create("twilight", "remote") user1 = ses.users.create("test_user_505", "rodsuser") user2 = ses.users.create("rod_serling_505#twilight", "rodsuser") + user3 = ses.users.create("local_test_user_505", "rodsuser") group = ses.groups.create("test_group_505") - ses.acls._call_atomic_acl_api( + ses.acls.apply_atomic_operations( self.coll_path, - a1:=iRODSAccess("write", "", user1.name, user1.zone), - a2:=iRODSAccess("read", "", user2.name, user2.zone), - a3:=iRODSAccess("read", "", group.name), + a1:=ACLOperation("write", user1.name, user1.zone), + a2:=ACLOperation("read", user2.name, user2.zone), + a3:=ACLOperation("read", user3.name), + a4:=ACLOperation("read", group.name), ) - accesses = ses.acls.get(self.coll) + normalize = lambda access: access.copy(decanonicalize=True, implied_zone=ses.zone) - # For purposes of equality tests, assign the path name of interest into each ACL. - for p in (a1, a2, a3): - p.path = self.coll_path + accesses = [normalize(acl) for acl in ses.acls.get(self.coll)] # Assert that the ACLs we added are among those listed for the object in the catalog. - normalize = lambda access: access.copy(decanonicalize=True, ref_zone=ses.zone) - self.assertLess( - set(normalize(_) for _ in (a1,a2,a3)), - set(normalize(_) for _ in accesses) - ) + self.assertIn(normalize(a1), accesses) + self.assertIn(normalize(a2), accesses) + self.assertIn(normalize(a3), accesses) + self.assertIn(normalize(a4), accesses) + finally: if user1: user1.remove() if user2: user2.remove() + if user3: + user3.remove() if group: group.remove() if zone: zone.remove() + if __name__ == "__main__": # let the tests find the parent irods lib sys.path.insert(0, os.path.abspath("../..")) From 1b2e7e1eb479250b3423a22a3157342593d2942b Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Thu, 26 Mar 2026 22:33:17 -0400 Subject: [PATCH 04/20] convert "codes" and "strings" into properties of the class to prevent casual corruption. RUF012 points out that instances of the class can casually modify an unmutable class variable, eg.: class A: value = [] def f(self,*y): self.value += [*y] --- irods/access.py | 60 ++++++++++++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 25 deletions(-) diff --git a/irods/access.py b/irods/access.py index e2d9f5e24..332c7734d 100644 --- a/irods/access.py +++ b/irods/access.py @@ -22,30 +22,10 @@ class _Access_LookupMeta(type): - def __getitem__(self, key): - return self.codes[key] - - def keys(self): - return list(self.codes.keys()) - - def values(self): - return list(self.codes[k] for k in self.codes.keys()) - - def items(self): - return list(zip(self.keys(), self.values())) - -class iRODSAccess(metaclass=_Access_LookupMeta): - @classmethod - def to_int(cls, key): - return cls.codes[key] - - @classmethod - def to_string(cls, key): - return cls.strings[key] - - # noqa: RUF012 - Cannot change in minor release - codes = collections.OrderedDict( + @staticmethod + def _codes(): + return collections.OrderedDict( (key_, value_) for key_, value_ in sorted( dict( @@ -75,10 +55,40 @@ def to_string(cls, key): if key_ in _ichmod_listed_permissions ) - # noqa: RUF012 - Cannot change in minor release - strings = collections.OrderedDict((number, string) for string, number in codes.items()) + @property + def codes(metaclass_target): return metaclass_target._codes() + + @property + def strings(metaclass_target): + return collections.OrderedDict((number, string) for string, number in + metaclass_target._codes().items()) + + def __getitem__(self, key): + return self.codes[key] + + def keys(self): + return list(self.codes.keys()) + + def values(self): + return list(self.codes[k] for k in self.codes.keys()) + + def items(self): + return list(zip(self.keys(), self.values())) + + +class iRODSAccess(metaclass=_Access_LookupMeta): + @classmethod + def to_int(cls, key): + return cls.codes[key] + + @classmethod + def to_string(cls, key): + return cls.strings[key] + def __init__(self, access_name, path, user_name="", user_zone="", user_type=None): + self.codes = self.__class__.codes.copy() + self.strings = self.__class__.strings.copy() self.access_name = access_name if isinstance(path, (iRODSCollection, iRODSDataObject)): self.path = path.path From 32f6a24e7712ebaa0b8c1f30e7ca8074c8399013 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Fri, 27 Mar 2026 05:20:13 -0400 Subject: [PATCH 05/20] ruff related changes --- README.md | 7 ++-- irods/access.py | 76 ++++++++++++++++++++------------------- irods/test/access_test.py | 11 +++--- 3 files changed, 49 insertions(+), 45 deletions(-) diff --git a/README.md b/README.md index dc3aed6a4..79c1d3fa8 100644 --- a/README.md +++ b/README.md @@ -2141,10 +2141,9 @@ Thus, for example: ``` ACLOperation('read','public') in sess.acls.get(object) ``` -is a valid operation. Consequently, any client application that habitually -caches object permissions could use similar code to check new ACLOperations against the cache -and conceivably be able to optimize size of an atomic ACLs request by eliminating -any ACLOperations that might have been redundant. +is a valid operation, so that an application that tends to cache object +permissions client-side might use such checks in optimizing atomic ACL +requests against the inclusion of any redundant ACLOperations. Quotas (v2.0.0) --------------- diff --git a/irods/access.py b/irods/access.py index 332c7734d..3b2a58225 100644 --- a/irods/access.py +++ b/irods/access.py @@ -26,42 +26,42 @@ class _Access_LookupMeta(type): @staticmethod def _codes(): return collections.OrderedDict( - (key_, value_) - for key_, value_ in sorted( - dict( - # copied from iRODS source code in - # ./server/core/include/irods/catalog_utilities.hpp: - null=1000, - execute=1010, - read_annotation=1020, - read_system_metadata=1030, - read_metadata=1040, - read_object=1050, - write_annotation=1060, - create_metadata=1070, - modify_metadata=1080, - delete_metadata=1090, - administer_object=1100, - create_object=1110, - modify_object=1120, - delete_object=1130, - create_token=1140, - delete_token=1150, - curate=1160, - own=1200, - ).items(), - key=lambda _: _[1], + (key_, value_) + for key_, value_ in sorted( + dict( + # copied from iRODS source code in + # ./server/core/include/irods/catalog_utilities.hpp: + null=1000, + execute=1010, + read_annotation=1020, + read_system_metadata=1030, + read_metadata=1040, + read_object=1050, + write_annotation=1060, + create_metadata=1070, + modify_metadata=1080, + delete_metadata=1090, + administer_object=1100, + create_object=1110, + modify_object=1120, + delete_object=1130, + create_token=1140, + delete_token=1150, + curate=1160, + own=1200, + ).items(), + key=lambda _: _[1], + ) + if key_ in _ichmod_listed_permissions ) - if key_ in _ichmod_listed_permissions - ) @property - def codes(metaclass_target): return metaclass_target._codes() + def codes(metaclass_target): + return metaclass_target._codes() @property def strings(metaclass_target): - return collections.OrderedDict((number, string) for string, number in - metaclass_target._codes().items()) + return collections.OrderedDict((number, string) for string, number in metaclass_target._codes().items()) def __getitem__(self, key): return self.codes[key] @@ -76,7 +76,7 @@ def items(self): return list(zip(self.keys(), self.values())) -class iRODSAccess(metaclass=_Access_LookupMeta): +class _iRODSAccess_base: @classmethod def to_int(cls, key): return cls.codes[key] @@ -85,10 +85,7 @@ def to_int(cls, key): def to_string(cls, key): return cls.strings[key] - - def __init__(self, access_name, path, user_name="", user_zone="", user_type=None): - self.codes = self.__class__.codes.copy() - self.strings = self.__class__.strings.copy() + def __init__(self, access_name, path, user_name, user_zone, user_type): self.access_name = access_name if isinstance(path, (iRODSCollection, iRODSDataObject)): self.path = path.path @@ -148,6 +145,13 @@ def __repr__(self): return f"" +class iRODSAccess(_iRODSAccess_base, metaclass=_Access_LookupMeta): + def __init__(self, access_name, path, user_name="", user_zone="", user_type=None): + self.codes = self.__class__.codes + self.strings = self.__class__.strings + super().__init__(access_name, path, user_name, user_zone, user_type) + + class ACLOperation(iRODSAccess): def __init__(self, access_name: str, user_name: str = "", user_zone: str = ""): super().__init__( @@ -198,7 +202,7 @@ def __repr__(self): } -class _iRODSAccess_pre_4_3_0(iRODSAccess): +class _iRODSAccess_pre_4_3_0(_iRODSAccess_base): codes = collections.OrderedDict( (key.replace("_", " "), value) for key, value in iRODSAccess.codes.items() diff --git a/irods/test/access_test.py b/irods/test/access_test.py index 3c65566e6..46ecf5a49 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -508,13 +508,14 @@ def test_atomic_acls_505(self): group = ses.groups.create("test_group_505") ses.acls.apply_atomic_operations( self.coll_path, - a1:=ACLOperation("write", user1.name, user1.zone), - a2:=ACLOperation("read", user2.name, user2.zone), - a3:=ACLOperation("read", user3.name), - a4:=ACLOperation("read", group.name), + a1 := ACLOperation("write", user1.name, user1.zone), + a2 := ACLOperation("read", user2.name, user2.zone), + a3 := ACLOperation("read", user3.name), + a4 := ACLOperation("read", group.name), ) - normalize = lambda access: access.copy(decanonicalize=True, implied_zone=ses.zone) + def normalize(access): + return access.copy(decanonicalize=True, implied_zone=ses.zone) accesses = [normalize(acl) for acl in ses.acls.get(self.coll)] From e373423b5f2cfa9408c8362e1dd60bc17963edfb Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Fri, 27 Mar 2026 14:30:09 -0400 Subject: [PATCH 06/20] [_809] deprecate class for storing permission codes pre-iRODS-4.3 --- irods/access.py | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/irods/access.py b/irods/access.py index 3b2a58225..e830bc454 100644 --- a/irods/access.py +++ b/irods/access.py @@ -1,5 +1,7 @@ import collections import copy +import warnings + from irods.collection import iRODSCollection from irods.data_object import iRODSDataObject from irods.path import iRODSPath @@ -202,10 +204,26 @@ def __repr__(self): } -class _iRODSAccess_pre_4_3_0(_iRODSAccess_base): - codes = collections.OrderedDict( - (key.replace("_", " "), value) - for key, value in iRODSAccess.codes.items() - if key in ("own", "write", "modify_object", "read", "read_object", "null") - ) - strings = collections.OrderedDict((number, string) for string, number in codes.items()) +class _deprecated: + class _iRODSAccess_pre_4_3_0(_iRODSAccess_base): + codes = collections.OrderedDict( + (key.replace("_", " "), value) + for key, value in iRODSAccess.codes.items() + if key in ("own", "write", "modify_object", "read", "read_object", "null") + ) + strings = collections.OrderedDict((number, string) for string, number in codes.items()) + def __init__(self, *args, **kwargs): + warnings.warn( + "_iRODSAccess_pre_4_3_0 is deprecated and will be removed in a future version. Use iRODSAccess instead.", + DeprecationWarning, + stacklevel=2 + ) + super().__init__(*args,**kwargs) + +_deprecated_names = {'_iRODSAccess_pre_4_3_0':_deprecated._iRODSAccess_pre_4_3_0} + +def __getattr__(name): + if name in _deprecated_names: + warnings.warn(f"{name} is deprecated", DeprecationWarning, stacklevel=2) + return _deprecated_names[name] + raise AttributeError(f"module {__name__!r} has no attribute {name!r}") From 642182956f8cec0b23a0aa195817978db702ac03 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Fri, 27 Mar 2026 14:46:43 -0400 Subject: [PATCH 07/20] README updates --- README.md | 46 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 36 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 79c1d3fa8..4fc299024 100644 --- a/README.md +++ b/README.md @@ -2122,28 +2122,54 @@ Atomic ACLs ----------- A list of permissions may be added to an object atomically using -the AccessManager's apply_atomic_operations method: -``` +the AccessManager's `apply_atomic_operations` method: +```py from irods.access import ACLOperation from irods.helpers import home_collection session = irods.helpers.make_session() myCollection = session.collections.create(f"{home_collection(session).path}/newCollection") -session.acls.apply_atomic_operations(myCollection.path, - *[ACLOperation("read", "public"), - ACLOperation("write", "bob", "otherZone") - ]) +session.acls.apply_atomic_operations( + myCollection.path, + *[ + ACLOperation("read", "public"), + ACLOperation("write", "bob", "otherZone") + ] +) ``` -ACLOperation objects form a linear order with iRODSAccess objects, and -indeed are subclassed from them as well, allowing equivalency testing: +`ACLOperation` objects form a linear order with `iRODSAccess` objects, and +indeed are subclassed from them as well, allowing equivalency testing. Thus, for example: -``` +```py ACLOperation('read','public') in sess.acls.get(object) ``` is a valid operation, so that an application that tends to cache object permissions client-side might use such checks in optimizing atomic ACL -requests against the inclusion of any redundant ACLOperations. +requests against the inclusion of any redundant ACL operations. + +For purposes of sorting, a `__lt__` operator is also defined that would +allow sorting of lists of `iRODSAccess`, `ACLOperations`, or the two intermixed: +```py +perms_list=[ + ACLOperation('read', 'bob'), + iRODSAccess('read', '/tempZone/home/alice', 'alice') +] +print(sorted(perms_list)) +``` + +and, as always, a sort key may be used for custom sorting; for example, +the following sorts the objects simply by ascending numerical value of the access: +```py +perms = sorted( + [ + ACLOperation('read', 'bob'), + ACLOperation('write', 'rods'), + ACLOperation('read_object', 'alice') + ], + key=lambda acl: iRODSAccess.codes[acl.access_name] +) +``` Quotas (v2.0.0) --------------- From 8397b343424e9160dd22cf62a62ff1432a518cfd Mon Sep 17 00:00:00 2001 From: Daniel Moore Date: Fri, 27 Mar 2026 21:17:17 -0400 Subject: [PATCH 08/20] update test name to include _issue_ --- irods/test/access_test.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/irods/test/access_test.py b/irods/test/access_test.py index 46ecf5a49..899b0ec8a 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -497,7 +497,7 @@ def test_iRODSAccess_cannot_be_constructed_using_unsupported_type__issue_558(sel self.sess, ) - def test_atomic_acls_505(self): + def test_atomic_acls__issue_505(self): ses = self.sess zone = user1 = user2 = user3 = group = None try: From 5b1c514fd234d0a609747b9bbc4dec7781151c30 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Sun, 29 Mar 2026 10:31:32 -0400 Subject: [PATCH 09/20] README example for normalization before comparison of acl-like objects --- README.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 4fc299024..24c880bd5 100644 --- a/README.md +++ b/README.md @@ -2138,7 +2138,21 @@ session.acls.apply_atomic_operations( ) ``` `ACLOperation` objects form a linear order with `iRODSAccess` objects, and -indeed are subclassed from them as well, allowing equivalency testing. +indeed are subclassed from them as well, allowing intermixed sequences to be +sorted; however, care should be taken to normalize the objects before comparisons +or for related uses of the 'in' operator: +```py +normalize = lambda acl: acl.copy(decanonicalize=True, implied_zone='tempZone') +acls = sorted( + [ + iRODSAccess('read object', '/tempZone/home/alice', 'bob', 'tempZone'), + ACLOperation('write', 'rods'), + ACLOperation('read', 'bob'), + ], + key=normalize +) +print(normalize(acls[0]) == normalize(acls[1])) +``` Thus, for example: ```py From e565b16545e9db8a002e81b2724e1af580bcce1f Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Sun, 29 Mar 2026 19:58:29 -0400 Subject: [PATCH 10/20] add true ACLOperation/iRODSAccess canonicalization for api calls and comparison --- README.md | 25 ++------------------- irods/access.py | 39 +++++++++++++++++++++++++++++---- irods/manager/access_manager.py | 2 +- irods/test/access_test.py | 2 +- 4 files changed, 39 insertions(+), 29 deletions(-) diff --git a/README.md b/README.md index 24c880bd5..9b6ad9d1f 100644 --- a/README.md +++ b/README.md @@ -2142,39 +2142,18 @@ indeed are subclassed from them as well, allowing intermixed sequences to be sorted; however, care should be taken to normalize the objects before comparisons or for related uses of the 'in' operator: ```py -normalize = lambda acl: acl.copy(decanonicalize=True, implied_zone='tempZone') +normalize = lambda acl: acl.copy(decanonicalize=-1, implied_zone='tempZone') acls = sorted( [ iRODSAccess('read object', '/tempZone/home/alice', 'bob', 'tempZone'), ACLOperation('write', 'rods'), ACLOperation('read', 'bob'), - ], + ], key=normalize ) print(normalize(acls[0]) == normalize(acls[1])) ``` -Thus, for example: -```py -ACLOperation('read','public') in sess.acls.get(object) -``` -is a valid operation, so that an application that tends to cache object -permissions client-side might use such checks in optimizing atomic ACL -requests against the inclusion of any redundant ACL operations. - -For purposes of sorting, a `__lt__` operator is also defined that would -allow sorting of lists of `iRODSAccess`, `ACLOperations`, or the two intermixed: -```py -perms_list=[ - ACLOperation('read', 'bob'), - iRODSAccess('read', '/tempZone/home/alice', 'alice') -] -print(sorted(perms_list)) -``` - -and, as always, a sort key may be used for custom sorting; for example, -the following sorts the objects simply by ascending numerical value of the access: -```py perms = sorted( [ ACLOperation('read', 'bob'), diff --git a/irods/access.py b/irods/access.py index e830bc454..07373fc58 100644 --- a/irods/access.py +++ b/irods/access.py @@ -123,16 +123,44 @@ def __hash__(self): return hash((self.access_name, iRODSPath(self.path), self.user_name, self.user_zone)) def copy(self, decanonicalize=False, implied_zone=''): + """ + Create a copy of the object, possibly in a normalized form. + + Args: + decanonicalize: Whether to modify to access_name field to a more human (1/True) or more standard (-1) form + If the former, then one-word style is favored, ie "read" and "write". If the latter, the new access_name + will be more machine-friendly for operators __lt__ (for sorting) and __eq__ (for equivalence or use with 'in'). + implied_zone: If a nonzero-length name, compare this against the zone_name field of the old object and force the zone_name to + zero-length in the new object. + + Returns: + The new copy + """ other = copy.deepcopy(self) - if decanonicalize: - replacement_string = { + access_name = self.access_name + + if decanonicalize == 1: + if (new_access_name := { "read object": "read", "read_object": "read", "modify object": "write", "modify_object": "write", - }.get(self.access_name) - other.access_name = replacement_string if replacement_string is not None else self.access_name + }.get(access_name)) != None: access_name = new_access_name + elif decanonicalize == -1: + # Canonicalize, ie. change out old access_name for an unambiguous "standard" value. + access_name = access_name.replace(" ","_") + if (new_access_name := { + "read": "read_object", + "write": "modify_object", + }.get(access_name)) != None: access_name = new_access_name + elif decanonicalize == 0: + pass + else: + msg = "Improper value for 'decanonicalize' parameter" + raise RuntimerError(msg) + + other.access_name = access_name # Useful if we wish to force an explicitly specified local zone to an implicit zone spec in the copy, for equality testing: if '' != implied_zone == other.user_zone: @@ -203,6 +231,9 @@ def __repr__(self): **{key: iRODSAccess.codes[_ichmod_synonym_mapping[key]] for key in _ichmod_synonym_mapping}, } +canonical_permissions = dict( + (k,v) for k,v in all_permissions.items() if ' ' not in k and k not in ('read','write') +) class _deprecated: class _iRODSAccess_pre_4_3_0(_iRODSAccess_base): diff --git a/irods/manager/access_manager.py b/irods/manager/access_manager.py index d63e5e2d8..527a8640a 100644 --- a/irods/manager/access_manager.py +++ b/irods/manager/access_manager.py @@ -174,7 +174,7 @@ def set(self, acl, recursive=False, admin=False, **kw): zone_ = acl.user_zone if acl.access_name.endswith("inherit"): zone_ = userName_ = "" - acl = acl.copy(decanonicalize=True) + acl = acl.copy(decanonicalize=-1) message_body = ModAclRequest( recursiveFlag=int(recursive), accessLevel=f"{prefix}{acl.access_name}", diff --git a/irods/test/access_test.py b/irods/test/access_test.py index 899b0ec8a..402a79f90 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -515,7 +515,7 @@ def test_atomic_acls__issue_505(self): ) def normalize(access): - return access.copy(decanonicalize=True, implied_zone=ses.zone) + return access.copy(decanonicalize=-1, implied_zone=ses.zone) accesses = [normalize(acl) for acl in ses.acls.get(self.coll)] From b9c4088b34f10a147f37054d00f5bb95a543dd42 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Sun, 29 Mar 2026 20:32:40 -0400 Subject: [PATCH 11/20] correct README again --- README.md | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 9b6ad9d1f..a9d018871 100644 --- a/README.md +++ b/README.md @@ -2139,29 +2139,35 @@ session.acls.apply_atomic_operations( ``` `ACLOperation` objects form a linear order with `iRODSAccess` objects, and indeed are subclassed from them as well, allowing intermixed sequences to be -sorted; however, care should be taken to normalize the objects before comparisons -or for related uses of the 'in' operator: +sorted. Care should be taken to normalize the objects before such comparisons, +sorting, or with related uses of the 'in' operator: ```py +from irods.access import * normalize = lambda acl: acl.copy(decanonicalize=-1, implied_zone='tempZone') acls = sorted( [ - iRODSAccess('read object', '/tempZone/home/alice', 'bob', 'tempZone'), + iRODSAccess('read_object', '/tempZone/home/alice', 'bob', 'tempZone'), ACLOperation('write', 'rods'), ACLOperation('read', 'bob'), ], key=normalize ) print(normalize(acls[0]) == normalize(acls[1])) +print(normalize(iRODSAccess('read', '/tempZone/home/alice', 'bob')) in map(normalize, acls)) ``` -perms = sorted( +If strict order of permissions is desired, use something like the below: +```py +from irods.access import * +from pprint import pp +pp(sorted( [ ACLOperation('read', 'bob'), - ACLOperation('write', 'rods'), + ACLOperation('own', 'rods'), ACLOperation('read_object', 'alice') ], - key=lambda acl: iRODSAccess.codes[acl.access_name] -) + key=lambda acl: (all_permissions[acl.access_name], normalize(acl)) +)) ``` Quotas (v2.0.0) From fe51e786475e731ff13871cc02a7679c8fc78d88 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Sun, 29 Mar 2026 20:47:06 -0400 Subject: [PATCH 12/20] README ':'->'.' --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a9d018871..7e31f1fd5 100644 --- a/README.md +++ b/README.md @@ -2140,7 +2140,7 @@ session.acls.apply_atomic_operations( `ACLOperation` objects form a linear order with `iRODSAccess` objects, and indeed are subclassed from them as well, allowing intermixed sequences to be sorted. Care should be taken to normalize the objects before such comparisons, -sorting, or with related uses of the 'in' operator: +sorting, or with related uses of the 'in' operator. ```py from irods.access import * normalize = lambda acl: acl.copy(decanonicalize=-1, implied_zone='tempZone') @@ -2165,7 +2165,7 @@ pp(sorted( ACLOperation('read', 'bob'), ACLOperation('own', 'rods'), ACLOperation('read_object', 'alice') - ], + ], key=lambda acl: (all_permissions[acl.access_name], normalize(acl)) )) ``` From 375ab0d8824737b10f3b1e6de01fe7b93ea6418e Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Sun, 29 Mar 2026 20:52:05 -0400 Subject: [PATCH 13/20] whitespace --- irods/access.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/irods/access.py b/irods/access.py index 07373fc58..2bb71de88 100644 --- a/irods/access.py +++ b/irods/access.py @@ -127,8 +127,8 @@ def copy(self, decanonicalize=False, implied_zone=''): Create a copy of the object, possibly in a normalized form. Args: - decanonicalize: Whether to modify to access_name field to a more human (1/True) or more standard (-1) form - If the former, then one-word style is favored, ie "read" and "write". If the latter, the new access_name + decanonicalize: Whether to modify to access_name field to a more human-readable (1/True) or more standard (-1) form. + If the former, then a more organic style is favored, i.e. "read" and "write". If the latter, the new access_name will be more machine-friendly for operators __lt__ (for sorting) and __eq__ (for equivalence or use with 'in'). implied_zone: If a nonzero-length name, compare this against the zone_name field of the old object and force the zone_name to zero-length in the new object. From c57620e89a9d7267aa714ee8ce1feeb421a4bf23 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Mon, 30 Mar 2026 08:43:25 -0400 Subject: [PATCH 14/20] improve README phrasing --- README.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 7e31f1fd5..1e9300860 100644 --- a/README.md +++ b/README.md @@ -2138,9 +2138,15 @@ session.acls.apply_atomic_operations( ) ``` `ACLOperation` objects form a linear order with `iRODSAccess` objects, and -indeed are subclassed from them as well, allowing intermixed sequences to be -sorted. Care should be taken to normalize the objects before such comparisons, -sorting, or with related uses of the 'in' operator. +indeed are subclassed from them as well, allowing equivalence comparisons and +also permitting intermixed sequences to be sorted (using the `__lt__` method +if no sort `key` parameter is given). + +Care should be taken however to normalize the objects before such comparisons +and sorting, and with connected uses of the `in` operator (which leverages `__eq__`). + +The following code sorts the objects based on their lexical order starting with the +normalized `access_name`, which serves to group identical permissions together: ```py from irods.access import * normalize = lambda acl: acl.copy(decanonicalize=-1, implied_zone='tempZone') @@ -2156,7 +2162,7 @@ print(normalize(acls[0]) == normalize(acls[1])) print(normalize(iRODSAccess('read', '/tempZone/home/alice', 'bob')) in map(normalize, acls)) ``` -If strict order of permissions is desired, use something like the below: +If strict order of permissions is desired, we can use code such as the following: ```py from irods.access import * from pprint import pp From a808b38d6d212fad2bd17bc0bda309cd3cdbcacf Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Mon, 30 Mar 2026 09:07:05 -0400 Subject: [PATCH 15/20] correct README examples --- README.md | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 1e9300860..b2415d1d1 100644 --- a/README.md +++ b/README.md @@ -2127,7 +2127,7 @@ the AccessManager's `apply_atomic_operations` method: from irods.access import ACLOperation from irods.helpers import home_collection session = irods.helpers.make_session() -myCollection = session.collections.create(f"{home_collection(session).path}/newCollection") +myCollection = session.collections.create(f"{home_collection(session)}/newCollection") session.acls.apply_atomic_operations( myCollection.path, @@ -2150,15 +2150,13 @@ normalized `access_name`, which serves to group identical permissions together: ```py from irods.access import * normalize = lambda acl: acl.copy(decanonicalize=-1, implied_zone='tempZone') -acls = sorted( - [ - iRODSAccess('read_object', '/tempZone/home/alice', 'bob', 'tempZone'), - ACLOperation('write', 'rods'), - ACLOperation('read', 'bob'), - ], - key=normalize -) -print(normalize(acls[0]) == normalize(acls[1])) +acls = [ + iRODSAccess('read_object', '/tempZone/home/alice', 'bob', 'tempZone'), + ACLOperation('write', 'rods'), + ACLOperation('read', 'bob'), +] +print(normalize(acls[0]) == normalize(acls[2])) +acls.sort(key=normalize) print(normalize(iRODSAccess('read', '/tempZone/home/alice', 'bob')) in map(normalize, acls)) ``` From b5668945ad9e277325f773bbb6bb84cf865c6b1b Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Mon, 30 Mar 2026 09:15:19 -0400 Subject: [PATCH 16/20] drop use of 'ichmod' in identifiers --- irods/access.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/irods/access.py b/irods/access.py index 2bb71de88..6aded77c9 100644 --- a/irods/access.py +++ b/irods/access.py @@ -7,7 +7,7 @@ from irods.path import iRODSPath -_ichmod_listed_permissions = ( +_permissions = ( "own", "delete_object", "write", @@ -54,7 +54,7 @@ def _codes(): ).items(), key=lambda _: _[1], ) - if key_ in _ichmod_listed_permissions + if key_ in _permissions ) @property @@ -218,7 +218,7 @@ def __repr__(self): ( - _ichmod_synonym_mapping := { + _synonym_mapping := { # syn : canonical "write": "modify_object", "read": "read_object", @@ -228,7 +228,7 @@ def __repr__(self): all_permissions = { **iRODSAccess.codes, - **{key: iRODSAccess.codes[_ichmod_synonym_mapping[key]] for key in _ichmod_synonym_mapping}, + **{key: iRODSAccess.codes[_synonym_mapping[key]] for key in _synonym_mapping}, } canonical_permissions = dict( From 4120862acd24ed253337e36d625915d299dc08dc Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Mon, 30 Mar 2026 09:38:06 -0400 Subject: [PATCH 17/20] add permissions in README section title --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index b2415d1d1..bf45b2ac2 100644 --- a/README.md +++ b/README.md @@ -2118,8 +2118,8 @@ membership, this can be achieved with another query. `.permissions` was therefore removed in v2.0.0 in favor of `.acls`. -Atomic ACLs ------------ +Atomically setting permissions +------------------------------ A list of permissions may be added to an object atomically using the AccessManager's `apply_atomic_operations` method: From 6192eae7567f42eaf0aa56b540b4f59fc75ab6dd Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Mon, 30 Mar 2026 09:45:55 -0400 Subject: [PATCH 18/20] correct docstring. --- irods/access.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/irods/access.py b/irods/access.py index 6aded77c9..2dfd0034d 100644 --- a/irods/access.py +++ b/irods/access.py @@ -130,11 +130,11 @@ def copy(self, decanonicalize=False, implied_zone=''): decanonicalize: Whether to modify to access_name field to a more human-readable (1/True) or more standard (-1) form. If the former, then a more organic style is favored, i.e. "read" and "write". If the latter, the new access_name will be more machine-friendly for operators __lt__ (for sorting) and __eq__ (for equivalence or use with 'in'). - implied_zone: If a nonzero-length name, compare this against the zone_name field of the old object and force the zone_name to - zero-length in the new object. + implied_zone: If a nonzero-length name, compare this against the zone_name field of the old object, and if they match, + force the zone_name to zero-length in the new object. Returns: - The new copy + A copy of the invoking object, normalized if requested. """ other = copy.deepcopy(self) From 762d2bdb6819499e256bfea3d3298ebe9db4be56 Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Tue, 31 Mar 2026 11:22:41 -0400 Subject: [PATCH 19/20] delay import of deprecated class until latest possible point of need --- irods/session.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/irods/session.py b/irods/session.py index 0b32a01f1..384ca25c9 100644 --- a/irods/session.py +++ b/irods/session.py @@ -106,12 +106,15 @@ def auth_file(self): @property def available_permissions(self): - from irods.access import iRODSAccess, _iRODSAccess_pre_4_3_0 - try: self.__access except AttributeError: - self.__access = _iRODSAccess_pre_4_3_0 if self.server_version < (4, 3) else iRODSAccess + if self.server_version < (4, 3): + from irods.access import _iRODSAccess_pre_4_3_0 + self.__access = _iRODSAccess_pre_4_3_0 + else: + from irods.access import iRODSAccess + self.__access = iRODSAccess return self.__access def __init__(self, configure=True, auto_cleanup=True, **kwargs): From 5a1a4bc22d20ba6dcf17895d17034ec222d49e4c Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Tue, 31 Mar 2026 21:26:49 -0400 Subject: [PATCH 20/20] ruff-1 --- irods/access.py | 66 ++++++++++++++++----------------- irods/manager/access_manager.py | 21 +++++------ irods/session.py | 2 + irods/test/access_test.py | 8 ++-- 4 files changed, 49 insertions(+), 48 deletions(-) diff --git a/irods/access.py b/irods/access.py index 2dfd0034d..de62af588 100644 --- a/irods/access.py +++ b/irods/access.py @@ -6,7 +6,6 @@ from irods.data_object import iRODSDataObject from irods.path import iRODSPath - _permissions = ( "own", "delete_object", @@ -30,40 +29,40 @@ def _codes(): return collections.OrderedDict( (key_, value_) for key_, value_ in sorted( - dict( - # copied from iRODS source code in + { + # adapted from iRODS source code in # ./server/core/include/irods/catalog_utilities.hpp: - null=1000, - execute=1010, - read_annotation=1020, - read_system_metadata=1030, - read_metadata=1040, - read_object=1050, - write_annotation=1060, - create_metadata=1070, - modify_metadata=1080, - delete_metadata=1090, - administer_object=1100, - create_object=1110, - modify_object=1120, - delete_object=1130, - create_token=1140, - delete_token=1150, - curate=1160, - own=1200, - ).items(), + "null": 1000, + "execute": 1010, + "read_annotation": 1020, + "read_system_metadata": 1030, + "read_metadata": 1040, + "read_object": 1050, + "write_annotation": 1060, + "create_metadata": 1070, + "modify_metadata": 1080, + "delete_metadata": 1090, + "administer_object": 1100, + "create_object": 1110, + "modify_object": 1120, + "delete_object": 1130, + "create_token": 1140, + "delete_token": 1150, + "curate": 1160, + "own": 1200, + }.items(), key=lambda _: _[1], ) if key_ in _permissions ) @property - def codes(metaclass_target): - return metaclass_target._codes() + def codes(cls): + return cls._codes() @property - def strings(metaclass_target): - return collections.OrderedDict((number, string) for string, number in metaclass_target._codes().items()) + def strings(cls): + return collections.OrderedDict((number, string) for string, number in cls._codes().items()) def __getitem__(self, key): return self.codes[key] @@ -146,14 +145,16 @@ def copy(self, decanonicalize=False, implied_zone=''): "read_object": "read", "modify object": "write", "modify_object": "write", - }.get(access_name)) != None: access_name = new_access_name + }.get(access_name)) is not None: + access_name = new_access_name elif decanonicalize == -1: # Canonicalize, ie. change out old access_name for an unambiguous "standard" value. access_name = access_name.replace(" ","_") if (new_access_name := { "read": "read_object", "write": "modify_object", - }.get(access_name)) != None: access_name = new_access_name + }.get(access_name)) is not None: + access_name = new_access_name elif decanonicalize == 0: pass else: @@ -219,11 +220,10 @@ def __repr__(self): ( _synonym_mapping := { - # syn : canonical "write": "modify_object", "read": "read_object", } -).update((key.replace("_", " "), key) for key in iRODSAccess.codes.keys()) +).update((key.replace("_", " "), key) for key in iRODSAccess.codes) all_permissions = { @@ -231,9 +231,9 @@ def __repr__(self): **{key: iRODSAccess.codes[_synonym_mapping[key]] for key in _synonym_mapping}, } -canonical_permissions = dict( - (k,v) for k,v in all_permissions.items() if ' ' not in k and k not in ('read','write') -) +canonical_permissions = { + k: v for k,v in all_permissions.items() if ' ' not in k and k not in ('read','write') +} class _deprecated: class _iRODSAccess_pre_4_3_0(_iRODSAccess_base): diff --git a/irods/manager/access_manager.py b/irods/manager/access_manager.py index 527a8640a..3be35a2f2 100644 --- a/irods/manager/access_manager.py +++ b/irods/manager/access_manager.py @@ -1,25 +1,24 @@ +import logging +import warnings from os.path import basename, dirname -from irods.manager import Manager +from irods.access import iRODSAccess from irods.api_number import api_number -from irods.message import ModAclRequest, iRODSMessage, JSON_Message -from irods.data_object import iRODSDataObject, irods_dirname, irods_basename from irods.collection import iRODSCollection +from irods.column import In +from irods.data_object import irods_basename, irods_dirname, iRODSDataObject +from irods.manager import Manager +from irods.message import JSON_Message, ModAclRequest, iRODSMessage from irods.models import ( - DataObject, Collection, - User, + CollectionAccess, CollectionUser, DataAccess, - CollectionAccess, + DataObject, + User, ) -from irods.access import iRODSAccess -from irods.column import In from irods.user import iRODSUser -import logging -import warnings - logger = logging.getLogger(__name__) diff --git a/irods/session.py b/irods/session.py index 384ca25c9..1f8d8305e 100644 --- a/irods/session.py +++ b/irods/session.py @@ -111,9 +111,11 @@ def available_permissions(self): except AttributeError: if self.server_version < (4, 3): from irods.access import _iRODSAccess_pre_4_3_0 + self.__access = _iRODSAccess_pre_4_3_0 else: from irods.access import iRODSAccess + self.__access = iRODSAccess return self.__access diff --git a/irods/test/access_test.py b/irods/test/access_test.py index 402a79f90..78fbf149e 100644 --- a/irods/test/access_test.py +++ b/irods/test/access_test.py @@ -4,15 +4,15 @@ import sys import unittest -from irods.access import iRODSAccess, ACLOperation +import irods.test.helpers as helpers +from irods.access import ACLOperation, iRODSAccess from irods.collection import iRODSCollection from irods.column import In, Like from irods.exception import UserDoesNotExist -from irods.models import User, Collection, DataObject +from irods.models import Collection, DataObject, User from irods.path import iRODSPath -from irods.user import iRODSUser from irods.session import iRODSSession -import irods.test.helpers as helpers +from irods.user import iRODSUser class TestAccess(unittest.TestCase):