# frozen_string_literal: true #-- copyright # OpenProject is an open source project management software. # Copyright (C) the OpenProject GmbH # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License version 3. # # OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows: # Copyright (C) 2006-2013 Jean-Philippe Lang # Copyright (C) 2010-2013 the ChiliProject Team # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. # # See COPYRIGHT and LICENSE files for more details. #++ class Group < Principal include ::Scopes::Scoped include Groups::Hierarchy attr_accessor :hierarchy_depth has_details_table(foreign_key: :principal_id) do belongs_to :parent, class_name: "Group", optional: true validates :parent, presence: true, if: -> { parent_id.present? } end validate :no_circular_parent, if: -> { parent_id.present? } validate :no_organizational_unit_mismatch, if: -> { parent_id.present? } # Register a partial to be rendered on the synchronized groups tab of the groups admin page # # @param title[String] I18n key that will be used as a title for the section # @param partial[String] The partial path as it would be passed to `render partial:` for the partial that renders # a list of synchronized groups to the group def self.add_synchronized_group_partial(title:, partial:, count_callback:) synchronized_group_partials.push(title:, partial:, count_callback:) end def self.synchronized_group_partials @synchronized_group_partials ||= [] end has_many :group_users, autosave: true, dependent: :destroy has_many :users, through: :group_users, before_add: :fail_add has_many :synchronized_groups, class_name: "::LdapGroups::SynchronizedGroup", dependent: :destroy acts_as_customizable alias_attribute(:name, :lastname) validates :name, presence: true validate :uniqueness_of_name validates :name, length: { maximum: 256 } # HACK: We want to have the :preference association on the Principal to allow # for eager loading preferences. # However, the preferences are currently very user specific. We therefore # remove the methods added by # has_one :preference # to avoid accidental assignment and usage of preferences on groups. undef_method :preference, :preference=, :build_preference, :create_preference, :create_preference! scopes :visible, :containing_user, :organizational_units # Columns required for formatting the group's name. def self.columns_for_name(_formatter = nil) [:lastname] end def to_s lastname end def scim_members @scim_members ||= users end def scim_members=(array) # Here we just assign array of found users to an instance variable. # So it is done on a higher(controller) level to pass users_ids list # to Groups::UpdateService @scim_members = array end def self.scim_resource_type Scimitar::Resources::Group end def self.scim_attributes_map { id: :id, externalId: :scim_external_id, displayName: :name, members: [ { list: :scim_members, using: { value: :id }, find_with: ->(scim_list_entry) { id = scim_list_entry["value"] type = scim_list_entry["type"] || "User" # Some online examples omit 'type' and believe 'User' will be assumed case type.downcase when "user" User.not_builtin.find_by(id:) when "group" # OP does not support nesting of groups but SCIM does. # For now raises exception in case of group as a member arrival. raise Scimitar::InvalidSyntaxError.new("Unsupported type #{type.inspect}") else raise Scimitar::InvalidSyntaxError.new("Unrecognised type #{type.inspect}") end } } ] } end def self.scim_queryable_attributes { displayName: { column: :lastname }, externalId: { column: UserAuthProviderLink.arel_table[:external_id] } } end include Scimitar::Resources::Mixin private def uniqueness_of_name groups_with_name = Group.where("lastname = ? AND id <> ?", name, id || 0).count if groups_with_name > 0 errors.add :name, :taken end end def fail_add fail "Do not add users through association, use `Groups::AddUsersService` instead." end def no_circular_parent if parent_id == id || descendant_ids.include?(parent_id) errors.add(:parent_id, :circular_dependency) end end def no_organizational_unit_mismatch parent = self.class.find_by(id: parent_id) return unless parent if organizational_unit? != parent.organizational_unit? errors.add(:parent_id, :organizational_unit_mismatch) end end end