#23277

method_perms.rb

# PRODUCTION
# ----------
# Admin (admin)
# API Admin (api_admin)
# Manager (manager)
# Artist (artist)
# Admin Defaults (admin_system_default)
# Script Defaults (api_admin_system_default)
# Manager Defaults (manager_system_default)
# Artist Defaults (artist_system_default)
# Supervisor (supervisor)
# Coordinator (coordinator)
# Reception (reception)
# Artist+Playlists (lead_artist)
# Hardware Inventory (hardware_inventory)
# Technology (admin_testing)
# Executive (temp_admin__testing_)
# Scheduling (scheduling)

# STAGING
# -----------
# Admin (admin)
# API Admin (api_admin)
# Manager (manager)
# Admin Defaults (admin_system_default)
# Script Defaults (api_admin_system_default)
# Manager Defaults (manager_system_default)
# Artist Defaults (artist_system_default)
# Supervisor (supervisor)
# Hardware Inventory (hardware_inventory)
# Scheduling (scheduling)
# Lead (lead)
# Production (production)
# Guest (retired) (reception)
# Guest (guest)
# Executive (retired) (temp_admin__testing_)
# Executive (executive)
# Technology (retired) (admin_testing)
# Technology (technology)
# Coordinator (retired) (coordinator)
# Artist (Retired) (lead_artist)
# Artist (artist)

# Artist -> Artist
# Artist + Playlist -> Lead
# Supervisor -> Supervisor
# Coordinator -> Production
# Manager -> Manager
# Reception -> Guest
# Executive -> Executive
# Scheduling -> Scheduling
# Technology -> Technology
# Admin -> Admin

# staging => production
RULESET_MAP = {
    'artist' => 'prod_artist',                   # Artist => Artist
    'lead' => 'prod_lead_artist',                # Lead => Artist+Playlist
    'supervisor' => 'prod_supervisor',           # Supervisor => Supervisor
    'production' => 'prod_coordinator',          # Production => Coordinator
    'manager' => 'prod_manager',                 # Manager => Manager
    'guest' => 'prod_reception',                 # Guest => Reception
    'executive' => 'prod_temp_admin__testing_',  # Executive => Executive
    'scheduling' => 'prod_scheduling',           # Scheduling => Scheduling
    'technology' => 'prod_admin_testing',        # Technology => Technology
    'admin' => 'prod_admin',                     # Admin => Admin
}

PRODUCTION_RULESET_MAP = {
    'artist' => 'artist',                   # Artist => Artist
    'lead' => 'lead_artist',                # Lead => Artist+Playlist
    'supervisor' => 'supervisor',           # Supervisor => Supervisor
    'production' => 'coordinator',          # Production => Coordinator
    'manager' => 'manager',                 # Manager => Manager
    'guest' => 'reception',                 # Guest => Reception
    'executive' => 'temp_admin__testing_',  # Executive => Executive
    'scheduling' => 'scheduling',           # Scheduling => Scheduling
    'technology' => 'admin_testing',        # Technology => Technology
    'admin' => 'admin',                     # Admin => Admin
}




ENTITY_TYPES = ShotgunConfig.instance['entity.system_types'].sort

class MethodPerms

    def load_ruleset(code)
        rs = PermissionRuleSet.find_by_code(code)
        raise ("Unable to find ruleset '#{code}'!") if rs.nil?

        rs
    end

    def copy_ruleset(source_rs)
        beta_code = "beta_#{source_rs.code}"
        puts "copying #{source_rs.code} to #{beta_code}..."
        beta_rs = PermissionRuleSet.create(:code => beta_code, 
                                           :display_name => beta_code.titleize, 
                                           :entity_type=>'HumanUser')
        beta_rs.copy_rules_from_another_set( source_rs )

        beta_rs
    end

    def delete_field_rules(rs)
        puts "deleting field-level rules on #{rs.code}..."
        puts "#{rs.permission_rules.length} rules before delete"
        rs.permission_rules.each do |rule|
            rule.destroy if ['see_field', 'update_field'].include?(rule.rule_type)
        end
        rs.reload
        puts "#{rs.permission_rules.length} rules after delete"
    end

    def copy_field_rules(source_rs, target_rs)
        puts "copying field rules from #{source_rs.code} to #{target_rs.code}..."
        puts "#{target_rs.permission_rules.length} rules before copy"
        rules = PermissionRuleSet.dump_rules(source_rs)
        rules.select! {|r| ['see_field', 'update_field'].include?(r[:rule_type])}
        puts "copying #{rules.length} field rules"
        target_rs.import_rules(rules)
        target_rs.reload
        puts "#{target_rs.permission_rules.length} rules after copy"
    end

    def run
        RULESET_MAP.each do |staging, production|
            puts "loading rulesets..."
            stage_rs = load_ruleset(staging)
            prod_rs = load_ruleset(production)

            beta_rs = copy_ruleset(stage_rs)
            delete_field_rules(beta_rs)
            beta_rs.reload
            copy_field_rules(prod_rs, beta_rs)
        end
    end

    def compare
        # compares two permission roles using PermissionsDiff
        load '/opt/shotgun/permissions_diff.rb'
        RULESET_MAP.each do |staging, production|
            diff = PermissionsDiff.new
            diff.compare("beta_#{staging}", production)
            diff.pp
            diff.csv
        end
    end

    def ensure_cdn_on
        # ensures that Cached Display Name doesn't have any permissions tied
        # to it.
        RULESET_MAP.each do |staging, production|
            ruleset = PermissionRuleSet.find_by_code("beta_#{staging}")
            puts "========== #{ruleset.code} "
            ENTITY_TYPES.each do |et|
                see = ruleset.allow?(:see_field, {:entity_type=>et, :field_name=>'cached_display_name'})
                update = ruleset.allow?(:update_field, {:entity_type=>et, :field_name=>'cached_display_name', :field_value=>nil})
                puts "#{et}: #{see} #{update}" if !see
            end
            ruleset.permission_rules.each do |r|
                if r.parameter_2 == 'cached_display_name'
                    puts r
                    r.destroy()
                end
            end;nil
        end
    end

    def get_conditional_perms(rs)
        # lists all of the conditional permissions for a ruleset
        conditional_rules = []
        ruleset = PermissionRuleSet.find_by_code(rs)
        ruleset.permission_rules.each do |r|
            if ['see_entity_condition', 'update_field_condition', 'retire_entity_condition'].include?(r.rule_type)
                conditional_rules << r
            end
        end
        conditional_rules.sort!
    end





    #
    #
    # PRODUCTION IMPORT
    #
    #
    # - dump all rules on staging
    # - copy json files to production
    # - backup all roles on production
    # - rebuild all rulesets on production
    # - clear cache / restart app
    # - rename the following roles:
    #   - lead_artist => lead
    #   - reception => guest
    #   - temp_admin__testing_ => executive
    #   - admin_testing => technology
    # - clear cache / restart app
    # - ensure default perm role is still valid
    # - login as one or more of the roles and ensure all is ok.


    def export_all_to_json
        # export rules to json file in /var/tmp/rulesetname.json
        require 'json'
        RULESET_MAP.each do |staging, production|
            rules = PermissionRuleSet.dump_rules("beta_#{staging}")
            File.open("/var/tmp/#{staging}.json","w") do |f|
                f.write(rules.to_json)
            end
        end
        nil
    end

    def backup_all_rulesets
        PermissionRuleSet.find(:all, :conditions=>'retirement_date is NULL').each do |rs|
            puts "#{rs.display_name} (#{rs.code})"
            if rs.entity_type == "HumanUser"
                puts "creating new ruleset..."
                backup_rs = PermissionRuleSet.create(:code=>"#{rs.code}_backup", :display_name=>"#{rs.display_name} Backup", :entity_type=>'HumanUser')
                raise "#{rs.code}_backup ruleset not created. It may already exist. Aborting" if backup_rs.id.nil?
                puts "created new ruleset #{backup_rs}"
                backup_rs.copy_rules_from_another_set( rs )
            end
            puts
        end
        nil
    end

    def import_rules_from_json(ruleset, json_file)
        puts "Replacing rules in #{ruleset} with rules in #{json_file}..."
        rules = []
        rs = load_ruleset(ruleset)
        File.open( json_file, "r" ) do |f|
            rules = JSON.load( f )
        end
        rs.permission_rules.each do |r|
            r.destroy
        end
        rs.import_rules(rules)
    end

    def rebuild_rulesets_on_production
        PRODUCTION_RULESET_MAP.each do |staging, production|
            import_rules_from_json(production, "/var/tmp/#{staging}.json")
        end
    end

    def rename_production_rulesets
        rs_to_rename = {
            'lead_artist' => {'code'=>'lead', 'display_name'=>'Lead'},
            'coordinator' => {'code'=>'production', 'display_name'=>'Production'},
            'reception' => {'code'=>'guest', 'display_name'=>'Guest'},
            'temp_admin__testing_' => {'code'=>'executive', 'display_name'=>'Executive'},
            'admin_testing' => {'code'=>'technology', 'display_name'=>'Technology'}
        }
        rs_to_rename.each do |code, newval|
            rs = load_ruleset(code)
            rs.code = newval['code']
            rs.display_name = newval['display_name']
            rs.save
        end
    end

    def list_rulesets
        PermissionRuleSet.find(:all, :conditions=>'retirement_date is NULL').each do |rs|
            puts "#{rs.id} \t#{rs.display_name} (#{rs.code})"
        end;nil
    end

    def search_for_invalid_rules
        PRODUCTION_RULESET_MAP.each do |staging, production|
            rs = load_ruleset(ruleset)
            rs.permission_rules.each do |r|
                puts "#{rs.code}: INVALID RULE #{r}" if ['save_my_tasks', 'save_project_nav_pages_and_detail_pages', 'manage_project_nav_bar'].include?(r.rule_type)
            end
        end
        nil
    end

end