Repository: rucio/rucio

Issue:
delete_rule for rule_deleters does not work
Motivation
----------

The conversion of issuer into an object is not done (at least) for the delete_replication_rule :
```
def delete_replication_rule(rule_id, purge_replicas, issuer):
    """
    Deletes a replication rule and all associated locks.

    :param rule_id:  The id of the rule to be deleted
    :param issuer:   The issuing account of this operation
    :raises:         RuleNotFound, AccessDenied
    """
    kwargs = {'rule_id': rule_id, 'purge_replicas': purge_replicas}
    if not has_permission(issuer=issuer, action='del_rule', kwargs=kwargs):
        raise AccessDenied('Account %s can not remove this replication rule.' % (issuer))
    rule.delete_rule(rule_id=rule_id, purge_replicas=purge_replicas, soft=True)
```
It leads to a permission issue when trying to delete a rule.
The other methods need to be checked too




Discussion:
The conversion is done in the permission API, this is correct. The problem here is that sometimes we do comparisons such as:
`if issuer in rse_attr.get('rule_deleters').split(','):`
Which does not work, since the issuer object is looked for in a list of strings. This needs to be adapted to `issuer.external`.
See https://github.com/rucio/rucio/blob/525812b8f83f1069d38ab78aebedb732f21e77ec/lib/rucio/core/permission/atlas.py#L473
There might be other places in the permission code which do that as well.
@hahahannes Can you please have a look in the permission APIs and adapt these lines? (Wherever issuer `in` is used. Thanks!

Resolving patch:
diff --git a/lib/rucio/core/permission/atlas.py b/lib/rucio/core/permission/atlas.py
--- a/lib/rucio/core/permission/atlas.py
+++ b/lib/rucio/core/permission/atlas.py
@@ -470,7 +470,7 @@ def perm_del_rule(issuer, kwargs):
     for rse in rses:
         rse_attr = list_rse_attributes(rse_id=rse['id'])
         if rse_attr.get('rule_deleters'):
-            if issuer in rse_attr.get('rule_deleters').split(','):
+            if issuer.external in rse_attr.get('rule_deleters').split(','):
                 return True
 
     return False
@@ -580,7 +580,7 @@ def perm_approve_rule(issuer, kwargs):
     for rse in rses:
         rse_attr = list_rse_attributes(rse_id=rse['id'])
         if rse_attr.get('rule_approvers'):
-            if issuer in rse_attr.get('rule_approvers').split(','):
+            if issuer.external in rse_attr.get('rule_approvers').split(','):
                 return True
 
     # LOCALGROUPDISK/LOCALGROUPTAPE admins can approve the rule
diff --git a/lib/rucio/core/rule.py b/lib/rucio/core/rule.py
--- a/lib/rucio/core/rule.py
+++ b/lib/rucio/core/rule.py
@@ -62,7 +62,7 @@
                                     InvalidObject, RSEBlacklisted, RuleReplaceFailed, RequestNotFound,
                                     ManualRuleApprovalBlocked, UnsupportedOperation, UndefinedPolicy)
 from rucio.common.schema import validate_schema
-from rucio.common.types import InternalScope
+from rucio.common.types import InternalScope, InternalAccount
 from rucio.common.utils import str_to_date, sizefmt
 from rucio.core import account_counter, rse_counter, request as request_core
 from rucio.core.account import get_account
@@ -3004,6 +3004,7 @@ def __create_recipents_list(rse_expression, session=None):
         rse_attr = list_rse_attributes(rse_id=rse['id'], session=session)
         if rse_attr.get('rule_approvers'):
             for account in rse_attr.get('rule_approvers').split(','):
+                account = InternalAccount(account)
                 try:
                     email = get_account(account=account, session=session).email
                     if email:


Test patch: