nuvolabase/orientdb — pull request #1347 by henryzhao81 (2013-02-13 19:41:49+00:00)
Title: Allow set user back to current database instance

I did some unittest, i create 2 users (ouser/puser) in OUser table, login to database with each user and create one restricted record for each user after login. After user created, ouser rid is #10:2, puser rid is #10:3

Delete user and create same 2 user again from OUser table, and login to each user and create restricted record again (before create i will delete old record). This time after user created, ouser rid is #10:3, puser rid is #10:2

(I am user Restful API to create record)

check the record i created by ouser, _allow field is still #10:2
check the record i created by puser, _allow field is still #10:3

No matter how many time i tried, and also print out the user for current database instance by
ODatabaseRecordThreadLocal.INSTANCE.get().getUser() before insert. Keep getting old user rid. But after i restart database, user rid is correct. Following is my unittest code sample

def "create ouser and pusesr" () {
setup :
ODatabaseDocumentTx db = database.openDatabase()
def user1 = "ouser"
def user2 = "puser"
def password = "password"
when :
deleteUser(user1, db)
deleteUser(user2, db)
createUser(user1, password, db)
createUser(user2, password, db)
then :
notThrown Exception
db.close()
}

def "create restricted document by ouser" () {
setup :
ODatabaseDocumentTx db = database.openDatabase()
def username = "ouser"
def password = "password"
def List result
when :
deleteRecord(db)
//create by Restful API
createRecord("http://localhost:2480/function/db/create/0", value1, value2, username, password);
result = query(db)

then :
notThrown Exception
result != null
result.size() == 1
ODocument doc = result.get(0)
doc.field("@rid") != null
checkRid(doc.getIdentity().toString()) == true
ODocument userDoc = db.getMetadata().getSecurity().getUser(username).getDocument()
ODocument field = doc.field("_allow")
field != null
field.equals(userDoc) //Error, login user and _allow are not equal
doc.field("updated") != null
db.close()
}

My change,

For Http Restful call, after authentication, return current successful login user, and store in OHttpRequest, then do the check, if 2 user are different, overwrite with login user.