Issue 113 remove cwms privilege

schema/src/buildCWMS_DB.sql

@@ -389,7 +389,6 @@ begin
    cwms_ts.start_truncate_ts_msg_arch_job;
 end;
 /
-@@cwms/create_sec_triggers
 @@cwms/create_user_policies
 @@cwms/at_dd_flag_trig
 prompt Recompiling all invalid objects...

schema/src/cwms/cwms_env_pkg_body.sql

@@ -40,7 +40,6 @@ AS
    */
    procedure log(p_procedure in varchar2, p_msg_level in integer, p_message   in varchar2)
    is
-      l_priv varchar2(255) := SYS_CONTEXT('CWMS_ENV','CWMS_PRIVILEGE');
       l_cur_office varchar2(5) := SYS_CONTEXT('CWMS_ENV','SESSION_OFFICE_ID');
       l_cur_office_code cwms_office.office_code%type := NULL;
    begin
@@ -49,15 +48,13 @@ AS
          l_cur_office_code := CWMS_UTIL.GET_DB_OFFICE_CODE(l_cur_office);
       end if;
       -- set environment so logging works
-      set_cwms_env ('CWMS_PRIVILEGE', 'CAN_WRITE');
       set_cwms_env ('SESSION_OFFICE_ID', 'CWMS');
       set_cwms_env ('SESSION_OFFICE_CODE', CWMS_UTIL.GET_DB_OFFICE_CODE('CWMS'));
 
       -- The actual thing this function is supposed to do
       cwms_msg.log_db_message(p_procedure,p_msg_level,p_message);
 
       -- reset environment back so security works
-      set_cwms_env ('CWMS_PRIVILEGE', l_priv);
       set_cwms_env ('SESSION_OFFICE_ID', l_cur_office);
       set_cwms_env ('SESSION_OFFICE_CODE', l_cur_office_code);
       resume_office_caching;
@@ -121,7 +118,7 @@ AS
    PROCEDURE clear_session_privileges
    IS
    BEGIN
-    set_cwms_env ('CWMS_PRIVILEGE', 'READ_ONLY');
+    null;
    END;
 
    PROCEDURE set_session_user(p_session_key VARCHAR2)
@@ -178,19 +175,14 @@ AS
    IS
       l_office_id   VARCHAR2 (16);
       l_username    at_sec_cwms_users.userid%type;
-      l_canwrite    BOOLEAN;
-      l_canlogin    BOOLEAN;
       l_cnt         NUMBER;
       l_rdl_privilege VARCHAR2(16);
       l_ccp_privilege INTEGER;
    BEGIN
-      l_canwrite := FALSE;
-      l_canlogin := FALSE;
       l_cnt := 0;
       l_rdl_privilege := 'NONE';
       l_ccp_privilege := 4;
       l_username := CWMS_UTIL.GET_USER_ID;
-      set_cwms_env ('CWMS_PRIVILEGE', 'READ_ONLY');
 
 
       SELECT SYS_CONTEXT ('CWMS_ENV', 'SESSION_OFFICE_ID')
@@ -214,19 +206,6 @@ AS
 
      FOR C IN (SELECT user_group_id FROM TABLE (cwms_sec.get_assigned_priv_groups_tab) WHERE db_office_id = l_office_id)
       LOOP
-        l_canlogin := TRUE;
-        IF((C.user_group_id='CCP Mgr') OR
-            (C.user_group_id='CCP Proc') OR
-            (C.user_group_id='CWMS DBA Users') OR
-            (C.user_group_id='CWMS PD Users') OR
-            (C.user_group_id='CWMS User Admins') OR
-            (C.user_group_id='Data Acquisition Mgr') OR
-            (C.user_group_id='Data Exchange Mgr') OR
-            (C.user_group_id='TS ID Creator') OR
-            (C.user_group_id='VT Mgr'))
-        THEN
-            l_canwrite := TRUE;
-        END IF;
         IF(c.user_group_id='RDL Mgr')
         THEN
             l_rdl_privilege := 'RDLCRUD';
@@ -260,14 +239,6 @@ AS
       END LOOP;
 
 
-      IF (l_canwrite)
-      THEN
-         set_cwms_env ('CWMS_PRIVILEGE', 'CAN_WRITE');
-      ELSIF (l_canlogin)
-      THEN
-         set_cwms_env ('CWMS_PRIVILEGE', 'CAN_LOGIN');
-      END IF;
-
       set_cwms_env('RDL_PRIVILEGE',l_rdl_privilege);
       set_cwms_env('CCP_PRIV_LEVEL',l_ccp_privilege);
    END set_session_privileges;

schema/src/cwms/tables/at_ts_extents.sql

@@ -63,20 +63,4 @@ comment on column at_ts_extents.greatest_accepted_value_time  is 'The time that
 comment on column at_ts_extents.greatest_accepted_value_entry is 'The time that the greatest accepted (not missing or rejected) non-null value (in database units) that has been stored for the time series was entered (stored)';
 comment on column at_ts_extents.last_update                   is 'The time that this record was updated';
 comment on column at_ts_extents.has_non_zero_quality          is 'Specifies whether the ENTIRE time series has ANY quality_code other than zero)';
-
-create or replace TRIGGER ST_TS_EXTENTS BEFORE DELETE OR INSERT OR UPDATE
-              ON AT_TS_EXTENTS REFERENCING NEW AS NEW OLD AS OLD
-
-             DECLARE
-
-             l_priv   VARCHAR2 (16);
-             BEGIN
-             SELECT SYS_CONTEXT ('CWMS_ENV', 'CWMS_PRIVILEGE') INTO l_priv FROM DUAL;
-             IF ((l_priv is NULL OR l_priv <> 'CAN_WRITE') AND user NOT IN ('SYS', '&&cwms_schema', upper('&&builduser')))
-             THEN
-
-               CWMS_20.CWMS_ERR.RAISE('NO_WRITE_PRIVILEGE');
-
-             END IF;
-           END;
 /           

schema/src/test/test_cwms_prop.sql

@@ -8,6 +8,7 @@ create or replace package test_cwms_prop as
 
     -- %test (store sec.upass.id property: Only admin user can set this. Otherwise throw an exception)
     --%throws(-20998)
+    --%disabled
     procedure test_store_upass_id_property;
 
     procedure teardown;

schema/src/test/test_ro.sql

@@ -8,6 +8,7 @@ create or replace package test_ro as
 
     -- %test (store a location: throws an exception)
     --%throws(-20048)
+    --%disabled
     procedure test_store_location;
 
     -- %test (store a property: is allowed for read-only user) 
@@ -18,6 +19,7 @@ create or replace package test_ro as
 
     -- %test (store sec.upass.id property: throws an exception)
     --%throws(-20998)
+    --%disabled
     procedure test_store_upass_id_property;
 
     -- %test(create cwms user)

schema/src/test/test_up.sql

@@ -22,11 +22,9 @@ AS
     PROCEDURE setup
     IS
     BEGIN
-     execute immediate 'alter trigger &cwms_schema..ST_PROPERTIES disable';
      insert into at_properties values(53,'CWMSDB','sec.upass.id','&upass_id','UPASS USER');
      insert into at_sec_cwms_users(userid) values ('deleteme');
      commit;
-     execute immediate 'alter trigger &cwms_schema..ST_PROPERTIES enable';
     END;
 
     PROCEDURE teardown

schema/src/test/test_webuser_abilities.sql

@@ -148,7 +148,6 @@ AS
         -- test without office ID set
         cwms_env.set_session_user_apikey(l_testkey2);
         ut.expect(cwms_util.get_user_id).to_equal(l_user2);
-        ut.expect(SYS_CONTEXT ('CWMS_ENV', 'CWMS_PRIVILEGE')).to_equal('READ_ONLY');
 
         /** I don't believe it but this actually is required, which is good. But
             we should still call it to make sure it doesn't fail.