<commit_before>accessDocuments = {}

# Registers documents for which we want to support generic grant and revoke methods
@registerForAccess = (document) ->
  assert document.prototype instanceof ReadAccessDocument

  accessDocuments[document.Meta._name] = document

RegisteredForAccess = Match.Where (documentName) ->
  check documentName, String
  accessDocuments.hasOwnProperty documentName

createNotInSetQuery = (documentId, set, personOrGroup, personOrGroupId) ->
  query =
    _id: documentId

  query["#{ set }#{ personOrGroup }s._id"] =
    $ne: personOrGroupId

  query

createAddToSetCommand = (set, personOrGroup, personOrGroupId) ->
  command =
    $addToSet: {}

  command.$addToSet["#{ set }#{ personOrGroup }s"] =
    _id: personOrGroupId

  command

createInSetQuery = (documentId, set, personOrGroup, personOrGroupId) ->
  query =
    _id: documentId

  query["#{ set }#{ personOrGroup }s._id"] = personOrGroupId

  query

createRemoveFromSetCommand = (set, personOrGroup, personOrGroupId) ->
  command =
    $pull: {}

  command.$pull["#{ set }#{ personOrGroup }s"] =
    _id: personOrGroupId

  command

setRole = (currentPerson, documentName, documentId, personOrGroup, personOrGroupId, role) ->
  assert currentPerson

  changesCount = 0

  # For private documents, grant read access together with admin/maintainer privileges
  if document.access is ACCESS.PRIVATE and role isnt null and role >= ROLES.READ_ACCESS
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      createNotInSetQuery documentId, 'read', personOrGroup, personOrGroupId
    ), createAddToSetCommand 'read', personOrGroup, personOrGroupId

  if role is ROLES.MAINTAINER
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      createNotInSetQuery documentId, 'maintainer', personOrGroup, personOrGroupId
    ), createAddToSetCommand 'maintainer', personOrGroup, personOrGroupId

  if role is ROLES.ADMIN
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      createNotInSetQuery documentId, 'admin', personOrGroup, personOrGroupId
    ), createAddToSetCommand 'admin', personOrGroup, personOrGroupId

  # Only clear read access for private documents when specifically clearing all permissions
  if document.access is ACCESS.PRIVATE and role is null
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      createInSetQuery documentId, 'read', personOrGroup, personOrGroupId
    ), createRemoveFromSetCommand 'read', personOrGroup, personOrGroupId

  if role isnt ROLES.MAINTAINER
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      createInSetQuery documentId, 'maintainer', personOrGroup, personOrGroupId
    ), createRemoveFromSetCommand 'maintainer', personOrGroup, personOrGroupId

  if role isnt ROLES.ADMIN
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      createInSetQuery documentId, 'admin', personOrGroup, personOrGroupId
    ), createRemoveFromSetCommand 'admin', personOrGroup, personOrGroupId

  changesCount

# TODO: Use this code on the client side as well
Meteor.methods
  'set-role-for-person': (documentName, documentId, personId, role) ->
    check documentName, RegisteredForAccess
    check documentId, DocumentId
    check personId, DocumentId
    check role, Match.Where (role) ->
      check role, Match.OneOf null, Match.Integer
      return role is null or 0 <= role <= ROLES.ADMIN

    currentPerson = Meteor.person()
    throw new Meteor.Error 401, "User not signed in." unless currentPerson

    !!setRole currentPerson, documentName, documentId, 'Person', personId, role<commit_msg>Bugfix. Private access match moved to query.<commit_after>accessDocuments = {}

# Registers documents for which we want to support generic grant and revoke methods
@registerForAccess = (document) ->
  assert document.prototype instanceof ReadAccessDocument

  accessDocuments[document.Meta._name] = document

RegisteredForAccess = Match.Where (documentName) ->
  check documentName, String
  accessDocuments.hasOwnProperty documentName

createNotInSetQuery = (documentId, set, personOrGroup, personOrGroupId) ->
  query =
    _id: documentId

  query["#{ set }#{ personOrGroup }s._id"] =
    $ne: personOrGroupId

  query

createAddToSetCommand = (set, personOrGroup, personOrGroupId) ->
  command =
    $addToSet: {}

  command.$addToSet["#{ set }#{ personOrGroup }s"] =
    _id: personOrGroupId

  command

createInSetQuery = (documentId, set, personOrGroup, personOrGroupId) ->
  query =
    _id: documentId

  query["#{ set }#{ personOrGroup }s._id"] = personOrGroupId

  query

createRemoveFromSetCommand = (set, personOrGroup, personOrGroupId) ->
  command =
    $pull: {}

  command.$pull["#{ set }#{ personOrGroup }s"] =
    _id: personOrGroupId

  command

setRole = (currentPerson, documentName, documentId, personOrGroup, personOrGroupId, role) ->
  assert currentPerson

  changesCount = 0

  # For private documents, grant read access together with admin/maintainer privileges
  if role isnt null and role >= ROLES.READ_ACCESS
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      _.extend createNotInSetQuery(documentId, 'read', personOrGroup, personOrGroupId),
        access: ACCESS.PRIVATE
    ), createAddToSetCommand 'read', personOrGroup, personOrGroupId

  if role is ROLES.MAINTAINER
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      createNotInSetQuery documentId, 'maintainer', personOrGroup, personOrGroupId
    ), createAddToSetCommand 'maintainer', personOrGroup, personOrGroupId

  if role is ROLES.ADMIN
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      createNotInSetQuery documentId, 'admin', personOrGroup, personOrGroupId
    ), createAddToSetCommand 'admin', personOrGroup, personOrGroupId

  # Only clear read access for private documents when specifically clearing all permissions
  if role is null
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      _.extend createInSetQuery(documentId, 'read', personOrGroup, personOrGroupId),
        access: ACCESS.PRIVATE
    ), createRemoveFromSetCommand 'read', personOrGroup, personOrGroupId

  if role isnt ROLES.MAINTAINER
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      createInSetQuery documentId, 'maintainer', personOrGroup, personOrGroupId
    ), createRemoveFromSetCommand 'maintainer', personOrGroup, personOrGroupId

  if role isnt ROLES.ADMIN
    changesCount += accessDocuments[documentName].documents.update accessDocuments[documentName].requireAdminAccessSelector(currentPerson,
      createInSetQuery documentId, 'admin', personOrGroup, personOrGroupId
    ), createRemoveFromSetCommand 'admin', personOrGroup, personOrGroupId

  changesCount

# TODO: Use this code on the client side as well
Meteor.methods
  'set-role-for-person': (documentName, documentId, personId, role) ->
    check documentName, RegisteredForAccess
    check documentId, DocumentId
    check personId, DocumentId
    check role, Match.Where (role) ->
      check role, Match.OneOf null, Match.Integer
      return role is null or 0 <= role <= ROLES.ADMIN

    currentPerson = Meteor.person()
    throw new Meteor.Error 401, "User not signed in." unless currentPerson

    !!setRole currentPerson, documentName, documentId, 'Person', personId, role
{'fraction_non_alphanumeric': 0.0836305497478785, 'fraction_numerical': 0.0012298610257040954, 'mean_word_length': 5.3284046692607, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 23, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1040709', 'n_tokens_mistral': 2268, 'n_tokens_neox': 2184, 'n_words': 575}