Allow user to limit search results

Using the 'all_data' flag, user can toggle wether
to return all data or just data they have access to.

api/dao/containerutil.py

@@ -8,6 +8,13 @@ CONT_TYPES = ['acquisition', 'analysis', 'collection', 'group', 'project', 'sess
 def getPerm(name):
     return INTEGER_ROLES[name]
 
+def get_perm_name(cont_type):
+    if cont_type == 'group':
+        return 'roles'
+    if cont_type in ['projects', 'collections', 'sessions', 'acquisitions']:
+        return 'permissions'
+
+
 def add_id_to_subject(subject, pid):
     """
     Add a mongo id field to given subject object (dict)

api/handlers/searchhandler.py

@@ -73,11 +73,12 @@ class SearchHandler(base.RequestHandler):
         queries = self.request.json_body
         path = queries.pop('path')
         min_score = self.get_param('min_score', 0.5)
+        all_data = self.is_true('all_data')
         # if the path starts with collections force the targets to exists within a collection
         if path.startswith('collections'):
             queries['collections'] = queries.get('collections', {"match_all": {}})
         target_paths = pathparser.PathParser(path).paths
-        search = queryprocessor.PreparedSearch(target_paths, queries)
+        search = queryprocessor.PreparedSearch(target_paths, queries, all_data, self.uid)
         return search.process_search()
 
 

api/search/queryprocessor.py

@@ -4,6 +4,7 @@ from . import (
     es_query, add_filter_from_list, add_filter
 )
 from .. import config
+from ..dao.containerutil import get_perm_name
 
 log = config.log
 
@@ -26,21 +27,32 @@ querygraph = {
         'children': ['acquisitions']
     }
 }
+
 _min_score = 1
 
 class SearchContainer(object):
 
-    def __init__(self, cont_name, query, targets):
+    def __init__(self, cont_name, query, targets, all_data=False, user=None):
         self.cont_name = cont_name
         self.query = query
         self.is_target = False
         self.child_targets = set()
+        self.results = None
+        self.all_data = all_data
+        self.user = user
+
         for t in targets:
             if t == cont_name:
                 self.is_target = True
             else:
                 self.child_targets.add(t)
-        self.results = None
+        if not all_data and user:
+            self.filter_for_user
+
+    def filter_for_user(self):
+        perm_name = get_perm_name(self.cont_name[:-1])
+        if perm_name is not None:
+            self.query = add_filter(self.query, perm_name+'_id', user)
 
     def get_results(self):
         if self.query is None:
@@ -141,7 +153,7 @@ class PreparedSearch(object):
 
     containers = ['groups', 'projects', 'sessions', 'collections', 'acquisitions']
 
-    def __init__(self, target_paths, queries):
+    def __init__(self, target_paths, queries, all_data=False, user=None):
         self.queries = queries
         self.target_lists = {}
         for path in target_paths:
@@ -151,7 +163,7 @@ class PreparedSearch(object):
         for cont_name in self.containers:
             query = self.queries.get(cont_name)
             targets = self.target_lists.get(cont_name, [])
-            self.search_containers[cont_name] = SearchContainer(cont_name, query, targets)
+            self.search_containers[cont_name] = SearchContainer(cont_name, query, targets, all_data, user)
 
     def _get_targets(self, path):
         path_parts = path.split('/')