[#505] create an atomic ACLs endpoint by d-w-moore · Pull Request #808 · irods/python-irodsclient

d-w-moore · 2026-03-20T23:27:52Z

No test yet, will undraft when I have one.
Exercised now with this script:

# run as rods after 
# $ irm -fr b; itouch b
# $ iadmin mkzone twilight remote
# $ iadmin mkuser dan rodsuser
# $ iadmin mkuser charlie#twilight rodsuser

import irods
from irods.access import iRODSAccess
from irods.exception import iRODSException

s = irods.helpers.make_session()

try:
  pass
  s.acls._call_atomic_acl_api(
   "/tempZone/home/rods/b",
   iRODSAccess("write","","dan"),
   iRODSAccess("write","","public"),
   iRODSAccess("read","","charlie","twilight"),
 )
except iRODSException as exc:
  print(f'{exc!r}')
  e = exc
  print (e.server_msg.get_json_encoded_struct())
#except Exception as exc:
#  print(repr(exc))
else:
  print ('---> success')
  pass

d-w-moore · 2026-03-23T15:47:37Z

How would the team feel about my deprecating _iRODSAccess_pre_4_3_0, since we're now officially not supporting iRODS < 4.3.0 in PRC?

korydraughn · 2026-03-23T15:50:25Z

The leading underscore indicates that symbol is private to the implementation. If that's the case, no objections here.

korydraughn · 2026-03-23T15:51:08Z

Then again, if it's an implementation detail, then we don't have to deprecate it. We can just remove it.

d-w-moore · 2026-03-23T17:47:12Z

Ready for review. ACLOperation now created as part of an improved interface for atomic ACLs call.

korydraughn · 2026-03-23T23:19:06Z

Spotted this in the type checking workflow.

irods/manager/access_manager.py:54: error: Incompatible types in assignment (expression has type "list[Any]", target has type "str")  [assignment]

korydraughn

Looking good so far.

irods/manager/access_manager.py

irods/access.py

irods/test/access_test.py

irods/manager/access_manager.py

irods/test/access_test.py

irods/manager/access_manager.py

irods/access.py

irods/manager/access_manager.py

d-w-moore · 2026-03-26T15:06:43Z

Sorry for the forced push... just put some ruff changes through and added a structure that maps all permission keys to their respective codes - including all synonyms. It will help someone that say wants to do this:

sorted( [*ses.acls.get(object) , *my_ACLOperation_list ], 
               key= lambda acl:irods.access.all_permissions[acl.access_name] )

which would sort the whole list of retrieved permissions and new applicable ACLOperations together, ordering by increasing numeric permission code.

Yes, I know - very niche. But it affords the customer some pretty good flexibility.

d-w-moore · 2026-03-26T21:18:41Z

linters and tests are queued up.

Code is ready for final review, I think.

alanking

Looks like we're rounding the corner. Still see a couple unresolved comments

irods/access.py

README.md

… casual corruption. RUF012 points out that instances of the class can casually modify an unmutable class variable, eg.: class A: value = [] def f(self,*y): self.value += [*y]

d-w-moore · 2026-03-27T20:02:25Z

I think it's ready for final eyes.... Squashing.

korydraughn

We're in the final stretch.

irods/test/access_test.py

korydraughn · 2026-03-27T21:03:46Z

irods/access.py

 from irods.path import iRODSPath


+_ichmod_listed_permissions = (


What's the reason behind including ichmod in the variable name?

They were copy/paste from output of man ichmod. Definitely open to suggestions on that one.

korydraughn · 2026-03-27T21:11:22Z

irods/access.py

+        # Useful if we wish to force an explicitly specified local zone to an implicit zone spec in the copy, for equality testing:
+        if '' != implied_zone == other.user_zone:
+            other.user_zone = ''


Please explain L138.

I'm trying to guess what it does. Here's what I got (without looking up python docs) ... L138 can be rewritten as:

if '' != implied_zone and implied_zone == other.user_zone: other.user_zone = ''

Is my interpretation correct? What does it accomplish?

If implied_zone is tempZone and other.user_zone is tempZone, other.user_zone is cleared. implied_zone remains nonempty.

That's the correct interpretation.

We're forcing other, ie the return value to have null length in the zone field if it matches a non empty "implied" value.

Any modification to the variable implied_zone would of course have no effect on any code external to the call frame. (That's just a python thing.)

korydraughn · 2026-03-27T21:12:36Z

irods/access.py

+
+
+(
+    _ichmod_synonym_mapping := {


Highlighting this for follow-up depending on the results of the other ichmod conversation.

korydraughn · 2026-03-27T21:14:33Z

irods/access.py

+class _deprecated:
+    class _iRODSAccess_pre_4_3_0(_iRODSAccess_base):
+        codes = collections.OrderedDict(
+            (key.replace("_", " "), value)
+            for key, value in iRODSAccess.codes.items()
+            if key in ("own", "write", "modify_object", "read", "read_object", "null")
+        )
+        strings = collections.OrderedDict((number, string) for string, number in codes.items())
+        def __init__(self, *args, **kwargs):
+            warnings.warn(
+                "_iRODSAccess_pre_4_3_0 is deprecated and will be removed in a future version. Use iRODSAccess instead.",
+                DeprecationWarning,
+                stacklevel=2
+            )
+            super().__init__(*args,**kwargs)
+
+_deprecated_names = {'_iRODSAccess_pre_4_3_0':_deprecated._iRODSAccess_pre_4_3_0}
+
+def __getattr__(name):
+    if name in _deprecated_names:
+        warnings.warn(f"{name} is deprecated", DeprecationWarning, stacklevel=2)
+        return _deprecated_names[name]
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")


Does this do what's intended?

I've tested it manually only. I wonder if a test is in order to make sure; wouldn't be that difficult.

README.md

korydraughn · 2026-03-27T21:26:36Z

README.md

 `<session>.permissions` was therefore removed in v2.0.0
 in favor of `<session>.acls`.

+Atomic ACLs


Consider including "Permissions" in the title. That will make the section easier to find for some readers.

…comparison

d-w-moore marked this pull request as draft March 20, 2026 23:28

d-w-moore added 2 commits March 21, 2026 00:37

add SYS_INTERNAL_ERR

7a81184

[_505,sq] atomic ACLs endpoint

228bf86

d-w-moore force-pushed the 505.m branch from 5a8986e to 228bf86 Compare March 21, 2026 04:42

d-w-moore self-assigned this Mar 21, 2026

d-w-moore marked this pull request as ready for review March 21, 2026 04:45

korydraughn reviewed Mar 23, 2026

View reviewed changes

alanking reviewed Mar 24, 2026

View reviewed changes

irods/manager/access_manager.py Outdated Show resolved Hide resolved

irods/test/access_test.py Outdated Show resolved Hide resolved

d-w-moore commented Mar 24, 2026

View reviewed changes

irods/manager/access_manager.py Outdated Show resolved Hide resolved

irods/access.py Outdated Show resolved Hide resolved

korydraughn reviewed Mar 25, 2026

View reviewed changes

irods/manager/access_manager.py Outdated Show resolved Hide resolved

d-w-moore force-pushed the 505.m branch from a78c710 to 6842412 Compare March 26, 2026 14:53

d-w-moore force-pushed the 505.m branch from 8a9c4b0 to 305189d Compare March 26, 2026 21:17

alanking reviewed Mar 27, 2026

View reviewed changes

irods/access.py Outdated Show resolved Hide resolved

README.md Outdated Show resolved Hide resolved

d-w-moore added 2 commits March 27, 2026 16:00

misc corrections / ruff lint and format

fb6e373

convert "codes" and "strings" into properties of the class to prevent…

1b2e7e1

… casual corruption. RUF012 points out that instances of the class can casually modify an unmutable class variable, eg.: class A: value = [] def f(self,*y): self.value += [*y]

d-w-moore force-pushed the 505.m branch from d9bb2be to 2e0e1c2 Compare March 27, 2026 20:02

korydraughn reviewed Mar 27, 2026

View reviewed changes

d-w-moore force-pushed the 505.m branch 2 times, most recently from 4c99900 to 968d9cd Compare March 28, 2026 12:52

d-w-moore added 3 commits March 28, 2026 08:53

ruff related changes

32f6a24

[_809] deprecate class for storing permission codes pre-iRODS-4.3

e373423

README updates

6421829

update test name to include _issue_

8397b34

d-w-moore force-pushed the 505.m branch from 968d9cd to 8397b34 Compare March 28, 2026 12:53

d-w-moore added 4 commits March 29, 2026 10:31

README example for normalization before comparison of acl-like objects

5b1c514

add true ACLOperation/iRODSAccess canonicalization for api calls and …

e565b16

…comparison

correct README again

b9c4088

README ':'->'.'

fe51e78

d-w-moore force-pushed the 505.m branch from 12109f9 to fe51e78 Compare March 30, 2026 00:47

whitespace

375ab0d

		from irods.path import iRODSPath


		_ichmod_listed_permissions = (

Conversation

d-w-moore commented Mar 20, 2026

Uh oh!

d-w-moore commented Mar 23, 2026

Uh oh!

korydraughn commented Mar 23, 2026

Uh oh!

korydraughn commented Mar 23, 2026

Uh oh!

d-w-moore commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

korydraughn commented Mar 23, 2026

Uh oh!

korydraughn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

d-w-moore commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

d-w-moore commented Mar 26, 2026

Uh oh!

alanking left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

d-w-moore commented Mar 27, 2026

Uh oh!

korydraughn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

d-w-moore commented Mar 23, 2026 •

edited

Loading

d-w-moore commented Mar 26, 2026 •

edited

Loading