[api] add a webui/change_role route to the API

This avoids having to patching XML for a very defined purpose:
adding/removing users/groups from projects/packages. to avoid
having 8 routes, I added one change_role route

src/api/app/controllers/webui_controller.rb

@@ -211,5 +211,40 @@ def request_list
 
     render json: ids.uniq.sort
   end
+
+  def change_role
+    valid_http_methods :post
+    required_parameters :project
+
+    if params[:package].blank?
+      target = Project.find_by_name!(name: params[:project])
+    else
+      target = Package.find_by_project_and_name(params[:project], params[:package])
+    end
 
+    if params.has_key? :userid
+      object = User.find_by_login!(params[:userid])
+    elsif params.has_key? :groupid
+      object = Group.find_by_title!(params[:groupid])
+    else
+      raise MissingParameterError, "Neither userid nor groupid given"
+    end
+
+    begin
+      if params[:todo].to_s == 'remove'
+        role = nil
+        role = Role.find_by_title(params[:role]) if params[:role]
+        target.remove_role(object, role)
+      elsif params[:todo].to_s == 'add'
+        role = Role.find_by_title!(params[:role])
+        target.add_role(object, role)
+      else
+        raise MissingParameterError, "Paramter todo is not 'add' or 'remove'"
+      end
+    rescue ActiveRecord::RecordInvalid => e
+      render_error status: 400, errorcode: 'change_role_failed', message: e.record.errors.full_messages.join('\n')
+      return
+    end
+    render json: 'ok'
+  end
 end

src/api/app/models/package.rb

@@ -892,6 +892,26 @@ def remove_all_groups
     self.package_group_role_relationships.delete_all
   end
 
+  def remove_role(what, role)
+    if what.kind_of? Group
+      rel = self.package_group_role_relationships.where(bs_group_id: what.id)
+    else
+      rel = self.package_user_role_relationships.where(bs_user_id: what.id)
+    end
+    rel = rel.where(role_id: role.id) if role
+    rel.delete_all
+    write_to_backend
+  end
+
+  def add_role(what, role)
+    if what.kind_of? Group
+      self.package_group_role_relationships.create!(role: role, group: what)
+    else
+      self.package_user_role_relationships.create!(role: role, user: what)
+    end
+    write_to_backend
+  end
+
   def open_requests_with_package_as_source_or_target
     rel = BsRequest.where(state: [:new, :review, :declined]).joins(:bs_request_actions)
     rel = rel.where("(bs_request_actions.source_project = ? and bs_request_actions.source_package = ?) or (bs_request_actions.target_project = ? and bs_request_actions.target_package = ?)", self.project.name, self.name, self.project.name, self.name)

src/api/app/models/project.rb

@@ -22,6 +22,7 @@ def errorcode
 
   has_many :project_user_role_relationships, :dependent => :delete_all, foreign_key: :db_project_id
   has_many :project_group_role_relationships, :dependent => :delete_all, foreign_key: :db_project_id
+
   has_many :packages, :dependent => :destroy, foreign_key: :db_project_id
   has_many :attribs, :dependent => :destroy, foreign_key: :db_project_id
   has_many :repositories, :dependent => :destroy, foreign_key: :db_project_id
@@ -1421,4 +1422,24 @@ def user_has_role?(user, role)
     return !self.project_group_role_relationships.where(role_id: role).joins(:groups_users).where(groups_users: { user_id: user.id }).first.nil?
   end
 
+  def remove_role(what, role)
+    if what.kind_of? Group
+      rel = self.project_group_role_relationships.where(bs_group_id: what.id)
+    else
+      rel = self.project_user_role_relationships.where(bs_user_id: what.id)
+    end
+    rel = rel.where(role_id: role.id) if role
+    rel.delete_all
+    write_to_backend
+  end
+
+  def add_role(what, role)
+    if what.kind_of? Group
+      self.project_group_role_relationships.create!(role: role, group: what)
+    else
+      self.project_user_role_relationships.create!(role: role, user: what)
+    end
+    write_to_backend
+  end
+
 end

src/api/config/routes.rb

@@ -298,6 +298,7 @@
       match 'webui/person_involved_requests' => :person_involved_requests
       match 'webui/request_ids' => :request_ids
       match 'webui/request_list' => :request_list
+      match 'webui/change_role' => :change_role, via: :post
     end
 
     match "/404" => "main#notfound"