Fix checking ownership by user perms not group.

refinery/core/api.py

@@ -161,12 +161,14 @@ def transform_res_list(self, user, res_list, request, **kwargs):
                 )
 
         if cache_check is None:
+            # for ownership, don't check group perms
             owned_res_set = Set(
                 get_objects_for_user(
                     user,
-                    'core.share_%s' %
-                    self.res_type._meta.verbose_name).values_list("id",
-                                                                  flat=True))
+                    'core.add_%s' %
+                    self.res_type._meta.verbose_name,
+                    use_groups=False
+                ).values_list("id", flat=True))
 
             public_res_set = Set(
                 get_objects_for_group(
@@ -743,9 +745,8 @@ def get_by_db_id(self, request, **kwargs):
             if group.group == ExtendedGroup.objects.public_group():
                 is_public = True
 
-        is_owner = request.user.has_perm(
-            'core.share_dataset', ds
-        )
+        # get_owner in core models uses add to distinguish owner
+        is_owner = request.user.has_perm('core.add_dataset', ds)
 
         try:
             user_uuid = request.user.profile.uuid

refinery/core/views.py

@@ -890,25 +890,30 @@ def delete(self, request, uuid):
         if not request.user.is_authenticated():
             return HttpResponseForbidden(
                 content="User {} is not authenticated".format(request.user))
-        else:
-            try:
-                dataset_deleted = DataSet.objects.get(uuid=uuid).delete()
-            except NameError as e:
-                logger.error(e)
-                return HttpResponseBadRequest(content="Bad Request")
-            except DataSet.DoesNotExist as e:
-                logger.error(e)
-                return HttpResponseNotFound(content="DataSet with UUID: {} "
-                                                    "not found.".format(uuid))
-            except DataSet.MultipleObjectsReturned as e:
-                logger.error(e)
-                return HttpResponseServerError(
-                    content="Multiple DataSets returned for this request")
+
+        try:
+            data_set = DataSet.objects.get(uuid=uuid)
+        except NameError as e:
+            logger.error(e)
+            return HttpResponseBadRequest(content="Bad Request")
+        except DataSet.DoesNotExist as e:
+            logger.error(e)
+            return HttpResponseNotFound(content="DataSet with UUID: {} "
+                                                "not found.".format(uuid))
+        except DataSet.MultipleObjectsReturned as e:
+            logger.error(e)
+            return HttpResponseServerError(
+                content="Multiple DataSets returned for this request")
+
+        if data_set.get_owner() == request.user:
+            data_set_deleted = data_set.delete()
+            if data_set_deleted[0]:
+                return Response({"data": data_set_deleted[1]})
             else:
-                if dataset_deleted[0]:
-                    return Response({"data": dataset_deleted[1]})
-                else:
-                    return HttpResponseBadRequest(content=dataset_deleted[1])
+                return HttpResponseBadRequest(content=data_set_deleted[1])
+
+        return Response('Unauthorized to delete data set with uuid: {'
+                        '}'.format(uuid), status=status.HTTP_401_UNAUTHORIZED)
 
     def patch(self, request, uuid, format=None):
         self.data_set = self.get_object(uuid)

refinery/ui/source/js/data-set-about/partials/details.html

@@ -397,24 +397,28 @@ <h3>Metadata</h3>
     </a>
       - {{ADCtrl.fileStoreItem.file_size | fileSizeFormat}}
   </p>
-  <a
-    class="refinery-base btn btn-primary"
-    ng-if="ADCtrl.dataSet.is_owner"
-    ng-disabled="!ADCtrl.dataSet.is_clean"
-    href="/data_set_manager/import/?data_set_title={{ ADCtrl.dataSet.title }}/#/isa-tab-import?data_set_uuid={{ ADCtrl.dataSet.uuid }}">
-    Revise Metadata
-  </a>
-  <span class="p-l-1-3" ng-if="ADCtrl.dataSet.is_owner">
-    <a
-      popover-placement="right"
-      uib-popover-html="'Redirects to the Data Set Upload page where you
-      can upload revised metadata. <strong>Note:</strong> Once you have
-      run an analysis or visualization on a data set, its metadata can no longer be revised.'"
-      popover-title="Revise Meta Data"
-      popover-trigger="'outsideClick'"
-      popover-append-to-body="true">
-        <i class="fa fa-question-circle info-icon icon-only"></i>
-    </a>
+   <span
+     class="p-l-1"
+     ng-class="{banned: !FBCtrl.dataSet.is_clean}"
+     ng-if="ADCtrl.dataSet.is_owner">
+      <a
+        class="refinery-base btn btn-default"
+        ng-class="{disabledLink: !ADCtrl.dataSet.is_clean}"
+        href="/data_set_manager/import/?data_set_title={{ ADCtrl.dataSet.title }}/#/isa-tab-import?data_set_uuid={{ ADCtrl.dataSet.uuid }}">
+        Revise Metadata
+      </a>
+     </span>
+    <span class="p-l-1-3" ng-if="ADCtrl.dataSet.is_owner">
+      <a
+        popover-placement="right"
+        uib-popover-html="'Redirects to the Data Set Upload page where you
+        can upload revised metadata. <strong>Note:</strong> Once you have
+        run an analysis or visualization on a data set, its metadata can no longer be revised.'"
+        popover-title="Revise Metadata"
+        popover-trigger="'outsideClick'"
+        popover-append-to-body="true">
+          <i class="fa fa-question-circle info-icon icon-only"></i>
+      </a>
   </span>
 </div>
 <div ng-if="ADCtrl.dataSet.pre_isa_archive && ADCtrl.fileStoreItem.datafile">
@@ -429,13 +433,17 @@ <h3>Metadata</h3>
   <p class="emphasized">Not available.</p>
 </div>
 <div ng-if="ADCtrl.dataSet.pre_isa_archive">
-   <a
-    class="refinery-base btn btn-primary"
-    ng-if="ADCtrl.dataSet.is_owner"
-    ng-disabled="!ADCtrl.dataSet.is_clean"
-    href="/data_set_manager/import/?data_set_title={{ ADCtrl.dataSet.title }}/#/?data_set_uuid={{ ADCtrl.dataSet.uuid }}">
-    Revise Metadata
-  </a>
+  <span
+     class="p-l-1"
+     ng-class="{banned: !FBCtrl.dataSet.is_clean}"
+     ng-if="ADCtrl.dataSet.is_owner">
+     <a
+      class="refinery-base btn btn-default"
+      ng-class="{disabledLink: !ADCtrl.dataSet.is_clean}"
+      href="/data_set_manager/import/?data_set_title={{ ADCtrl.dataSet.title }}/#/?data_set_uuid={{ ADCtrl.dataSet.uuid }}">
+      Revise Metadata
+    </a>
+  </span>
   <span class="p-l-1-3" ng-if="ADCtrl.dataSet.is_owner">
     <a
       popover-placement="right"
@@ -450,7 +458,7 @@ <h3>Metadata</h3>
   </span>
 </div>
 
-<span class="refinery-subheader">
+<span class="refinery-subheader p-t-1-2">
   <h3>Data Files</h3>
 </span>
 <p>