rucio 35.7.0__py3-none-any.whl → 37.0.0rc2__py3-none-any.whl

rucio/gateway/authentication.py

@@ -170,8 +170,9 @@ def get_auth_token_user_pass(
     """
 
     kwargs = {'account': account, 'username': username, 'password': password}
-    if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_user_pass', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('User with identity %s can not log to account %s' % (username, account))
+    auth_result = permission.has_permission(issuer=account, vo=vo, action='get_auth_token_user_pass', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('User with identity %s can not log to account %s. %s' % (username, account, auth_result.message))
 
     internal_account = InternalAccount(account, vo=vo)
 
@@ -204,8 +205,9 @@ def get_auth_token_gss(
     """
 
     kwargs = {'account': account, 'gsscred': gsscred}
-    if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_gss', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('User with identity %s can not log to account %s' % (gsscred, account))
+    auth_result = permission.has_permission(issuer=account, vo=vo, action='get_auth_token_gss', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('User with identity %s can not log to account %s. %s' % (gsscred, account, auth_result.message))
 
     internal_account = InternalAccount(account, vo=vo)
 
@@ -241,8 +243,9 @@ def get_auth_token_x509(
         account = identity.get_default_account(dn, IdentityType.X509).external
 
     kwargs = {'account': account, 'dn': dn}
-    if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_x509', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('User with identity %s can not log to account %s' % (dn, account))
+    auth_result = permission.has_permission(issuer=account, vo=vo, action='get_auth_token_x509', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('User with identity %s can not log to account %s. %s' % (dn, account, auth_result.message))
 
     internal_account = InternalAccount(account, vo=vo)
 
@@ -275,8 +278,9 @@ def get_auth_token_ssh(
     """
 
     kwargs = {'account': account, 'signature': signature}
-    if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_ssh', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('User with provided signature can not log to account %s' % account)
+    auth_result = permission.has_permission(issuer=account, vo=vo, action='get_auth_token_ssh', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('User with provided signature can not log to account %s. %s' % (account, auth_result.message))
 
     internal_account = InternalAccount(account, vo=vo)
 
@@ -307,8 +311,9 @@ def get_ssh_challenge_token(
     """
 
     kwargs = {'account': account}
-    if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_ssh', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('User can not get challenge token for account %s' % account)
+    auth_result = permission.has_permission(issuer=account, vo=vo, action='get_auth_token_ssh', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('User can not get challenge token for account %s. %s' % (account, auth_result.message))
 
     internal_account = InternalAccount(account, vo=vo)
 
@@ -340,8 +345,9 @@ def get_auth_token_saml(
     """
 
     kwargs = {'account': account, 'saml_nameid': saml_nameid}
-    if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_saml', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('User with identity %s can not log to account %s' % (saml_nameid, account))
+    auth_result = permission.has_permission(issuer=account, vo=vo, action='get_auth_token_saml', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('User with identity %s can not log to account %s. %s' % (saml_nameid, account, auth_result.message))
 
     internal_account = InternalAccount(account, vo=vo)
 

rucio/gateway/config.py

@@ -43,8 +43,9 @@ def sections(issuer: Optional[str] = None, vo: str = 'def', *, session: "Session
     """
 
     kwargs = {'issuer': issuer}
-    if not permission.has_permission(issuer=issuer, vo=vo, action='config_sections', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('%s cannot retrieve sections' % issuer)
+    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='config_sections', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('%s cannot retrieve sections. %s' % (issuer, auth_result.message))
     return config.sections(session=session)
 
 
@@ -60,8 +61,9 @@ def add_section(section: str, issuer: Optional[str] = None, vo: str = 'def', *,
     """
 
     kwargs = {'issuer': issuer, 'section': section}
-    if not permission.has_permission(issuer=issuer, vo=vo, action='config_add_section', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('%s cannot add section %s' % (issuer, section))
+    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='config_add_section', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('%s cannot add section %s. %s' % (issuer, section, auth_result.message))
     return config.add_section(section, session=session)
 
 
@@ -78,8 +80,9 @@ def has_section(section: str, issuer: Optional[str] = None, vo: str = 'def', *,
     """
 
     kwargs = {'issuer': issuer, 'section': section}
-    if not permission.has_permission(issuer=issuer, vo=vo, action='config_has_section', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('%s cannot check existence of section %s' % (issuer, section))
+    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='config_has_section', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('%s cannot check existence of section %s. %s' % (issuer, section, auth_result.message))
     return config.has_section(section, session=session)
 
 
@@ -96,8 +99,9 @@ def options(section: str, issuer: Optional[str] = None, vo: str = 'def', *, sess
     """
 
     kwargs = {'issuer': issuer, 'section': section}
-    if not permission.has_permission(issuer=issuer, vo=vo, action='config_options', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('%s cannot retrieve options from section %s' % (issuer, section))
+    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='config_options', kwargs=kwargs, session=session)
+    if auth_result.allowed:
+        raise exception.AccessDenied('%s cannot retrieve options from section %s. %s' % (issuer, section, auth_result.message))
     return config.options(section, session=session)
 
 
@@ -115,8 +119,9 @@ def has_option(section: str, option: str, issuer: Optional[str] = None, vo: str
     """
 
     kwargs = {'issuer': issuer, 'section': section, 'option': option}
-    if not permission.has_permission(issuer=issuer, vo=vo, action='config_has_option', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('%s cannot check existence of option %s from section %s' % (issuer, option, section))
+    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='config_has_option', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('%s cannot check existence of option %s from section %s. %s' % (issuer, option, section, auth_result.message))
     return config.has_option(section, option, session=session)
 
 
@@ -137,8 +142,9 @@ def get(section: str, option: str, issuer: Optional[str] = None, vo: str = 'def'
     """
 
     kwargs = {'issuer': issuer, 'section': section, 'option': option}
-    if not permission.has_permission(issuer=issuer, vo=vo, action='config_get', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('%s cannot retrieve option %s from section %s' % (issuer, option, section))
+    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='config_get', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('%s cannot retrieve option %s from section %s. %s' % (issuer, option, section, auth_result.message))
     return config.get(section, option, session=session, convert_type_fnc=convert_to_any_type)
 
 
@@ -156,8 +162,9 @@ def items(section: str, issuer: Optional[str] = None, vo: str = 'def', *, sessio
     """
 
     kwargs = {'issuer': issuer, 'section': section}
-    if not permission.has_permission(issuer=issuer, vo=vo, action='config_items', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('%s cannot retrieve options and values from section %s' % (issuer, section))
+    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='config_items', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('%s cannot retrieve options and values from section %s. %s' % (issuer, section, auth_result.message))
     return config.items(section, session=session, convert_type_fnc=convert_to_any_type)
 
 
@@ -175,8 +182,9 @@ def set(section: str, option: str, value: Any, issuer: Optional[str] = None, vo:
     """
 
     kwargs = {'issuer': issuer, 'section': section, 'option': option, 'value': value}
-    if not permission.has_permission(issuer=issuer, vo=vo, action='config_set', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('%s cannot set option %s to %s in section %s' % (issuer, option, value, section))
+    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='config_set', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('%s cannot set option %s to %s in section %s. %s' % (issuer, option, value, section, auth_result.message))
     return config.set(section, option, value, session=session)
 
 
@@ -193,8 +201,9 @@ def remove_section(section: str, issuer: Optional[str] = None, vo: str = 'def',
     """
 
     kwargs = {'issuer': issuer, 'section': section}
-    if not permission.has_permission(issuer=issuer, vo=vo, action='config_remove_section', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('%s cannot remove section %s' % (issuer, section))
+    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='config_remove_section', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('%s cannot remove section %s. %s' % (issuer, section, auth_result.message))
     return config.remove_section(section, session=session)
 
 
@@ -212,6 +221,7 @@ def remove_option(section: str, option: str, issuer: Optional[str] = None, vo: s
     """
 
     kwargs = {'issuer': issuer, 'section': section, 'option': option}
-    if not permission.has_permission(issuer=issuer, vo=vo, action='config_remove_option', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('%s cannot remove option %s from section %s' % (issuer, option, section))
+    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='config_remove_option', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('%s cannot remove option %s from section %s. %s' % (issuer, option, section, auth_result.message))
     return config.remove_option(section, option, session=session)

rucio/gateway/credential.py

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from typing import TYPE_CHECKING, Literal
+from typing import TYPE_CHECKING
 
 from rucio.common import exception
 from rucio.core import credential
@@ -23,6 +23,8 @@ from rucio.gateway import permission
 if TYPE_CHECKING:
     from sqlalchemy.orm import Session
 
+    from rucio.common.constants import RSE_BASE_SUPPORTED_PROTOCOL_OPERATIONS_LITERAL, SUPPORTED_SIGN_URL_SERVICES_LITERAL
+
 
 @read_session
 def get_signed_url(
@@ -30,8 +32,8 @@ def get_signed_url(
     appid: str,
     ip: str,
     rse: str,
-    service: Literal['gsc', 's3', 'swift'],
-    operation: Literal['read', 'write', 'delete'],
+    service: 'SUPPORTED_SIGN_URL_SERVICES_LITERAL',
+    operation: 'RSE_BASE_SUPPORTED_PROTOCOL_OPERATIONS_LITERAL',
     url: str,
     lifetime: int,
     vo: str = 'def',
@@ -57,13 +59,10 @@ def get_signed_url(
     """
 
     kwargs = {'account': account}
-    if not permission.has_permission(issuer=account, vo=vo, action='get_signed_url', kwargs=kwargs, session=session):
-        raise exception.AccessDenied('Account %s can not get signed URL for rse=%s, service=%s, operation=%s, url=%s, lifetime=%s' % (account,
-                                                                                                                                      rse,
-                                                                                                                                      service,
-                                                                                                                                      operation,
-                                                                                                                                      url,
-                                                                                                                                      lifetime))
+    auth_result = permission.has_permission(issuer=account, vo=vo, action='get_signed_url', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise exception.AccessDenied('Account %s can not get signed URL for rse=%s, service=%s, operation=%s, url=%s, lifetime=%s. %s' %
+                                     (account, rse, service, operation, url, lifetime, auth_result.message))
 
     # look up RSE ID for name
     rse_id = get_rse_id(rse, vo=vo, session=session)

rucio/gateway/did.py

@@ -12,7 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from collections.abc import Iterable, Iterator, Mapping, Sequence
 from copy import deepcopy
 from typing import TYPE_CHECKING, Any, Optional
 
@@ -29,13 +28,15 @@ from rucio.db.sqla.constants import DIDType
 from rucio.db.sqla.session import read_session, stream_session, transactional_session
 
 if TYPE_CHECKING:
+    from collections.abc import Iterable, Iterator, Mapping, Sequence
+
     from sqlalchemy.orm import Session
 
 
 @stream_session
 def list_dids(
     scope: str,
-    filters: Mapping[Any, Any],
+    filters: 'Mapping[Any, Any]',
     did_type: str = 'collection',
     ignore_case: bool = False,
     limit: Optional[int] = None,
@@ -45,7 +46,7 @@ def list_dids(
     vo: str = 'def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     List dids in a scope.
 
@@ -85,9 +86,9 @@ def add_did(
     account: Optional[str] = None,
     statuses: Optional[dict[str, str]] = None,
     meta: Optional[dict[str, str]] = None,
-    rules: Optional[Sequence[dict[str, Any]]] = None,
+    rules: Optional['Sequence[dict[str, Any]]'] = None,
     lifetime: Optional[str] = None,
-    dids: Optional[Sequence[dict[str, Any]]] = None,
+    dids: Optional['Sequence[dict[str, Any]]'] = None,
     rse: Optional[str] = None,
     vo: str = 'def',
     *,
@@ -119,8 +120,9 @@ def add_did(
     validate_schema(name='dids', obj=dids, vo=vo)
     validate_schema(name='rse', obj=rse, vo=vo)
     kwargs = {'scope': scope, 'name': name, 'type': did_type, 'issuer': issuer, 'account': account, 'statuses': statuses, 'meta': meta, 'rules': rules, 'lifetime': lifetime}
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='add_did', kwargs=kwargs, session=session):
-        raise AccessDenied('Account %s can not add data identifier to scope %s' % (issuer, scope))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='add_did', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not add data identifier to scope %s. %s' % (issuer, scope, auth_result.message))
 
     owner_account = None if account is None else InternalAccount(account, vo=vo)
     issuer_account = InternalAccount(issuer, vo=vo)
@@ -156,7 +158,7 @@ def add_did(
 
 @transactional_session
 def add_dids(
-    dids: Sequence[dict[str, Any]],
+    dids: 'Sequence[dict[str, Any]]',
     issuer: str,
     vo: str = 'def',
     *,
@@ -178,8 +180,9 @@ def add_dids(
             d['rse_id'] = rse_id
 
     kwargs = {'issuer': issuer, 'dids': dids}
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='add_dids', kwargs=kwargs, session=session):
-        raise AccessDenied('Account %s can not bulk add data identifier' % (issuer))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='add_dids', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not bulk add data identifier. %s' % (issuer, auth_result.message))
 
     issuer_account = InternalAccount(issuer, vo=vo)
     for d in dids:
@@ -219,8 +222,9 @@ def attach_dids(
         attachment['rse_id'] = rse_id
 
     kwargs = {'scope': scope, 'name': name, 'attachment': attachment}
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='attach_dids', kwargs=kwargs, session=session):
-        raise AccessDenied('Account %s can not add data identifiers to %s:%s' % (issuer, scope, name))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='attach_dids', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not add data identifiers to %s:%s. %s' % (issuer, scope, name, auth_result.message))
 
     internal_scope = InternalScope(scope, vo=vo)
     issuer_account = InternalAccount(issuer, vo=vo)
@@ -243,7 +247,7 @@ def attach_dids(
 
 @transactional_session
 def attach_dids_to_dids(
-    attachments: Sequence[dict[str, Any]],
+    attachments: 'Sequence[dict[str, Any]]',
     issuer: str,
     ignore_duplicate: bool = False,
     vo: str = 'def',
@@ -268,8 +272,9 @@ def attach_dids_to_dids(
                 rse_id = get_rse_id(rse=a['rse'], vo=vo, session=session)
             a['rse_id'] = rse_id
 
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='attach_dids_to_dids', kwargs={'attachments': attachments}, session=session):
-        raise AccessDenied('Account %s can not add data identifiers' % (issuer))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='attach_dids_to_dids', kwargs={'attachments': attachments}, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not add data identifiers. %s' % (issuer, auth_result.message))
 
     issuer_account = InternalAccount(issuer, vo=vo)
     for attachment in attachments:
@@ -287,7 +292,7 @@ def attach_dids_to_dids(
 def detach_dids(
     scope: str,
     name: str,
-    dids: Sequence[dict[str, Any]],
+    dids: 'Sequence[dict[str, Any]]',
     issuer: str,
     vo: str = 'def',
     *,
@@ -304,8 +309,9 @@ def detach_dids(
     :param session: The database session in use.
     """
     kwargs = {'scope': scope, 'name': name, 'dids': dids, 'issuer': issuer}
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='detach_dids', kwargs=kwargs, session=session):
-        raise AccessDenied('Account %s can not detach data identifiers from %s:%s' % (issuer, scope, name))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='detach_dids', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not detach data identifiers from %s:%s. %s' % (issuer, scope, name, auth_result.message))
 
     internal_scope = InternalScope(scope, vo=vo)
     for d in dids:
@@ -323,7 +329,7 @@ def list_new_dids(
     vo: str = 'def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     List recent identifiers.
 
@@ -342,7 +348,7 @@ def list_new_dids(
 
 @transactional_session
 def set_new_dids(
-    dids: Sequence[dict[str, Any]],
+    dids: 'Sequence[dict[str, Any]]',
     new_flag: bool = True,
     vo: str = 'def',
     *,
@@ -370,7 +376,7 @@ def list_content(
     vo: str = 'def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     List data identifier contents.
 
@@ -394,7 +400,7 @@ def list_content_history(
     vo='def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     List data identifier contents history.
 
@@ -414,12 +420,12 @@ def list_content_history(
 
 @stream_session
 def bulk_list_files(
-    dids: Iterable[dict[str, Any]],
+    dids: 'Iterable[dict[str, Any]]',
     long: bool = False,
     vo: str = 'def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     List file contents of a list of data identifiers.
 
@@ -444,7 +450,7 @@ def list_files(
     vo: str = 'def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     List data identifier file contents.
 
@@ -471,7 +477,7 @@ def scope_list(
     vo: str = 'def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     List data identifiers in a scope.
 
@@ -544,8 +550,9 @@ def set_metadata(
     if key in RESERVED_KEYS:
         raise AccessDenied('Account %s can not change this metadata value to data identifier %s:%s' % (issuer, scope, name))
 
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='set_metadata', kwargs=kwargs, session=session):
-        raise AccessDenied('Account %s can not add metadata to data identifier %s:%s' % (issuer, scope, name))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='set_metadata', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not add metadata to data identifier %s:%s. %s' % (issuer, scope, name, auth_result.message))
 
     internal_scope = InternalScope(scope, vo=vo)
     return did.set_metadata(scope=internal_scope, name=name, key=key, value=value, recursive=recursive, session=session)
@@ -579,8 +586,9 @@ def set_metadata_bulk(
         if key in RESERVED_KEYS:
             raise AccessDenied('Account %s can not change the value of the metadata key %s to data identifier %s:%s' % (issuer, key, scope, name))
 
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='set_metadata_bulk', kwargs=kwargs, session=session):
-        raise AccessDenied('Account %s can not add metadata to data identifier %s:%s' % (issuer, scope, name))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='set_metadata_bulk', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not add metadata to data identifier %s:%s. %s' % (issuer, scope, name, auth_result.message))
 
     internal_scope = InternalScope(scope, vo=vo)
     return did.set_metadata_bulk(scope=internal_scope, name=name, meta=meta, recursive=recursive, session=session)
@@ -588,7 +596,7 @@ def set_metadata_bulk(
 
 @transactional_session
 def set_dids_metadata_bulk(
-    dids: Iterable[dict[str, Any]],
+    dids: 'Iterable[dict[str, Any]]',
     issuer: str,
     recursive: bool = False,
     vo: str = 'def',
@@ -607,8 +615,9 @@ def set_dids_metadata_bulk(
 
     for entry in dids:
         kwargs = {'scope': entry['scope'], 'name': entry['name'], 'meta': entry['meta'], 'issuer': issuer}
-        if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='set_metadata_bulk', kwargs=kwargs, session=session):
-            raise AccessDenied('Account %s can not add metadata to data identifier %s:%s' % (issuer, entry['scope'], entry['name']))
+        auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='set_metadata_bulk', kwargs=kwargs, session=session)
+        if not auth_result.allowed:
+            raise AccessDenied('Account %s can not add metadata to data identifier %s:%s. %s' % (issuer, entry['scope'], entry['name'], auth_result.message))
         entry['scope'] = InternalScope(entry['scope'], vo=vo)
         meta = entry['meta']
         for key in meta:
@@ -633,6 +642,7 @@ def get_metadata(
     :param scope: The scope name.
     :param name: The data identifier name.
     :param vo: The VO to act on.
+    :param plugin: The metadata plugin to query, 'ALL' for all available plugins
     :param session: The database session in use.
     """
 
@@ -644,16 +654,18 @@ def get_metadata(
 
 @stream_session
 def get_metadata_bulk(
-    dids: Iterable[dict[str, Any]],
+    dids: 'Iterable[dict[str, Any]]',
     inherit: bool = False,
+    plugin: str = 'DID_COLUMN',
     vo: str = 'def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     Get metadata for a list of dids
     :param dids:               A list of dids.
     :param inherit:            A boolean. If set to true, the metadata of the parent are concatenated.
+    :param plugin:             The metadata plugin to query, 'ALL' for all available plugins
     :param vo:                 The VO to act on.
     :param session: The database session in use.
     """
@@ -661,7 +673,7 @@ def get_metadata_bulk(
     validate_schema(name='dids', obj=dids, vo=vo)
     for entry in dids:
         entry['scope'] = InternalScope(entry['scope'], vo=vo)
-    meta = did.get_metadata_bulk(dids, inherit=inherit, session=session)
+    meta = did.get_metadata_bulk(dids, inherit=inherit, plugin=plugin, session=session)
     for met in meta:
         yield gateway_update_return_dict(met, session=session)
 
@@ -710,8 +722,9 @@ def set_status(
     :param session: The database session in use.
     """
 
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='set_status', kwargs={'scope': scope, 'name': name, 'issuer': issuer}, session=session):
-        raise AccessDenied('Account %s can not set status on data identifier %s:%s' % (issuer, scope, name))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='set_status', kwargs={'scope': scope, 'name': name, 'issuer': issuer}, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not set status on data identifier %s:%s. %s' % (issuer, scope, name, auth_result.message))
 
     internal_scope = InternalScope(scope, vo=vo)
 
@@ -724,7 +737,7 @@ def get_dataset_by_guid(
     vo: str = 'def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     Get the parent datasets for a given GUID.
     :param guid: The GUID.
@@ -748,7 +761,7 @@ def list_parent_dids(
     vo: str = 'def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     List parent datasets and containers of a did.
 
@@ -792,8 +805,9 @@ def create_did_sample(
     :param session: The database session in use.
     """
     kwargs = {'issuer': issuer, 'scope': output_scope}
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='create_did_sample', kwargs=kwargs, session=session):
-        raise AccessDenied('Account %s can not bulk add data identifier' % (issuer))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='create_did_sample', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not bulk add data identifier. %s' % (issuer, auth_result.message))
 
     input_internal_scope = InternalScope(input_scope, vo=vo)
     output_internal_scope = InternalScope(output_scope, vo=vo)
@@ -806,7 +820,7 @@ def create_did_sample(
 
 @transactional_session
 def resurrect(
-    dids: Iterable[dict[str, Any]],
+    dids: 'Iterable[dict[str, Any]]',
     issuer: str,
     vo: str = 'def',
     *,
@@ -821,8 +835,9 @@ def resurrect(
     :param session: The database session in use.
     """
     kwargs = {'issuer': issuer}
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='resurrect', kwargs=kwargs, session=session):
-        raise AccessDenied('Account %s can not resurrect data identifiers' % (issuer))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='resurrect', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not resurrect data identifiers. %s' % (issuer, auth_result.message))
     validate_schema(name='dids', obj=dids, vo=vo)
 
     for d in dids:
@@ -838,7 +853,7 @@ def list_archive_content(
     vo: str = 'def',
     *,
     session: "Session"
-) -> Iterator[dict[str, Any]]:
+) -> 'Iterator[dict[str, Any]]':
     """
     List archive contents.
 
@@ -879,7 +894,7 @@ def add_did_to_followed(
 
 @transactional_session
 def add_dids_to_followed(
-    dids: Iterable[Mapping[str, Any]],
+    dids: 'Iterable[Mapping[str, Any]]',
     account: str,
     *,
     session: "Session",
@@ -903,7 +918,7 @@ def get_users_following_did(
     *,
     session: "Session",
     vo: str = 'def'
-) -> Iterator[dict[str, str]]:
+) -> 'Iterator[dict[str, str]]':
     """
     Return list of users following a did
 
@@ -938,8 +953,9 @@ def remove_did_from_followed(
     :param issuer: The issuer account
     """
     kwargs = {'scope': scope, 'issuer': issuer}
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='remove_did_from_followed', kwargs=kwargs, session=session):
-        raise AccessDenied('Account %s can not remove data identifiers from followed table' % (issuer))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='remove_did_from_followed', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not remove data identifiers from followed table. %s' % (issuer, auth_result.message))
 
     internal_scope = InternalScope(scope, vo=vo)
     internal_account = InternalAccount(account, vo=vo)
@@ -948,7 +964,7 @@ def remove_did_from_followed(
 
 @transactional_session
 def remove_dids_from_followed(
-    dids: Iterable[Mapping[str, Any]],
+    dids: 'Iterable[Mapping[str, Any]]',
     account: str,
     issuer: str,
     *,
@@ -963,8 +979,9 @@ def remove_dids_from_followed(
     :param session: The database session in use.
     """
     kwargs = {'dids': dids, 'issuer': issuer}
-    if not rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='remove_dids_from_followed', kwargs=kwargs, session=session):
-        raise AccessDenied('Account %s can not bulk remove data identifiers from followed table' % (issuer))
+    auth_result = rucio.gateway.permission.has_permission(issuer=issuer, vo=vo, action='remove_dids_from_followed', kwargs=kwargs, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not bulk remove data identifiers from followed table. %s' % (issuer, auth_result.message))
 
     internal_account = InternalAccount(account, vo=vo)
     return did.remove_dids_from_followed(dids=dids, account=internal_account, session=session)

rucio/gateway/dirac.py

@@ -68,14 +68,16 @@ def add_files(
     for rse in rses:
         rse_id = rses[rse]
         kwargs = {'rse': rse, 'rse_id': rse_id}
-        if not has_permission(issuer=issuer, action='add_replicas', kwargs=kwargs, vo=vo, session=session):
-            raise AccessDenied('Account %s can not add file replicas on %s for VO %s' % (issuer, rse, vo))
+        auth_result = has_permission(issuer=issuer, action='add_replicas', kwargs=kwargs, vo=vo, session=session)
+        if not auth_result.allowed:
+            raise AccessDenied('Account %s can not add file replicas on %s for VO %s. %s' % (issuer, rse, vo, auth_result.message))
         if not has_permission(issuer=issuer, action='skip_availability_check', kwargs=kwargs, vo=vo, session=session):
             ignore_availability = False
 
     # Check if the issuer can add the files
     kwargs = {'issuer': issuer, 'dids': dids}
-    if not has_permission(issuer=issuer, action='add_dids', kwargs=kwargs, vo=vo, session=session):
-        raise AccessDenied('Account %s can not bulk add data identifier for VO %s' % (issuer, vo))
+    auth_result = has_permission(issuer=issuer, action='add_dids', kwargs=kwargs, vo=vo, session=session)
+    if not auth_result.allowed:
+        raise AccessDenied('Account %s can not bulk add data identifier for VO %s. %s' % (issuer, vo, auth_result.message))
 
     dirac.add_files(lfns=lfns, account=issuer, ignore_availability=ignore_availability, parents_metadata=parents_metadata, vo=vo, session=session)