rucio 37.1.0.post1__tar.gz → 37.2.0__tar.gz

{rucio-37.1.0.post1 → rucio-37.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rucio
-Version: 37.1.0.post1
+Version: 37.2.0
 Summary: Rucio Package
 Home-page: https://rucio.cern.ch/
 Author: Rucio
@@ -27,7 +27,6 @@ Requires-Dist: dogpile-cache<=1.2.2
 Requires-Dist: packaging
 Requires-Dist: tabulate
 Requires-Dist: jsonschema
-Requires-Dist: dataclasses
 Requires-Dist: rich
 Requires-Dist: typing_extensions
 Requires-Dist: argcomplete

{rucio-37.1.0.post1 → rucio-37.2.0}/lib/rucio/common/utils.py

@@ -595,20 +595,17 @@ class ScopeExtractionAlgorithms(PolicyPackageAlgorithms):
     @staticmethod
     def extract_scope_default(did: str, scopes: Optional['Sequence[str]']) -> 'Sequence[str]':
         """
-        Default fallback scope extraction algorithm, based on the ATLAS scope extraction algorithm.
+        Default scope extraction algorithm. Extracts the scope from the DID.
 
         :param did: The DID to extract the scope from.
+        :param scopes: Not used in the default algorithm.
 
-        :returns: A tuple containing the extracted scope and the DID.
+        :returns: A tuple containing the extracted scope and the name.
         """
-        if did.find(':') > -1:
-            if len(did.split(':')) > 2:
-                raise RucioException('Too many colons. Cannot extract scope and name')
-            scope, name = did.split(':')[0], did.split(':')[1]
-            if name.endswith('/'):
-                name = name[:-1]
-            return scope, name
-        else:
+
+        # This block is ATLAS specific, to be removed in the future.
+        # More info at https://github.com/rucio/rucio/pull/7521
+        if did.find(':') == -1:
             scope = did.split('.')[0]
             if did.startswith('user') or did.startswith('group'):
                 scope = ".".join(did.split('.')[0:2])
@@ -616,6 +613,16 @@ class ScopeExtractionAlgorithms(PolicyPackageAlgorithms):
                 did = did[:-1]
             return scope, did
 
+        parts = did.split(':')
+        if len(parts) != 2:
+            msg = f"Cannot extract scope and name from DID {did}. The DID should have exactly one colon but found {len(parts)} colons."
+            raise RucioException(msg)
+        scope, name = parts
+        if not scope or not name:
+            msg = f"Cannot extract scope and name from DID {did}. Found empty scope or name."
+            raise RucioException(msg)
+        return scope, name
+
     @staticmethod
     def extract_scope_dirac(did: str, scopes: Optional['Sequence[str]']) -> 'Sequence[str]':
         # Default dirac scope extract algorithm. Scope is the second element in the LFN or the first one (VO name)

{rucio-37.1.0.post1 → rucio-37.2.0}/lib/rucio/core/did.py

@@ -254,6 +254,7 @@ def attach_dids(
         name: str,
         dids: "Sequence[Mapping[str, Any]]",
         account: "InternalAccount",
+        ignore_duplicate: bool = False,
         rse_id: Optional[str] = None,
         *,
         session: "Session",
@@ -265,10 +266,11 @@ def attach_dids(
     :param name: The data identifier name.
     :param dids: The content.
     :param account: The account owner.
+    :param ignore_duplicate: If True, ignore duplicate entries.
     :param rse_id: The RSE id for the replicas.
     :param session: The database session in use.
     """
-    return attach_dids_to_dids(attachments=[{'scope': scope, 'name': name, 'dids': dids, 'rse_id': rse_id}], account=account, session=session)
+    return attach_dids_to_dids(attachments=[{'scope': scope, 'name': name, 'dids': dids, 'rse_id': rse_id}], account=account, ignore_duplicate=ignore_duplicate, session=session)
 
 
 @transactional_session
@@ -340,6 +342,7 @@ def attach_dids_to_dids(
                                                collections_temp_table=children_temp_table,
                                                collections=children,
                                                account=account,
+                                               ignore_duplicate=ignore_duplicate,
                                                session=session)
                 update_parent = True
 
@@ -669,6 +672,7 @@ def __add_collections_to_container(
     collections_temp_table: Any,
     collections: "Mapping[tuple[InternalScope, str], Mapping[str, Any]]",
     account: "InternalAccount",
+    ignore_duplicate: bool = False,
     *,
     session: "Session"
 ) -> None:
@@ -678,6 +682,7 @@ def __add_collections_to_container(
     :param parent_did: the DataIdentifier object of the parent did
     :param collections: .
     :param account: The account owner.
+    :param ignore_duplicate: If True, ignore duplicate entries.
     :param session: The database session in use.
     """
 
@@ -695,9 +700,27 @@ def __add_collections_to_container(
         and_(models.DataIdentifier.scope == collections_temp_table.scope,
              models.DataIdentifier.name == collections_temp_table.name),
     )
+    if ignore_duplicate:
+        stmt = stmt.add_columns(
+            models.DataIdentifierAssociation.scope.label("ignore_duplicate_parent_scope"),
+            models.DataIdentifierAssociation.name.label("ignore_duplicate_parent_name"),
+            collections_temp_table.scope.label("ignore_duplicate_child_scope"),
+            collections_temp_table.name.label("ignore_duplicate_child_name"),
+        ).outerjoin_from(
+            collections_temp_table,
+            models.DataIdentifierAssociation,
+            and_(
+                models.DataIdentifierAssociation.scope == parent_did.scope,
+                models.DataIdentifierAssociation.name == parent_did.name,
+                models.DataIdentifierAssociation.child_scope == collections_temp_table.scope,
+                models.DataIdentifierAssociation.child_name == collections_temp_table.name,
+            ),
+        )
 
     container_parents = None
     child_type = None
+    ignore_duplicate_existing_attachments = set()
+
     for row in session.execute(stmt):
 
         if row.did_scope is None:
@@ -719,8 +742,14 @@ def __add_collections_to_container(
             if (row.scope, row.name) in container_parents:
                 raise exception.UnsupportedOperation('Circular attachment detected. %s:%s is already a parent of %s:%s' % (row.scope, row.name, parent_did.scope, parent_did.name))
 
+        if ignore_duplicate and row.ignore_duplicate_parent_scope is not None:
+            ignore_duplicate_existing_attachments.add((row.ignore_duplicate_parent_scope, row.ignore_duplicate_parent_name, row.ignore_duplicate_child_scope, row.ignore_duplicate_child_name))
+
     messages = []
     for c in collections.values():
+        if ignore_duplicate and (parent_did.scope, parent_did.name, c['scope'], c['name']) in ignore_duplicate_existing_attachments:
+            continue
+
         did_asso = models.DataIdentifierAssociation(
             scope=parent_did.scope,
             name=parent_did.name,

{rucio-37.1.0.post1 → rucio-37.2.0}/lib/rucio/core/did_meta_plugins/did_column_meta.py

@@ -234,7 +234,7 @@ class DidColumnMeta(DidMetaPlugin):
         )
         stmt = stmt.with_hint(
             models.DataIdentifier,
-            'NO_EXPAND',
+            'USE_CONCAT INDEX_RS_ASC(DIDS)',
             'oracle'
         )
 

{rucio-37.1.0.post1 → rucio-37.2.0}/lib/rucio/gateway/credential.py

@@ -17,28 +17,22 @@ from typing import TYPE_CHECKING
 from rucio.common import exception
 from rucio.core import credential
 from rucio.core.rse import get_rse_id
-from rucio.db.sqla.session import read_session
+from rucio.db.sqla.constants import DatabaseOperationType
+from rucio.db.sqla.session import db_session
 from rucio.gateway import permission
 
 if TYPE_CHECKING:
-    from sqlalchemy.orm import Session
-
     from rucio.common.constants import RSE_BASE_SUPPORTED_PROTOCOL_OPERATIONS_LITERAL, SUPPORTED_SIGN_URL_SERVICES_LITERAL
 
 
-@read_session
 def get_signed_url(
     account: str,
-    appid: str,
-    ip: str,
     rse: str,
     service: 'SUPPORTED_SIGN_URL_SERVICES_LITERAL',
     operation: 'RSE_BASE_SUPPORTED_PROTOCOL_OPERATIONS_LITERAL',
     url: str,
     lifetime: int,
     vo: str = 'def',
-    *,
-    session: "Session"
 ) -> str:
     """
     Get a signed URL for a particular service and operation.
@@ -46,25 +40,25 @@ def get_signed_url(
     The signed URL will be valid for 1 hour.
 
     :param account: Account identifier as a string.
-    :param appid: The application identifier as a string.
-    :param ip: IP address of the client as a string.
     :param rse: The name of the RSE to which the URL points.
     :param service: The service to authorise, currently only 'gsc'.
     :param operation: The operation to sign, either 'read', 'write', or 'delete'.
     :param url: The URL to sign.
     :param lifetime: Lifetime in seconds.
     :param vo: The vo to act on.
-    :param session: The database session in use.
+
     :returns: Signed URL as a variable-length string.
     """
 
     kwargs = {'account': account}
-    auth_result = permission.has_permission(issuer=account, vo=vo, action='get_signed_url', kwargs=kwargs, session=session)
-    if not auth_result.allowed:
-        raise exception.AccessDenied('Account %s can not get signed URL for rse=%s, service=%s, operation=%s, url=%s, lifetime=%s. %s' %
-                                     (account, rse, service, operation, url, lifetime, auth_result.message))
 
-    # look up RSE ID for name
-    rse_id = get_rse_id(rse, vo=vo, session=session)
+    with db_session(DatabaseOperationType.READ) as session:
+        auth_result = permission.has_permission(issuer=account, vo=vo, action='get_signed_url', kwargs=kwargs, session=session)
+        if not auth_result.allowed:
+            raise exception.AccessDenied('Account %s can not get signed URL for rse=%s, service=%s, operation=%s, url=%s, lifetime=%s. %s' %
+                                         (account, rse, service, operation, url, lifetime, auth_result.message))
+
+        # look up RSE ID for name
+        rse_id = get_rse_id(rse, vo=vo, session=session)
 
     return credential.get_signed_url(rse_id, service, operation, url, lifetime)

{rucio-37.1.0.post1 → rucio-37.2.0}/lib/rucio/gateway/heartbeat.py

@@ -16,45 +16,40 @@ from typing import TYPE_CHECKING, Optional
 
 from rucio.common import exception
 from rucio.core import heartbeat
-from rucio.db.sqla.session import read_session, transactional_session
+from rucio.db.sqla.constants import DatabaseOperationType
+from rucio.db.sqla.session import db_session
 from rucio.gateway import permission
 
 if TYPE_CHECKING:
     from threading import Thread
 
-    from sqlalchemy.orm import Session
 
-
-@read_session
-def list_heartbeats(issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> list["heartbeat.HeartbeatDict"]:
+def list_heartbeats(issuer: str, vo: str = 'def') -> list["heartbeat.HeartbeatDict"]:
     """
     Return a list of tuples of all heartbeats.
 
     :param issuer: The issuer account.
     :param vo: the VO for the issuer.
-    :param session: The database session in use.
     :returns: List of tuples [('Executable', 'Hostname', ...), ...]
     """
 
     kwargs = {'issuer': issuer}
-    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='list_heartbeats', kwargs=kwargs, session=session)
-    if not auth_result.allowed:
-        raise exception.AccessDenied('%s cannot list heartbeats. %s' % (issuer, auth_result.message))
-    return heartbeat.list_heartbeats(session=session)
+    with db_session(DatabaseOperationType.READ) as session:
+        auth_result = permission.has_permission(issuer=issuer, vo=vo, action='list_heartbeats', kwargs=kwargs, session=session)
+        if not auth_result.allowed:
+            raise exception.AccessDenied('%s cannot list heartbeats. %s' % (issuer, auth_result.message))
+        return heartbeat.list_heartbeats(session=session)
 
 
-@transactional_session
 def create_heartbeat(
     executable: str,
     hostname: str,
     pid: int,
     older_than: int,
     payload: Optional[str],
+    issuer: str,
     thread: Optional["Thread"] = None,
-    issuer: Optional[str] = None,
     vo: str = 'def',
-    *,
-    session: "Session"
 ) -> None:
     """
     Creates a heartbeat.
@@ -66,11 +61,12 @@ def create_heartbeat(
     :param thread: Python Thread Object.
     :param older_than: Ignore specified heartbeats older than specified nr of seconds.
     :param payload: Payload identifier which can be further used to identify the work a certain thread is executing.
-    :param session: The database session in use.
 
     """
     kwargs = {'issuer': issuer}
-    auth_result = permission.has_permission(issuer=issuer, vo=vo, action='send_heartbeats', kwargs=kwargs, session=session)
-    if not auth_result.allowed:
-        raise exception.AccessDenied('%s cannot send heartbeats. %s' % (issuer, auth_result.message))
-    heartbeat.live(executable=executable, hostname=hostname, pid=pid, thread=thread, older_than=older_than, payload=payload, session=session)
+
+    with db_session(DatabaseOperationType.WRITE) as session:
+        auth_result = permission.has_permission(issuer=issuer, vo=vo, action='send_heartbeats', kwargs=kwargs, session=session)
+        if not auth_result.allowed:
+            raise exception.AccessDenied('%s cannot send heartbeats. %s' % (issuer, auth_result.message))
+        heartbeat.live(executable=executable, hostname=hostname, pid=pid, thread=thread, older_than=older_than, payload=payload, session=session)

{rucio-37.1.0.post1 → rucio-37.2.0}/lib/rucio/gateway/meta_conventions.py

@@ -16,43 +16,37 @@ from typing import TYPE_CHECKING, Optional, Union
 
 from rucio.common.exception import AccessDenied
 from rucio.core import meta_conventions
-from rucio.db.sqla.session import read_session, transactional_session
+from rucio.db.sqla.constants import DatabaseOperationType
+from rucio.db.sqla.session import db_session
 from rucio.gateway.permission import has_permission
 
 if TYPE_CHECKING:
-    from sqlalchemy.orm import Session
-
     from rucio.common.types import InternalAccount
     from rucio.db.sqla.constants import KeyType
 
 
-@read_session
-def list_keys(*, session: "Session") -> list[str]:
+def list_keys() -> list[str]:
     """
     Lists all keys for DID Metadata Conventions.
 
-    :param session: The database session in use.
-
     :returns: A list containing all keys.
     """
-    return meta_conventions.list_keys(session=session)
+    with db_session(DatabaseOperationType.READ) as session:
+        return meta_conventions.list_keys(session=session)
 
 
-@read_session
-def list_values(key: str, *, session: "Session") -> list[str]:
+def list_values(key: str) -> list[str]:
     """
     Lists all allowed values for a DID key (all values for a key in DID Metadata Conventions).
 
     :param key: the name for the key.
-    :param session: The database session in use.
-
 
     :returns: A list containing all values.
     """
-    return meta_conventions.list_values(key=key, session=session)
+    with db_session(DatabaseOperationType.READ) as session:
+        return meta_conventions.list_values(key=key, session=session)
 
 
-@transactional_session
 def add_key(
     key: str,
     key_type: Union["KeyType", str],
@@ -60,8 +54,6 @@ def add_key(
     value_type: Optional[str] = None,
     value_regexp: Optional[str] = None,
     vo: str = 'def',
-    *,
-    session: "Session"
 ) -> None:
     """
     Add an allowed key for DID metadata (update the DID Metadata Conventions table with a new key).
@@ -72,27 +64,26 @@ def add_key(
     :param value_type: the type of the value, if defined.
     :param value_regexp: the regular expression that values should match, if defined.
     :param vo: The vo to act on
-    :param session: The database session in use.
     """
     kwargs = {'key': key, 'key_type': key_type, 'value_type': value_type, 'value_regexp': value_regexp}
-    auth_result = has_permission(issuer=issuer, vo=vo, action='add_key', kwargs=kwargs, session=session)
-    if not auth_result.allowed:
-        raise AccessDenied('Account %s can not add key. %s' % (issuer, auth_result.message))
-    return meta_conventions.add_key(key=key, key_type=key_type, value_type=value_type, value_regexp=value_regexp, session=session)
+    with db_session(DatabaseOperationType.WRITE) as session:
+        auth_result = has_permission(issuer=issuer, vo=vo, action='add_key', kwargs=kwargs, session=session)
+        if not auth_result.allowed:
+            raise AccessDenied('Account %s can not add key. %s' % (issuer, auth_result.message))
+        return meta_conventions.add_key(key=key, key_type=key_type, value_type=value_type, value_regexp=value_regexp, session=session)
 
 
-@transactional_session
-def add_value(key: str, value: str, issuer: "InternalAccount", vo: str = 'def', *, session: "Session") -> None:
+def add_value(key: str, value: str, issuer: "InternalAccount", vo: str = 'def') -> None:
     """
     Add an allowed value for DID metadata (update a key in DID Metadata Conventions table).
 
     :param key: the name for the key.
     :param value: the value.
     :param vo: the vo to act on.
-    :param session: The database session in use.
     """
     kwargs = {'key': key, 'value': value}
-    auth_result = has_permission(issuer=issuer, vo=vo, action='add_value', kwargs=kwargs, session=session)
-    if not auth_result.allowed:
-        raise AccessDenied('Account %s can not add value %s to key %s. %s' % (issuer, value, key, auth_result.message))
-    return meta_conventions.add_value(key=key, value=value, session=session)
+    with db_session(DatabaseOperationType.WRITE) as session:
+        auth_result = has_permission(issuer=issuer, vo=vo, action='add_value', kwargs=kwargs, session=session)
+        if not auth_result.allowed:
+            raise AccessDenied('Account %s can not add value %s to key %s. %s' % (issuer, value, key, auth_result.message))
+        return meta_conventions.add_value(key=key, value=value, session=session)

{rucio-37.1.0.post1 → rucio-37.2.0}/lib/rucio/gateway/quarantined_replica.py

@@ -18,24 +18,20 @@ from rucio.common import exception
 from rucio.common.types import InternalScope
 from rucio.core.quarantined_replica import add_quarantined_replicas
 from rucio.core.rse import get_rse_id
-from rucio.db.sqla.session import transactional_session
+from rucio.db.sqla.constants import DatabaseOperationType
+from rucio.db.sqla.session import db_session
 from rucio.gateway import permission
 
 if TYPE_CHECKING:
     from collections.abc import Iterable
 
-    from sqlalchemy.orm import Session
 
-
-@transactional_session
 def quarantine_file_replicas(
     replicas: "Iterable[dict[str, Any]]",
     issuer: str,
     rse: Optional[str] = None,
     rse_id: Optional[str] = None,
     vo: str = 'def',
-    *,
-    session: "Session"
 ) -> None:
     """
     Quarantine replicas.
@@ -45,7 +41,6 @@ def quarantine_file_replicas(
     :param vo: The VO to act on.
     :param rse: RSE name
     :param rse_id: RSE id - either RSE name or RSE id must be specified
-    :param session: The database session in use.
     """
 
     if not replicas:
@@ -54,26 +49,28 @@ def quarantine_file_replicas(
     if (rse is None) == (rse_id is None):
         raise exception.InputValidationError("Either RSE name or RSE id must be specified, but not both")
 
-    if rse_id is None:
-        rse_id = get_rse_id(rse, vo=vo, session=session)
+    with db_session(DatabaseOperationType.WRITE) as session:
+
+        if rse_id is None:
+            rse_id = get_rse_id(rse, vo=vo, session=session)
 
-    auth_result = permission.has_permission(issuer, 'quarantine_file_replicas', {}, vo=vo, session=session)
-    if not auth_result.allowed:
-        raise exception.AccessDenied('Account %s can not quarantine replicas. %s' % (issuer, auth_result.message))
+        auth_result = permission.has_permission(issuer, 'quarantine_file_replicas', {}, vo=vo, session=session)
+        if not auth_result.allowed:
+            raise exception.AccessDenied('Account %s can not quarantine replicas. %s' % (issuer, auth_result.message))
 
-    replica_infos = []
-    for r in replicas:
-        if "path" not in r:
-            raise exception.InputValidationError("Replica info must include path")
-        scope = r.get("scope")
-        if scope and isinstance(scope, str):
-            scope = InternalScope(scope, vo=vo)
-        replica_infos.append(
-            {
-                "scope": scope or None,
-                "name": r.get("name"),
-                "path": r["path"]
-            }
-        )
+        replica_infos = []
+        for r in replicas:
+            if "path" not in r:
+                raise exception.InputValidationError("Replica info must include path")
+            scope = r.get("scope")
+            if scope and isinstance(scope, str):
+                scope = InternalScope(scope, vo=vo)
+            replica_infos.append(
+                {
+                    "scope": scope or None,
+                    "name": r.get("name"),
+                    "path": r["path"]
+                }
+            )
 
-    add_quarantined_replicas(rse_id, replica_infos, session=session)
+        add_quarantined_replicas(rse_id, replica_infos, session=session)

{rucio-37.1.0.post1 → rucio-37.2.0}/lib/rucio/gateway/vo.py

@@ -12,23 +12,19 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from typing import TYPE_CHECKING, Any, Optional
+from typing import Any, Optional
 
 from rucio.common import exception
 from rucio.common.schema import validate_schema
 from rucio.common.types import InternalAccount
 from rucio.core import identity
 from rucio.core import vo as vo_core
-from rucio.db.sqla.constants import IdentityType
-from rucio.db.sqla.session import read_session, transactional_session
+from rucio.db.sqla.constants import DatabaseOperationType, IdentityType
+from rucio.db.sqla.session import db_session
 from rucio.gateway.permission import has_permission
 
-if TYPE_CHECKING:
-    from sqlalchemy.orm import Session
 
-
-@transactional_session
-def add_vo(new_vo: str, issuer: str, description: Optional[str] = None, email: Optional[str] = None, vo: str = 'def', *, session: "Session") -> None:
+def add_vo(new_vo: str, issuer: str, description: Optional[str] = None, email: Optional[str] = None, vo: str = 'def') -> None:
     '''
     Add a new VO.
 
@@ -37,38 +33,38 @@ def add_vo(new_vo: str, issuer: str, description: Optional[str] = None, email: O
     :param email: A contact for the VO.
     :param issuer: The user issuing the command.
     :param vo: The vo of the user issuing the command.
-    :param session: The database session in use.
     '''
 
     new_vo = vo_core.map_vo(new_vo)
     validate_schema('vo', new_vo, vo=vo)
 
     kwargs = {}
-    auth_result = has_permission(issuer=issuer, action='add_vo', kwargs=kwargs, vo=vo, session=session)
-    if not auth_result.allowed:
-        raise exception.AccessDenied('Account {} cannot add a VO. {}'.format(issuer, auth_result.message))
 
-    vo_core.add_vo(vo=new_vo, description=description, email=email, session=session)
+    with db_session(DatabaseOperationType.WRITE) as session:
+        auth_result = has_permission(issuer=issuer, action='add_vo', kwargs=kwargs, vo=vo, session=session)
+        if not auth_result.allowed:
+            raise exception.AccessDenied('Account {} cannot add a VO. {}'.format(issuer, auth_result.message))
+
+        vo_core.add_vo(vo=new_vo, description=description, email=email, session=session)
 
 
-@read_session
-def list_vos(issuer: str, vo: str = 'def', *, session: "Session") -> list[dict[str, Any]]:
+def list_vos(issuer: str, vo: str = 'def') -> list[dict[str, Any]]:
     '''
     List the VOs.
 
     :param issuer: The user issuing the command.
     :param vo: The vo of the user issuing the command.
-    :param session: The database session in use.
     '''
     kwargs = {}
-    auth_result = has_permission(issuer=issuer, action='list_vos', kwargs=kwargs, vo=vo, session=session)
-    if not auth_result.allowed:
-        raise exception.AccessDenied('Account {} cannot list VOs. {}'.format(issuer, auth_result.message))
 
-    return vo_core.list_vos(session=session)
+    with db_session(DatabaseOperationType.READ) as session:
+        auth_result = has_permission(issuer=issuer, action='list_vos', kwargs=kwargs, vo=vo, session=session)
+        if not auth_result.allowed:
+            raise exception.AccessDenied('Account {} cannot list VOs. {}'.format(issuer, auth_result.message))
+
+        return vo_core.list_vos(session=session)
 
 
-@transactional_session
 def recover_vo_root_identity(
     root_vo: str,
     identity_key: str,
@@ -78,8 +74,6 @@ def recover_vo_root_identity(
     default: bool = False,
     password: Optional[str] = None,
     vo: str = 'def',
-    *,
-    session: "Session"
 ) -> None:
     """
     Adds a membership association between identity and the root account for given VO.
@@ -92,22 +86,22 @@ def recover_vo_root_identity(
     :param default: If True, the account should be used by default with the provided identity.
     :param password: Password if id_type is userpass.
     :param vo: the VO to act on.
-    :param session: The database session in use.
     """
     kwargs = {}
     root_vo = vo_core.map_vo(root_vo)
-    auth_result = has_permission(issuer=issuer, vo=vo, action='recover_vo_root_identity', kwargs=kwargs, session=session)
-    if not auth_result.allowed:
-        raise exception.AccessDenied('Account %s can not recover root identity. %s' % (issuer, auth_result.message))
 
-    account = InternalAccount('root', vo=root_vo)
+    with db_session(DatabaseOperationType.WRITE) as session:
+        auth_result = has_permission(issuer=issuer, vo=vo, action='recover_vo_root_identity', kwargs=kwargs, session=session)
+        if not auth_result.allowed:
+            raise exception.AccessDenied('Account %s can not recover root identity. %s' % (issuer, auth_result.message))
 
-    return identity.add_account_identity(identity=identity_key, type_=IdentityType[id_type.upper()], default=default,
-                                         email=email, account=account, password=password, session=session)
+        account = InternalAccount('root', vo=root_vo)
 
+        return identity.add_account_identity(identity=identity_key, type_=IdentityType[id_type.upper()], default=default,
+                                             email=email, account=account, password=password, session=session)
 
-@transactional_session
-def update_vo(updated_vo: str, parameters: dict[str, Any], issuer: str, vo: str = 'def', *, session: "Session") -> None:
+
+def update_vo(updated_vo: str, parameters: dict[str, Any], issuer: str, vo: str = 'def') -> None:
     """
     Update VO properties (email, description).
 
@@ -115,12 +109,13 @@ def update_vo(updated_vo: str, parameters: dict[str, Any], issuer: str, vo: str
     :param parameters: A dictionary with the new properties.
     :param issuer: The user issuing the command.
     :param vo: The VO of the user issusing the command.
-    :param session: The database session in use.
     """
     kwargs = {}
     updated_vo = vo_core.map_vo(updated_vo)
-    auth_result = has_permission(issuer=issuer, action='update_vo', kwargs=kwargs, vo=vo, session=session)
-    if not auth_result.allowed:
-        raise exception.AccessDenied('Account {} cannot update VO. {}'.format(issuer, auth_result.message))
 
-    return vo_core.update_vo(vo=updated_vo, parameters=parameters, session=session)
+    with db_session(DatabaseOperationType.WRITE) as session:
+        auth_result = has_permission(issuer=issuer, action='update_vo', kwargs=kwargs, vo=vo, session=session)
+        if not auth_result.allowed:
+            raise exception.AccessDenied('Account {} cannot update VO. {}'.format(issuer, auth_result.message))
+
+        return vo_core.update_vo(vo=updated_vo, parameters=parameters, session=session)

{rucio-37.1.0.post1 → rucio-37.2.0}/lib/rucio/vcsversion.py

@@ -4,8 +4,8 @@ This file is automatically generated; Do not edit it. :)
 '''
 VERSION_INFO = {
     'final': True,
-    'version': '37.1.0.post1',
+    'version': '37.2.0',
     'branch_nick': 'release-37',
-    'revision_id': '420fea7843ab9f55e21b71eb93709f7621db8873',
-    'revno': 13642
+    'revision_id': 'ebd2ace1ae33234044fc2d70c35f6ae8f59127ce',
+    'revno': 13666
 }