Merge 1.0.0 changes back to master.

2018-08-14 19:38:16 -04:00
commit 7d822df5a3
@@ -36,9 +36,11 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
    var $q                       = $injector.get('$q');
    var authenticationService    = $injector.get('authenticationService');
    var dataSourceService        = $injector.get('dataSourceService');
+    var membershipService        = $injector.get('membershipService');
    var permissionService        = $injector.get('permissionService');
    var requestService           = $injector.get('requestService');
    var schemaService            = $injector.get('schemaService');
+    var userGroupService         = $injector.get('userGroupService');
    var userService              = $injector.get('userService');

    /**
@@ -133,6 +135,46 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
     */
    $scope.permissionsRemoved = new PermissionSet();

+    /**
+     * The identifiers of all user groups which can be manipulated (all groups
+     * for which the user accessing this interface has UPDATE permission),
+     * either through adding the current user as a member or removing the
+     * current user from that group. If this information has not yet been
+     * retrieved, this will be null.
+     *
+     * @type String[]
+     */
+    $scope.availableGroups = null;
+
+    /**
+     * The identifiers of all user groups of which the user is a member,
+     * taking into account any user groups which will be added/removed when
+     * saved. If this information has not yet been retrieved, this will be
+     * null.
+     *
+     * @type String[]
+     */
+    $scope.parentGroups = null;
+
+    /**
+     * The set of identifiers of all parent user groups to which the user will
+     * be added when saved. Parent groups will only be present in this set if
+     * they are manually added, and not later manually removed before saving.
+     *
+     * @type String[]
+     */
+    $scope.parentGroupsAdded = [];
+
+    /**
+     * The set of identifiers of all parent user groups from which the user
+     * will be removed when saved. Parent groups will only be present in this
+     * set if they are manually removed, and not later manually added before
+     * saving.
+     *
+     * @type String[]
+     */
+    $scope.parentGroupsRemoved = [];
+
    /**
     * For each applicable data source, the management-related actions that the
     * current user may perform on the user account currently being created
@@ -166,6 +208,8 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
        return $scope.users                 !== null
            && $scope.permissionFlags       !== null
            && $scope.managementPermissions !== null
+            && $scope.availableGroups       !== null
+            && $scope.parentGroups          !== null
            && $scope.attributes            !== null;

    };
@@ -204,12 +248,14 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
    var loadExistingUser = function loadExistingUser(dataSource, username) {
        return $q.all({
            users : dataSourceService.apply(userService.getUser, dataSources, username),
-            permissions : permissionService.getPermissions(dataSource, username)
+            permissions : permissionService.getPermissions(dataSource, username),
+            parentGroups : membershipService.getUserGroups(dataSource, username)
        })
        .then(function userDataRetrieved(values) {

            $scope.users = values.users;
            $scope.user  = values.users[dataSource];
+            $scope.parentGroups = values.parentGroups;

            // Create skeleton user if user does not exist
            if (!$scope.user)
@@ -243,12 +289,15 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
    var loadClonedUser = function loadClonedUser(dataSource, username) {
        return $q.all({
            users : dataSourceService.apply(userService.getUser, [dataSource], username),
-            permissions : permissionService.getPermissions(dataSource, username)
+            permissions : permissionService.getPermissions(dataSource, username),
+            parentGroups : membershipService.getUserGroups(dataSource, username)
        })
        .then(function userDataRetrieved(values) {

            $scope.users = {};
            $scope.user  = values.users[dataSource];
+            $scope.parentGroups = values.parentGroups;
+            $scope.parentGroupsAdded = values.parentGroups;

            // The current user will be associated with cloneSourceUsername in the
            // retrieved permission set
@@ -274,6 +323,7 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto

        // Use skeleton user object with no associated permissions
        $scope.user = new User();
+        $scope.parentGroups = [];
        $scope.permissionFlags = new PermissionFlagSet();

        // As no permissions are yet associated with the user, it is safe to
@@ -314,6 +364,7 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
    $q.all({
        userData    : loadRequestedUser(),
        permissions : dataSourceService.apply(permissionService.getEffectivePermissions, dataSources, currentUsername),
+        userGroups  : userGroupService.getUserGroups($scope.dataSource, [ PermissionSet.ObjectPermissionType.UPDATE ]),
        attributes  : schemaService.getUserAttributes($scope.dataSource)
    })
    .then(function dataReceived(values) {
@@ -326,6 +377,12 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
            // Determine whether data source contains this user
            var exists = (dataSource in $scope.users);

+            // Add the identifiers of all modifiable user groups
+            $scope.availableGroups = [];
+            angular.forEach(values.userGroups, function addUserGroupIdentifier(userGroup) {
+                $scope.availableGroups.push(userGroup.identifier);
+            });
+
            // Calculate management actions available for this specific account
            $scope.managementPermissions[dataSource] = ManagementPermissions.fromPermissionSet(
                    values.permissions[dataSource],
@@ -415,9 +472,11 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
                
            }

-            // Upon success, save any changed permissions
-            return permissionService.patchPermissions($scope.dataSource, $scope.user.username,
-                $scope.permissionsAdded, $scope.permissionsRemoved);
+            // Upon success, save any changed permissions/groups
+            return $q.all([
+                permissionService.patchPermissions($scope.dataSource, $scope.user.username, $scope.permissionsAdded, $scope.permissionsRemoved),
+                membershipService.patchUserGroups($scope.dataSource, $scope.user.username, $scope.parentGroupsAdded, $scope.parentGroupsRemoved)
+            ]);

        });

@@ -0,0 +1,538 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * The controller for editing user groups.
+ */
+angular.module('manage').controller('manageUserGroupController', ['$scope', '$injector',
+        function manageUserGroupController($scope, $injector) {
+            
+    // Required types
+    var ManagementPermissions = $injector.get('ManagementPermissions');
+    var PermissionFlagSet     = $injector.get('PermissionFlagSet');
+    var PermissionSet         = $injector.get('PermissionSet');
+    var UserGroup             = $injector.get('UserGroup');
+
+    // Required services
+    var $location             = $injector.get('$location');
+    var $routeParams          = $injector.get('$routeParams');
+    var $q                    = $injector.get('$q');
+    var authenticationService = $injector.get('authenticationService');
+    var dataSourceService     = $injector.get('dataSourceService');
+    var membershipService     = $injector.get('membershipService');
+    var permissionService     = $injector.get('permissionService');
+    var requestService        = $injector.get('requestService');
+    var schemaService         = $injector.get('schemaService');
+    var userGroupService      = $injector.get('userGroupService');
+    var userService           = $injector.get('userService');
+
+    /**
+     * The identifiers of all data sources currently available to the
+     * authenticated user.
+     *
+     * @type String[]
+     */
+    var dataSources = authenticationService.getAvailableDataSources();
+
+    /**
+     * The username of the current, authenticated user.
+     *
+     * @type String
+     */
+    var currentUsername = authenticationService.getCurrentUsername();
+
+    /**
+     * The identifier of the original user group from which this user group is
+     * being cloned. Only valid if this is a new user group.
+     *
+     * @type String
+     */
+    var cloneSourceIdentifier = $location.search().clone;
+
+    /**
+     * The identifier of the user group being edited. If a new user group is
+     * being created, this will not be defined.
+     *
+     * @type String
+     */
+    var identifier = $routeParams.id;
+
+    /**
+     * The unique identifier of the data source containing the user group being
+     * edited.
+     *
+     * @type String
+     */
+    $scope.dataSource = $routeParams.dataSource;
+
+    /**
+     * All user groups associated with the same identifier as the group being
+     * created or edited, as a map of data source identifier to the UserGroup
+     * object within that data source.
+     *
+     * @type Object.<String, UserGroup>
+     */
+    $scope.userGroups = null;
+
+    /**
+     * The user group being modified.
+     *
+     * @type UserGroup
+     */
+    $scope.userGroup = null;
+
+    /**
+     * All permissions associated with the user group being modified.
+     * 
+     * @type PermissionFlagSet
+     */
+    $scope.permissionFlags = null;
+
+    /**
+     * The set of permissions that will be added to the user group when the
+     * user group is saved. Permissions will only be present in this set if they
+     * are manually added, and not later manually removed before saving.
+     *
+     * @type PermissionSet
+     */
+    $scope.permissionsAdded = new PermissionSet();
+
+    /**
+     * The set of permissions that will be removed from the user group when the
+     * user group is saved. Permissions will only be present in this set if they
+     * are manually removed, and not later manually added before saving.
+     *
+     * @type PermissionSet
+     */
+    $scope.permissionsRemoved = new PermissionSet();
+
+    /**
+     * The identifiers of all user groups which can be manipulated (all groups
+     * for which the user accessing this interface has UPDATE permission),
+     * whether that means changing the members of those groups or changing the
+     * groups of which those groups are members. If this information has not
+     * yet been retrieved, this will be null.
+     *
+     * @type String[]
+     */
+    $scope.availableGroups = null;
+
+    /**
+     * The identifiers of all users which can be manipulated (all users for
+     * which the user accessing this interface has UPDATE permission), either
+     * through adding those users as a member of the current group or removing
+     * those users from the current group. If this information has not yet been
+     * retrieved, this will be null.
+     *
+     * @type String[]
+     */
+    $scope.availableUsers = null;
+
+    /**
+     * The identifiers of all user groups of which this group is a member,
+     * taking into account any user groups which will be added/removed when
+     * saved. If this information has not yet been retrieved, this will be
+     * null.
+     *
+     * @type String[]
+     */
+    $scope.parentGroups = null;
+
+    /**
+     * The set of identifiers of all parent user groups to which this group
+     * will be added when saved. Parent groups will only be present in this set
+     * if they are manually added, and not later manually removed before
+     * saving.
+     *
+     * @type String[]
+     */
+    $scope.parentGroupsAdded = [];
+
+    /**
+     * The set of identifiers of all parent user groups from which this group
+     * will be removed when saved. Parent groups will only be present in this
+     * set if they are manually removed, and not later manually added before
+     * saving.
+     *
+     * @type String[]
+     */
+    $scope.parentGroupsRemoved = [];
+
+    /**
+     * The identifiers of all user groups which are members of this group,
+     * taking into account any user groups which will be added/removed when
+     * saved. If this information has not yet been retrieved, this will be
+     * null.
+     *
+     * @type String[]
+     */
+    $scope.memberGroups = null;
+
+    /**
+     * The set of identifiers of all member user groups which will be added to
+     * this group when saved. Member groups will only be present in this set if
+     * they are manually added, and not later manually removed before saving.
+     *
+     * @type String[]
+     */
+    $scope.memberGroupsAdded = [];
+
+    /**
+     * The set of identifiers of all member user groups which will be removed
+     * from this group when saved. Member groups will only be present in this
+     * set if they are manually removed, and not later manually added before
+     * saving.
+     *
+     * @type String[]
+     */
+    $scope.memberGroupsRemoved = [];
+
+    /**
+     * The identifiers of all users which are members of this group, taking
+     * into account any users which will be added/removed when saved. If this
+     * information has not yet been retrieved, this will be null.
+     *
+     * @type String[]
+     */
+    $scope.memberUsers = null;
+
+    /**
+     * The set of identifiers of all member users which will be added to this
+     * group when saved. Member users will only be present in this set if they
+     * are manually added, and not later manually removed before saving.
+     *
+     * @type String[]
+     */
+    $scope.memberUsersAdded = [];
+
+    /**
+     * The set of identifiers of all member users which will be removed from
+     * this group when saved. Member users will only be present in this set if
+     * they are manually removed, and not later manually added before saving.
+     *
+     * @type String[]
+     */
+    $scope.memberUsersRemoved = [];
+
+    /**
+     * For each applicable data source, the management-related actions that the
+     * current user may perform on the user group currently being created
+     * or modified, as a map of data source identifier to the
+     * {@link ManagementPermissions} object describing the actions available
+     * within that data source, or null if the current user's permissions have
+     * not yet been loaded.
+     *
+     * @type Object.<String, ManagementPermissions>
+     */
+    $scope.managementPermissions = null;
+
+    /**
+     * All available user group attributes. This is only the set of attribute
+     * definitions, organized as logical groupings of attributes, not attribute
+     * values.
+     *
+     * @type Form[]
+     */
+    $scope.attributes = null;
+
+    /**
+     * Returns whether critical data has completed being loaded.
+     *
+     * @returns {Boolean}
+     *     true if enough data has been loaded for the user group interface to
+     *     be useful, false otherwise.
+     */
+    $scope.isLoaded = function isLoaded() {
+
+        return $scope.userGroups            !== null
+            && $scope.permissionFlags       !== null
+            && $scope.managementPermissions !== null
+            && $scope.availableGroups       !== null
+            && $scope.availableUsers        !== null
+            && $scope.parentGroups          !== null
+            && $scope.memberGroups          !== null
+            && $scope.memberUsers           !== null
+            && $scope.attributes            !== null;
+
+    };
+
+    /**
+     * Returns whether the current user can edit the identifier of the user
+     * group being edited.
+     *
+     * @returns {Boolean}
+     *     true if the current user can edit the identifier of the user group
+     *     being edited, false otherwise.
+     */
+    $scope.canEditIdentifier = function canEditIdentifier() {
+        return !identifier;
+    };
+
+    /**
+     * Loads the data associated with the user group having the given
+     * identifier, preparing the interface for making modifications to that
+     * existing user group.
+     *
+     * @param {String} dataSource
+     *     The unique identifier of the data source containing the user group
+     *     to load.
+     *
+     * @param {String} identifier
+     *     The unique identifier of the user group to load.
+     *
+     * @returns {Promise}
+     *     A promise which is resolved when the interface has been prepared for
+     *     editing the given user group.
+     */
+    var loadExistingUserGroup = function loadExistingGroup(dataSource, identifier) {
+        return $q.all({
+            userGroups   : dataSourceService.apply(userGroupService.getUserGroup, dataSources, identifier),
+            permissions  : permissionService.getPermissions(dataSource, identifier, true),
+            parentGroups : membershipService.getUserGroups(dataSource, identifier, true),
+            memberGroups : membershipService.getMemberUserGroups(dataSource, identifier),
+            memberUsers  : membershipService.getMemberUsers(dataSource, identifier)
+        })
+        .then(function userGroupDataRetrieved(values) {
+
+            $scope.userGroups = values.userGroups;
+            $scope.userGroup  = values.userGroups[dataSource];
+            $scope.parentGroups = values.parentGroups;
+            $scope.memberGroups = values.memberGroups;
+            $scope.memberUsers = values.memberUsers;
+
+            // Create skeleton user group if user group does not exist
+            if (!$scope.userGroup)
+                $scope.userGroup = new UserGroup({
+                    'identifier' : identifier
+                });
+
+            $scope.permissionFlags = PermissionFlagSet.fromPermissionSet(values.permissions);
+
+        });
+    };
+
+    /**
+     * Loads the data associated with the user group having the given
+     * identifier, preparing the interface for cloning that existing user
+     * group.
+     *
+     * @param {String} dataSource
+     *     The unique identifier of the data source containing the user group to
+     *     be cloned.
+     *
+     * @param {String} identifier
+     *     The unique identifier of the user group being cloned.
+     *
+     * @returns {Promise}
+     *     A promise which is resolved when the interface has been prepared for
+     *     cloning the given user group.
+     */
+    var loadClonedUserGroup = function loadClonedUserGroup(dataSource, identifier) {
+        return $q.all({
+            userGroups   : dataSourceService.apply(userGroupService.getUserGroup, [dataSource], identifier),
+            permissions  : permissionService.getPermissions(dataSource, identifier, true),
+            parentGroups : membershipService.getUserGroups(dataSource, identifier, true),
+            memberGroups : membershipService.getMemberUserGroups(dataSource, identifier),
+            memberUsers  : membershipService.getMemberUsers(dataSource, identifier)
+        })
+        .then(function userGroupDataRetrieved(values) {
+
+            $scope.userGroups = {};
+            $scope.userGroup  = values.userGroups[dataSource];
+            $scope.parentGroups = values.parentGroups;
+            $scope.parentGroupsAdded = values.parentGroups;
+            $scope.memberGroups = values.memberGroups;
+            $scope.memberGroupsAdded = values.memberGroups;
+            $scope.memberUsers = values.memberUsers;
+            $scope.memberUsersAdded = values.memberUsers;
+
+            $scope.permissionFlags = PermissionFlagSet.fromPermissionSet(values.permissions);
+            $scope.permissionsAdded = values.permissions;
+
+        });
+    };
+
+    /**
+     * Loads skeleton user group data, preparing the interface for creating a
+     * new user group.
+     *
+     * @returns {Promise}
+     *     A promise which is resolved when the interface has been prepared for
+     *     creating a new user group.
+     */
+    var loadSkeletonUserGroup = function loadSkeletonUserGroup() {
+
+        // No user groups exist regardless of data source if the user group is
+        // being created
+        $scope.userGroups = {};
+
+        // Use skeleton user group object with no associated permissions
+        $scope.userGroup = new UserGroup();
+        $scope.parentGroups = [];
+        $scope.memberGroups = [];
+        $scope.memberUsers = [];
+        $scope.permissionFlags = new PermissionFlagSet();
+
+        return $q.resolve();
+
+    };
+
+    /**
+     * Loads the data required for performing the management task requested
+     * through the route parameters given at load time, automatically preparing
+     * the interface for editing an existing user group, cloning an existing
+     * user group, or creating an entirely new user group.
+     *
+     * @returns {Promise}
+     *     A promise which is resolved when the interface has been prepared
+     *     for performing the requested management task.
+     */
+    var loadRequestedUserGroup = function loadRequestedUserGroup() {
+
+        // Pull user group data and permissions if we are editing an existing
+        // user group
+        if (identifier)
+            return loadExistingUserGroup($scope.dataSource, identifier);
+
+        // If we are cloning an existing user group, pull its data instead
+        if (cloneSourceIdentifier)
+            return loadClonedUserGroup($scope.dataSource, cloneSourceIdentifier);
+
+        // If we are creating a new user group, populate skeleton user group data
+        return loadSkeletonUserGroup();
+
+    };
+
+    // Populate interface with requested data
+    $q.all({
+        userGroupData : loadRequestedUserGroup(),
+        permissions   : dataSourceService.apply(permissionService.getEffectivePermissions, dataSources, currentUsername),
+        userGroups    : userGroupService.getUserGroups($scope.dataSource, [ PermissionSet.ObjectPermissionType.UPDATE ]),
+        users         : userService.getUsers($scope.dataSource, [ PermissionSet.ObjectPermissionType.UPDATE ]),
+        attributes    : schemaService.getUserGroupAttributes($scope.dataSource)
+    })
+    .then(function dataReceived(values) {
+
+        $scope.attributes = values.attributes;
+
+        $scope.managementPermissions = {};
+        angular.forEach(dataSources, function deriveManagementPermissions(dataSource) {
+
+            // Determine whether data source contains this user group
+            var exists = (dataSource in $scope.userGroups);
+
+            // Add the identifiers of all modifiable user groups
+            $scope.availableGroups = [];
+            angular.forEach(values.userGroups, function addUserGroupIdentifier(userGroup) {
+                $scope.availableGroups.push(userGroup.identifier);
+            });
+
+            // Add the identifiers of all modifiable users
+            $scope.availableUsers = [];
+            angular.forEach(values.users, function addUserIdentifier(user) {
+                $scope.availableUsers.push(user.username);
+            });
+
+            // Calculate management actions available for this specific group
+            $scope.managementPermissions[dataSource] = ManagementPermissions.fromPermissionSet(
+                    values.permissions[dataSource],
+                    PermissionSet.SystemPermissionType.CREATE_USER_GROUP,
+                    PermissionSet.hasUserGroupPermission,
+                    exists ? identifier : null);
+
+        });
+
+    }, requestService.WARN);
+
+    /**
+     * Returns the URL for the page which manages the user group currently
+     * being edited under the given data source. The given data source need not
+     * be the same as the data source currently selected.
+     *
+     * @param {String} dataSource
+     *     The unique identifier of the data source that the URL is being
+     *     generated for.
+     *
+     * @returns {String}
+     *     The URL for the page which manages the user group currently being
+     *     edited under the given data source.
+     */
+    $scope.getUserGroupURL = function getUserGroupURL(dataSource) {
+        return '/manage/' + encodeURIComponent(dataSource) + '/userGroups/' + encodeURIComponent(identifier || '');
+    };
+
+    /**
+     * Cancels all pending edits, returning to the main list of user groups.
+     */
+    $scope.returnToUserGroupList = function returnToUserGroupList() {
+        $location.url('/settings/userGroups');
+    };
+
+    /**
+     * Cancels all pending edits, opening an edit page for a new user group
+     * which is prepopulated with the data from the user currently being edited.
+     */
+    $scope.cloneUserGroup = function cloneUserGroup() {
+        $location.path('/manage/' + encodeURIComponent($scope.dataSource) + '/userGroups').search('clone', identifier);
+    };
+
+    /**
+     * Saves the current user group, creating a new user group or updating the
+     * existing user group depending on context, returning a promise which is
+     * resolved if the save operation succeeds and rejected if the save
+     * operation fails.
+     *
+     * @returns {Promise}
+     *     A promise which is resolved if the save operation succeeds and is
+     *     rejected with an {@link Error} if the save operation fails.
+     */
+    $scope.saveUserGroup = function saveUserGroup() {
+
+        // Save or create the user group, depending on whether the user group exists
+        var saveUserGroupPromise;
+        if ($scope.dataSource in $scope.userGroups)
+            saveUserGroupPromise = userGroupService.saveUserGroup($scope.dataSource, $scope.userGroup);
+        else
+            saveUserGroupPromise = userGroupService.createUserGroup($scope.dataSource, $scope.userGroup);
+
+        return saveUserGroupPromise.then(function savedUserGroup() {
+            return $q.all([
+                permissionService.patchPermissions($scope.dataSource, $scope.userGroup.identifier, $scope.permissionsAdded, $scope.permissionsRemoved, true),
+                membershipService.patchUserGroups($scope.dataSource, $scope.userGroup.identifier, $scope.parentGroupsAdded, $scope.parentGroupsRemoved, true),
+                membershipService.patchMemberUserGroups($scope.dataSource, $scope.userGroup.identifier, $scope.memberGroupsAdded, $scope.memberGroupsRemoved),
+                membershipService.patchMemberUsers($scope.dataSource, $scope.userGroup.identifier, $scope.memberUsersAdded, $scope.memberUsersRemoved)
+            ]);
+        });
+
+    };
+
+    /**
+     * Deletes the current user group, returning a promise which is resolved if
+     * the delete operation succeeds and rejected if the delete operation
+     * fails.
+     *
+     * @returns {Promise}
+     *     A promise which is resolved if the delete operation succeeds and is
+     *     rejected with an {@link Error} if the delete operation fails.
+     */
+    $scope.deleteUserGroup = function deleteUserGroup() {
+        return userGroupService.deleteUserGroup($scope.dataSource, $scope.userGroup);
+    };
+
+}]);
@@ -76,9 +76,12 @@ angular.module('manage').directive('dataSourceTabs', ['$injector',
        $scope.$watch('permissions', function permissionsChanged(permissions) {

            $scope.pages = [];
-            angular.forEach(permissions, function addDataSourcePage(managementPermissions, dataSource) {
+
+            var dataSources = _.keys($scope.permissions).sort();
+            angular.forEach(dataSources, function addDataSourcePage(dataSource) {

                // Determine whether data source contains this object
+                var managementPermissions = permissions[dataSource];
                var exists = !!managementPermissions.identifier;

                // Data source is not relevant if the associated object does not
@@ -0,0 +1,300 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * A directive for manipulating a set of objects sharing some common relation
+ * and represented by an array of their identifiers. The specific objects
+ * added or removed are tracked within a separate pair of arrays of
+ * identifiers.
+ */
+angular.module('manage').directive('identifierSetEditor', ['$injector',
+    function identifierSetEditor($injector) {
+
+    var directive = {
+
+        // Element only
+        restrict: 'E',
+        replace: true,
+
+        scope: {
+
+            /**
+             * The translation key of the text which should be displayed within
+             * the main header of the identifier set editor.
+             *
+             * @type String
+             */
+            header : '@',
+
+            /**
+             * The translation key of the text which should be displayed if no
+             * identifiers are currently present within the set.
+             *
+             * @type String
+             */
+            emptyPlaceholder : '@',
+
+            /**
+             * The translation key of the text which should be displayed if no
+             * identifiers are available to be added within the set.
+             *
+             * @type String
+             */
+            unavailablePlaceholder : '@',
+
+            /**
+             * All identifiers which are available to be added to or removed
+             * from the identifier set being edited.
+             *
+             * @type String[]
+             */
+            identifiersAvailable : '=',
+
+            /**
+             * The current state of the identifier set being manipulated. This
+             * array will be modified as changes are made through this
+             * identifier set editor.
+             *
+             * @type String[]
+             */
+            identifiers : '=',
+
+            /**
+             * The set of identifiers that have been added, relative to the
+             * initial state of the identifier set being manipulated.
+             *
+             * @type String[]
+             */
+            identifiersAdded : '=',
+
+            /**
+             * The set of identifiers that have been removed, relative to the
+             * initial state of the identifier set being manipulated.
+             *
+             * @type String[]
+             */
+            identifiersRemoved : '='
+
+        },
+
+        templateUrl: 'app/manage/templates/identifierSetEditor.html'
+
+    };
+
+    directive.controller = ['$scope', function identifierSetEditorController($scope) {
+
+        /**
+         * Whether the full list of available identifiers should be displayed.
+         * Initially, only an abbreviated list of identifiers currently present
+         * is shown.
+         *
+         * @type Boolean
+         */
+        $scope.expanded = false;
+
+        /**
+         * Map of identifiers to boolean flags indicating whether that
+         * identifier is currently present (true) or absent (false). If an
+         * identifier is absent, it may also be absent from this map.
+         *
+         * @type Object.<String, Boolean>
+         */
+        $scope.identifierFlags = {};
+
+        /**
+         * Map of identifiers to boolean flags indicating whether that
+         * identifier is editable. If an identifier is not editable, it will be
+         * absent from this map.
+         *
+         * @type Object.<String, Boolean>
+         */
+        $scope.isEditable = {};
+
+        /**
+         * Adds the given identifier to the given sorted array of identifiers,
+         * preserving the sorted order of the array. If the identifier is
+         * already present, no change is made to the array. The given array
+         * must already be sorted in ascending order.
+         *
+         * @param {String[]} arr
+         *     The sorted array of identifiers to add the given identifier to.
+         *
+         * @param {String} identifier
+         *     The identifier to add to the given array.
+         */
+        var addIdentifier = function addIdentifier(arr, identifier) {
+
+            // Determine location that the identifier should be added to
+            // maintain sorted order
+            var index = _.sortedIndex(arr, identifier);
+
+            // Do not add if already present
+            if (arr[index] === identifier)
+                return;
+
+            // Insert identifier at determined location
+            arr.splice(index, 0, identifier);
+
+        };
+
+        /**
+         * Removes the given identifier from the given sorted array of
+         * identifiers, preserving the sorted order of the array. If the
+         * identifier is already absent, no change is made to the array. The
+         * given array must already be sorted in ascending order.
+         *
+         * @param {String[]} arr
+         *     The sorted array of identifiers to remove the given identifier
+         *     from.
+         *
+         * @param {String} identifier
+         *     The identifier to remove from the given array.
+         *
+         * @returns {Boolean}
+         *     true if the identifier was present in the given array and has
+         *     been removed, false otherwise.
+         */
+        var removeIdentifier = function removeIdentifier(arr, identifier) {
+
+            // Search for identifier in sorted array
+            var index = _.sortedIndexOf(arr, identifier);
+
+            // Nothing to do if already absent
+            if (index === -1)
+                return false;
+
+            // Remove identifier
+            arr.splice(index, 1);
+            return true;
+
+        };
+
+        // Keep identifierFlags up to date when identifiers array is replaced
+        // or initially assigned
+        $scope.$watch('identifiers', function identifiersChanged(identifiers) {
+
+            // Maintain identifiers in sorted order so additions and removals
+            // can be made more efficiently
+            if (identifiers)
+                identifiers.sort();
+
+            // Convert array of identifiers into set of boolean
+            // presence/absence flags
+            $scope.identifierFlags = {};
+            angular.forEach(identifiers, function storeIdentifierFlag(identifier) {
+                $scope.identifierFlags[identifier] = true;
+            });
+
+        });
+
+        // An identifier is editable iff it is available to be added or removed
+        // from the identifier set being edited (iff it is within the
+        // identifiersAvailable array)
+        $scope.$watch('identifiersAvailable', function availableIdentifiersChanged(identifiers) {
+            $scope.isEditable = {};
+            angular.forEach(identifiers, function storeEditableIdentifier(identifier) {
+                $scope.isEditable[identifier] = true;
+            });
+        });
+
+        /**
+         * Notifies the controller that a change has been made to the flag
+         * denoting presence/absence of a particular identifier within the
+         * <code>identifierFlags</code> map. The <code>identifiers</code>,
+         * <code>identifiersAdded</code>, and <code>identifiersRemoved</code>
+         * arrays are updated accordingly.
+         *
+         * @param {String} identifier
+         *     The identifier which has been added or removed through modifying
+         *     its boolean flag within <code>identifierFlags</code>.
+         */
+        $scope.identifierChanged = function identifierChanged(identifier) {
+
+            // Determine status of modified identifier
+            var present = !!$scope.identifierFlags[identifier];
+
+            // Add/remove identifier from added/removed sets depending on
+            // change in flag state
+            if (present) {
+
+                addIdentifier($scope.identifiers, identifier);
+
+                if (!removeIdentifier($scope.identifiersRemoved, identifier))
+                    addIdentifier($scope.identifiersAdded, identifier);
+
+            }
+            else {
+
+                removeIdentifier($scope.identifiers, identifier);
+
+                if (!removeIdentifier($scope.identifiersAdded, identifier))
+                    addIdentifier($scope.identifiersRemoved, identifier);
+
+            }
+
+        };
+
+        /**
+         * Removes the given identifier, updating <code>identifierFlags</code>,
+         * <code>identifiers</code>, <code>identifiersAdded</code>, and
+         * <code>identifiersRemoved</code> accordingly.
+         *
+         * @param {String} identifier
+         *     The identifier to remove.
+         */
+        $scope.removeIdentifier = function removeIdentifier(identifier) {
+            $scope.identifierFlags[identifier] = false;
+            $scope.identifierChanged(identifier);
+        };
+
+        /**
+         * Shows the full list of available identifiers. If the full list is
+         * already shown, this function has no effect.
+         */
+        $scope.expand = function expand() {
+            $scope.expanded = true;
+        };
+
+        /**
+         * Hides the full list of available identifiers. If the full list is
+         * already hidden, this function has no effect.
+         */
+        $scope.collapse = function collapse() {
+            $scope.expanded = false;
+        };
+
+        /**
+         * Returns whether there are absolutely no identifiers that can be
+         * managed using this editor. If true, the editor is effectively
+         * useless, as there is nothing whatsoever to display.
+         *
+         * @returns {Boolean}
+         *     true if there are no identifiers that can be managed using this
+         *     editor, false otherwise.
+         */
+        $scope.isEmpty = function isEmpty() {
+            return _.isEmpty($scope.identifiers)
+                && _.isEmpty($scope.identifiersAvailable);
+        };
+
+    }];
+
+    return directive;
+
+}]);
@@ -125,6 +125,10 @@ angular.module('manage').directive('systemPermissionEditor', ['$injector',
                label: "MANAGE_USER.FIELD_HEADER_CREATE_NEW_USERS",
                value: PermissionSet.SystemPermissionType.CREATE_USER
            },
+            {
+                label: "MANAGE_USER.FIELD_HEADER_CREATE_NEW_USER_GROUPS",
+                value: PermissionSet.SystemPermissionType.CREATE_USER_GROUP
+            },
            {
                label: "MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
                value: PermissionSet.SystemPermissionType.CREATE_CONNECTION
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+.manage-user-group .page-tabs .page-list li.read-only a[href],
+.manage-user-group .page-tabs .page-list li.unlinked  a[href],
+.manage-user-group .page-tabs .page-list li.linked    a[href] {
+    padding-right: 2.5em;
+    position: relative;
+}
+
+.manage-user-group .page-tabs .page-list li.read-only a[href]:before,
+.manage-user-group .page-tabs .page-list li.unlinked  a[href]:before,
+.manage-user-group .page-tabs .page-list li.linked    a[href]:before {
+    content: ' ';
+    position: absolute;
+    right: 0;
+    bottom: 0;
+    top: 0;
+    width: 2.5em;
+    background-size: 1.25em;
+    background-repeat: no-repeat;
+    background-position: center;
+}
+
+.manage-user-group .page-tabs .page-list li.read-only a[href]:before {
+    background-image: url('images/lock.png');
+}
+
+.manage-user-group .page-tabs .page-list li.unlinked a[href]:before {
+    background-image: url('images/plus.png');
+}
+
+.manage-user-group .page-tabs .page-list li.unlinked a[href] {
+    opacity: 0.5;
+}
+
+.manage-user-group .page-tabs .page-list li.unlinked a[href]:hover,
+.manage-user-group .page-tabs .page-list li.unlinked a[href].current {
+    opacity: 1;
+}
+
+.manage-user-group .page-tabs .page-list li.linked a[href]:before {
+    background-image: url('images/checkmark.png');
+}
+
+.manage-user-group .notice.read-only {
+
+    background: #FDA;
+    border: 1px solid rgba(0, 0, 0, 0.125);
+    border-radius: 0.25em;
+
+    text-align: center;
+    padding: 1em;
+
+}
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+.related-objects .abbreviated-related-objects {
+    display: table;
+    margin: 1em 0;
+}
+
+.related-objects .abbreviated-related-objects ul {
+    display: table-cell;
+    vertical-align: top;
+}
+
+.related-objects .abbreviated-related-objects ul,
+.related-objects .all-related-objects ul {
+    padding: 0;
+    list-style: none;
+}
+
+.related-objects .abbreviated-related-objects ul li {
+
+    display: inline-block;
+    margin: 0.25em;
+    padding: 0.25em;
+
+    border: 1px solid silver;
+    background: #F5F5F5;
+    -moz-border-radius: 0.25em;
+    -webkit-border-radius: 0.25em;
+    -khtml-border-radius: 0.25em;
+    border-radius: 0.25em;
+
+}
+
+.related-objects .abbreviated-related-objects ul li img.remove {
+    max-height: 0.75em;
+    max-width: 0.75em;
+    margin: 0 0.25em;
+}
+
+.related-objects .abbreviated-related-objects ul li .identifier {
+    margin: 0 0.25em;
+}
+
+.related-objects .abbreviated-related-objects img.expand,
+.related-objects .abbreviated-related-objects img.collapse {
+    display: table-cell;
+    max-height: 1.5em;
+    max-width: 1.5em;
+    margin: 0.375em 0;
+}
+
+.related-objects .all-related-objects {
+    border-top: 1px solid silver;
+}
+
+.related-objects .abbreviated-related-objects p.no-related-objects,
+.related-objects .all-related-objects p.no-objects-available {
+    font-style: italic;
+    opacity: 0.5;
+}
+
+.related-objects .abbreviated-related-objects p.no-related-objects {
+    display: table-cell;
+    vertical-align: middle;
+}
@@ -0,0 +1,47 @@
+<div class="related-objects" ng-hide="isEmpty()">
+    <div class="header">
+        <h2>{{ header | translate }}</h2>
+        <div class="filter">
+            <input class="search-string" type="text"
+                   placeholder="{{ 'SETTINGS_USERS.FIELD_PLACEHOLDER_FILTER' | translate }}"
+                   ng-model="filterString"/>
+        </div>
+    </div>
+
+    <div class="section">
+
+        <!-- Abbreviated list of only the currently selected objects -->
+        <div class="abbreviated-related-objects">
+            <img src="images/arrows/right.png" alt="Expand" class="expand" ng-hide="expanded" ng-click="expand()"/>
+            <img src="images/arrows/down.png" alt="Collapse" class="collapse" ng-show="expanded" ng-click="collapse()"/>
+            <p ng-hide="identifiers.length" class="no-related-objects">{{ emptyPlaceholder | translate }}</p>
+            <ul>
+                <li ng-repeat="identifier in identifiers | filter: filterString">
+                    <label><img src="images/x-red.png" alt="Remove" class="remove"
+                                ng-click="removeIdentifier(identifier)"
+                                ng-show="isEditable[identifier]"/><span class="identifier">{{ identifier }}</span>
+                    </label>
+                </li>
+            </ul>
+        </div>
+
+        <!-- Exhaustive, paginated list of all objects -->
+        <div class="all-related-objects" ng-show="expanded">
+            <p ng-hide="identifiersAvailablePage.length" class="no-objects-available">{{ unavailablePlaceholder | translate }}</p>
+            <ul>
+                <li ng-repeat="identifier in identifiersAvailablePage">
+                    <label><input type="checkbox"
+                           ng-model="identifierFlags[identifier]"
+                           ng-change="identifierChanged(identifier)"/>
+                        <span class="identifier">{{ identifier }}</span>
+                    </label>
+                </li>
+            </ul>
+
+            <!-- Pager controls for user list -->
+            <guac-pager page="identifiersAvailablePage" page-size="25"
+                        items="identifiersAvailable | orderBy | filter: filterString"></guac-pager>
+        </div>
+
+    </div>
+</div>
@@ -56,6 +56,17 @@
              permissions-removed="permissionsRemoved">
        </system-permission-editor>

+        <!-- Parent group section -->
+        <identifier-set-editor
+            header="MANAGE_USER.SECTION_HEADER_USER_GROUPS"
+            empty-placeholder="MANAGE_USER.HELP_NO_USER_GROUPS"
+            unavailable-placeholder="MANAGE_USER.INFO_NO_USER_GROUPS_AVAILABLE"
+            identifiers-available="availableGroups"
+            identifiers="parentGroups"
+            identifiers-added="parentGroupsAdded"
+            identifiers-removed="parentGroupsRemoved">
+        </identifier-set-editor>
+
        <!-- Connection permissions section -->
        <connection-permission-editor ng-show="managementPermissions[dataSource].canChangePermissions"
              data-data-source="dataSource"
@@ -0,0 +1,101 @@
+<div class="manage-user-group view" ng-class="{loading: !isLoaded()}">
+
+    <!-- User group header and data source tabs -->
+    <div class="header tabbed">
+        <h2>{{'MANAGE_USER_GROUP.SECTION_HEADER_EDIT_USER_GROUP' | translate}}</h2>
+        <guac-user-menu></guac-user-menu>
+    </div>
+    <data-data-source-tabs ng-hide="cloneSourceIdentifier"
+        permissions="managementPermissions"
+        url="getUserGroupURL(dataSource)">
+    </data-data-source-tabs>
+
+    <!-- Warn if user group is read-only -->
+    <div class="section" ng-hide="managementPermissions[dataSource].canSaveObject">
+        <p class="notice read-only">{{'MANAGE_USER_GROUP.INFO_READ_ONLY' | translate}}</p>
+    </div>
+
+    <!-- Sections applicable to non-read-only user groups -->
+    <div ng-show="managementPermissions[dataSource].canSaveObject">
+
+        <!-- User group name -->
+        <div class="section">
+            <table class="properties">
+                <tr>
+                    <th>{{'MANAGE_USER_GROUP.FIELD_HEADER_USER_GROUP_NAME' | translate}}</th>
+                    <td>
+                        <input ng-show="canEditIdentifier()" ng-model="userGroup.identifier" type="text"/>
+                        <span  ng-hide="canEditIdentifier()">{{userGroup.identifier}}</span>
+                    </td>
+                </tr>
+            </table>
+        </div>
+
+        <!-- User group attributes section -->
+        <div class="attributes" ng-show="managementPermissions[dataSource].canChangeAttributes">
+            <guac-form namespace="'USER_GROUP_ATTRIBUTES'" content="attributes"
+                       model="userGroup.attributes"
+                       model-only="!managementPermissions[dataSource].canChangeAllAttributes"></guac-form>
+        </div>
+
+        <!-- System permissions section -->
+        <system-permission-editor ng-show="managementPermissions[dataSource].canChangePermissions"
+              data-data-source="dataSource"
+              permission-flags="permissionFlags"
+              permissions-added="permissionsAdded"
+              permissions-removed="permissionsRemoved">
+        </system-permission-editor>
+
+        <!-- Parent group section -->
+        <identifier-set-editor
+            header="MANAGE_USER_GROUP.SECTION_HEADER_USER_GROUPS"
+            empty-placeholder="MANAGE_USER_GROUP.HELP_NO_USER_GROUPS"
+            unavailable-placeholder="MANAGE_USER_GROUP.INFO_NO_USER_GROUPS_AVAILABLE"
+            identifiers-available="availableGroups"
+            identifiers="parentGroups"
+            identifiers-added="parentGroupsAdded"
+            identifiers-removed="parentGroupsRemoved">
+        </identifier-set-editor>
+
+        <!-- Member group section -->
+        <identifier-set-editor
+            header="MANAGE_USER_GROUP.SECTION_HEADER_MEMBER_USER_GROUPS"
+            empty-placeholder="MANAGE_USER_GROUP.HELP_NO_MEMBER_USER_GROUPS"
+            unavailable-placeholder="MANAGE_USER_GROUP.INFO_NO_USER_GROUPS_AVAILABLE"
+            identifiers-available="availableGroups"
+            identifiers="memberGroups"
+            identifiers-added="memberGroupsAdded"
+            identifiers-removed="memberGroupsRemoved">
+        </identifier-set-editor>
+
+        <!-- Member user section -->
+        <identifier-set-editor
+            header="MANAGE_USER_GROUP.SECTION_HEADER_MEMBER_USERS"
+            empty-placeholder="MANAGE_USER_GROUP.HELP_NO_MEMBER_USERS"
+            unavailable-placeholder="MANAGE_USER_GROUP.INFO_NO_USERS_AVAILABLE"
+            identifiers-available="availableUsers"
+            identifiers="memberUsers"
+            identifiers-added="memberUsersAdded"
+            identifiers-removed="memberUsersRemoved">
+        </identifier-set-editor>
+
+        <!-- Connection permissions section -->
+        <connection-permission-editor ng-show="managementPermissions[dataSource].canChangePermissions"
+              data-data-source="dataSource"
+              permission-flags="permissionFlags"
+              permissions-added="permissionsAdded"
+              permissions-removed="permissionsRemoved">
+        </connection-permission-editor>
+
+        <!-- Form action buttons -->
+        <management-buttons namespace="MANAGE_USER_GROUP"
+              permissions="managementPermissions[dataSource]"
+              save="saveUserGroup()"
+              delete="deleteUserGroup()"
+              clone="cloneUserGroup()"
+              return="returnToUserGroupList()">
+        </management-buttons>
+
+    </div>
+
+</div>
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * A service for defining the ManageableUserGroup class.
+ */
+angular.module('manage').factory('ManageableUserGroup', [function defineManageableUserGroup() {
+
+    /**
+     * A pairing of an @link{UserGroup} with the identifier of its corresponding
+     * data source.
+     *
+     * @constructor
+     * @param {Object|ManageableUserGroup} template
+     */
+    var ManageableUserGroup = function ManageableUserGroup(template) {
+
+        /**
+         * The unique identifier of the data source containing this user.
+         *
+         * @type String
+         */
+        this.dataSource = template.dataSource;
+
+        /**
+         * The @link{UserGroup} object represented by this ManageableUserGroup
+         * and contained within the associated data source.
+         *
+         * @type UserGroup
+         */
+        this.userGroup = template.userGroup;
+
+    };
+
+    return ManageableUserGroup;
+
+}]);