Merge pull request #735 from dynamic-entropy/single_rse_ask_approval

Restrict rse expression to single rse when ask_approval is used
dmwm · Mar 1, 2024 · 5945331 · 5945331
2 parents 9b2e4df + 394ed23
commit 5945331
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/policy/CMSRucioPolicy/permission.py b/src/policy/CMSRucioPolicy/permission.py
@@ -315,6 +315,10 @@ def perm_add_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
             if rse_attr.get('requires_approval', False):
                 return False
 
+    # If asked for approval, rse_expression can only be a single RSE
+    if kwargs["activity"] != "User AutoApprove" and kwargs["ask_approval"] and len(rses) != 1:
+        return False
+
     if kwargs["activity"] == "User AutoApprove":
         return _check_for_auto_approve_eligibility(issuer, rses, kwargs, session=session)