From 23f8695b950d1a432d05529d60492f6f0cedf01d Mon Sep 17 00:00:00 2001
From: Jules-Bertholet <jules.bertholet@gmail.com>
Date: Sat, 29 May 2021 15:07:22 +0000
Subject: [PATCH] Fix permissions

---
 scripts/_common.sh | 14 ++++++++++++++
 scripts/install    |  9 ++-------
 scripts/restore    |  3 +--
 scripts/upgrade    | 11 ++---------
 4 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/scripts/_common.sh b/scripts/_common.sh
index 13f3b5b..5066720 100644
--- a/scripts/_common.sh
+++ b/scripts/_common.sh
@@ -15,6 +15,20 @@ jupyterlab_version="3.0.14"
 # PERSONAL HELPERS
 #=================================================
 
+function python_setup {
+	pushd "$final_path"
+		sudo -u $app PIPENV_VENV_IN_PROJECT="enabled" PIPENV_SKIP_LOCK=true  python3 -m pipenv install jupyterlab==$jupyterlab_version jupyterhub notebook jupyterhub-ldapauthenticator pyzmq --three 2>&1
+		sudo -u $app python3 -m pipenv run jupyterhub upgrade-db 2>&1
+	popd
+}
+
+function set_permissions {
+	# Set permissions to app files
+	chown -R root:$app "$final_path"
+	chown -R $app:$app "$final_path/.venv"
+	chmod -R g=u,g-w,o-rwx "$final_path"
+}
+
 #=================================================
 # EXPERIMENTAL HELPERS
 #=================================================
diff --git a/scripts/install b/scripts/install
index c1dae89..c17473d 100644
--- a/scripts/install
+++ b/scripts/install
@@ -94,11 +94,7 @@ ynh_app_setting_set --app=$app --key=final_path --value=$final_path
 
 mkdir -p $final_path
 
-pushd $final_path
-
-PIPENV_VENV_IN_PROJECT="enabled" PIPENV_SKIP_LOCK=true  ynh_exec_warn_less python3 -m pipenv install jupyterlab==$jupyterlab_version jupyterhub notebook jupyterhub-ldapauthenticator pyzmq --three
-
-popd
+python_setup
 
 #=================================================
 # NGINX CONFIGURATION
@@ -147,8 +143,7 @@ ynh_add_config --template="../conf/jupyter_notebook_config.py" --destination="$f
 #=================================================
 
 # Set permissions to app files
-chown -R root: $final_path/
-chown -R $admin: $final_path/.venv/
+set_permissions
 
 #=================================================
 # ADVERTISE SERVICE IN ADMIN PANEL
diff --git a/scripts/restore b/scripts/restore
index 5dc2da6..4e7359f 100644
--- a/scripts/restore
+++ b/scripts/restore
@@ -70,8 +70,7 @@ ynh_system_user_create --username=$app
 #=================================================
 
 # Restore permissions on app files
-chown -R root: $final_path/
-chown -R $admin: $final_path/.venv/
+set_permissions
 
 #=================================================
 # SPECIFIC RESTORATION
diff --git a/scripts/upgrade b/scripts/upgrade
index 5633efb..90dc9e8 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -117,13 +117,7 @@ then
 	# Download, check integrity, uncompress and patch the source from app.src
 	mkdir -p $final_path
 
-	pushd $final_path
-
-	PIPENV_VENV_IN_PROJECT="enabled" PIPENV_SKIP_LOCK=true  ynh_exec_warn_less python3 -m pipenv install jupyterlab==$jupyterlab_version jupyterhub notebook jupyterhub-ldapauthenticator pyzmq
-
-	ynh_exec_warn_less python3 -m pipenv run jupyterhub upgrade-db
-
-	popd
+	python_setup
 fi
 
 #=================================================
@@ -157,8 +151,7 @@ ynh_add_systemd_config
 #=================================================
 
 # Set permissions on app files
-chown -R root: $final_path/
-chown -R $admin: $final_path/.venv/
+set_permissions
 
 #=================================================
 # ADVERTISE SERVICE IN ADMIN PANEL