--- a/misc/migration/bootstrapmigration_repository.py	Mon Feb 15 15:05:15 2010 +0100
+++ b/misc/migration/bootstrapmigration_repository.py	Mon Feb 15 15:10:25 2010 +0100
@@ -10,24 +10,35 @@
 
 applcubicwebversion, cubicwebversion = versions_map['cubicweb']
 
-if applcubicwebversion < (3, 6, 0) and cubicwebversion >= (3, 6, 0):
-    from cubicweb.server import schemaserial as ss
+from cubicweb.server import schemaserial as ss
+def _add_relation_definition_no_perms(subjtype, rtype, objtype):
+    rschema = fsschema.rschema(rtype)
+    for query, args in ss.rdef2rql(rschema, subjtype, objtype, groupmap=None):
+        rql(query, args, ask_confirm=False)
+    commit(ask_confirm=False)
+
+if applcubicwebversion == (3, 6, 0) and cubicwebversion >= (3, 6, 0):
+    _add_relation_definition_no_perms('CWAttribute', 'update_permission', 'CWGroup')
+    _add_relation_definition_no_perms('CWAttribute', 'update_permission', 'RQLExpression')
+    session.set_pool()
+    session.unsafe_execute('SET X update_permission Y WHERE X is CWAttribute, X add_permission Y')
+    drop_relation_definition('CWAttribute', 'add_permission', 'CWGroup')
+    drop_relation_definition('CWAttribute', 'add_permission', 'RQLExpression')
+    drop_relation_definition('CWAttribute', 'delete_permission', 'CWGroup')
+    drop_relation_definition('CWAttribute', 'delete_permission', 'RQLExpression')
+
+elif applcubicwebversion < (3, 6, 0) and cubicwebversion >= (3, 6, 0):
     session.set_pool()
     session.execute = session.unsafe_execute
     permsdict = ss.deserialize_ertype_permissions(session)
-    def _add_relation_definition_no_perms(subjtype, rtype, objtype):
-        rschema = fsschema.rschema(rtype)
-        for query, args in ss.rdef2rql(rschema, subjtype, objtype, groupmap=None):
-            rql(query, args, ask_confirm=False)
-        commit(ask_confirm=False)
 
     config.disabled_hooks_categories.add('integrity')
     for rschema in repo.schema.relations():
         rpermsdict = permsdict.get(rschema.eid, {})
         for rdef in rschema.rdefs.values():
-            for action in ('read', 'add', 'delete'):
+            for action in rdef.ACTIONS:
                 actperms = []
-                for something in rpermsdict.get(action, ()):
+                for something in rpermsdict.get(action == 'update' and 'add' or action, ()):
                     if isinstance(something, tuple):
                         actperms.append(rdef.rql_expression(*something))
                     else: # group name
@@ -36,18 +47,32 @@
     for action in ('read', 'add', 'delete'):
         _add_relation_definition_no_perms('CWRelation', '%s_permission' % action, 'CWGroup')
         _add_relation_definition_no_perms('CWRelation', '%s_permission' % action, 'RQLExpression')
+    for action in ('read', 'update'):
         _add_relation_definition_no_perms('CWAttribute', '%s_permission' % action, 'CWGroup')
         _add_relation_definition_no_perms('CWAttribute', '%s_permission' % action, 'RQLExpression')
     for action in ('read', 'add', 'delete'):
-        rql('SET X %s_permission Y WHERE X is IN (CWAttribute, CWRelation), '
+        rql('SET X %s_permission Y WHERE X is CWRelation, '
             'RT %s_permission Y, X relation_type RT, Y is CWGroup' % (action, action))
         rql('INSERT RQLExpression Y: Y exprtype YET, Y mainvars YMV, Y expression YEX, '
-            'X %s_permission Y WHERE X is IN (CWAttribute, CWRelation), '
+            'X %s_permission Y WHERE X is CWRelation, '
             'X relation_type RT, RT %s_permission Y2, Y2 exprtype YET, '
             'Y2 mainvars YMV, Y2 expression YEX' % (action, action))
+    rql('SET X read_permission Y WHERE X is CWAttribute, '
+        'RT read_permission Y, X relation_type RT, Y is CWGroup')
+    rql('INSERT RQLExpression Y: Y exprtype YET, Y mainvars YMV, Y expression YEX, '
+        'X read_permission Y WHERE X is CWAttribute, '
+        'X relation_type RT, RT read_permission Y2, Y2 exprtype YET, '
+        'Y2 mainvars YMV, Y2 expression YEX')
+    rql('SET X update_permission Y WHERE X is CWAttribute, '
+        'RT add_permission Y, X relation_type RT, Y is CWGroup')
+    rql('INSERT RQLExpression Y: Y exprtype YET, Y mainvars YMV, Y expression YEX, '
+        'X update_permission Y WHERE X is CWAttribute, '
+        'X relation_type RT, RT add_permission Y2, Y2 exprtype YET, '
+        'Y2 mainvars YMV, Y2 expression YEX')
+    for action in ('read', 'add', 'delete'):
         drop_relation_definition('CWRType', '%s_permission' % action, 'CWGroup', commit=False)
         drop_relation_definition('CWRType', '%s_permission' % action, 'RQLExpression')
-    config.disabled_hooks_categories.add('integrity')
+    config.disabled_hooks_categories.remove('integrity')
 
 if applcubicwebversion < (3, 4, 0) and cubicwebversion >= (3, 4, 0):