apps/workbench/test/controllers/projects_controller_test.rb

   1 # Copyright (C) The Arvados Authors. All rights reserved.
   2 #
   3 # SPDX-License-Identifier: AGPL-3.0
   4
   5 require 'test_helper'
   6 require 'helpers/share_object_helper'
   7
   8 class ProjectsControllerTest < ActionController::TestCase
   9   include ShareObjectHelper
  10
  11   test "invited user is asked to sign user agreements on front page" do
  12     get :index, {}, session_for(:inactive)
  13     assert_response :redirect
  14     assert_match(/^#{Regexp.escape(user_agreements_url)}\b/,
  15                  @response.redirect_url,
  16                  "Inactive user was not redirected to user_agreements page")
  17   end
  18
  19   test "uninvited user is asked to wait for activation" do
  20     get :index, {}, session_for(:inactive_uninvited)
  21     assert_response :redirect
  22     assert_match(/^#{Regexp.escape(inactive_users_url)}\b/,
  23                  @response.redirect_url,
  24                  "Uninvited user was not redirected to inactive user page")
  25   end
  26
  27   [[:active, true],
  28    [:project_viewer, false]].each do |which_user, should_show|
  29     test "create subproject button #{'not ' unless should_show} shown to #{which_user}" do
  30       readonly_project_uuid = api_fixture('groups')['aproject']['uuid']
  31       get :show, {
  32         id: readonly_project_uuid
  33       }, session_for(which_user)
  34       buttons = css_select('[data-method=post]').select do |el|
  35         el.attributes['data-remote-href'].value.match /project.*owner_uuid.*#{readonly_project_uuid}/
  36       end
  37       if should_show
  38         assert_not_empty(buttons, "did not offer to create a subproject")
  39       else
  40         assert_empty(buttons.collect(&:to_s),
  41                      "offered to create a subproject in a non-writable project")
  42       end
  43     end
  44   end
  45
  46   test "sharing a project with a user and group" do
  47     uuid_list = [api_fixture("groups")["future_project_viewing_group"]["uuid"],
  48                  api_fixture("users")["future_project_user"]["uuid"]]
  49     post(:share_with, {
  50            id: api_fixture("groups")["asubproject"]["uuid"],
  51            uuids: uuid_list,
  52            format: "json"},
  53          session_for(:active))
  54     assert_response :success
  55     assert_equal(uuid_list, json_response["success"])
  56   end
  57
  58   test "user with project read permission can't add permissions" do
  59     share_uuid = api_fixture("users")["spectator"]["uuid"]
  60     post(:share_with, {
  61            id: api_fixture("groups")["aproject"]["uuid"],
  62            uuids: [share_uuid],
  63            format: "json"},
  64          session_for(:project_viewer))
  65     assert_response 422
  66     assert(json_response["errors"].andand.
  67              any? { |msg| msg.start_with?("#{share_uuid}: ") },
  68            "JSON response missing properly formatted sharing error")
  69   end
  70
  71   test "admin can_manage aproject" do
  72     assert user_can_manage(:admin, api_fixture("groups")["aproject"])
  73   end
  74
  75   test "owner can_manage aproject" do
  76     assert user_can_manage(:active, api_fixture("groups")["aproject"])
  77   end
  78
  79   test "owner can_manage asubproject" do
  80     assert user_can_manage(:active, api_fixture("groups")["asubproject"])
  81   end
  82
  83   test "viewer can't manage aproject" do
  84     refute user_can_manage(:project_viewer, api_fixture("groups")["aproject"])
  85   end
  86
  87   test "viewer can't manage asubproject" do
  88     refute user_can_manage(:project_viewer, api_fixture("groups")["asubproject"])
  89   end
  90
  91   test "subproject_admin can_manage asubproject" do
  92     assert user_can_manage(:subproject_admin, api_fixture("groups")["asubproject"])
  93   end
  94
  95   test "detect ownership loop in project breadcrumbs" do
  96     # This test has an arbitrary time limit -- otherwise we'd just sit
  97     # here forever instead of reporting that the loop was not
  98     # detected. The test passes quickly, but fails slowly.
  99     Timeout::timeout 10 do
 100       get(:show,
 101           { id: api_fixture("groups")["project_owns_itself"]["uuid"] },
 102           session_for(:admin))
 103     end
 104     assert_response :success
 105   end
 106
 107   test "project admin can remove collections from the project" do
 108     # Deleting an object that supports 'trash_at' should make it
 109     # completely inaccessible to API queries, not simply moved out of
 110     # the project.
 111     coll_key = "collection_to_remove_from_subproject"
 112     coll_uuid = api_fixture("collections")[coll_key]["uuid"]
 113     delete(:remove_item,
 114            { id: api_fixture("groups")["asubproject"]["uuid"],
 115              item_uuid: coll_uuid,
 116              format: "js" },
 117            session_for(:subproject_admin))
 118     assert_response :success
 119     assert_match(/\b#{coll_uuid}\b/, @response.body,
 120                  "removed object not named in response")
 121
 122     use_token :subproject_admin
 123     assert_raise ArvadosApiClient::NotFoundException do
 124       Collection.find(coll_uuid, cache: false)
 125     end
 126   end
 127
 128   test "project admin can remove items from project other than collections" do
 129     # An object which does not have an trash_at field (e.g. Specimen)
 130     # should be implicitly moved to the user's Home project when removed.
 131     specimen_uuid = api_fixture('specimens', 'in_asubproject')['uuid']
 132     delete(:remove_item,
 133            { id: api_fixture('groups', 'asubproject')['uuid'],
 134              item_uuid: specimen_uuid,
 135              format: 'js' },
 136            session_for(:subproject_admin))
 137     assert_response :success
 138     assert_match(/\b#{specimen_uuid}\b/, @response.body,
 139                  "removed object not named in response")
 140
 141     use_token :subproject_admin
 142     new_specimen = Specimen.find(specimen_uuid)
 143     assert_equal api_fixture('users', 'subproject_admin')['uuid'], new_specimen.owner_uuid
 144   end
 145
 146   # An object which does not offer an expired_at field but has a xx_owner_uuid_name_unique constraint
 147   # will be renamed when removed and another object with the same name exists in user's home project.
 148   [
 149     ['pipeline_templates', 'template_in_asubproject_with_same_name_as_one_in_active_user_home'],
 150   ].each do |dm, fixture|
 151     test "removing #{dm} from a subproject results in renaming it when there is another such object with same name in home project" do
 152       object = api_fixture(dm, fixture)
 153       delete(:remove_item,
 154              { id: api_fixture('groups', 'asubproject')['uuid'],
 155                item_uuid: object['uuid'],
 156                format: 'js' },
 157              session_for(:active))
 158       assert_response :success
 159       assert_match(/\b#{object['uuid']}\b/, @response.body,
 160                    "removed object not named in response")
 161       use_token :active
 162       if dm.eql?('groups')
 163         found = Group.find(object['uuid'])
 164       else
 165         found = PipelineTemplate.find(object['uuid'])
 166       end
 167       assert_equal api_fixture('users', 'active')['uuid'], found.owner_uuid
 168       assert_equal true, found.name.include?(object['name'] + ' removed from ')
 169     end
 170   end
 171
 172   test 'projects#show tab infinite scroll partial obeys limit' do
 173     get_contents_rows(limit: 1, filters: [['uuid','is_a',['arvados#job']]])
 174     assert_response :success
 175     assert_equal(1, json_response['content'].scan('<tr').count,
 176                  "Did not get exactly one row")
 177   end
 178
 179   ['', ' asc', ' desc'].each do |direction|
 180     test "projects#show tab partial orders correctly by #{direction}" do
 181       _test_tab_content_order direction
 182     end
 183   end
 184
 185   def _test_tab_content_order direction
 186     get_contents_rows(limit: 100,
 187                       order: "created_at#{direction}",
 188                       filters: [['uuid','is_a',['arvados#job',
 189                                                 'arvados#pipelineInstance']]])
 190     assert_response :success
 191     not_grouped_by_kind = nil
 192     last_timestamp = nil
 193     last_kind = nil
 194     found_kind = {}
 195     json_response['content'].scan /<tr[^>]+>/ do |tr_tag|
 196       found_timestamps = 0
 197       tr_tag.scan(/\ data-object-created-at=\"(.*?)\"/).each do |t,|
 198         if last_timestamp
 199           correct_operator = / desc$/ =~ direction ? :>= : :<=
 200           assert_operator(last_timestamp, correct_operator, t,
 201                           "Rows are not sorted by created_at#{direction}")
 202         end
 203         last_timestamp = t
 204         found_timestamps += 1
 205       end
 206       assert_equal(1, found_timestamps,
 207                    "Content row did not have exactly one timestamp")
 208
 209       # Confirm that the test for timestamp ordering couldn't have
 210       # passed merely because the test fixtures have convenient
 211       # timestamps (e.g., there is only one pipeline and one job in
 212       # the project being tested, or there are no pipelines at all in
 213       # the project being tested):
 214       tr_tag.scan /\ data-kind=\"(.*?)\"/ do |kind|
 215         if last_kind and last_kind != kind and found_kind[kind]
 216           # We saw this kind before, then a different kind, then
 217           # this kind again. That means objects are not grouped by
 218           # kind.
 219           not_grouped_by_kind = true
 220         end
 221         found_kind[kind] ||= 0
 222         found_kind[kind] += 1
 223         last_kind = kind
 224       end
 225     end
 226     assert_equal(true, not_grouped_by_kind,
 227                  "Could not confirm that results are not grouped by kind")
 228   end
 229
 230   def get_contents_rows params
 231     params = {
 232       id: api_fixture('users')['active']['uuid'],
 233       partial: :contents_rows,
 234       format: :json,
 235     }.merge(params)
 236     encoded_params = Hash[params.map { |k,v|
 237                             [k, (v.is_a?(Array) || v.is_a?(Hash)) ? v.to_json : v]
 238                           }]
 239     get :show, encoded_params, session_for(:active)
 240   end
 241
 242   test "visit non-public project as anonymous when anonymous browsing is enabled and expect page not found" do
 243     Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 244     get(:show, {id: api_fixture('groups')['aproject']['uuid']})
 245     assert_response 404
 246     assert_match(/log ?in/i, @response.body)
 247   end
 248
 249   test "visit home page as anonymous when anonymous browsing is enabled and expect login" do
 250     Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 251     get(:index)
 252     assert_response :redirect
 253     assert_match /\/users\/welcome/, @response.redirect_url
 254   end
 255
 256   [
 257     nil,
 258     :active,
 259   ].each do |user|
 260     test "visit public projects page when anon config is enabled, as user #{user}, and expect page" do
 261       Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 262
 263       if user
 264         get :public, {}, session_for(user)
 265       else
 266         get :public
 267       end
 268
 269       assert_response :success
 270       assert_not_nil assigns(:objects)
 271       project_names = assigns(:objects).collect(&:name)
 272       assert_includes project_names, 'Unrestricted public data'
 273       assert_not_includes project_names, 'A Project'
 274       refute_empty css_select('[href="/projects/public"]')
 275     end
 276   end
 277
 278   test "visit public projects page when anon config is not enabled as active user and expect 404" do
 279     get :public, {}, session_for(:active)
 280     assert_response 404
 281   end
 282
 283   test "visit public projects page when anon config is enabled but public projects page is disabled as active user and expect 404" do
 284     Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 285     Rails.configuration.enable_public_projects_page = false
 286     get :public, {}, session_for(:active)
 287     assert_response 404
 288   end
 289
 290   test "visit public projects page when anon config is not enabled as anonymous and expect login page" do
 291     get :public
 292     assert_response :redirect
 293     assert_match /\/users\/welcome/, @response.redirect_url
 294     assert_empty css_select('[href="/projects/public"]')
 295   end
 296
 297   test "visit public projects page when anon config is enabled and public projects page is disabled and expect login page" do
 298     Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 299     Rails.configuration.enable_public_projects_page = false
 300     get :index
 301     assert_response :redirect
 302     assert_match /\/users\/welcome/, @response.redirect_url
 303     assert_empty css_select('[href="/projects/public"]')
 304   end
 305
 306   test "visit public projects page when anon config is not enabled and public projects page is enabled and expect login page" do
 307     Rails.configuration.enable_public_projects_page = true
 308     get :index
 309     assert_response :redirect
 310     assert_match /\/users\/welcome/, @response.redirect_url
 311     assert_empty css_select('[href="/projects/public"]')
 312   end
 313
 314   test "find a project and edit its description" do
 315     project = api_fixture('groups')['aproject']
 316     use_token :active
 317     found = Group.find(project['uuid'])
 318     found.description = 'test description update'
 319     found.save!
 320     get(:show, {id: project['uuid']}, session_for(:active))
 321     assert_includes @response.body, 'test description update'
 322   end
 323
 324   test "find a project and edit description to textile description" do
 325     project = api_fixture('groups')['aproject']
 326     use_token :active
 327     found = Group.find(project['uuid'])
 328     found.description = '*test bold description for textile formatting*'
 329     found.save!
 330     get(:show, {id: project['uuid']}, session_for(:active))
 331     assert_includes @response.body, '<strong>test bold description for textile formatting</strong>'
 332   end
 333
 334   test "find a project and edit description to html description" do
 335     project = api_fixture('groups')['aproject']
 336     use_token :active
 337     found = Group.find(project['uuid'])
 338     found.description = '<b>Textile</b> description with link to home page <a href="/">take me home</a>.'
 339     found.save!
 340     get(:show, {id: project['uuid']}, session_for(:active))
 341     assert_includes @response.body, '<b>Textile</b> description with link to home page <a href="/">take me home</a>.'
 342   end
 343
 344   test "find a project and edit description to unsafe html description" do
 345     project = api_fixture('groups')['aproject']
 346     use_token :active
 347     found = Group.find(project['uuid'])
 348     found.description = 'Textile description with unsafe script tag <script language="javascript">alert("Hello there")</script>.'
 349     found.save!
 350     get(:show, {id: project['uuid']}, session_for(:active))
 351     assert_includes @response.body, 'Textile description with unsafe script tag alert("Hello there").'
 352   end
 353
 354   # Tests #14519
 355   test "textile table on description renders as table html markup" do
 356     use_token :active
 357     project = api_fixture('groups')['aproject']
 358     textile_table = <<EOT
 359 table(table table-striped table-condensed).
 360 |_. First Header |_. Second Header |
 361 |Content Cell |Content Cell |
 362 |Content Cell |Content Cell |
 363 EOT
 364     found = Group.find(project['uuid'])
 365     found.description = textile_table
 366     found.save!
 367     get(:show, {id: project['uuid']}, session_for(:active))
 368     assert_includes @response.body, '<th>First Header'
 369     assert_includes @response.body, '<td>Content Cell'
 370   end
 371
 372   test "find a project and edit description to textile description with link to object" do
 373     project = api_fixture('groups')['aproject']
 374     use_token :active
 375     found = Group.find(project['uuid'])
 376
 377     # uses 'Link to object' as a hyperlink for the object
 378     found.description = '"Link to object":' + api_fixture('groups')['asubproject']['uuid']
 379     found.save!
 380     get(:show, {id: project['uuid']}, session_for(:active))
 381
 382     # check that input was converted to textile, not staying as inputted
 383     refute_includes  @response.body,'"Link to object"'
 384     refute_empty css_select('[href="/groups/zzzzz-j7d0g-axqo7eu9pwvna1x"]')
 385   end
 386
 387   test "project viewer can't see project sharing tab" do
 388     project = api_fixture('groups')['aproject']
 389     get(:show, {id: project['uuid']}, session_for(:project_viewer))
 390     refute_includes @response.body, '<div id="Sharing"'
 391     assert_includes @response.body, '<div id="Data_collections"'
 392   end
 393
 394   [
 395     'admin',
 396     'active',
 397   ].each do |username|
 398     test "#{username} can see project sharing tab" do
 399      project = api_fixture('groups')['aproject']
 400      get(:show, {id: project['uuid']}, session_for(username))
 401      assert_includes @response.body, '<div id="Sharing"'
 402      assert_includes @response.body, '<div id="Data_collections"'
 403     end
 404   end
 405
 406   [
 407     ['admin',true],
 408     ['active',true],
 409     ['project_viewer',false],
 410   ].each do |user, can_move|
 411     test "#{user} can move subproject from project #{can_move}" do
 412       get(:show, {id: api_fixture('groups')['aproject']['uuid']}, session_for(user))
 413       if can_move
 414         assert_includes @response.body, 'Move project...'
 415       else
 416         refute_includes @response.body, 'Move project...'
 417       end
 418     end
 419   end
 420
 421   [
 422     [:admin, true],
 423     [:active, false],
 424   ].each do |user, expect_all_nodes|
 425     test "in dashboard other index page links as #{user}" do
 426       get :index, {}, session_for(user)
 427
 428       [["processes", "/all_processes"],
 429        ["collections", "/collections"],
 430       ].each do |target, path|
 431         assert_includes @response.body, "href=\"#{path}\""
 432         assert_includes @response.body, "All #{target}"
 433       end
 434
 435       if expect_all_nodes
 436         assert_includes @response.body, "href=\"/nodes\""
 437         assert_includes @response.body, "All nodes"
 438       else
 439         assert_not_includes @response.body, "href=\"/nodes\""
 440         assert_not_includes @response.body, "All nodes"
 441       end
 442     end
 443   end
 444
 445   test "dashboard should show the correct status for processes" do
 446     get :index, {}, session_for(:active)
 447     assert_select 'div.panel-body.recent-processes' do
 448       [
 449         {
 450           fixture: 'container_requests',
 451           state: 'completed',
 452           selectors: [['div.progress', false],
 453                       ['span.label.label-success', true, 'Complete']]
 454         },
 455         {
 456           fixture: 'container_requests',
 457           state: 'uncommitted',
 458           selectors: [['div.progress', false],
 459                       ['span.label.label-default', true, 'Uncommitted']]
 460         },
 461         {
 462           fixture: 'container_requests',
 463           state: 'queued',
 464           selectors: [['div.progress', false],
 465                       ['span.label.label-default', true, 'Queued']]
 466         },
 467         {
 468           fixture: 'container_requests',
 469           state: 'running',
 470           selectors: [['.label-info', true, 'Running']]
 471         },
 472         {
 473           fixture: 'pipeline_instances',
 474           state: 'new_pipeline',
 475           selectors: [['div.progress', false],
 476                       ['span.label.label-default', true, 'Not started']]
 477         },
 478         {
 479           fixture: 'pipeline_instances',
 480           state: 'pipeline_in_running_state',
 481           selectors: [['.label-info', true, 'Running']]
 482         },
 483       ].each do |c|
 484         uuid = api_fixture(c[:fixture])[c[:state]]['uuid']
 485         assert_select "div.dashboard-panel-info-row.row-#{uuid}" do
 486           if c.include? :selectors
 487             c[:selectors].each do |selector, should_show, label|
 488               assert_select selector, should_show, "UUID #{uuid} should #{should_show ? '' : 'not'} show '#{selector}'"
 489               if should_show and not label.nil?
 490                 assert_select selector, label, "UUID #{uuid} state label should show #{label}"
 491               end
 492             end
 493           end
 494         end
 495       end
 496     end
 497   end
 498
 499   test "visit a public project and verify the public projects page link exists" do
 500     Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 501     uuid = api_fixture('groups')['anonymously_accessible_project']['uuid']
 502     get :show, {id: uuid}
 503     project = assigns(:object)
 504     assert_equal uuid, project['uuid']
 505     refute_empty css_select("[href=\"/projects/#{project['uuid']}\"]")
 506     assert_includes @response.body, "<a href=\"/projects/public\">Public Projects</a>"
 507   end
 508
 509   test 'all_projects unaffected by params after use by ProjectsController (#6640)' do
 510     @controller = ProjectsController.new
 511     project_uuid = api_fixture('groups')['aproject']['uuid']
 512     get :index, {
 513       filters: [['uuid', '<', project_uuid]].to_json,
 514       limit: 0,
 515       offset: 1000,
 516     }, session_for(:active)
 517     assert_select "#projects-menu + ul li.divider ~ li a[href=/projects/#{project_uuid}]"
 518   end
 519
 520   [
 521     ["active", 5, ["aproject", "asubproject"], "anonymously_accessible_project"],
 522     ["user1_with_load", 2, ["project_with_10_collections"], "project_with_2_pipelines_and_60_crs"],
 523     ["admin", 5, ["anonymously_accessible_project", "subproject_in_anonymous_accessible_project"], "aproject"],
 524   ].each do |user, page_size, tree_segment, unexpected|
 525     # Note: this test is sensitive to database collation. It passes
 526     # with en_US.UTF-8.
 527     test "build my projects tree for #{user} user and verify #{unexpected} is omitted" do
 528       use_token user
 529
 530       tree, _, _ = @controller.send(:my_wanted_projects_tree,
 531                                     User.current,
 532                                     page_size)
 533
 534       tree_segment_at_depth_1 = api_fixture('groups')[tree_segment[0]]
 535       tree_segment_at_depth_2 = api_fixture('groups')[tree_segment[1]] if tree_segment[1]
 536
 537       node_depth = {}
 538       tree.each do |x|
 539         node_depth[x[:object]['uuid']] = x[:depth]
 540       end
 541
 542       assert_equal(1, node_depth[tree_segment_at_depth_1['uuid']])
 543       assert_equal(2, node_depth[tree_segment_at_depth_2['uuid']]) if tree_segment[1]
 544
 545       unexpected_project = api_fixture('groups')[unexpected]
 546       assert_nil(node_depth[unexpected_project['uuid']], node_depth.inspect)
 547     end
 548   end
 549
 550   [
 551     ["active", 1],
 552     ["project_viewer", 1],
 553     ["admin", 0],
 554   ].each do |user, size|
 555     test "starred projects for #{user}" do
 556       use_token user
 557       ctrl = ProjectsController.new
 558       current_user = User.find(api_fixture('users')[user]['uuid'])
 559       my_starred_project = ctrl.send :my_starred_projects, current_user
 560       assert_equal(size, my_starred_project.andand.size)
 561
 562       ctrl2 = ProjectsController.new
 563       current_user = User.find(api_fixture('users')[user]['uuid'])
 564       my_starred_project = ctrl2.send :my_starred_projects, current_user
 565       assert_equal(size, my_starred_project.andand.size)
 566     end
 567   end
 568
 569   test "unshare project and verify that it is no longer included in shared user's starred projects" do
 570     # remove sharing link
 571     use_token :system_user
 572     Link.find(api_fixture('links')['share_starred_project_with_project_viewer']['uuid']).destroy
 573
 574     # verify that project is no longer included in starred projects
 575     use_token :project_viewer
 576     current_user = User.find(api_fixture('users')['project_viewer']['uuid'])
 577     ctrl = ProjectsController.new
 578     my_starred_project = ctrl.send :my_starred_projects, current_user
 579     assert_equal(0, my_starred_project.andand.size)
 580
 581     # share it again
 582     @controller = LinksController.new
 583     post :create, {
 584       link: {
 585         link_class: 'permission',
 586         name: 'can_read',
 587         head_uuid: api_fixture('groups')['starred_and_shared_active_user_project']['uuid'],
 588         tail_uuid: api_fixture('users')['project_viewer']['uuid'],
 589       },
 590       format: :json
 591     }, session_for(:system_user)
 592
 593     # verify that the project is again included in starred projects
 594     use_token :project_viewer
 595     ctrl = ProjectsController.new
 596     my_starred_project = ctrl.send :my_starred_projects, current_user
 597     assert_equal(1, my_starred_project.andand.size)
 598   end
 599 end