apps/workbench/test/controllers/projects_controller_test.rb

   1 # Copyright (C) The Arvados Authors. All rights reserved.
   2 #
   3 # SPDX-License-Identifier: AGPL-3.0
   4
   5 require 'test_helper'
   6 require 'helpers/share_object_helper'
   7
   8 class ProjectsControllerTest < ActionController::TestCase
   9   include ShareObjectHelper
  10
  11   test "invited user is asked to sign user agreements on front page" do
  12     get :index, {}, session_for(:inactive)
  13     assert_response :redirect
  14     assert_match(/^#{Regexp.escape(user_agreements_url)}\b/,
  15                  @response.redirect_url,
  16                  "Inactive user was not redirected to user_agreements page")
  17   end
  18
  19   test "uninvited user is asked to wait for activation" do
  20     get :index, {}, session_for(:inactive_uninvited)
  21     assert_response :redirect
  22     assert_match(/^#{Regexp.escape(inactive_users_url)}\b/,
  23                  @response.redirect_url,
  24                  "Uninvited user was not redirected to inactive user page")
  25   end
  26
  27   [[:active, true],
  28    [:project_viewer, false]].each do |which_user, should_show|
  29     test "create subproject button #{'not ' unless should_show} shown to #{which_user}" do
  30       readonly_project_uuid = api_fixture('groups')['aproject']['uuid']
  31       get :show, {
  32         id: readonly_project_uuid
  33       }, session_for(which_user)
  34       buttons = css_select('[data-method=post]').select do |el|
  35         el.attributes['data-remote-href'].value.match /project.*owner_uuid.*#{readonly_project_uuid}/
  36       end
  37       if should_show
  38         assert_not_empty(buttons, "did not offer to create a subproject")
  39       else
  40         assert_empty(buttons.collect(&:to_s),
  41                      "offered to create a subproject in a non-writable project")
  42       end
  43     end
  44   end
  45
  46   test "sharing a project with a user and group" do
  47     uuid_list = [api_fixture("groups")["future_project_viewing_group"]["uuid"],
  48                  api_fixture("users")["future_project_user"]["uuid"]]
  49     post(:share_with, {
  50            id: api_fixture("groups")["asubproject"]["uuid"],
  51            uuids: uuid_list,
  52            format: "json"},
  53          session_for(:active))
  54     assert_response :success
  55     assert_equal(uuid_list, json_response["success"])
  56   end
  57
  58   test "user with project read permission can't add permissions" do
  59     share_uuid = api_fixture("users")["spectator"]["uuid"]
  60     post(:share_with, {
  61            id: api_fixture("groups")["aproject"]["uuid"],
  62            uuids: [share_uuid],
  63            format: "json"},
  64          session_for(:project_viewer))
  65     assert_response 422
  66     assert(json_response["errors"].andand.
  67              any? { |msg| msg.start_with?("#{share_uuid}: ") },
  68            "JSON response missing properly formatted sharing error")
  69   end
  70
  71   test "admin can_manage aproject" do
  72     assert user_can_manage(:admin, api_fixture("groups")["aproject"])
  73   end
  74
  75   test "owner can_manage aproject" do
  76     assert user_can_manage(:active, api_fixture("groups")["aproject"])
  77   end
  78
  79   test "owner can_manage asubproject" do
  80     assert user_can_manage(:active, api_fixture("groups")["asubproject"])
  81   end
  82
  83   test "viewer can't manage aproject" do
  84     refute user_can_manage(:project_viewer, api_fixture("groups")["aproject"])
  85   end
  86
  87   test "viewer can't manage asubproject" do
  88     refute user_can_manage(:project_viewer, api_fixture("groups")["asubproject"])
  89   end
  90
  91   test "subproject_admin can_manage asubproject" do
  92     assert user_can_manage(:subproject_admin, api_fixture("groups")["asubproject"])
  93   end
  94
  95   test "detect ownership loop in project breadcrumbs" do
  96     # This test has an arbitrary time limit -- otherwise we'd just sit
  97     # here forever instead of reporting that the loop was not
  98     # detected. The test passes quickly, but fails slowly.
  99     Timeout::timeout 10 do
 100       get(:show,
 101           { id: api_fixture("groups")["project_owns_itself"]["uuid"] },
 102           session_for(:admin))
 103     end
 104     assert_response :success
 105   end
 106
 107   test "project admin can remove collections from the project" do
 108     # Deleting an object that supports 'trash_at' should make it
 109     # completely inaccessible to API queries, not simply moved out of
 110     # the project.
 111     coll_key = "collection_to_remove_from_subproject"
 112     coll_uuid = api_fixture("collections")[coll_key]["uuid"]
 113     delete(:remove_item,
 114            { id: api_fixture("groups")["asubproject"]["uuid"],
 115              item_uuid: coll_uuid,
 116              format: "js" },
 117            session_for(:subproject_admin))
 118     assert_response :success
 119     assert_match(/\b#{coll_uuid}\b/, @response.body,
 120                  "removed object not named in response")
 121
 122     use_token :subproject_admin
 123     assert_raise ArvadosApiClient::NotFoundException do
 124       Collection.find(coll_uuid, cache: false)
 125     end
 126   end
 127
 128   test "project admin can remove items from project other than collections" do
 129     # An object which does not have an trash_at field (e.g. Specimen)
 130     # should be implicitly moved to the user's Home project when removed.
 131     specimen_uuid = api_fixture('specimens', 'in_asubproject')['uuid']
 132     delete(:remove_item,
 133            { id: api_fixture('groups', 'asubproject')['uuid'],
 134              item_uuid: specimen_uuid,
 135              format: 'js' },
 136            session_for(:subproject_admin))
 137     assert_response :success
 138     assert_match(/\b#{specimen_uuid}\b/, @response.body,
 139                  "removed object not named in response")
 140
 141     use_token :subproject_admin
 142     new_specimen = Specimen.find(specimen_uuid)
 143     assert_equal api_fixture('users', 'subproject_admin')['uuid'], new_specimen.owner_uuid
 144   end
 145
 146   # An object which does not offer an expired_at field but has a xx_owner_uuid_name_unique constraint
 147   # will be renamed when removed and another object with the same name exists in user's home project.
 148   [
 149     ['pipeline_templates', 'template_in_asubproject_with_same_name_as_one_in_active_user_home'],
 150   ].each do |dm, fixture|
 151     test "removing #{dm} from a subproject results in renaming it when there is another such object with same name in home project" do
 152       object = api_fixture(dm, fixture)
 153       delete(:remove_item,
 154              { id: api_fixture('groups', 'asubproject')['uuid'],
 155                item_uuid: object['uuid'],
 156                format: 'js' },
 157              session_for(:active))
 158       assert_response :success
 159       assert_match(/\b#{object['uuid']}\b/, @response.body,
 160                    "removed object not named in response")
 161       use_token :active
 162       if dm.eql?('groups')
 163         found = Group.find(object['uuid'])
 164       else
 165         found = PipelineTemplate.find(object['uuid'])
 166       end
 167       assert_equal api_fixture('users', 'active')['uuid'], found.owner_uuid
 168       assert_equal true, found.name.include?(object['name'] + ' removed from ')
 169     end
 170   end
 171
 172   test 'projects#show tab infinite scroll partial obeys limit' do
 173     get_contents_rows(limit: 1, filters: [['uuid','is_a',['arvados#job']]])
 174     assert_response :success
 175     assert_equal(1, json_response['content'].scan('<tr').count,
 176                  "Did not get exactly one row")
 177   end
 178
 179   ['', ' asc', ' desc'].each do |direction|
 180     test "projects#show tab partial orders correctly by #{direction}" do
 181       _test_tab_content_order direction
 182     end
 183   end
 184
 185   def _test_tab_content_order direction
 186     get_contents_rows(limit: 100,
 187                       order: "created_at#{direction}",
 188                       filters: [['uuid','is_a',['arvados#job',
 189                                                 'arvados#pipelineInstance']]])
 190     assert_response :success
 191     not_grouped_by_kind = nil
 192     last_timestamp = nil
 193     last_kind = nil
 194     found_kind = {}
 195     json_response['content'].scan /<tr[^>]+>/ do |tr_tag|
 196       found_timestamps = 0
 197       tr_tag.scan(/\ data-object-created-at=\"(.*?)\"/).each do |t,|
 198         if last_timestamp
 199           correct_operator = / desc$/ =~ direction ? :>= : :<=
 200           assert_operator(last_timestamp, correct_operator, t,
 201                           "Rows are not sorted by created_at#{direction}")
 202         end
 203         last_timestamp = t
 204         found_timestamps += 1
 205       end
 206       assert_equal(1, found_timestamps,
 207                    "Content row did not have exactly one timestamp")
 208
 209       # Confirm that the test for timestamp ordering couldn't have
 210       # passed merely because the test fixtures have convenient
 211       # timestamps (e.g., there is only one pipeline and one job in
 212       # the project being tested, or there are no pipelines at all in
 213       # the project being tested):
 214       tr_tag.scan /\ data-kind=\"(.*?)\"/ do |kind|
 215         if last_kind and last_kind != kind and found_kind[kind]
 216           # We saw this kind before, then a different kind, then
 217           # this kind again. That means objects are not grouped by
 218           # kind.
 219           not_grouped_by_kind = true
 220         end
 221         found_kind[kind] ||= 0
 222         found_kind[kind] += 1
 223         last_kind = kind
 224       end
 225     end
 226     assert_equal(true, not_grouped_by_kind,
 227                  "Could not confirm that results are not grouped by kind")
 228   end
 229
 230   def get_contents_rows params
 231     params = {
 232       id: api_fixture('users')['active']['uuid'],
 233       partial: :contents_rows,
 234       format: :json,
 235     }.merge(params)
 236     encoded_params = Hash[params.map { |k,v|
 237                             [k, (v.is_a?(Array) || v.is_a?(Hash)) ? v.to_json : v]
 238                           }]
 239     get :show, encoded_params, session_for(:active)
 240   end
 241
 242   test "visit non-public project as anonymous when anonymous browsing is enabled and expect page not found" do
 243     Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 244     get(:show, {id: api_fixture('groups')['aproject']['uuid']})
 245     assert_response 404
 246     assert_match(/log ?in/i, @response.body)
 247   end
 248
 249   test "visit home page as anonymous when anonymous browsing is enabled and expect login" do
 250     Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 251     get(:index)
 252     assert_response :redirect
 253     assert_match /\/users\/welcome/, @response.redirect_url
 254   end
 255
 256   [
 257     nil,
 258     :active,
 259   ].each do |user|
 260     test "visit public projects page when anon config is enabled, as user #{user}, and expect page" do
 261       Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 262
 263       if user
 264         get :public, {}, session_for(user)
 265       else
 266         get :public
 267       end
 268
 269       assert_response :success
 270       assert_not_nil assigns(:objects)
 271       project_names = assigns(:objects).collect(&:name)
 272       assert_includes project_names, 'Unrestricted public data'
 273       assert_not_includes project_names, 'A Project'
 274       refute_empty css_select('[href="/projects/public"]')
 275     end
 276   end
 277
 278   test "visit public projects page when anon config is not enabled as active user and expect 404" do
 279     get :public, {}, session_for(:active)
 280     assert_response 404
 281   end
 282
 283   test "visit public projects page when anon config is enabled but public projects page is disabled as active user and expect 404" do
 284     Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 285     Rails.configuration.enable_public_projects_page = false
 286     get :public, {}, session_for(:active)
 287     assert_response 404
 288   end
 289
 290   test "visit public projects page when anon config is not enabled as anonymous and expect login page" do
 291     get :public
 292     assert_response :redirect
 293     assert_match /\/users\/welcome/, @response.redirect_url
 294     assert_empty css_select('[href="/projects/public"]')
 295   end
 296
 297   test "visit public projects page when anon config is enabled and public projects page is disabled and expect login page" do
 298     Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 299     Rails.configuration.enable_public_projects_page = false
 300     get :index
 301     assert_response :redirect
 302     assert_match /\/users\/welcome/, @response.redirect_url
 303     assert_empty css_select('[href="/projects/public"]')
 304   end
 305
 306   test "visit public projects page when anon config is not enabled and public projects page is enabled and expect login page" do
 307     Rails.configuration.enable_public_projects_page = true
 308     get :index
 309     assert_response :redirect
 310     assert_match /\/users\/welcome/, @response.redirect_url
 311     assert_empty css_select('[href="/projects/public"]')
 312   end
 313
 314   test "find a project and edit its description" do
 315     project = api_fixture('groups')['aproject']
 316     use_token :active
 317     found = Group.find(project['uuid'])
 318     found.description = 'test description update'
 319     found.save!
 320     get(:show, {id: project['uuid']}, session_for(:active))
 321     assert_includes @response.body, 'test description update'
 322   end
 323
 324   test "find a project and edit description to textile description" do
 325     project = api_fixture('groups')['aproject']
 326     use_token :active
 327     found = Group.find(project['uuid'])
 328     found.description = '*test bold description for textile formatting*'
 329     found.save!
 330     get(:show, {id: project['uuid']}, session_for(:active))
 331     assert_includes @response.body, '<strong>test bold description for textile formatting</strong>'
 332   end
 333
 334   test "find a project and edit description to html description" do
 335     project = api_fixture('groups')['aproject']
 336     use_token :active
 337     found = Group.find(project['uuid'])
 338     found.description = '<b>Textile</b> description with link to home page <a href="/">take me home</a>.'
 339     found.save!
 340     get(:show, {id: project['uuid']}, session_for(:active))
 341     assert_includes @response.body, '<b>Textile</b> description with link to home page <a href="/">take me home</a>.'
 342   end
 343
 344   test "find a project and edit description to unsafe html description" do
 345     project = api_fixture('groups')['aproject']
 346     use_token :active
 347     found = Group.find(project['uuid'])
 348     found.description = 'Textile description with unsafe script tag <script language="javascript">alert("Hello there")</script>.'
 349     found.save!
 350     get(:show, {id: project['uuid']}, session_for(:active))
 351     assert_includes @response.body, 'Textile description with unsafe script tag alert("Hello there").'
 352   end
 353
 354   test "find a project and edit description to textile description with link to object" do
 355     project = api_fixture('groups')['aproject']
 356     use_token :active
 357     found = Group.find(project['uuid'])
 358
 359     # uses 'Link to object' as a hyperlink for the object
 360     found.description = '"Link to object":' + api_fixture('groups')['asubproject']['uuid']
 361     found.save!
 362     get(:show, {id: project['uuid']}, session_for(:active))
 363
 364     # check that input was converted to textile, not staying as inputted
 365     refute_includes  @response.body,'"Link to object"'
 366     refute_empty css_select('[href="/groups/zzzzz-j7d0g-axqo7eu9pwvna1x"]')
 367   end
 368
 369   test "project viewer can't see project sharing tab" do
 370     project = api_fixture('groups')['aproject']
 371     get(:show, {id: project['uuid']}, session_for(:project_viewer))
 372     refute_includes @response.body, '<div id="Sharing"'
 373     assert_includes @response.body, '<div id="Data_collections"'
 374   end
 375
 376   [
 377     'admin',
 378     'active',
 379   ].each do |username|
 380     test "#{username} can see project sharing tab" do
 381      project = api_fixture('groups')['aproject']
 382      get(:show, {id: project['uuid']}, session_for(username))
 383      assert_includes @response.body, '<div id="Sharing"'
 384      assert_includes @response.body, '<div id="Data_collections"'
 385     end
 386   end
 387
 388   [
 389     ['admin',true],
 390     ['active',true],
 391     ['project_viewer',false],
 392   ].each do |user, can_move|
 393     test "#{user} can move subproject from project #{can_move}" do
 394       get(:show, {id: api_fixture('groups')['aproject']['uuid']}, session_for(user))
 395       if can_move
 396         assert_includes @response.body, 'Move project...'
 397       else
 398         refute_includes @response.body, 'Move project...'
 399       end
 400     end
 401   end
 402
 403   [
 404     [:admin, true],
 405     [:active, false],
 406   ].each do |user, expect_all_nodes|
 407     test "in dashboard other index page links as #{user}" do
 408       get :index, {}, session_for(user)
 409
 410       [["processes", "/all_processes"],
 411        ["collections", "/collections"],
 412       ].each do |target, path|
 413         assert_includes @response.body, "href=\"#{path}\""
 414         assert_includes @response.body, "All #{target}"
 415       end
 416
 417       if expect_all_nodes
 418         assert_includes @response.body, "href=\"/nodes\""
 419         assert_includes @response.body, "All nodes"
 420       else
 421         assert_not_includes @response.body, "href=\"/nodes\""
 422         assert_not_includes @response.body, "All nodes"
 423       end
 424     end
 425   end
 426
 427   test "dashboard should show the correct status for processes" do
 428     get :index, {}, session_for(:active)
 429     assert_select 'div.panel-body.recent-processes' do
 430       [
 431         {
 432           fixture: 'container_requests',
 433           state: 'completed',
 434           selectors: [['div.progress', false],
 435                       ['span.label.label-success', true, 'Complete']]
 436         },
 437         {
 438           fixture: 'container_requests',
 439           state: 'uncommitted',
 440           selectors: [['div.progress', false],
 441                       ['span.label.label-default', true, 'Uncommitted']]
 442         },
 443         {
 444           fixture: 'container_requests',
 445           state: 'queued',
 446           selectors: [['div.progress', false],
 447                       ['span.label.label-default', true, 'Queued']]
 448         },
 449         {
 450           fixture: 'container_requests',
 451           state: 'running',
 452           selectors: [['.label-info', true, 'Running']]
 453         },
 454         {
 455           fixture: 'pipeline_instances',
 456           state: 'new_pipeline',
 457           selectors: [['div.progress', false],
 458                       ['span.label.label-default', true, 'Not started']]
 459         },
 460         {
 461           fixture: 'pipeline_instances',
 462           state: 'pipeline_in_running_state',
 463           selectors: [['.label-info', true, 'Running']]
 464         },
 465       ].each do |c|
 466         uuid = api_fixture(c[:fixture])[c[:state]]['uuid']
 467         assert_select "div.dashboard-panel-info-row.row-#{uuid}" do
 468           if c.include? :selectors
 469             c[:selectors].each do |selector, should_show, label|
 470               assert_select selector, should_show, "UUID #{uuid} should #{should_show ? '' : 'not'} show '#{selector}'"
 471               if should_show and not label.nil?
 472                 assert_select selector, label, "UUID #{uuid} state label should show #{label}"
 473               end
 474             end
 475           end
 476         end
 477       end
 478     end
 479   end
 480
 481   test "visit a public project and verify the public projects page link exists" do
 482     Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token']
 483     uuid = api_fixture('groups')['anonymously_accessible_project']['uuid']
 484     get :show, {id: uuid}
 485     project = assigns(:object)
 486     assert_equal uuid, project['uuid']
 487     refute_empty css_select("[href=\"/projects/#{project['uuid']}\"]")
 488     assert_includes @response.body, "<a href=\"/projects/public\">Public Projects</a>"
 489   end
 490
 491   test 'all_projects unaffected by params after use by ProjectsController (#6640)' do
 492     @controller = ProjectsController.new
 493     project_uuid = api_fixture('groups')['aproject']['uuid']
 494     get :index, {
 495       filters: [['uuid', '<', project_uuid]].to_json,
 496       limit: 0,
 497       offset: 1000,
 498     }, session_for(:active)
 499     assert_select "#projects-menu + ul li.divider ~ li a[href=/projects/#{project_uuid}]"
 500   end
 501
 502   [
 503     ["active", 5, ["aproject", "asubproject"], "anonymously_accessible_project"],
 504     ["user1_with_load", 2, ["project_with_10_collections"], "project_with_2_pipelines_and_60_crs"],
 505     ["admin", 5, ["anonymously_accessible_project", "subproject_in_anonymous_accessible_project"], "aproject"],
 506   ].each do |user, page_size, tree_segment, unexpected|
 507     # Note: this test is sensitive to database collation. It passes
 508     # with en_US.UTF-8.
 509     test "build my projects tree for #{user} user and verify #{unexpected} is omitted" do
 510       use_token user
 511
 512       tree, _, _ = @controller.send(:my_wanted_projects_tree,
 513                                     User.current,
 514                                     page_size)
 515
 516       tree_segment_at_depth_1 = api_fixture('groups')[tree_segment[0]]
 517       tree_segment_at_depth_2 = api_fixture('groups')[tree_segment[1]] if tree_segment[1]
 518
 519       node_depth = {}
 520       tree.each do |x|
 521         node_depth[x[:object]['uuid']] = x[:depth]
 522       end
 523
 524       assert_equal(1, node_depth[tree_segment_at_depth_1['uuid']])
 525       assert_equal(2, node_depth[tree_segment_at_depth_2['uuid']]) if tree_segment[1]
 526
 527       unexpected_project = api_fixture('groups')[unexpected]
 528       assert_nil(node_depth[unexpected_project['uuid']], node_depth.inspect)
 529     end
 530   end
 531
 532   [
 533     ["active", 1],
 534     ["project_viewer", 1],
 535     ["admin", 0],
 536   ].each do |user, size|
 537     test "starred projects for #{user}" do
 538       use_token user
 539       ctrl = ProjectsController.new
 540       current_user = User.find(api_fixture('users')[user]['uuid'])
 541       my_starred_project = ctrl.send :my_starred_projects, current_user
 542       assert_equal(size, my_starred_project.andand.size)
 543
 544       ctrl2 = ProjectsController.new
 545       current_user = User.find(api_fixture('users')[user]['uuid'])
 546       my_starred_project = ctrl2.send :my_starred_projects, current_user
 547       assert_equal(size, my_starred_project.andand.size)
 548     end
 549   end
 550
 551   test "unshare project and verify that it is no longer included in shared user's starred projects" do
 552     # remove sharing link
 553     use_token :system_user
 554     Link.find(api_fixture('links')['share_starred_project_with_project_viewer']['uuid']).destroy
 555
 556     # verify that project is no longer included in starred projects
 557     use_token :project_viewer
 558     current_user = User.find(api_fixture('users')['project_viewer']['uuid'])
 559     ctrl = ProjectsController.new
 560     my_starred_project = ctrl.send :my_starred_projects, current_user
 561     assert_equal(0, my_starred_project.andand.size)
 562
 563     # share it again
 564     @controller = LinksController.new
 565     post :create, {
 566       link: {
 567         link_class: 'permission',
 568         name: 'can_read',
 569         head_uuid: api_fixture('groups')['starred_and_shared_active_user_project']['uuid'],
 570         tail_uuid: api_fixture('users')['project_viewer']['uuid'],
 571       },
 572       format: :json
 573     }, session_for(:system_user)
 574
 575     # verify that the project is again included in starred projects
 576     use_token :project_viewer
 577     ctrl = ProjectsController.new
 578     my_starred_project = ctrl.send :my_starred_projects, current_user
 579     assert_equal(1, my_starred_project.andand.size)
 580   end
 581 end