apps/workbench/test/controllers/collections_controller_test.rb

   1 # Copyright (C) The Arvados Authors. All rights reserved.
   2 #
   3 # SPDX-License-Identifier: AGPL-3.0
   4
   5 require 'test_helper'
   6
   7 class CollectionsControllerTest < ActionController::TestCase
   8   # These tests don't do state-changing API calls. Save some time by
   9   # skipping the database reset.
  10   reset_api_fixtures :after_each_test, false
  11   reset_api_fixtures :after_suite, true
  12
  13   include PipelineInstancesHelper
  14
  15   NONEXISTENT_COLLECTION = "ffffffffffffffffffffffffffffffff+0"
  16
  17   def config_anonymous enable
  18     Rails.configuration.anonymous_user_token =
  19       if enable
  20         api_fixture('api_client_authorizations')['anonymous']['api_token']
  21       else
  22         false
  23       end
  24   end
  25
  26   def stub_file_content
  27     # For the duration of the current test case, stub file download
  28     # content with a randomized (but recognizable) string. Return the
  29     # string, the test case can use it in assertions.
  30     txt = 'the quick brown fox ' + rand(2**32).to_s
  31     @controller.stubs(:file_enumerator).returns([txt])
  32     txt
  33   end
  34
  35   def collection_params(collection_name, file_name=nil)
  36     uuid = api_fixture('collections')[collection_name.to_s]['uuid']
  37     params = {uuid: uuid, id: uuid}
  38     params[:file] = file_name if file_name
  39     params
  40   end
  41
  42   def assert_hash_includes(actual_hash, expected_hash, msg=nil)
  43     expected_hash.each do |key, value|
  44       assert_equal(value, actual_hash[key], msg)
  45     end
  46   end
  47
  48   def assert_no_session
  49     assert_hash_includes(session, {arvados_api_token: nil},
  50                          "session includes unexpected API token")
  51   end
  52
  53   def assert_session_for_auth(client_auth)
  54     api_token =
  55       api_fixture('api_client_authorizations')[client_auth.to_s]['api_token']
  56     assert_hash_includes(session, {arvados_api_token: api_token},
  57                          "session token does not belong to #{client_auth}")
  58   end
  59
  60   def show_collection(params, session={}, response=:success)
  61     params = collection_params(params) if not params.is_a? Hash
  62     session = session_for(session) if not session.is_a? Hash
  63     get(:show, params, session)
  64     assert_response response
  65   end
  66
  67   test "viewing a collection" do
  68     show_collection(:foo_file, :active)
  69     assert_equal([['.', 'foo', 3]], assigns(:object).files)
  70   end
  71
  72   test "viewing a collection with spaces in filename" do
  73     show_collection(:w_a_z_file, :active)
  74     assert_equal([['.', 'w a z', 5]], assigns(:object).files)
  75   end
  76
  77   test "download a file with spaces in filename" do
  78     collection = api_fixture('collections')['w_a_z_file']
  79     fakepipe = IO.popen(['echo', '-n', 'w a z'], 'rb')
  80     IO.expects(:popen).with { |cmd, mode|
  81       cmd.include? "#{collection['uuid']}/w a z"
  82     }.returns(fakepipe)
  83     get :show_file, {
  84       uuid: collection['uuid'],
  85       file: 'w a z'
  86     }, session_for(:active)
  87     assert_response :success
  88     assert_equal 'w a z', response.body
  89   end
  90
  91   test "viewing a collection fetches related projects" do
  92     show_collection({id: api_fixture('collections')["foo_file"]['portable_data_hash']}, :active)
  93     assert_includes(assigns(:same_pdh).map(&:owner_uuid),
  94                     api_fixture('groups')['aproject']['uuid'],
  95                     "controller did not find linked project")
  96   end
  97
  98   test "viewing a collection fetches related permissions" do
  99     show_collection(:bar_file, :active)
 100     assert_includes(assigns(:permissions).map(&:uuid),
 101                     api_fixture('links')['bar_file_readable_by_active']['uuid'],
 102                     "controller did not find permission link")
 103   end
 104
 105   test "viewing a collection fetches jobs that output it" do
 106     show_collection(:bar_file, :active)
 107     assert_includes(assigns(:output_of).map(&:uuid),
 108                     api_fixture('jobs')['foobar']['uuid'],
 109                     "controller did not find output job")
 110   end
 111
 112   test "viewing a collection fetches jobs that logged it" do
 113     show_collection(:baz_file, :active)
 114     assert_includes(assigns(:log_of).map(&:uuid),
 115                     api_fixture('jobs')['foobar']['uuid'],
 116                     "controller did not find logger job")
 117   end
 118
 119   test "sharing auths available to admin" do
 120     show_collection("collection_owned_by_active", "admin_trustedclient")
 121     assert_not_nil assigns(:search_sharing)
 122   end
 123
 124   test "sharing auths available to owner" do
 125     show_collection("collection_owned_by_active", "active_trustedclient")
 126     assert_not_nil assigns(:search_sharing)
 127   end
 128
 129   test "sharing auths available to reader" do
 130     show_collection("foo_collection_in_aproject",
 131                     "project_viewer_trustedclient")
 132     assert_not_nil assigns(:search_sharing)
 133   end
 134
 135   test "viewing collection files with a reader token" do
 136     params = collection_params(:foo_file)
 137     params[:reader_token] = api_fixture("api_client_authorizations",
 138                                         "active_all_collections", "api_token")
 139     get(:show_file_links, params)
 140     assert_response :success
 141     assert_equal([['.', 'foo', 3]], assigns(:object).files)
 142     assert_no_session
 143   end
 144
 145   test "fetching collection file with reader token" do
 146     expected = stub_file_content
 147     params = collection_params(:foo_file, "foo")
 148     params[:reader_token] = api_fixture("api_client_authorizations",
 149                                         "active_all_collections", "api_token")
 150     get(:show_file, params)
 151     assert_response :success
 152     assert_equal(expected, @response.body,
 153                  "failed to fetch a Collection file with a reader token")
 154     assert_no_session
 155   end
 156
 157   test "reader token Collection links end with trailing slash" do
 158     # Testing the fix for #2937.
 159     session = session_for(:active_trustedclient)
 160     post(:share, collection_params(:foo_file), session)
 161     assert(@controller.download_link.ends_with? '/',
 162            "Collection share link does not end with slash for wget")
 163   end
 164
 165   test "getting a file from Keep" do
 166     params = collection_params(:foo_file, 'foo')
 167     sess = session_for(:active)
 168     expect_content = stub_file_content
 169     get(:show_file, params, sess)
 170     assert_response :success
 171     assert_equal(expect_content, @response.body,
 172                  "failed to get a correct file from Keep")
 173   end
 174
 175   test 'anonymous download' do
 176     config_anonymous true
 177     expect_content = stub_file_content
 178     get :show_file, {
 179       uuid: api_fixture('collections')['user_agreement_in_anonymously_accessible_project']['uuid'],
 180       file: 'GNU_General_Public_License,_version_3.pdf',
 181     }
 182     assert_response :success
 183     assert_equal expect_content, response.body
 184   end
 185
 186   test "can't get a file from Keep without permission" do
 187     params = collection_params(:foo_file, 'foo')
 188     sess = session_for(:spectator)
 189     get(:show_file, params, sess)
 190     assert_response 404
 191   end
 192
 193   test "trying to get a nonexistent file from Keep returns a 404" do
 194     params = collection_params(:foo_file, 'gone')
 195     sess = session_for(:admin)
 196     get(:show_file, params, sess)
 197     assert_response 404
 198   end
 199
 200   test "getting a file from Keep with a good reader token" do
 201     params = collection_params(:foo_file, 'foo')
 202     read_token = api_fixture('api_client_authorizations')['active']['api_token']
 203     params[:reader_token] = read_token
 204     expect_content = stub_file_content
 205     get(:show_file, params)
 206     assert_response :success
 207     assert_equal(expect_content, @response.body,
 208                  "failed to get a correct file from Keep using a reader token")
 209     assert_not_equal(read_token, session[:arvados_api_token],
 210                      "using a reader token set the session's API token")
 211   end
 212
 213   [false, true].each do |anon|
 214     test "download a file using a reader token with insufficient scope, anon #{anon}" do
 215       config_anonymous anon
 216       params = collection_params(:foo_file, 'foo')
 217       params[:reader_token] =
 218         api_fixture('api_client_authorizations')['active_noscope']['api_token']
 219       get(:show_file, params)
 220       if anon
 221         # Some files can be shown without a valid token, but not this one.
 222         assert_response 404
 223       else
 224         # No files will ever be shown without a valid token. You
 225         # should log in and try again.
 226         assert_response :redirect
 227       end
 228     end
 229   end
 230
 231   test "can get a file with an unpermissioned auth but in-scope reader token" do
 232     params = collection_params(:foo_file, 'foo')
 233     sess = session_for(:expired)
 234     read_token = api_fixture('api_client_authorizations')['active']['api_token']
 235     params[:reader_token] = read_token
 236     expect_content = stub_file_content
 237     get(:show_file, params, sess)
 238     assert_response :success
 239     assert_equal(expect_content, @response.body,
 240                  "failed to get a correct file from Keep using a reader token")
 241     assert_not_equal(read_token, session[:arvados_api_token],
 242                      "using a reader token set the session's API token")
 243   end
 244
 245   test "inactive user can retrieve user agreement" do
 246     ua_collection = api_fixture('collections')['user_agreement']
 247     # Here we don't test whether the agreement can be retrieved from
 248     # Keep. We only test that show_file decides to send file content,
 249     # so we use the file content stub.
 250     stub_file_content
 251     get :show_file, {
 252       uuid: ua_collection['uuid'],
 253       file: ua_collection['manifest_text'].match(/ \d+:\d+:(\S+)/)[1]
 254     }, session_for(:inactive)
 255     assert_nil(assigns(:unsigned_user_agreements),
 256                "Did not skip check_user_agreements filter " +
 257                "when showing the user agreement.")
 258     assert_response :success
 259   end
 260
 261   test "requesting nonexistent Collection returns 404" do
 262     show_collection({uuid: NONEXISTENT_COLLECTION, id: NONEXISTENT_COLLECTION},
 263                     :active, 404)
 264   end
 265
 266   test "use a reasonable read buffer even if client requests a huge range" do
 267     fakefiledata = mock
 268     IO.expects(:popen).returns(fakefiledata)
 269     fakefiledata.expects(:read).twice.with() do |length|
 270       # Fail the test if read() is called with length>1MiB:
 271       length < 2**20
 272       ## Force the ActionController::Live thread to lose the race to
 273       ## verify that @response.body.length actually waits for the
 274       ## response (see below):
 275       # sleep 3
 276     end.returns("foo\n", nil)
 277     fakefiledata.expects(:close)
 278     foo_file = api_fixture('collections')['foo_file']
 279     @request.headers['Range'] = 'bytes=0-4294967296/*'
 280     get :show_file, {
 281       uuid: foo_file['uuid'],
 282       file: foo_file['manifest_text'].match(/ \d+:\d+:(\S+)/)[1]
 283     }, session_for(:active)
 284     # Wait for the whole response to arrive before deciding whether
 285     # mocks' expectations were met. Otherwise, Mocha will fail the
 286     # test depending on how slowly the ActionController::Live thread
 287     # runs.
 288     @response.body.length
 289   end
 290
 291   test "show file in a subdirectory of a collection" do
 292     params = collection_params(:collection_with_files_in_subdir, 'subdir2/subdir3/subdir4/file1_in_subdir4.txt')
 293     expect_content = stub_file_content
 294     get(:show_file, params, session_for(:user1_with_load))
 295     assert_response :success
 296     assert_equal(expect_content, @response.body, "failed to get a correct file from Keep")
 297   end
 298
 299   test 'provenance graph' do
 300     use_token 'admin'
 301
 302     obj = find_fixture Collection, "graph_test_collection3"
 303
 304     provenance = obj.provenance.stringify_keys
 305
 306     [obj[:portable_data_hash]].each do |k|
 307       assert_not_nil provenance[k], "Expected key #{k} in provenance set"
 308     end
 309
 310     prov_svg = ProvenanceHelper::create_provenance_graph(provenance, "provenance_svg",
 311                                                          {:request => RequestDuck,
 312                                                            :direction => :bottom_up,
 313                                                            :combine_jobs => :script_only})
 314
 315     stage1 = find_fixture Job, "graph_stage1"
 316     stage3 = find_fixture Job, "graph_stage3"
 317     previous_job_run = find_fixture Job, "previous_job_run"
 318
 319     obj_id = obj.portable_data_hash.gsub('+', '\\\+')
 320     stage1_out = stage1.output.gsub('+', '\\\+')
 321     stage1_id = "#{stage1.script}_#{Digest::MD5.hexdigest(stage1[:script_parameters].to_json)}"
 322     stage3_id = "#{stage3.script}_#{Digest::MD5.hexdigest(stage3[:script_parameters].to_json)}"
 323
 324     assert /#{obj_id}&#45;&gt;#{stage3_id}/.match(prov_svg)
 325
 326     assert /#{stage3_id}&#45;&gt;#{stage1_out}/.match(prov_svg)
 327
 328     assert /#{stage1_out}&#45;&gt;#{stage1_id}/.match(prov_svg)
 329
 330   end
 331
 332   test 'used_by graph' do
 333     use_token 'admin'
 334     obj = find_fixture Collection, "graph_test_collection1"
 335
 336     used_by = obj.used_by.stringify_keys
 337
 338     used_by_svg = ProvenanceHelper::create_provenance_graph(used_by, "used_by_svg",
 339                                                             {:request => RequestDuck,
 340                                                               :direction => :top_down,
 341                                                               :combine_jobs => :script_only,
 342                                                               :pdata_only => true})
 343
 344     stage2 = find_fixture Job, "graph_stage2"
 345     stage3 = find_fixture Job, "graph_stage3"
 346
 347     stage2_id = "#{stage2.script}_#{Digest::MD5.hexdigest(stage2[:script_parameters].to_json)}"
 348     stage3_id = "#{stage3.script}_#{Digest::MD5.hexdigest(stage3[:script_parameters].to_json)}"
 349
 350     obj_id = obj.portable_data_hash.gsub('+', '\\\+')
 351     stage3_out = stage3.output.gsub('+', '\\\+')
 352
 353     assert /#{obj_id}&#45;&gt;#{stage2_id}/.match(used_by_svg)
 354
 355     assert /#{obj_id}&#45;&gt;#{stage3_id}/.match(used_by_svg)
 356
 357     assert /#{stage3_id}&#45;&gt;#{stage3_out}/.match(used_by_svg)
 358
 359     assert /#{stage3_id}&#45;&gt;#{stage3_out}/.match(used_by_svg)
 360
 361   end
 362
 363   test "view collection with empty properties" do
 364     fixture_name = :collection_with_empty_properties
 365     show_collection(fixture_name, :active)
 366     assert_equal(api_fixture('collections')[fixture_name.to_s]['name'], assigns(:object).name)
 367     assert_not_nil(assigns(:object).properties)
 368     assert_empty(assigns(:object).properties)
 369   end
 370
 371   test "view collection with one property" do
 372     fixture_name = :collection_with_one_property
 373     show_collection(fixture_name, :active)
 374     fixture = api_fixture('collections')[fixture_name.to_s]
 375     assert_equal(fixture['name'], assigns(:object).name)
 376     assert_equal(fixture['properties'][0], assigns(:object).properties[0])
 377   end
 378
 379   test "create collection with properties" do
 380     post :create, {
 381       collection: {
 382         name: 'collection created with properties',
 383         manifest_text: '',
 384         properties: {
 385           property_1: 'value_1'
 386         },
 387       },
 388       format: :json
 389     }, session_for(:active)
 390     assert_response :success
 391     assert_not_nil assigns(:object).uuid
 392     assert_equal 'collection created with properties', assigns(:object).name
 393     assert_equal 'value_1', assigns(:object).properties[:property_1]
 394   end
 395
 396   test "update description and check manifest_text is not lost" do
 397     collection = api_fixture("collections")["multilevel_collection_1"]
 398     post :update, {
 399       id: collection["uuid"],
 400       collection: {
 401         description: 'test description update'
 402       },
 403       format: :json
 404     }, session_for(:active)
 405     assert_response :success
 406     assert_not_nil assigns(:object)
 407     # Ensure the Workbench response still has the original manifest_text
 408     assert_equal 'test description update', assigns(:object).description
 409     assert_equal true, strip_signatures_and_compare(collection['manifest_text'], assigns(:object).manifest_text)
 410     # Ensure the API server still has the original manifest_text after
 411     # we called arvados.v1.collections.update
 412     use_token :active do
 413       assert_equal true, strip_signatures_and_compare(Collection.find(collection['uuid']).manifest_text,
 414                                                       collection['manifest_text'])
 415     end
 416   end
 417
 418   # Since we got the initial collection from fixture, there are no signatures in manifest_text.
 419   # However, after update or find, the collection retrieved will have singed manifest_text.
 420   # Hence, let's compare each line after excluding signatures.
 421   def strip_signatures_and_compare m1, m2
 422     m1_lines = m1.split "\n"
 423     m2_lines = m2.split "\n"
 424
 425     return false if m1_lines.size != m2_lines.size
 426
 427     m1_lines.each_with_index do |line, i|
 428       m1_words = []
 429       line.split.each do |word|
 430         m1_words << word.split('+A')[0]
 431       end
 432       m2_words = []
 433       m2_lines[i].split.each do |word|
 434         m2_words << word.split('+A')[0]
 435       end
 436       return false if !m1_words.join(' ').eql?(m2_words.join(' '))
 437     end
 438
 439     return true
 440   end
 441
 442   test "view collection and verify none of the file types listed are disabled" do
 443     show_collection(:collection_with_several_supported_file_types, :active)
 444
 445     files = assigns(:object).files
 446     assert_equal true, files.length>0, "Expected one or more files in collection"
 447
 448     disabled = css_select('[disabled="disabled"]').collect do |el|
 449       el
 450     end
 451     assert_equal 0, disabled.length, "Expected no disabled files in collection viewables list"
 452   end
 453
 454   test "view collection and verify file types listed are all disabled" do
 455     show_collection(:collection_with_several_unsupported_file_types, :active)
 456
 457     files = assigns(:object).files.collect do |_, file, _|
 458       file
 459     end
 460     assert_equal true, files.length>0, "Expected one or more files in collection"
 461
 462     disabled = css_select('[disabled="disabled"]').collect do |el|
 463       el.attributes['title'].split[-1]
 464     end
 465
 466     assert_equal files.sort, disabled.sort, "Expected to see all collection files in disabled list of files"
 467   end
 468
 469   test "anonymous user accesses collection in shared project" do
 470     config_anonymous true
 471     collection = api_fixture('collections')['public_text_file']
 472     get(:show, {id: collection['uuid']})
 473
 474     response_object = assigns(:object)
 475     assert_equal collection['name'], response_object['name']
 476     assert_equal collection['uuid'], response_object['uuid']
 477     assert_includes @response.body, 'Hello world'
 478     assert_includes @response.body, 'Content address'
 479     refute_nil css_select('[href="#Advanced"]')
 480   end
 481
 482   test "can view empty collection" do
 483     get :show, {id: 'd41d8cd98f00b204e9800998ecf8427e+0'}, session_for(:active)
 484     assert_includes @response.body, 'The following collections have this content'
 485   end
 486
 487   test "collection portable data hash redirect" do
 488     di = api_fixture('collections')['docker_image']
 489     get :show, {id: di['portable_data_hash']}, session_for(:active)
 490     assert_match /\/collections\/#{di['uuid']}/, @response.redirect_url
 491   end
 492
 493   test "collection portable data hash with multiple matches" do
 494     pdh = api_fixture('collections')['foo_file']['portable_data_hash']
 495     get :show, {id: pdh}, session_for(:admin)
 496     matches = api_fixture('collections').select {|k,v| v["portable_data_hash"] == pdh}
 497     assert matches.size > 1
 498
 499     matches.each do |k,v|
 500       assert_match /href="\/collections\/#{v['uuid']}">.*#{v['name']}<\/a>/, @response.body
 501     end
 502
 503     assert_includes @response.body, 'The following collections have this content:'
 504     assert_not_includes @response.body, 'more results are not shown'
 505     assert_not_includes @response.body, 'Activity'
 506     assert_not_includes @response.body, 'Sharing and permissions'
 507   end
 508
 509   test "collection page renders name" do
 510     collection = api_fixture('collections')['foo_file']
 511     get :show, {id: collection['uuid']}, session_for(:active)
 512     assert_includes @response.body, collection['name']
 513     assert_match /not authorized to manage collection sharing links/, @response.body
 514   end
 515
 516   test "No Upload tab on non-writable collection" do
 517     get :show, {id: api_fixture('collections')['user_agreement']['uuid']}, session_for(:active)
 518     assert_not_includes @response.body, '<a href="#Upload"'
 519   end
 520
 521   def setup_for_keep_web cfg='https://%{uuid_or_pdh}.example', dl_cfg=false
 522     Rails.configuration.keep_web_url = cfg
 523     Rails.configuration.keep_web_download_url = dl_cfg
 524     @controller.expects(:file_enumerator).never
 525   end
 526
 527   %w(uuid portable_data_hash).each do |id_type|
 528     test "Redirect to keep_web_url via #{id_type}" do
 529       setup_for_keep_web
 530       tok = api_fixture('api_client_authorizations')['active']['api_token']
 531       id = api_fixture('collections')['w_a_z_file'][id_type]
 532       get :show_file, {uuid: id, file: "w a z"}, session_for(:active)
 533       assert_response :redirect
 534       assert_equal "https://#{id.sub '+', '-'}.example/_/w%20a%20z?api_token=#{tok}", @response.redirect_url
 535     end
 536
 537     test "Redirect to keep_web_url via #{id_type} with reader token" do
 538       setup_for_keep_web
 539       tok = api_fixture('api_client_authorizations')['active']['api_token']
 540       id = api_fixture('collections')['w_a_z_file'][id_type]
 541       get :show_file, {uuid: id, file: "w a z", reader_token: tok}, session_for(:expired)
 542       assert_response :redirect
 543       assert_equal "https://#{id.sub '+', '-'}.example/t=#{tok}/_/w%20a%20z", @response.redirect_url
 544     end
 545
 546     test "Redirect to keep_web_url via #{id_type} with no token" do
 547       setup_for_keep_web
 548       config_anonymous true
 549       id = api_fixture('collections')['public_text_file'][id_type]
 550       get :show_file, {uuid: id, file: "Hello World.txt"}
 551       assert_response :redirect
 552       assert_equal "https://#{id.sub '+', '-'}.example/_/Hello%20World.txt", @response.redirect_url
 553     end
 554
 555     test "Redirect to keep_web_url via #{id_type} with disposition param" do
 556       setup_for_keep_web
 557       config_anonymous true
 558       id = api_fixture('collections')['public_text_file'][id_type]
 559       get :show_file, {
 560         uuid: id,
 561         file: "Hello World.txt",
 562         disposition: 'attachment',
 563       }
 564       assert_response :redirect
 565       assert_equal "https://#{id.sub '+', '-'}.example/_/Hello%20World.txt?disposition=attachment", @response.redirect_url
 566     end
 567
 568     test "Redirect to keep_web_download_url via #{id_type}" do
 569       setup_for_keep_web('https://collections.example/c=%{uuid_or_pdh}',
 570                          'https://download.example/c=%{uuid_or_pdh}')
 571       tok = api_fixture('api_client_authorizations')['active']['api_token']
 572       id = api_fixture('collections')['w_a_z_file'][id_type]
 573       get :show_file, {uuid: id, file: "w a z"}, session_for(:active)
 574       assert_response :redirect
 575       assert_equal "https://download.example/c=#{id.sub '+', '-'}/_/w%20a%20z?api_token=#{tok}", @response.redirect_url
 576     end
 577
 578     test "Redirect to keep_web_url via #{id_type} when trust_all_content enabled" do
 579       Rails.configuration.trust_all_content = true
 580       setup_for_keep_web('https://collections.example/c=%{uuid_or_pdh}',
 581                          'https://download.example/c=%{uuid_or_pdh}')
 582       tok = api_fixture('api_client_authorizations')['active']['api_token']
 583       id = api_fixture('collections')['w_a_z_file'][id_type]
 584       get :show_file, {uuid: id, file: "w a z"}, session_for(:active)
 585       assert_response :redirect
 586       assert_equal "https://collections.example/c=#{id.sub '+', '-'}/_/w%20a%20z?api_token=#{tok}", @response.redirect_url
 587     end
 588   end
 589
 590   [false, true].each do |anon|
 591     test "No redirect to keep_web_url if collection not found, anon #{anon}" do
 592       setup_for_keep_web
 593       config_anonymous anon
 594       id = api_fixture('collections')['w_a_z_file']['uuid']
 595       get :show_file, {uuid: id, file: "w a z"}, session_for(:spectator)
 596       assert_response 404
 597     end
 598
 599     test "Redirect download to keep_web_download_url, anon #{anon}" do
 600       config_anonymous anon
 601       setup_for_keep_web('https://collections.example/c=%{uuid_or_pdh}',
 602                          'https://download.example/c=%{uuid_or_pdh}')
 603       tok = api_fixture('api_client_authorizations')['active']['api_token']
 604       id = api_fixture('collections')['public_text_file']['uuid']
 605       get :show_file, {
 606         uuid: id,
 607         file: 'Hello world.txt',
 608         disposition: 'attachment',
 609       }, session_for(:active)
 610       assert_response :redirect
 611       expect_url = "https://download.example/c=#{id.sub '+', '-'}/_/Hello%20world.txt"
 612       if not anon
 613         expect_url += "?api_token=#{tok}"
 614       end
 615       assert_equal expect_url, @response.redirect_url
 616     end
 617   end
 618
 619   test "Error if file is impossible to retrieve from keep_web_url" do
 620     # Cannot pass a session token using a single-origin keep-web URL,
 621     # cannot read this collection without a session token.
 622     setup_for_keep_web 'https://collections.example/c=%{uuid_or_pdh}', false
 623     id = api_fixture('collections')['w_a_z_file']['uuid']
 624     get :show_file, {uuid: id, file: "w a z"}, session_for(:active)
 625     assert_response 422
 626   end
 627
 628   [false, true].each do |trust_all_content|
 629     test "Redirect preview to keep_web_download_url when preview is disabled and trust_all_content is #{trust_all_content}" do
 630       Rails.configuration.trust_all_content = trust_all_content
 631       setup_for_keep_web false, 'https://download.example/c=%{uuid_or_pdh}'
 632       tok = api_fixture('api_client_authorizations')['active']['api_token']
 633       id = api_fixture('collections')['w_a_z_file']['uuid']
 634       get :show_file, {uuid: id, file: "w a z"}, session_for(:active)
 635       assert_response :redirect
 636       assert_equal "https://download.example/c=#{id.sub '+', '-'}/_/w%20a%20z?api_token=#{tok}", @response.redirect_url
 637     end
 638   end
 639
 640   test "remove selected files from collection" do
 641     use_token :active
 642
 643     # create a new collection to test; using existing collections will cause other tests to fail,
 644     # and resetting fixtures after each test makes it take almost 4 times to run this test file.
 645     manifest_text = ". d41d8cd98f00b204e9800998ecf8427e+0 0:0:file1 0:0:file2\n./dir1 d41d8cd98f00b204e9800998ecf8427e+0 0:0:file1 0:0:file2\n"
 646
 647     collection = Collection.create(manifest_text: manifest_text)
 648     assert_includes(collection['manifest_text'], "0:0:file1")
 649
 650     # now remove all files named 'file1' from the collection
 651     post :remove_selected_files, {
 652       id: collection['uuid'],
 653       selection: ["#{collection['uuid']}/file1",
 654                   "#{collection['uuid']}/dir1/file1"],
 655       format: :json
 656     }, session_for(:active)
 657     assert_response :success
 658
 659     # verify no 'file1' in the updated collection
 660     collection = Collection.select([:uuid, :manifest_text]).where(uuid: collection['uuid']).first
 661     assert_not_includes(collection['manifest_text'], "0:0:file1")
 662     assert_includes(collection['manifest_text'], "0:0:file2") # but other files still exist
 663   end
 664
 665   test "remove all files from a subdir of a collection" do
 666     use_token :active
 667
 668     # create a new collection to test
 669     manifest_text = ". d41d8cd98f00b204e9800998ecf8427e+0 0:0:file1 0:0:file2\n./dir1 d41d8cd98f00b204e9800998ecf8427e+0 0:0:file1 0:0:file2\n"
 670
 671     collection = Collection.create(manifest_text: manifest_text)
 672     assert_includes(collection['manifest_text'], "0:0:file1")
 673
 674     # now remove all files from "dir1" subdir of the collection
 675     post :remove_selected_files, {
 676       id: collection['uuid'],
 677       selection: ["#{collection['uuid']}/dir1/file1",
 678                   "#{collection['uuid']}/dir1/file2"],
 679       format: :json
 680     }, session_for(:active)
 681     assert_response :success
 682
 683     # verify that "./dir1" no longer exists in this collection's manifest text
 684     collection = Collection.select([:uuid, :manifest_text]).where(uuid: collection['uuid']).first
 685     assert_match /. d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:file1 0:0:file2\n$/, collection['manifest_text']
 686     assert_not_includes(collection['manifest_text'], 'dir1')
 687   end
 688
 689   test "rename file in a collection" do
 690     use_token :active
 691
 692     # create a new collection to test
 693     manifest_text = ". d41d8cd98f00b204e9800998ecf8427e+0 0:0:file1 0:0:file2\n./dir1 d41d8cd98f00b204e9800998ecf8427e+0 0:0:dir1file1 0:0:dir1file2 0:0:dir1imagefile.png\n"
 694
 695     collection = Collection.create(manifest_text: manifest_text)
 696     assert_includes(collection['manifest_text'], "0:0:file1")
 697
 698     # rename 'file1' as 'file1renamed' and verify
 699     post :update, {
 700       id: collection['uuid'],
 701       collection: {
 702         'rename-file-path:file1' => 'file1renamed'
 703       },
 704       format: :json
 705     }, session_for(:active)
 706     assert_response :success
 707
 708     collection = Collection.select([:uuid, :manifest_text]).where(uuid: collection['uuid']).first
 709     assert_match /. d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:file1renamed 0:0:file2\n.\/dir1 d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:dir1file1 0:0:dir1file2 0:0:dir1imagefile.png\n$/, collection['manifest_text']
 710
 711     # now rename 'file2' such that it is moved into 'dir1'
 712     @test_counter = 0
 713     post :update, {
 714       id: collection['uuid'],
 715       collection: {
 716         'rename-file-path:file2' => 'dir1/file2'
 717       },
 718       format: :json
 719     }, session_for(:active)
 720     assert_response :success
 721
 722     collection = Collection.select([:uuid, :manifest_text]).where(uuid: collection['uuid']).first
 723     assert_match /. d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:file1renamed\n.\/dir1 d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:dir1file1 0:0:dir1file2 0:0:dir1imagefile.png 0:0:file2\n$/, collection['manifest_text']
 724
 725     # now rename 'dir1/dir1file1' such that it is moved into a new subdir
 726     @test_counter = 0
 727     post :update, {
 728       id: collection['uuid'],
 729       collection: {
 730         'rename-file-path:dir1/dir1file1' => 'dir2/dir3/dir1file1moved'
 731       },
 732       format: :json
 733     }, session_for(:active)
 734     assert_response :success
 735
 736     collection = Collection.select([:uuid, :manifest_text]).where(uuid: collection['uuid']).first
 737     assert_match /. d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:file1renamed\n.\/dir1 d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:dir1file2 0:0:dir1imagefile.png 0:0:file2\n.\/dir2\/dir3 d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:dir1file1moved\n$/, collection['manifest_text']
 738
 739     # now rename the image file 'dir1/dir1imagefile.png'
 740     @test_counter = 0
 741     post :update, {
 742       id: collection['uuid'],
 743       collection: {
 744         'rename-file-path:dir1/dir1imagefile.png' => 'dir1/dir1imagefilerenamed.png'
 745       },
 746       format: :json
 747     }, session_for(:active)
 748     assert_response :success
 749
 750     collection = Collection.select([:uuid, :manifest_text]).where(uuid: collection['uuid']).first
 751     assert_match /. d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:file1renamed\n.\/dir1 d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:dir1file2 0:0:dir1imagefilerenamed.png 0:0:file2\n.\/dir2\/dir3 d41d8cd98f00b204e9800998ecf8427e\+0\+A(.*) 0:0:dir1file1moved\n$/, collection['manifest_text']
 752   end
 753
 754   test "renaming file with a duplicate name in same stream not allowed" do
 755     use_token :active
 756
 757     # rename 'file2' as 'file1' and expect error
 758     post :update, {
 759       id: 'zzzzz-4zz18-pyw8yp9g3pr7irn',
 760       collection: {
 761         'rename-file-path:file2' => 'file1'
 762       },
 763       format: :json
 764     }, session_for(:active)
 765     assert_response 422
 766     assert_includes json_response['errors'], 'Duplicate file path'
 767   end
 768
 769   test "renaming file with a duplicate name as another stream not allowed" do
 770     use_token :active
 771
 772     # rename 'file1' as 'dir1/file1' and expect error
 773     post :update, {
 774       id: 'zzzzz-4zz18-pyw8yp9g3pr7irn',
 775       collection: {
 776         'rename-file-path:file1' => 'dir1/file1'
 777       },
 778       format: :json
 779     }, session_for(:active)
 780     assert_response 422
 781     assert_includes json_response['errors'], 'Duplicate file path'
 782   end
 783
 784   [
 785     [:active, true],
 786     [:spectator, false],
 787   ].each do |user, editable|
 788     test "tags tab #{editable ? 'shows' : 'does not show'} edit button to #{user}" do
 789       use_token user
 790
 791       get :tags, {
 792         id: api_fixture('collections')['collection_with_tags_owned_by_active']['uuid'],
 793         format: :js,
 794       }, session_for(user)
 795
 796       assert_response :success
 797
 798       found = 0
 799       response.body.scan /<i[^>]+>/ do |remove_icon|
 800         remove_icon.scan(/\ collection-tag-remove(.*?)\"/).each do |i,|
 801           found += 1
 802         end
 803       end
 804
 805       if editable
 806         assert_equal(3, found)  # two from the tags + 1 from the hidden "add tag" row
 807       else
 808         assert_equal(0, found)
 809       end
 810     end
 811   end
 812
 813   test "save_tags and verify that 'other' properties are retained" do
 814     use_token :active
 815
 816     collection = api_fixture('collections')['collection_with_tags_owned_by_active']
 817
 818     new_tags = {"new_tag1" => "new_tag1_value",
 819                 "new_tag2" => "new_tag2_value"}
 820
 821     post :save_tags, {
 822       id: collection['uuid'],
 823       tag_data: new_tags,
 824       format: :js,
 825     }, session_for(:active)
 826
 827     assert_response :success
 828     assert_equal true, response.body.include?("new_tag1")
 829     assert_equal true, response.body.include?("new_tag1_value")
 830     assert_equal true, response.body.include?("new_tag2")
 831     assert_equal true, response.body.include?("new_tag2_value")
 832     assert_equal false, response.body.include?("existing tag 1")
 833     assert_equal false, response.body.include?("value for existing tag 1")
 834
 835     updated_tags = Collection.find(collection['uuid']).properties
 836     assert_equal true, updated_tags.keys.include?(:'new_tag1')
 837     assert_equal new_tags['new_tag1'], updated_tags[:'new_tag1']
 838     assert_equal true, updated_tags.keys.include?(:'new_tag2')
 839     assert_equal new_tags['new_tag2'], updated_tags[:'new_tag2']
 840     assert_equal false, updated_tags.keys.include?(:'existing tag 1')
 841     assert_equal false, updated_tags.keys.include?(:'existing tag 2')
 842   end
 843 end