services/api/test/integration/users_test.rb

   1 # Copyright (C) The Arvados Authors. All rights reserved.
   2 #
   3 # SPDX-License-Identifier: AGPL-3.0
   4
   5 require 'test_helper'
   6 require 'helpers/users_test_helper'
   7
   8 class UsersTest < ActionDispatch::IntegrationTest
   9   include UsersTestHelper
  10
  11   test "setup user multiple times" do
  12     repo_name = 'usertestrepo'
  13
  14     post "/arvados/v1/users/setup",
  15       params: {
  16         repo_name: repo_name,
  17         openid_prefix: 'https://www.google.com/accounts/o8/id',
  18         user: {
  19           uuid: 'zzzzz-tpzed-abcdefghijklmno',
  20           first_name: "in_create_test_first_name",
  21           last_name: "test_last_name",
  22           email: "foo@example.com"
  23         }
  24       },
  25       headers: auth(:admin)
  26
  27     assert_response :success
  28
  29     response_items = json_response['items']
  30
  31     created = find_obj_in_resp response_items, 'arvados#user', nil
  32
  33     assert_equal 'in_create_test_first_name', created['first_name']
  34     assert_not_nil created['uuid'], 'expected non-null uuid for the new user'
  35     assert_equal 'zzzzz-tpzed-abcdefghijklmno', created['uuid']
  36     assert_not_nil created['email'], 'expected non-nil email'
  37     assert_nil created['identity_url'], 'expected no identity_url'
  38
  39     # repo link and link add user to 'All users' group
  40
  41     verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
  42         'foo/usertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
  43
  44     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
  45         'All users', created['uuid'], 'arvados#group', true, 'Group'
  46
  47     verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login',
  48         nil, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
  49
  50     verify_system_group_permission_link_for created['uuid']
  51
  52     # invoke setup again with the same data
  53     post "/arvados/v1/users/setup",
  54       params: {
  55         repo_name: repo_name,
  56         vm_uuid: virtual_machines(:testvm).uuid,
  57         openid_prefix: 'https://www.google.com/accounts/o8/id',
  58         user: {
  59           uuid: 'zzzzz-tpzed-abcdefghijklmno',
  60           first_name: "in_create_test_first_name",
  61           last_name: "test_last_name",
  62           email: "foo@example.com"
  63         }
  64       },
  65       headers: auth(:admin)
  66     assert_response 422         # cannot create another user with same UUID
  67
  68     # invoke setup on the same user
  69     post "/arvados/v1/users/setup",
  70       params: {
  71         repo_name: repo_name,
  72         vm_uuid: virtual_machines(:testvm).uuid,
  73         openid_prefix: 'https://www.google.com/accounts/o8/id',
  74         uuid: 'zzzzz-tpzed-abcdefghijklmno',
  75       },
  76       headers: auth(:admin)
  77
  78     response_items = json_response['items']
  79
  80     created = find_obj_in_resp response_items, 'arvados#user', nil
  81     assert_equal 'in_create_test_first_name', created['first_name']
  82     assert_not_nil created['uuid'], 'expected non-null uuid for the new user'
  83     assert_equal 'zzzzz-tpzed-abcdefghijklmno', created['uuid']
  84     assert_not_nil created['email'], 'expected non-nil email'
  85     assert_nil created['identity_url'], 'expected no identity_url'
  86
  87     # arvados#user, repo link and link add user to 'All users' group
  88     verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
  89         'foo/usertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
  90
  91     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
  92         'All users', created['uuid'], 'arvados#group', true, 'Group'
  93
  94     verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login',
  95         virtual_machines(:testvm).uuid, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
  96
  97     verify_system_group_permission_link_for created['uuid']
  98   end
  99
 100   test "setup user in multiple steps and verify response" do
 101     post "/arvados/v1/users/setup",
 102       params: {
 103         openid_prefix: 'http://www.example.com/account',
 104         user: {
 105           email: "foo@example.com"
 106         }
 107       },
 108       headers: auth(:admin)
 109
 110     assert_response :success
 111     response_items = json_response['items']
 112     created = find_obj_in_resp response_items, 'arvados#user', nil
 113
 114     assert_not_nil created['uuid'], 'expected uuid for new user'
 115     assert_not_nil created['email'], 'expected non-nil email'
 116     assert_equal created['email'], 'foo@example.com', 'expected input email'
 117
 118     # two new links: system_group, and 'All users' group.
 119
 120     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
 121         'All users', created['uuid'], 'arvados#group', true, 'Group'
 122
 123     verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login',
 124         nil, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
 125
 126    # invoke setup with a repository
 127     post "/arvados/v1/users/setup",
 128       params: {
 129         openid_prefix: 'http://www.example.com/account',
 130         repo_name: 'newusertestrepo',
 131         uuid: created['uuid']
 132       },
 133       headers: auth(:admin)
 134
 135     assert_response :success
 136
 137     response_items = json_response['items']
 138     created = find_obj_in_resp response_items, 'arvados#user', nil
 139
 140     assert_equal 'foo@example.com', created['email'], 'expected input email'
 141
 142      # verify links
 143     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
 144         'All users', created['uuid'], 'arvados#group', true, 'Group'
 145
 146     verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
 147         'foo/newusertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
 148
 149     verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login',
 150         nil, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
 151
 152     # invoke setup with a vm_uuid
 153     post "/arvados/v1/users/setup",
 154       params: {
 155         vm_uuid: virtual_machines(:testvm).uuid,
 156         openid_prefix: 'http://www.example.com/account',
 157         user: {
 158           email: 'junk_email'
 159         },
 160         uuid: created['uuid']
 161       },
 162       headers: auth(:admin)
 163
 164     assert_response :success
 165
 166     response_items = json_response['items']
 167     created = find_obj_in_resp response_items, 'arvados#user', nil
 168
 169     assert_equal created['email'], 'foo@example.com', 'expected original email'
 170
 171     # verify links
 172     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
 173         'All users', created['uuid'], 'arvados#group', true, 'Group'
 174
 175     verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login',
 176         virtual_machines(:testvm).uuid, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
 177   end
 178
 179   test "setup and unsetup user" do
 180     post "/arvados/v1/users/setup",
 181       params: {
 182         repo_name: 'newusertestrepo',
 183         vm_uuid: virtual_machines(:testvm).uuid,
 184         user: {email: 'foo@example.com'},
 185         openid_prefix: 'https://www.google.com/accounts/o8/id'
 186       },
 187       headers: auth(:admin)
 188
 189     assert_response :success
 190     response_items = json_response['items']
 191     created = find_obj_in_resp response_items, 'arvados#user', nil
 192     assert_not_nil created['uuid'], 'expected uuid for the new user'
 193     assert_equal created['email'], 'foo@example.com', 'expected given email'
 194
 195     # four extra links: system_group, login, group, repo and vm
 196
 197     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
 198         'All users', created['uuid'], 'arvados#group', true, 'Group'
 199
 200     verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
 201         'foo/newusertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
 202
 203     verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login',
 204         virtual_machines(:testvm).uuid, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
 205
 206     verify_link_existence created['uuid'], created['email'], true, true, true, true, false
 207
 208     post "/arvados/v1/users/#{created['uuid']}/unsetup", params: {}, headers: auth(:admin)
 209
 210     assert_response :success
 211
 212     created2 = json_response
 213     assert_not_nil created2['uuid'], 'expected uuid for the newly created user'
 214     assert_equal created['uuid'], created2['uuid'], 'expected uuid not found'
 215
 216     verify_link_existence created['uuid'], created['email'], false, false, false, false, false
 217   end
 218
 219   def find_obj_in_resp (response_items, kind, head_kind=nil)
 220     response_items.each do |x|
 221       if x && x['kind']
 222         return x if (x['kind'] == kind && x['head_kind'] == head_kind)
 223       end
 224     end
 225     nil
 226   end
 227
 228   test 'merge active into project_viewer account' do
 229     post('/arvados/v1/groups',
 230       params: {
 231         group: {
 232           group_class: 'project',
 233           name: "active user's stuff",
 234         },
 235       },
 236       headers: auth(:project_viewer))
 237     assert_response(:success)
 238     project_uuid = json_response['uuid']
 239
 240     post('/arvados/v1/users/merge',
 241       params: {
 242         new_user_token: api_client_authorizations(:project_viewer_trustedclient).api_token,
 243         new_owner_uuid: project_uuid,
 244         redirect_to_new_user: true,
 245       },
 246       headers: auth(:active_trustedclient))
 247     assert_response(:success)
 248
 249     get('/arvados/v1/users/current', params: {}, headers: auth(:active))
 250     assert_response(:success)
 251     assert_equal(users(:project_viewer).uuid, json_response['uuid'])
 252
 253     get('/arvados/v1/authorized_keys/' + authorized_keys(:active).uuid,
 254       params: {},
 255       headers: auth(:active))
 256     assert_response(:success)
 257     assert_equal(users(:project_viewer).uuid, json_response['owner_uuid'])
 258     assert_equal(users(:project_viewer).uuid, json_response['authorized_user_uuid'])
 259
 260     get('/arvados/v1/repositories/' + repositories(:foo).uuid,
 261       params: {},
 262       headers: auth(:active))
 263     assert_response(:success)
 264     assert_equal(users(:project_viewer).uuid, json_response['owner_uuid'])
 265     assert_equal("#{users(:project_viewer).username}/foo", json_response['name'])
 266
 267     get('/arvados/v1/groups/' + groups(:aproject).uuid,
 268       params: {},
 269       headers: auth(:active))
 270     assert_response(:success)
 271     assert_equal(project_uuid, json_response['owner_uuid'])
 272   end
 273
 274   test 'pre-activate user' do
 275     post '/arvados/v1/users',
 276       params: {
 277         "user" => {
 278           "email" => 'foo@example.com',
 279           "is_active" => true,
 280           "username" => "barney"
 281         }
 282       },
 283       headers: {'HTTP_AUTHORIZATION' => "OAuth2 #{api_token(:admin)}"}
 284     assert_response :success
 285     rp = json_response
 286     assert_not_nil rp["uuid"]
 287     assert_not_nil rp["is_active"]
 288     assert_nil rp["is_admin"]
 289
 290     get "/arvados/v1/users/#{rp['uuid']}",
 291       params: {format: 'json'},
 292       headers: auth(:admin)
 293     assert_response :success
 294     assert_equal rp["uuid"], json_response['uuid']
 295     assert_nil json_response['is_admin']
 296     assert_equal true, json_response['is_active']
 297     assert_equal 'foo@example.com', json_response['email']
 298     assert_equal 'barney', json_response['username']
 299   end
 300
 301   test 'merge with repository name conflict' do
 302     post('/arvados/v1/groups',
 303       params: {
 304         group: {
 305           group_class: 'project',
 306           name: "active user's stuff",
 307         },
 308       },
 309       headers: auth(:project_viewer))
 310     assert_response(:success)
 311     project_uuid = json_response['uuid']
 312
 313     post('/arvados/v1/repositories/',
 314          params: { :repository => { :name => "#{users(:project_viewer).username}/foo", :owner_uuid => users(:project_viewer).uuid } },
 315          headers: auth(:project_viewer))
 316     assert_response(:success)
 317
 318     post('/arvados/v1/users/merge',
 319       params: {
 320         new_user_token: api_client_authorizations(:project_viewer_trustedclient).api_token,
 321         new_owner_uuid: project_uuid,
 322         redirect_to_new_user: true,
 323       },
 324       headers: auth(:active_trustedclient))
 325     assert_response(:success)
 326
 327     get('/arvados/v1/repositories/' + repositories(:foo).uuid,
 328       params: {},
 329       headers: auth(:active))
 330     assert_response(:success)
 331     assert_equal(users(:project_viewer).uuid, json_response['owner_uuid'])
 332     assert_equal("#{users(:project_viewer).username}/migratedfoo", json_response['name'])
 333
 334   end
 335
 336   test "cannot set is_activate to false directly" do
 337     post('/arvados/v1/users',
 338       params: {
 339         user: {
 340           email: "bob@example.com",
 341           username: "bobby"
 342         },
 343       },
 344       headers: auth(:admin))
 345     assert_response(:success)
 346     user = json_response
 347     assert_equal false, user['is_active']
 348
 349     post("/arvados/v1/users/#{user['uuid']}/activate",
 350       params: {},
 351       headers: auth(:admin))
 352     assert_response(:success)
 353     user = json_response
 354     assert_equal true, user['is_active']
 355
 356     put("/arvados/v1/users/#{user['uuid']}",
 357          params: {
 358            user: {is_active: false}
 359          },
 360          headers: auth(:admin))
 361     assert_response 422
 362   end
 363
 364   test "cannot self activate when AutoSetupNewUsers is false" do
 365     Rails.configuration.Users.NewUsersAreActive = false
 366     Rails.configuration.Users.AutoSetupNewUsers = false
 367
 368     user = nil
 369     token = nil
 370     act_as_system_user do
 371       user = User.create!(email: "bob@example.com", username: "bobby")
 372       ap = ApiClientAuthorization.create!(user: user, api_client: ApiClient.all.first)
 373       token = ap.api_token
 374     end
 375
 376     get("/arvados/v1/users/#{user['uuid']}",
 377         params: {},
 378         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 379     assert_response(:success)
 380     user = json_response
 381     assert_equal false, user['is_active']
 382
 383     post("/arvados/v1/users/#{user['uuid']}/activate",
 384         params: {},
 385         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 386     assert_response 422
 387     assert_match(/Cannot activate without being invited/, json_response['errors'][0])
 388   end
 389
 390
 391   test "cannot self activate after unsetup" do
 392     Rails.configuration.Users.NewUsersAreActive = false
 393     Rails.configuration.Users.AutoSetupNewUsers = false
 394
 395     user = nil
 396     token = nil
 397     act_as_system_user do
 398       user = User.create!(email: "bob@example.com", username: "bobby")
 399       ap = ApiClientAuthorization.create!(user: user, api_client_id: 0)
 400       token = ap.api_token
 401     end
 402
 403     post("/arvados/v1/users/setup",
 404         params: {uuid: user['uuid']},
 405         headers: auth(:admin))
 406     assert_response :success
 407
 408     post("/arvados/v1/users/#{user['uuid']}/activate",
 409         params: {},
 410         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 411     assert_response 403
 412     assert_match(/Cannot activate without user agreements/, json_response['errors'][0])
 413
 414     post("/arvados/v1/user_agreements/sign",
 415         params: {uuid: 'zzzzz-4zz18-t68oksiu9m80s4y'},
 416         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 417     assert_response :success
 418
 419     post("/arvados/v1/users/#{user['uuid']}/activate",
 420         params: {},
 421         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 422     assert_response :success
 423
 424     get("/arvados/v1/users/#{user['uuid']}",
 425         params: {},
 426         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 427     assert_response(:success)
 428     user = json_response
 429     assert_equal true, user['is_active']
 430
 431     post("/arvados/v1/users/#{user['uuid']}/unsetup",
 432         params: {},
 433         headers: auth(:admin))
 434     assert_response :success
 435
 436     get("/arvados/v1/users/#{user['uuid']}",
 437         params: {},
 438         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 439     assert_response(:success)
 440     user = json_response
 441     assert_equal false, user['is_active']
 442
 443     post("/arvados/v1/users/#{user['uuid']}/activate",
 444         params: {},
 445         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 446     assert_response 422
 447     assert_match(/Cannot activate without being invited/, json_response['errors'][0])
 448   end
 449
 450
 451 end