3 class PermissionTest < ActiveSupport::TestCase
4 include CurrentApiClient
6 test "Grant permissions on an object I own" do
7 set_user_from_auth :active_trustedclient
12 # Ensure I have permission to manage this group even when its owner changes
13 perm_link = Link.create(tail_uuid: users(:active).uuid,
15 link_class: 'permission',
17 assert perm_link.save, "should give myself permission on my own object"
20 test "Delete permission links when deleting an object" do
21 set_user_from_auth :active_trustedclient
24 Link.create!(tail_uuid: users(:active).uuid,
26 link_class: 'permission',
29 assert ob.destroy, "Could not destroy object with 1 permission link"
30 assert_empty(Link.where(head_uuid: ob_uuid),
31 "Permission link was not deleted when object was deleted")
34 test "permission links owned by root" do
35 set_user_from_auth :active_trustedclient
37 perm_link = Link.create!(tail_uuid: users(:active).uuid,
39 link_class: 'permission',
41 assert_equal system_user_uuid, perm_link.owner_uuid
45 set_user_from_auth :active_trustedclient
48 Link.create!(tail_uuid: users(:active).uuid,
50 link_class: 'permission',
52 assert Specimen.readable_by(users(:active)).where(uuid: ob.uuid).any?, "user does not have read permission"
56 set_user_from_auth :active_trustedclient
59 Link.create!(tail_uuid: users(:active).uuid,
61 link_class: 'permission',
63 assert ob.writable_by.include?(users(:active).uuid), "user does not have write permission"
66 test "writable_by reports requesting user's own uuid for a writable project" do
67 invited_to_write = users(:project_viewer)
68 group = groups(:asubproject)
70 # project_view can read, but cannot see write or see writers list
71 set_user_from_auth :project_viewer
72 assert_equal([group.owner_uuid],
74 "writers list should just have owner_uuid")
76 # allow project_viewer to write for the remainder of the test
77 set_user_from_auth :admin
78 Link.create!(tail_uuid: invited_to_write.uuid,
79 head_uuid: group.uuid,
80 link_class: 'permission',
82 group.permissions.reload
84 # project_viewer should see self in writers list (but not all writers)
85 set_user_from_auth :project_viewer
86 assert_not_nil(group.writable_by,
87 "can write but cannot see writers list")
88 assert_includes(group.writable_by, invited_to_write.uuid,
89 "self missing from writers list")
90 assert_includes(group.writable_by, group.owner_uuid,
91 "project owner missing from writers list")
92 refute_includes(group.writable_by, users(:active).uuid,
93 "saw :active user in writers list")
95 # active user should see full writers list
96 set_user_from_auth :active
97 assert_includes(group.writable_by, invited_to_write.uuid,
98 "permission just added, but missing from writers list")
100 # allow project_viewer to manage for the remainder of the test
101 set_user_from_auth :admin
102 Link.create!(tail_uuid: invited_to_write.uuid,
103 head_uuid: group.uuid,
104 link_class: 'permission',
106 # invite another writer we can test for
107 Link.create!(tail_uuid: users(:spectator).uuid,
108 head_uuid: group.uuid,
109 link_class: 'permission',
111 group.permissions.reload
113 set_user_from_auth :project_viewer
114 assert_not_nil(group.writable_by,
115 "can manage but cannot see writers list")
116 assert_includes(group.writable_by, users(:spectator).uuid,
117 ":spectator missing from writers list")
120 test "user owns group, group can_manage object's group, user can add permissions" do
121 set_user_from_auth :admin
123 owner_grp = Group.create!(owner_uuid: users(:active).uuid)
125 sp_grp = Group.create!
126 sp = Specimen.create!(owner_uuid: sp_grp.uuid)
128 manage_perm = Link.create!(link_class: 'permission',
130 tail_uuid: owner_grp.uuid,
131 head_uuid: sp_grp.uuid)
133 # active user owns owner_grp, which has can_manage permission on sp_grp
134 # user should be able to add permissions on sp.
135 set_user_from_auth :active_trustedclient
136 test_perm = Link.create(tail_uuid: users(:active).uuid,
138 link_class: 'permission',
140 test_uuid = test_perm.uuid
141 assert test_perm.save, "could not save new permission on target object"
142 assert test_perm.destroy, "could not delete new permission on target object"
146 skip "can_manage permission on a non-group object" do
147 set_user_from_auth :admin
149 ob = Specimen.create!
150 # grant can_manage permission to active
151 perm_link = Link.create!(tail_uuid: users(:active).uuid,
153 link_class: 'permission',
155 # ob is owned by :admin, the link is owned by root
156 assert_equal users(:admin).uuid, ob.owner_uuid
157 assert_equal system_user_uuid, perm_link.owner_uuid
159 # user "active" can modify the permission link
160 set_user_from_auth :active_trustedclient
161 perm_link.properties["foo"] = 'bar'
162 assert perm_link.save, "could not save modified link"
164 assert_equal 'bar', perm_link.properties['foo'], "link properties do not include foo = bar"
167 test "user without can_manage permission may not modify permission link" do
168 set_user_from_auth :admin
170 ob = Specimen.create!
171 # grant can_manage permission to active
172 perm_link = Link.create!(tail_uuid: users(:active).uuid,
174 link_class: 'permission',
176 # ob is owned by :admin, the link is owned by root
177 assert_equal ob.owner_uuid, users(:admin).uuid
178 assert_equal perm_link.owner_uuid, system_user_uuid
180 # user "active" may not modify the permission link
181 set_user_from_auth :active_trustedclient
182 perm_link.name = 'can_manage'
183 assert_raises ArvadosModel::PermissionDeniedError do
188 test "manager user gets permission to minions' articles via can_manage link" do
189 manager = create :active_user, first_name: "Manage", last_name: "Er"
190 minion = create :active_user, first_name: "Min", last_name: "Ion"
191 minions_specimen = act_as_user minion do
194 # Manager creates a group. (Make sure it doesn't magically give
195 # anyone any additional permissions.)
197 act_as_user manager do
198 g = create :group, name: "NoBigSecret Lab"
199 assert_empty(User.readable_by(manager).where(uuid: minion.uuid),
200 "saw a user I shouldn't see")
201 assert_raises(ArvadosModel::PermissionDeniedError,
202 ActiveRecord::RecordInvalid,
203 "gave can_read permission to a user I shouldn't see") do
204 create(:permission_link,
205 name: 'can_read', tail_uuid: minion.uuid, head_uuid: g.uuid)
207 %w(can_manage can_write can_read).each do |perm_type|
208 assert_raises(ArvadosModel::PermissionDeniedError,
209 ActiveRecord::RecordInvalid,
210 "escalated privileges") do
211 create(:permission_link,
212 name: perm_type, tail_uuid: g.uuid, head_uuid: minion.uuid)
215 assert_empty(User.readable_by(manager).where(uuid: minion.uuid),
216 "manager saw minion too soon")
217 assert_empty(User.readable_by(minion).where(uuid: manager.uuid),
218 "minion saw manager too soon")
219 assert_empty(Group.readable_by(minion).where(uuid: g.uuid),
220 "minion saw manager's new NoBigSecret Lab group too soon")
222 # Manager declares everybody on the system should be able to see
223 # the NoBigSecret Lab group.
224 create(:permission_link,
226 tail_uuid: 'zzzzz-j7d0g-fffffffffffffff',
228 # ...but nobody has joined the group yet. Manager still can't see
230 assert_empty(User.readable_by(manager).where(uuid: minion.uuid),
231 "manager saw minion too soon")
234 act_as_user minion do
235 # Minion can see the group.
236 assert_not_empty(Group.readable_by(minion).where(uuid: g.uuid),
237 "minion could not see the NoBigSecret Lab group")
238 # Minion joins the group.
239 create(:permission_link,
242 head_uuid: minion.uuid)
245 act_as_user manager do
246 # Now, manager can see minion.
247 assert_not_empty(User.readable_by(manager).where(uuid: minion.uuid),
248 "manager could not see minion")
249 # But cannot obtain further privileges this way.
250 assert_raises(ArvadosModel::PermissionDeniedError,
251 "escalated privileges") do
252 create(:permission_link,
253 name: 'can_manage', tail_uuid: manager.uuid, head_uuid: minion.uuid)
255 assert_empty(Specimen
256 .readable_by(manager)
257 .where(uuid: minions_specimen.uuid),
258 "manager saw the minion's private stuff")
259 assert_raises(ArvadosModel::PermissionDeniedError,
260 "manager could update minion's private stuff") do
261 minions_specimen.update_attributes(properties: {'x' => 'y'})
265 act_as_system_user do
266 # Root can give Manager more privileges over Minion.
267 create(:permission_link,
268 name: 'can_manage', tail_uuid: g.uuid, head_uuid: minion.uuid)
271 act_as_user manager do
272 # Now, manager can read and write Minion's stuff.
273 assert_not_empty(Specimen
274 .readable_by(manager)
275 .where(uuid: minions_specimen.uuid),
276 "manager could not find minion's specimen by uuid")
278 minions_specimen.update_attributes(properties: {'x' => 'y'}),
279 "manager could not update minion's specimen object")
283 test "users with bidirectional read permission in group can see each other, but cannot see each other's private articles" do
284 a = create :active_user, first_name: "A"
285 b = create :active_user, first_name: "B"
286 other = create :active_user, first_name: "OTHER"
287 act_as_system_user do
290 create(:permission_link,
291 name: 'can_read', tail_uuid: u.uuid, head_uuid: g.uuid)
292 create(:permission_link,
293 name: 'can_read', head_uuid: u.uuid, tail_uuid: g.uuid)
296 a_specimen = act_as_user a do
299 assert_not_empty(Specimen.readable_by(a).where(uuid: a_specimen.uuid),
300 "A cannot read own Specimen, following test probably useless.")
301 assert_empty(Specimen.readable_by(b).where(uuid: a_specimen.uuid),
302 "B can read A's Specimen")
304 assert_empty(User.readable_by(u).where(uuid: other.uuid),
305 "#{u.first_name} can see OTHER in the user list")
306 assert_empty(User.readable_by(other).where(uuid: u.uuid),
307 "OTHER can see #{u.first_name} in the user list")
309 assert_raises ArvadosModel::PermissionDeniedError, "wrote without perm" do
310 other.update_attributes!(prefs: {'pwned' => true})
312 assert_equal(true, u.update_attributes!(prefs: {'thisisme' => true}),
313 "#{u.first_name} can't update its own prefs")
316 assert_raises(ArvadosModel::PermissionDeniedError,
317 "OTHER wrote #{u.first_name} without perm") do
318 u.update_attributes!(prefs: {'pwned' => true})
320 assert_equal(true, other.update_attributes!(prefs: {'thisisme' => true}),
321 "OTHER can't update its own prefs")
326 test "cannot create with owner = unwritable user" do
327 set_user_from_auth :rominiadmin
328 assert_raises ArvadosModel::PermissionDeniedError, "created with owner = unwritable user" do
329 Specimen.create!(owner_uuid: users(:active).uuid)
333 test "cannot change owner to unwritable user" do
334 set_user_from_auth :rominiadmin
335 ob = Specimen.create!
336 assert_raises ArvadosModel::PermissionDeniedError, "changed owner to unwritable user" do
337 ob.update_attributes!(owner_uuid: users(:active).uuid)
341 test "cannot create with owner = unwritable group" do
342 set_user_from_auth :rominiadmin
343 assert_raises ArvadosModel::PermissionDeniedError, "created with owner = unwritable group" do
344 Specimen.create!(owner_uuid: groups(:aproject).uuid)
348 test "cannot change owner to unwritable group" do
349 set_user_from_auth :rominiadmin
350 ob = Specimen.create!
351 assert_raises ArvadosModel::PermissionDeniedError, "changed owner to unwritable group" do
352 ob.update_attributes!(owner_uuid: groups(:aproject).uuid)
356 def container_logs(container, user)
357 Log.readable_by(users(user)).
358 where(object_uuid: containers(container).uuid, event_type: "test")
361 test "container logs created by dispatch are visible to container requestor" do
362 set_user_from_auth :dispatch1
363 Log.create!(object_uuid: containers(:running).uuid,
366 assert_not_empty container_logs(:running, :admin)
367 assert_not_empty container_logs(:running, :active)
368 assert_empty container_logs(:running, :spectator)
371 test "container logs created by dispatch are public if container request is public" do
372 set_user_from_auth :dispatch1
373 Log.create!(object_uuid: containers(:running_older).uuid,
376 assert_not_empty container_logs(:running_older, :anonymous)