1 # Copyright (C) The Arvados Authors. All rights reserved.
3 # SPDX-License-Identifier: AGPL-3.0
7 class Arvados::V1::GroupsControllerTest < ActionController::TestCase
9 test "attempt to delete group without read or write access" do
10 authorize_with :active
11 post :destroy, id: groups(:empty_lonely_group).uuid
15 test "attempt to delete group without write access" do
16 authorize_with :active
17 post :destroy, id: groups(:all_users).uuid
21 test "get list of projects" do
22 authorize_with :active
23 get :index, filters: [['group_class', '=', 'project']], format: :json
24 assert_response :success
26 json_response['items'].each do |group|
27 assert_equal 'project', group['group_class']
28 group_uuids << group['uuid']
30 assert_includes group_uuids, groups(:aproject).uuid
31 assert_includes group_uuids, groups(:asubproject).uuid
32 assert_not_includes group_uuids, groups(:system_group).uuid
33 assert_not_includes group_uuids, groups(:private).uuid
36 test "get list of groups that are not projects" do
37 authorize_with :active
38 get :index, filters: [['group_class', '!=', 'project']], format: :json
39 assert_response :success
41 json_response['items'].each do |group|
42 assert_not_equal 'project', group['group_class']
43 group_uuids << group['uuid']
45 assert_not_includes group_uuids, groups(:aproject).uuid
46 assert_not_includes group_uuids, groups(:asubproject).uuid
47 assert_includes group_uuids, groups(:private).uuid
48 assert_includes group_uuids, groups(:group_with_no_class).uuid
51 test "get list of groups with bogus group_class" do
52 authorize_with :active
54 filters: [['group_class', '=', 'nogrouphasthislittleclass']],
57 assert_response :success
58 assert_equal [], json_response['items']
59 assert_equal 0, json_response['items_available']
62 def check_project_contents_response disabled_kinds=[]
63 assert_response :success
64 assert_operator 2, :<=, json_response['items_available']
65 assert_operator 2, :<=, json_response['items'].count
66 kinds = json_response['items'].collect { |i| i['kind'] }.uniq
67 expect_kinds = %w'arvados#group arvados#specimen arvados#pipelineTemplate arvados#job' - disabled_kinds
68 assert_equal expect_kinds, (expect_kinds & kinds)
70 json_response['items'].each do |i|
71 if i['kind'] == 'arvados#group'
72 assert(i['group_class'] == 'project',
73 "group#contents returned a non-project group")
77 disabled_kinds.each do |d|
78 assert_equal true, !kinds.include?(d)
82 test 'get group-owned objects' do
83 authorize_with :active
85 id: groups(:aproject).uuid,
88 check_project_contents_response
91 test "user with project read permission can see project objects" do
92 authorize_with :project_viewer
94 id: groups(:aproject).uuid,
97 check_project_contents_response
100 test "list objects across projects" do
101 authorize_with :project_viewer
104 filters: [['uuid', 'is_a', 'arvados#specimen']]
106 assert_response :success
107 found_uuids = json_response['items'].collect { |i| i['uuid'] }
108 [[:in_aproject, true],
109 [:in_asubproject, true],
110 [:owned_by_private_group, false]].each do |specimen_fixture, should_find|
112 assert_includes found_uuids, specimens(specimen_fixture).uuid, "did not find specimen fixture '#{specimen_fixture}'"
114 refute_includes found_uuids, specimens(specimen_fixture).uuid, "found specimen fixture '#{specimen_fixture}'"
119 test "list trashed collections and projects" do
120 authorize_with :active
125 ['uuid', 'is_a', ['arvados#collection', 'arvados#group']],
126 ['is_trashed', '=', true],
130 assert_response :success
131 found_uuids = json_response['items'].collect { |i| i['uuid'] }
132 assert_includes found_uuids, groups(:trashed_project).uuid
133 refute_includes found_uuids, groups(:aproject).uuid
134 assert_includes found_uuids, collections(:expired_collection).uuid
135 refute_includes found_uuids, collections(:w_a_z_file).uuid
138 test "list objects in home project" do
139 authorize_with :active
143 id: users(:active).uuid
145 assert_response :success
146 found_uuids = json_response['items'].collect { |i| i['uuid'] }
147 assert_includes found_uuids, specimens(:owned_by_active_user).uuid, "specimen did not appear in home project"
148 refute_includes found_uuids, specimens(:in_asubproject).uuid, "specimen appeared unexpectedly in home project"
151 test "user with project read permission can see project collections" do
152 authorize_with :project_viewer
154 id: groups(:asubproject).uuid,
157 ids = json_response['items'].map { |item| item["uuid"] }
158 assert_includes ids, collections(:baz_file_in_asubproject).uuid
162 ['collections.name', 'asc', :<=, "name"],
163 ['collections.name', 'desc', :>=, "name"],
164 ['name', 'asc', :<=, "name"],
165 ['name', 'desc', :>=, "name"],
166 ['collections.created_at', 'asc', :<=, "created_at"],
167 ['collections.created_at', 'desc', :>=, "created_at"],
168 ['created_at', 'asc', :<=, "created_at"],
169 ['created_at', 'desc', :>=, "created_at"],
170 ].each do |column, order, operator, field|
171 test "user with project read permission can sort projects on #{column} #{order}" do
172 authorize_with :project_viewer
174 id: groups(:asubproject).uuid,
176 filters: [['uuid', 'is_a', "arvados#collection"]],
177 order: "#{column} #{order}"
179 sorted_values = json_response['items'].collect { |item| item[field] }
181 # Here we avoid assuming too much about the database
182 # collation. Both "alice"<"Bob" and "alice">"Bob" can be
183 # correct. Hopefully it _is_ safe to assume that if "a" comes
184 # before "b" in the ascii alphabet, "aX">"bY" is never true for
185 # any strings X and Y.
186 reliably_sortable_names = sorted_values.select do |name|
187 name[0] >= 'a' && name[0] <= 'z'
191 # Preserve order of sorted_values. But do not use &=. If
192 # sorted_values has out-of-order duplicates, we want to preserve
193 # them here, so we can detect them and fail the test below.
194 sorted_values.select! do |name|
195 reliably_sortable_names.include? name
198 assert_sorted(operator, sorted_values)
202 def assert_sorted(operator, sorted_items)
203 actually_checked_anything = false
205 sorted_items.each do |entry|
207 assert_operator(previous, operator, entry,
208 "Entries sorted incorrectly.")
209 actually_checked_anything = true
213 assert actually_checked_anything, "Didn't even find two items to compare."
216 # Even though the project_viewer tests go through other controllers,
217 # I'm putting them here so they're easy to find alongside the other
219 def check_new_project_link_fails(link_attrs)
220 @controller = Arvados::V1::LinksController.new
221 post :create, link: {
222 link_class: "permission",
224 head_uuid: groups(:aproject).uuid,
226 assert_includes(403..422, response.status)
229 test "user with project read permission can't add users to it" do
230 authorize_with :project_viewer
231 check_new_project_link_fails(tail_uuid: users(:spectator).uuid)
234 test "user with project read permission can't add items to it" do
235 authorize_with :project_viewer
236 check_new_project_link_fails(tail_uuid: collections(:baz_file).uuid)
239 test "user with project read permission can't rename items in it" do
240 authorize_with :project_viewer
241 @controller = Arvados::V1::LinksController.new
243 id: jobs(:running).uuid,
244 name: "Denied test name",
246 assert_includes(403..404, response.status)
249 test "user with project read permission can't remove items from it" do
250 @controller = Arvados::V1::PipelineTemplatesController.new
251 authorize_with :project_viewer
253 id: pipeline_templates(:two_part).uuid,
255 owner_uuid: users(:project_viewer).uuid,
261 test "user with project read permission can't delete it" do
262 authorize_with :project_viewer
263 post :destroy, {id: groups(:aproject).uuid}
267 test 'get group-owned objects with limit' do
268 authorize_with :active
270 id: groups(:aproject).uuid,
274 assert_response :success
275 assert_operator 1, :<, json_response['items_available']
276 assert_equal 1, json_response['items'].count
279 test 'get group-owned objects with limit and offset' do
280 authorize_with :active
282 id: groups(:aproject).uuid,
287 assert_response :success
288 assert_operator 1, :<, json_response['items_available']
289 assert_equal 0, json_response['items'].count
292 test 'get group-owned objects with additional filter matching nothing' do
293 authorize_with :active
295 id: groups(:aproject).uuid,
296 filters: [['uuid', 'in', ['foo_not_a_uuid','bar_not_a_uuid']]],
299 assert_response :success
300 assert_equal [], json_response['items']
301 assert_equal 0, json_response['items_available']
304 %w(offset limit).each do |arg|
305 ['foo', '', '1234five', '0x10', '-8'].each do |val|
306 test "Raise error on bogus #{arg} parameter #{val.inspect}" do
307 authorize_with :active
309 :id => groups(:aproject).uuid,
318 test "Collection contents don't include manifest_text" do
319 authorize_with :active
321 id: groups(:aproject).uuid,
322 filters: [["uuid", "is_a", "arvados#collection"]],
325 assert_response :success
326 refute(json_response["items"].any? { |c| not c["portable_data_hash"] },
327 "response included an item without a portable data hash")
328 refute(json_response["items"].any? { |c| c.include?("manifest_text") },
329 "response included an item with a manifest text")
332 test 'get writable_by list for owned group' do
333 authorize_with :active
335 id: groups(:aproject).uuid,
338 assert_response :success
339 assert_not_nil(json_response['writable_by'],
340 "Should receive uuid list in 'writable_by' field")
341 assert_includes(json_response['writable_by'], users(:active).uuid,
342 "owner should be included in writable_by list")
345 test 'no writable_by list for group with read-only access' do
346 authorize_with :rominiadmin
348 id: groups(:testusergroup_admins).uuid,
351 assert_response :success
352 assert_equal([json_response['owner_uuid']],
353 json_response['writable_by'],
354 "Should only see owner_uuid in 'writable_by' field")
357 test 'get writable_by list by admin user' do
358 authorize_with :admin
360 id: groups(:testusergroup_admins).uuid,
363 assert_response :success
364 assert_not_nil(json_response['writable_by'],
365 "Should receive uuid list in 'writable_by' field")
366 assert_includes(json_response['writable_by'],
368 "Current user should be included in 'writable_by' field")
371 test 'creating subproject with duplicate name fails' do
372 authorize_with :active
376 owner_uuid: users(:active).uuid,
377 group_class: 'project',
381 response_errors = json_response['errors']
382 assert_not_nil response_errors, 'Expected error in response'
383 assert(response_errors.first.include?('duplicate key'),
384 "Expected 'duplicate key' error in #{response_errors.first}")
387 test 'creating duplicate named subproject succeeds with ensure_unique_name' do
388 authorize_with :active
392 owner_uuid: users(:active).uuid,
393 group_class: 'project',
395 ensure_unique_name: true
397 assert_response :success
398 new_project = json_response
399 assert_not_equal(new_project['uuid'],
400 groups(:aproject).uuid,
401 "create returned same uuid as existing project")
402 assert_match(/^A Project \(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z\)$/,
406 test "create request with async=true returns 202 Accepted" do
407 name = "Random group #{rand(1000)}"
408 assert_equal nil, Group.find_by_name(name)
409 authorize_with :active
416 assert_response :accepted
417 assert_not_equal nil, Group.find_by_name(name)
420 test "unsharing a project results in hiding it from previously shared user" do
421 # remove sharing link for project
422 @controller = Arvados::V1::LinksController.new
423 authorize_with :admin
424 post :destroy, id: links(:share_starred_project_with_project_viewer).uuid
425 assert_response :success
427 # verify that the user can no longer see the project
428 @test_counter = 0 # Reset executed action counter
429 @controller = Arvados::V1::GroupsController.new
430 authorize_with :project_viewer
431 get :index, filters: [['group_class', '=', 'project']], format: :json
432 assert_response :success
434 json_response['items'].each do |g|
435 found_projects[g['uuid']] = g
437 assert_equal false, found_projects.include?(groups(:starred_and_shared_active_user_project).uuid)
441 @controller = Arvados::V1::LinksController.new
442 authorize_with :system_user
443 post :create, link: {
444 link_class: "permission",
446 head_uuid: groups(:starred_and_shared_active_user_project).uuid,
447 tail_uuid: users(:project_viewer).uuid,
450 # verify that project_viewer user can now see shared project again
452 @controller = Arvados::V1::GroupsController.new
453 authorize_with :project_viewer
454 get :index, filters: [['group_class', '=', 'project']], format: :json
455 assert_response :success
457 json_response['items'].each do |g|
458 found_projects[g['uuid']] = g
460 assert_equal true, found_projects.include?(groups(:starred_and_shared_active_user_project).uuid)
464 [['owner_uuid', '!=', 'zzzzz-tpzed-xurymjxw79nv3jz'], 200,
465 'zzzzz-d1hrv-subprojpipeline', 'zzzzz-d1hrv-1xfj6xkicf2muk2'],
466 [["pipeline_instances.state", "not in", ["Complete", "Failed"]], 200,
467 'zzzzz-d1hrv-1xfj6xkicf2muk2', 'zzzzz-d1hrv-i3e77t9z5y8j9cc'],
468 [['container_requests.requesting_container_uuid', '=', nil], 200,
469 'zzzzz-xvhdp-cr4queuedcontnr', 'zzzzz-xvhdp-cr4requestercn2'],
470 [['container_requests.no_such_column', '=', nil], 422],
471 [['container_requests.', '=', nil], 422],
472 [['.requesting_container_uuid', '=', nil], 422],
473 [['no_such_table.uuid', '!=', 'zzzzz-tpzed-xurymjxw79nv3jz'], 422],
474 ].each do |filter, expect_code, expect_uuid, not_expect_uuid|
475 test "get contents with '#{filter}' filter" do
476 authorize_with :active
477 get :contents, filters: [filter], format: :json
478 assert_response expect_code
479 if expect_code == 200
480 assert_not_empty json_response['items']
481 item_uuids = json_response['items'].collect {|item| item['uuid']}
482 assert_includes(item_uuids, expect_uuid)
483 assert_not_includes(item_uuids, not_expect_uuid)
488 test 'get contents with jobs and pipeline instances disabled' do
489 Rails.configuration.disable_api_methods = ['jobs.index', 'pipeline_instances.index']
491 authorize_with :active
493 id: groups(:aproject).uuid,
496 check_project_contents_response %w'arvados#pipelineInstance arvados#job'
499 test 'get contents with low max_index_database_read' do
500 # Some result will certainly have at least 12 bytes in a
502 Rails.configuration.max_index_database_read = 12
503 authorize_with :active
505 id: groups(:aproject).uuid,
508 assert_response :success
509 assert_not_empty(json_response['items'])
510 assert_operator(json_response['items'].count,
511 :<, json_response['items_available'])
514 test 'get contents, recursive=true' do
515 authorize_with :active
517 id: groups(:aproject).uuid,
521 get :contents, params
522 owners = json_response['items'].map do |item|
525 assert_includes(owners, groups(:aproject).uuid)
526 assert_includes(owners, groups(:asubproject).uuid)
529 [false, nil].each do |recursive|
530 test "get contents, recursive=#{recursive.inspect}" do
531 authorize_with :active
533 id: groups(:aproject).uuid,
536 params[:recursive] = false if recursive == false
537 get :contents, params
538 owners = json_response['items'].map do |item|
541 assert_includes(owners, groups(:aproject).uuid)
542 refute_includes(owners, groups(:asubproject).uuid)
546 test 'get home project contents, recursive=true' do
547 authorize_with :active
549 id: users(:active).uuid,
553 owners = json_response['items'].map do |item|
556 assert_includes(owners, users(:active).uuid)
557 assert_includes(owners, groups(:aproject).uuid)
558 assert_includes(owners, groups(:asubproject).uuid)
561 ### trashed project tests ###
563 [:active, :admin].each do |auth|
564 # project: to query, to untrash, is visible, parent contents listing success
565 [[:trashed_project, [], false, true],
566 [:trashed_project, [:trashed_project], true, true],
567 [:trashed_subproject, [], false, false],
568 [:trashed_subproject, [:trashed_project], true, true],
569 [:trashed_subproject3, [:trashed_project], false, true],
570 [:trashed_subproject3, [:trashed_subproject3], false, false],
571 [:trashed_subproject3, [:trashed_project, :trashed_subproject3], true, true],
572 ].each do |project, untrash, visible, success|
574 test "contents listing #{project} #{untrash} as #{auth}" do
577 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
580 id: groups(project).owner_uuid,
584 assert_response :success
585 item_uuids = json_response['items'].map do |item|
589 assert_includes(item_uuids, groups(project).uuid)
591 assert_not_includes(item_uuids, groups(project).uuid)
598 test "contents of #{project} #{untrash} as #{auth}" do
601 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
604 id: groups(project).uuid,
608 assert_response :success
614 test "index #{project} #{untrash} as #{auth}" do
617 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
622 assert_response :success
623 item_uuids = json_response['items'].map do |item|
627 assert_includes(item_uuids, groups(project).uuid)
629 assert_not_includes(item_uuids, groups(project).uuid)
633 test "show #{project} #{untrash} as #{auth}" do
636 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
639 id: groups(project).uuid,
643 assert_response :success
649 test "show include_trash #{project} #{untrash} as #{auth}" do
652 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
655 id: groups(project).uuid,
659 assert_response :success
662 test "index include_trash #{project} #{untrash} as #{auth}" do
665 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
671 assert_response :success
672 item_uuids = json_response['items'].map do |item|
675 assert_includes(item_uuids, groups(project).uuid)
679 test "delete project #{auth}" do
681 [:trashed_project].each do |pr|
682 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
684 assert !Group.find_by_uuid(groups(:trashed_project).uuid).is_trashed
686 id: groups(:trashed_project).uuid,
689 assert_response :success
690 assert Group.find_by_uuid(groups(:trashed_project).uuid).is_trashed
693 test "untrash project #{auth}" do
695 assert Group.find_by_uuid(groups(:trashed_project).uuid).is_trashed
697 id: groups(:trashed_project).uuid,
700 assert_response :success
701 assert !Group.find_by_uuid(groups(:trashed_project).uuid).is_trashed
704 test "untrash project with name conflict #{auth}" do
706 [:trashed_project].each do |pr|
707 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
709 gc = Group.create!({owner_uuid: "zzzzz-j7d0g-trashedproject1",
710 name: "trashed subproject 3",
711 group_class: "project"})
713 id: groups(:trashed_subproject3).uuid,
715 ensure_unique_name: true
717 assert_response :success
718 assert_match /^trashed subproject 3 \(\d{4}-\d\d-\d\d.*?Z\)$/, json_response['name']
721 test "move trashed subproject to new owner #{auth}" do
723 assert_nil Group.readable_by(users(auth)).where(uuid: groups(:trashed_subproject).uuid).first
725 id: groups(:trashed_subproject).uuid,
727 owner_uuid: users(:active).uuid
732 assert_response :success
733 assert_not_nil Group.readable_by(users(auth)).where(uuid: groups(:trashed_subproject).uuid).first
737 test 'get shared owned by another user' do
738 authorize_with :user_bar_in_sharing_group
740 act_as_system_user do
742 tail_uuid: users(:user_bar_in_sharing_group).uuid,
743 link_class: 'permission',
745 head_uuid: groups(:project_owned_by_foo).uuid)
748 get :shared, {:filters => [["group_class", "=", "project"]], :include => "owner_uuid"}
750 assert_equal 1, json_response['items'].length
751 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
753 assert_equal 1, json_response['included'].length
754 assert_equal json_response['included'][0]["uuid"], users(:user_foo_in_sharing_group).uuid
757 test 'get shared, owned by unreadable project' do
758 authorize_with :user_bar_in_sharing_group
760 act_as_system_user do
761 Group.find_by_uuid(groups(:project_owned_by_foo).uuid).update!(owner_uuid: groups(:aproject).uuid)
763 tail_uuid: users(:user_bar_in_sharing_group).uuid,
764 link_class: 'permission',
766 head_uuid: groups(:project_owned_by_foo).uuid)
769 get :shared, {:filters => [["group_class", "=", "project"]], :include => "owner_uuid"}
771 assert_equal 1, json_response['items'].length
772 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
774 assert_equal 0, json_response['included'].length
777 test 'get shared, owned by non-project' do
778 authorize_with :user_bar_in_sharing_group
780 act_as_system_user do
781 Group.find_by_uuid(groups(:project_owned_by_foo).uuid).update!(owner_uuid: groups(:group_for_sharing_tests).uuid)
784 get :shared, {:filters => [["group_class", "=", "project"]], :include => "owner_uuid"}
786 assert_equal 1, json_response['items'].length
787 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
789 assert_equal 1, json_response['included'].length
790 assert_equal json_response['included'][0]["uuid"], groups(:group_for_sharing_tests).uuid
793 ### contents with exclude_home_project
795 test 'contents, exclude home owned by another user' do
796 authorize_with :user_bar_in_sharing_group
798 act_as_system_user do
800 tail_uuid: users(:user_bar_in_sharing_group).uuid,
801 link_class: 'permission',
803 head_uuid: groups(:project_owned_by_foo).uuid)
805 tail_uuid: users(:user_bar_in_sharing_group).uuid,
806 link_class: 'permission',
808 head_uuid: collections(:collection_owned_by_foo).uuid)
811 get :contents, {:include => "owner_uuid", :exclude_home_project => true}
813 assert_equal 2, json_response['items'].length
814 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
815 assert_equal json_response['items'][1]["uuid"], collections(:collection_owned_by_foo).uuid
817 assert_equal 1, json_response['included'].length
818 assert_equal json_response['included'][0]["uuid"], users(:user_foo_in_sharing_group).uuid
821 test 'contents, exclude home, owned by unreadable project' do
822 authorize_with :user_bar_in_sharing_group
824 act_as_system_user do
825 Group.find_by_uuid(groups(:project_owned_by_foo).uuid).update!(owner_uuid: groups(:aproject).uuid)
827 tail_uuid: users(:user_bar_in_sharing_group).uuid,
828 link_class: 'permission',
830 head_uuid: groups(:project_owned_by_foo).uuid)
833 get :contents, {:include => "owner_uuid", :exclude_home_project => true}
835 assert_equal 1, json_response['items'].length
836 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
838 assert_equal 0, json_response['included'].length
841 test 'contents, exclude home, owned by non-project' do
842 authorize_with :user_bar_in_sharing_group
844 act_as_system_user do
845 Group.find_by_uuid(groups(:project_owned_by_foo).uuid).update!(owner_uuid: groups(:group_for_sharing_tests).uuid)
848 get :contents, {:include => "owner_uuid", :exclude_home_project => true}
850 assert_equal 1, json_response['items'].length
851 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
853 assert_equal 1, json_response['included'].length
854 assert_equal json_response['included'][0]["uuid"], groups(:group_for_sharing_tests).uuid
858 test 'contents, exclude home, with parent specified' do
859 authorize_with :active
861 get :contents, {id: groups(:aproject).uuid, :include => "owner_uuid", :exclude_home_project => true}