services/api/test/integration/users_test.rb

   1 # Copyright (C) The Arvados Authors. All rights reserved.
   2 #
   3 # SPDX-License-Identifier: AGPL-3.0
   4
   5 require 'test_helper'
   6 require 'helpers/users_test_helper'
   7
   8 class UsersTest < ActionDispatch::IntegrationTest
   9   include UsersTestHelper
  10
  11   test "setup user multiple times" do
  12     repo_name = 'usertestrepo'
  13
  14     post "/arvados/v1/users/setup",
  15       params: {
  16         repo_name: repo_name,
  17         openid_prefix: 'https://www.google.com/accounts/o8/id',
  18         user: {
  19           uuid: 'zzzzz-tpzed-abcdefghijklmno',
  20           first_name: "in_create_test_first_name",
  21           last_name: "test_last_name",
  22           email: "foo@example.com"
  23         }
  24       },
  25       headers: auth(:admin)
  26
  27     assert_response :success
  28
  29     response_items = json_response['items']
  30
  31     created = find_obj_in_resp response_items, 'arvados#user', nil
  32
  33     assert_equal 'in_create_test_first_name', created['first_name']
  34     assert_not_nil created['uuid'], 'expected non-null uuid for the new user'
  35     assert_equal 'zzzzz-tpzed-abcdefghijklmno', created['uuid']
  36     assert_not_nil created['email'], 'expected non-nil email'
  37     assert_nil created['identity_url'], 'expected no identity_url'
  38
  39     # arvados#user, repo link and link add user to 'All users' group
  40     verify_link response_items, 'arvados#user', true, 'permission', 'can_login',
  41         created['uuid'], created['email'], 'arvados#user', false, 'arvados#user'
  42
  43     verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
  44         'foo/usertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
  45
  46     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
  47         'All users', created['uuid'], 'arvados#group', true, 'Group'
  48
  49     verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login',
  50         nil, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
  51
  52     verify_system_group_permission_link_for created['uuid']
  53
  54     # invoke setup again with the same data
  55     post "/arvados/v1/users/setup",
  56       params: {
  57         repo_name: repo_name,
  58         vm_uuid: virtual_machines(:testvm).uuid,
  59         openid_prefix: 'https://www.google.com/accounts/o8/id',
  60         user: {
  61           uuid: 'zzzzz-tpzed-abcdefghijklmno',
  62           first_name: "in_create_test_first_name",
  63           last_name: "test_last_name",
  64           email: "foo@example.com"
  65         }
  66       },
  67       headers: auth(:admin)
  68     assert_response 422         # cannot create another user with same UUID
  69
  70     # invoke setup on the same user
  71     post "/arvados/v1/users/setup",
  72       params: {
  73         repo_name: repo_name,
  74         vm_uuid: virtual_machines(:testvm).uuid,
  75         openid_prefix: 'https://www.google.com/accounts/o8/id',
  76         uuid: 'zzzzz-tpzed-abcdefghijklmno',
  77       },
  78       headers: auth(:admin)
  79
  80     response_items = json_response['items']
  81
  82     created = find_obj_in_resp response_items, 'arvados#user', nil
  83     assert_equal 'in_create_test_first_name', created['first_name']
  84     assert_not_nil created['uuid'], 'expected non-null uuid for the new user'
  85     assert_equal 'zzzzz-tpzed-abcdefghijklmno', created['uuid']
  86     assert_not_nil created['email'], 'expected non-nil email'
  87     assert_nil created['identity_url'], 'expected no identity_url'
  88
  89     # arvados#user, repo link and link add user to 'All users' group
  90     verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
  91         'foo/usertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
  92
  93     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
  94         'All users', created['uuid'], 'arvados#group', true, 'Group'
  95
  96     verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login',
  97         virtual_machines(:testvm).uuid, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
  98
  99     verify_system_group_permission_link_for created['uuid']
 100   end
 101
 102   test "setup user in multiple steps and verify response" do
 103     post "/arvados/v1/users/setup",
 104       params: {
 105         openid_prefix: 'http://www.example.com/account',
 106         user: {
 107           email: "foo@example.com"
 108         }
 109       },
 110       headers: auth(:admin)
 111
 112     assert_response :success
 113     response_items = json_response['items']
 114     created = find_obj_in_resp response_items, 'arvados#user', nil
 115
 116     assert_not_nil created['uuid'], 'expected uuid for new user'
 117     assert_not_nil created['email'], 'expected non-nil email'
 118     assert_equal created['email'], 'foo@example.com', 'expected input email'
 119
 120     # three new links: system_group, arvados#user, and 'All users' group.
 121     verify_link response_items, 'arvados#user', true, 'permission', 'can_login',
 122         created['uuid'], created['email'], 'arvados#user', false, 'arvados#user'
 123
 124     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
 125         'All users', created['uuid'], 'arvados#group', true, 'Group'
 126
 127     verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login',
 128         nil, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
 129
 130    # invoke setup with a repository
 131     post "/arvados/v1/users/setup",
 132       params: {
 133         openid_prefix: 'http://www.example.com/account',
 134         repo_name: 'newusertestrepo',
 135         uuid: created['uuid']
 136       },
 137       headers: auth(:admin)
 138
 139     assert_response :success
 140
 141     response_items = json_response['items']
 142     created = find_obj_in_resp response_items, 'arvados#user', nil
 143
 144     assert_equal 'foo@example.com', created['email'], 'expected input email'
 145
 146      # verify links
 147     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
 148         'All users', created['uuid'], 'arvados#group', true, 'Group'
 149
 150     verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
 151         'foo/newusertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
 152
 153     verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login',
 154         nil, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
 155
 156     # invoke setup with a vm_uuid
 157     post "/arvados/v1/users/setup",
 158       params: {
 159         vm_uuid: virtual_machines(:testvm).uuid,
 160         openid_prefix: 'http://www.example.com/account',
 161         user: {
 162           email: 'junk_email'
 163         },
 164         uuid: created['uuid']
 165       },
 166       headers: auth(:admin)
 167
 168     assert_response :success
 169
 170     response_items = json_response['items']
 171     created = find_obj_in_resp response_items, 'arvados#user', nil
 172
 173     assert_equal created['email'], 'foo@example.com', 'expected original email'
 174
 175     # verify links
 176     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
 177         'All users', created['uuid'], 'arvados#group', true, 'Group'
 178
 179     verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login',
 180         virtual_machines(:testvm).uuid, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
 181   end
 182
 183   test "setup and unsetup user" do
 184     post "/arvados/v1/users/setup",
 185       params: {
 186         repo_name: 'newusertestrepo',
 187         vm_uuid: virtual_machines(:testvm).uuid,
 188         user: {email: 'foo@example.com'},
 189         openid_prefix: 'https://www.google.com/accounts/o8/id'
 190       },
 191       headers: auth(:admin)
 192
 193     assert_response :success
 194     response_items = json_response['items']
 195     created = find_obj_in_resp response_items, 'arvados#user', nil
 196     assert_not_nil created['uuid'], 'expected uuid for the new user'
 197     assert_equal created['email'], 'foo@example.com', 'expected given email'
 198
 199     # five extra links: system_group, login, group, repo and vm
 200     verify_link response_items, 'arvados#user', true, 'permission', 'can_login',
 201         created['uuid'], created['email'], 'arvados#user', false, 'arvados#user'
 202
 203     verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
 204         'All users', created['uuid'], 'arvados#group', true, 'Group'
 205
 206     verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
 207         'foo/newusertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
 208
 209     verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login',
 210         virtual_machines(:testvm).uuid, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
 211
 212     verify_link_existence created['uuid'], created['email'], true, true, true, true, false
 213
 214     post "/arvados/v1/users/#{created['uuid']}/unsetup", params: {}, headers: auth(:admin)
 215
 216     assert_response :success
 217
 218     created2 = json_response
 219     assert_not_nil created2['uuid'], 'expected uuid for the newly created user'
 220     assert_equal created['uuid'], created2['uuid'], 'expected uuid not found'
 221
 222     verify_link_existence created['uuid'], created['email'], false, false, false, false, false
 223   end
 224
 225   def find_obj_in_resp (response_items, kind, head_kind=nil)
 226     response_items.each do |x|
 227       if x && x['kind']
 228         return x if (x['kind'] == kind && x['head_kind'] == head_kind)
 229       end
 230     end
 231     nil
 232   end
 233
 234   test 'merge active into project_viewer account' do
 235     post('/arvados/v1/groups',
 236       params: {
 237         group: {
 238           group_class: 'project',
 239           name: "active user's stuff",
 240         },
 241       },
 242       headers: auth(:project_viewer))
 243     assert_response(:success)
 244     project_uuid = json_response['uuid']
 245
 246     post('/arvados/v1/users/merge',
 247       params: {
 248         new_user_token: api_client_authorizations(:project_viewer_trustedclient).api_token,
 249         new_owner_uuid: project_uuid,
 250         redirect_to_new_user: true,
 251       },
 252       headers: auth(:active_trustedclient))
 253     assert_response(:success)
 254
 255     get('/arvados/v1/users/current', params: {}, headers: auth(:active))
 256     assert_response(:success)
 257     assert_equal(users(:project_viewer).uuid, json_response['uuid'])
 258
 259     get('/arvados/v1/authorized_keys/' + authorized_keys(:active).uuid,
 260       params: {},
 261       headers: auth(:active))
 262     assert_response(:success)
 263     assert_equal(users(:project_viewer).uuid, json_response['owner_uuid'])
 264     assert_equal(users(:project_viewer).uuid, json_response['authorized_user_uuid'])
 265
 266     get('/arvados/v1/repositories/' + repositories(:foo).uuid,
 267       params: {},
 268       headers: auth(:active))
 269     assert_response(:success)
 270     assert_equal(users(:project_viewer).uuid, json_response['owner_uuid'])
 271     assert_equal("#{users(:project_viewer).username}/foo", json_response['name'])
 272
 273     get('/arvados/v1/groups/' + groups(:aproject).uuid,
 274       params: {},
 275       headers: auth(:active))
 276     assert_response(:success)
 277     assert_equal(project_uuid, json_response['owner_uuid'])
 278   end
 279
 280   test 'pre-activate user' do
 281     post '/arvados/v1/users',
 282       params: {
 283         "user" => {
 284           "email" => 'foo@example.com',
 285           "is_active" => true,
 286           "username" => "barney"
 287         }
 288       },
 289       headers: {'HTTP_AUTHORIZATION' => "OAuth2 #{api_token(:admin)}"}
 290     assert_response :success
 291     rp = json_response
 292     assert_not_nil rp["uuid"]
 293     assert_not_nil rp["is_active"]
 294     assert_nil rp["is_admin"]
 295
 296     get "/arvados/v1/users/#{rp['uuid']}",
 297       params: {format: 'json'},
 298       headers: auth(:admin)
 299     assert_response :success
 300     assert_equal rp["uuid"], json_response['uuid']
 301     assert_nil json_response['is_admin']
 302     assert_equal true, json_response['is_active']
 303     assert_equal 'foo@example.com', json_response['email']
 304     assert_equal 'barney', json_response['username']
 305   end
 306
 307   test 'merge with repository name conflict' do
 308     post('/arvados/v1/groups',
 309       params: {
 310         group: {
 311           group_class: 'project',
 312           name: "active user's stuff",
 313         },
 314       },
 315       headers: auth(:project_viewer))
 316     assert_response(:success)
 317     project_uuid = json_response['uuid']
 318
 319     post('/arvados/v1/repositories/',
 320          params: { :repository => { :name => "#{users(:project_viewer).username}/foo", :owner_uuid => users(:project_viewer).uuid } },
 321          headers: auth(:project_viewer))
 322     assert_response(:success)
 323
 324     post('/arvados/v1/users/merge',
 325       params: {
 326         new_user_token: api_client_authorizations(:project_viewer_trustedclient).api_token,
 327         new_owner_uuid: project_uuid,
 328         redirect_to_new_user: true,
 329       },
 330       headers: auth(:active_trustedclient))
 331     assert_response(:success)
 332
 333     get('/arvados/v1/repositories/' + repositories(:foo).uuid,
 334       params: {},
 335       headers: auth(:active))
 336     assert_response(:success)
 337     assert_equal(users(:project_viewer).uuid, json_response['owner_uuid'])
 338     assert_equal("#{users(:project_viewer).username}/migratedfoo", json_response['name'])
 339
 340   end
 341
 342   test "cannot set is_activate to false directly" do
 343     post('/arvados/v1/users',
 344       params: {
 345         user: {
 346           email: "bob@example.com",
 347           username: "bobby"
 348         },
 349       },
 350       headers: auth(:admin))
 351     assert_response(:success)
 352     user = json_response
 353     assert_equal false, user['is_active']
 354
 355     post("/arvados/v1/users/#{user['uuid']}/activate",
 356       params: {},
 357       headers: auth(:admin))
 358     assert_response(:success)
 359     user = json_response
 360     assert_equal true, user['is_active']
 361
 362     put("/arvados/v1/users/#{user['uuid']}",
 363          params: {
 364            user: {is_active: false}
 365          },
 366          headers: auth(:admin))
 367     assert_response 422
 368   end
 369
 370   test "cannot self activate when AutoSetupNewUsers is false" do
 371     Rails.configuration.Users.NewUsersAreActive = false
 372     Rails.configuration.Users.AutoSetupNewUsers = false
 373
 374     user = nil
 375     token = nil
 376     act_as_system_user do
 377       user = User.create!(email: "bob@example.com", username: "bobby")
 378       ap = ApiClientAuthorization.create!(user: user, api_client: ApiClient.all.first)
 379       token = ap.api_token
 380     end
 381
 382     get("/arvados/v1/users/#{user['uuid']}",
 383         params: {},
 384         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 385     assert_response(:success)
 386     user = json_response
 387     assert_equal false, user['is_active']
 388
 389     post("/arvados/v1/users/#{user['uuid']}/activate",
 390         params: {},
 391         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 392     assert_response 422
 393     assert_match(/Cannot activate without being invited/, json_response['errors'][0])
 394   end
 395
 396
 397   test "cannot self activate after unsetup" do
 398     Rails.configuration.Users.NewUsersAreActive = false
 399     Rails.configuration.Users.AutoSetupNewUsers = false
 400
 401     user = nil
 402     token = nil
 403     act_as_system_user do
 404       user = User.create!(email: "bob@example.com", username: "bobby")
 405       ap = ApiClientAuthorization.create!(user: user, api_client_id: 0)
 406       token = ap.api_token
 407     end
 408
 409     post("/arvados/v1/users/setup",
 410         params: {uuid: user['uuid']},
 411         headers: auth(:admin))
 412     assert_response :success
 413
 414     post("/arvados/v1/users/#{user['uuid']}/activate",
 415         params: {},
 416         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 417     assert_response 403
 418     assert_match(/Cannot activate without user agreements/, json_response['errors'][0])
 419
 420     post("/arvados/v1/user_agreements/sign",
 421         params: {uuid: 'zzzzz-4zz18-t68oksiu9m80s4y'},
 422         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 423     assert_response :success
 424
 425     post("/arvados/v1/users/#{user['uuid']}/activate",
 426         params: {},
 427         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 428     assert_response :success
 429
 430     get("/arvados/v1/users/#{user['uuid']}",
 431         params: {},
 432         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 433     assert_response(:success)
 434     user = json_response
 435     assert_equal true, user['is_active']
 436
 437     post("/arvados/v1/users/#{user['uuid']}/unsetup",
 438         params: {},
 439         headers: auth(:admin))
 440     assert_response :success
 441
 442     get("/arvados/v1/users/#{user['uuid']}",
 443         params: {},
 444         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 445     assert_response(:success)
 446     user = json_response
 447     assert_equal false, user['is_active']
 448
 449     post("/arvados/v1/users/#{user['uuid']}/activate",
 450         params: {},
 451         headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"})
 452     assert_response 422
 453     assert_match(/Cannot activate without being invited/, json_response['errors'][0])
 454   end
 455
 456
 457 end