1 # Copyright (C) The Arvados Authors. All rights reserved.
3 # SPDX-License-Identifier: AGPL-3.0
7 class Arvados::V1::GroupsControllerTest < ActionController::TestCase
9 test "attempt to delete group without read or write access" do
10 authorize_with :active
11 post :destroy, params: {id: groups(:empty_lonely_group).uuid}
15 test "attempt to delete group without write access" do
16 authorize_with :active
17 post :destroy, params: {id: groups(:all_users).uuid}
21 test "get list of projects" do
22 authorize_with :active
23 get :index, params: {filters: [['group_class', '=', 'project']], format: :json}
24 assert_response :success
26 json_response['items'].each do |group|
27 assert_equal 'project', group['group_class']
28 group_uuids << group['uuid']
30 assert_includes group_uuids, groups(:aproject).uuid
31 assert_includes group_uuids, groups(:asubproject).uuid
32 assert_not_includes group_uuids, groups(:system_group).uuid
33 assert_not_includes group_uuids, groups(:private).uuid
36 test "get list of groups that are not projects" do
37 authorize_with :active
38 get :index, params: {filters: [['group_class', '!=', 'project']], format: :json}
39 assert_response :success
41 json_response['items'].each do |group|
42 assert_not_equal 'project', group['group_class']
43 group_uuids << group['uuid']
45 assert_not_includes group_uuids, groups(:aproject).uuid
46 assert_not_includes group_uuids, groups(:asubproject).uuid
47 assert_includes group_uuids, groups(:private).uuid
48 assert_includes group_uuids, groups(:group_with_no_class).uuid
51 test "get list of groups with bogus group_class" do
52 authorize_with :active
54 filters: [['group_class', '=', 'nogrouphasthislittleclass']],
57 assert_response :success
58 assert_equal [], json_response['items']
59 assert_equal 0, json_response['items_available']
62 def check_project_contents_response disabled_kinds=[]
63 assert_response :success
64 assert_operator 2, :<=, json_response['items_available']
65 assert_operator 2, :<=, json_response['items'].count
66 kinds = json_response['items'].collect { |i| i['kind'] }.uniq
67 expect_kinds = %w'arvados#group arvados#specimen arvados#pipelineTemplate arvados#job' - disabled_kinds
68 assert_equal expect_kinds, (expect_kinds & kinds)
70 json_response['items'].each do |i|
71 if i['kind'] == 'arvados#group'
72 assert(i['group_class'] == 'project',
73 "group#contents returned a non-project group")
77 disabled_kinds.each do |d|
78 assert_equal true, !kinds.include?(d)
82 test 'get group-owned objects' do
83 authorize_with :active
84 get :contents, params: {
85 id: groups(:aproject).uuid,
88 check_project_contents_response
91 test "user with project read permission can see project objects" do
92 authorize_with :project_viewer
93 get :contents, params: {
94 id: groups(:aproject).uuid,
97 check_project_contents_response
100 test "list objects across projects" do
101 authorize_with :project_viewer
102 get :contents, params: {
104 filters: [['uuid', 'is_a', 'arvados#specimen']]
106 assert_response :success
107 found_uuids = json_response['items'].collect { |i| i['uuid'] }
108 [[:in_aproject, true],
109 [:in_asubproject, true],
110 [:owned_by_private_group, false]].each do |specimen_fixture, should_find|
112 assert_includes found_uuids, specimens(specimen_fixture).uuid, "did not find specimen fixture '#{specimen_fixture}'"
114 refute_includes found_uuids, specimens(specimen_fixture).uuid, "found specimen fixture '#{specimen_fixture}'"
119 test "list trashed collections and projects" do
120 authorize_with :active
121 get(:contents, params: {
125 ['uuid', 'is_a', ['arvados#collection', 'arvados#group']],
126 ['is_trashed', '=', true],
130 assert_response :success
131 found_uuids = json_response['items'].collect { |i| i['uuid'] }
132 assert_includes found_uuids, groups(:trashed_project).uuid
133 refute_includes found_uuids, groups(:aproject).uuid
134 assert_includes found_uuids, collections(:expired_collection).uuid
135 refute_includes found_uuids, collections(:w_a_z_file).uuid
138 test "list objects in home project" do
139 authorize_with :active
140 get :contents, params: {
143 id: users(:active).uuid
145 assert_response :success
146 found_uuids = json_response['items'].collect { |i| i['uuid'] }
147 assert_includes found_uuids, specimens(:owned_by_active_user).uuid, "specimen did not appear in home project"
148 refute_includes found_uuids, specimens(:in_asubproject).uuid, "specimen appeared unexpectedly in home project"
151 test "user with project read permission can see project collections" do
152 authorize_with :project_viewer
153 get :contents, params: {
154 id: groups(:asubproject).uuid,
157 ids = json_response['items'].map { |item| item["uuid"] }
158 assert_includes ids, collections(:baz_file_in_asubproject).uuid
162 ['collections.name', 'asc', :<=, "name"],
163 ['collections.name', 'desc', :>=, "name"],
164 ['name', 'asc', :<=, "name"],
165 ['name', 'desc', :>=, "name"],
166 ['collections.created_at', 'asc', :<=, "created_at"],
167 ['collections.created_at', 'desc', :>=, "created_at"],
168 ['created_at', 'asc', :<=, "created_at"],
169 ['created_at', 'desc', :>=, "created_at"],
170 ].each do |column, order, operator, field|
171 test "user with project read permission can sort projects on #{column} #{order}" do
172 authorize_with :project_viewer
173 get :contents, params: {
174 id: groups(:asubproject).uuid,
176 filters: [['uuid', 'is_a', "arvados#collection"]],
177 order: "#{column} #{order}"
179 sorted_values = json_response['items'].collect { |item| item[field] }
181 # Here we avoid assuming too much about the database
182 # collation. Both "alice"<"Bob" and "alice">"Bob" can be
183 # correct. Hopefully it _is_ safe to assume that if "a" comes
184 # before "b" in the ascii alphabet, "aX">"bY" is never true for
185 # any strings X and Y.
186 reliably_sortable_names = sorted_values.select do |name|
187 name[0] >= 'a' && name[0] <= 'z'
191 # Preserve order of sorted_values. But do not use &=. If
192 # sorted_values has out-of-order duplicates, we want to preserve
193 # them here, so we can detect them and fail the test below.
194 sorted_values.select! do |name|
195 reliably_sortable_names.include? name
198 assert_sorted(operator, sorted_values)
202 def assert_sorted(operator, sorted_items)
203 actually_checked_anything = false
205 sorted_items.each do |entry|
207 assert_operator(previous, operator, entry,
208 "Entries sorted incorrectly.")
209 actually_checked_anything = true
213 assert actually_checked_anything, "Didn't even find two items to compare."
216 # Even though the project_viewer tests go through other controllers,
217 # I'm putting them here so they're easy to find alongside the other
219 def check_new_project_link_fails(link_attrs)
220 @controller = Arvados::V1::LinksController.new
221 post :create, params: {
223 link_class: "permission",
225 head_uuid: groups(:aproject).uuid,
228 assert_includes(403..422, response.status)
231 test "user with project read permission can't add users to it" do
232 authorize_with :project_viewer
233 check_new_project_link_fails(tail_uuid: users(:spectator).uuid)
236 test "user with project read permission can't add items to it" do
237 authorize_with :project_viewer
238 check_new_project_link_fails(tail_uuid: collections(:baz_file).uuid)
241 test "user with project read permission can't rename items in it" do
242 authorize_with :project_viewer
243 @controller = Arvados::V1::LinksController.new
244 post :update, params: {
245 id: jobs(:running).uuid,
246 name: "Denied test name",
248 assert_includes(403..404, response.status)
251 test "user with project read permission can't remove items from it" do
252 @controller = Arvados::V1::PipelineTemplatesController.new
253 authorize_with :project_viewer
254 post :update, params: {
255 id: pipeline_templates(:two_part).uuid,
257 owner_uuid: users(:project_viewer).uuid,
263 test "user with project read permission can't delete it" do
264 authorize_with :project_viewer
265 post :destroy, params: {id: groups(:aproject).uuid}
269 test 'get group-owned objects with limit' do
270 authorize_with :active
271 get :contents, params: {
272 id: groups(:aproject).uuid,
276 assert_response :success
277 assert_operator 1, :<, json_response['items_available']
278 assert_equal 1, json_response['items'].count
281 test 'get group-owned objects with limit and offset' do
282 authorize_with :active
283 get :contents, params: {
284 id: groups(:aproject).uuid,
289 assert_response :success
290 assert_operator 1, :<, json_response['items_available']
291 assert_equal 0, json_response['items'].count
294 test 'get group-owned objects with additional filter matching nothing' do
295 authorize_with :active
296 get :contents, params: {
297 id: groups(:aproject).uuid,
298 filters: [['uuid', 'in', ['foo_not_a_uuid','bar_not_a_uuid']]],
301 assert_response :success
302 assert_equal [], json_response['items']
303 assert_equal 0, json_response['items_available']
306 %w(offset limit).each do |arg|
307 ['foo', '', '1234five', '0x10', '-8'].each do |val|
308 test "Raise error on bogus #{arg} parameter #{val.inspect}" do
309 authorize_with :active
310 get :contents, params: {
311 :id => groups(:aproject).uuid,
320 test "Collection contents don't include manifest_text" do
321 authorize_with :active
322 get :contents, params: {
323 id: groups(:aproject).uuid,
324 filters: [["uuid", "is_a", "arvados#collection"]],
327 assert_response :success
328 refute(json_response["items"].any? { |c| not c["portable_data_hash"] },
329 "response included an item without a portable data hash")
330 refute(json_response["items"].any? { |c| c.include?("manifest_text") },
331 "response included an item with a manifest text")
334 test 'get writable_by list for owned group' do
335 authorize_with :active
337 id: groups(:aproject).uuid,
340 assert_response :success
341 assert_not_nil(json_response['writable_by'],
342 "Should receive uuid list in 'writable_by' field")
343 assert_includes(json_response['writable_by'], users(:active).uuid,
344 "owner should be included in writable_by list")
347 test 'no writable_by list for group with read-only access' do
348 authorize_with :rominiadmin
350 id: groups(:testusergroup_admins).uuid,
353 assert_response :success
354 assert_equal([json_response['owner_uuid']],
355 json_response['writable_by'],
356 "Should only see owner_uuid in 'writable_by' field")
359 test 'get writable_by list by admin user' do
360 authorize_with :admin
362 id: groups(:testusergroup_admins).uuid,
365 assert_response :success
366 assert_not_nil(json_response['writable_by'],
367 "Should receive uuid list in 'writable_by' field")
368 assert_includes(json_response['writable_by'],
370 "Current user should be included in 'writable_by' field")
373 test 'creating subproject with duplicate name fails' do
374 authorize_with :active
375 post :create, params: {
378 owner_uuid: users(:active).uuid,
379 group_class: 'project',
383 response_errors = json_response['errors']
384 assert_not_nil response_errors, 'Expected error in response'
385 assert(response_errors.first.include?('duplicate key'),
386 "Expected 'duplicate key' error in #{response_errors.first}")
389 test 'creating duplicate named subproject succeeds with ensure_unique_name' do
390 authorize_with :active
391 post :create, params: {
394 owner_uuid: users(:active).uuid,
395 group_class: 'project',
397 ensure_unique_name: true
399 assert_response :success
400 new_project = json_response
401 assert_not_equal(new_project['uuid'],
402 groups(:aproject).uuid,
403 "create returned same uuid as existing project")
404 assert_match(/^A Project \(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z\)$/,
408 test "unsharing a project results in hiding it from previously shared user" do
409 # remove sharing link for project
410 @controller = Arvados::V1::LinksController.new
411 authorize_with :admin
412 post :destroy, params: {id: links(:share_starred_project_with_project_viewer).uuid}
413 assert_response :success
415 # verify that the user can no longer see the project
416 @test_counter = 0 # Reset executed action counter
417 @controller = Arvados::V1::GroupsController.new
418 authorize_with :project_viewer
419 get :index, params: {filters: [['group_class', '=', 'project']], format: :json}
420 assert_response :success
422 json_response['items'].each do |g|
423 found_projects[g['uuid']] = g
425 assert_equal false, found_projects.include?(groups(:starred_and_shared_active_user_project).uuid)
429 @controller = Arvados::V1::LinksController.new
430 authorize_with :system_user
431 post :create, params: {
433 link_class: "permission",
435 head_uuid: groups(:starred_and_shared_active_user_project).uuid,
436 tail_uuid: users(:project_viewer).uuid,
440 # verify that project_viewer user can now see shared project again
442 @controller = Arvados::V1::GroupsController.new
443 authorize_with :project_viewer
444 get :index, params: {filters: [['group_class', '=', 'project']], format: :json}
445 assert_response :success
447 json_response['items'].each do |g|
448 found_projects[g['uuid']] = g
450 assert_equal true, found_projects.include?(groups(:starred_and_shared_active_user_project).uuid)
454 [['owner_uuid', '!=', 'zzzzz-tpzed-xurymjxw79nv3jz'], 200,
455 'zzzzz-d1hrv-subprojpipeline', 'zzzzz-d1hrv-1xfj6xkicf2muk2'],
456 [["pipeline_instances.state", "not in", ["Complete", "Failed"]], 200,
457 'zzzzz-d1hrv-1xfj6xkicf2muk2', 'zzzzz-d1hrv-i3e77t9z5y8j9cc'],
458 [['container_requests.requesting_container_uuid', '=', nil], 200,
459 'zzzzz-xvhdp-cr4queuedcontnr', 'zzzzz-xvhdp-cr4requestercn2'],
460 [['container_requests.no_such_column', '=', nil], 422],
461 [['container_requests.', '=', nil], 422],
462 [['.requesting_container_uuid', '=', nil], 422],
463 [['no_such_table.uuid', '!=', 'zzzzz-tpzed-xurymjxw79nv3jz'], 422],
464 ].each do |filter, expect_code, expect_uuid, not_expect_uuid|
465 test "get contents with '#{filter}' filter" do
466 authorize_with :active
467 get :contents, params: {filters: [filter], format: :json}
468 assert_response expect_code
469 if expect_code == 200
470 assert_not_empty json_response['items']
471 item_uuids = json_response['items'].collect {|item| item['uuid']}
472 assert_includes(item_uuids, expect_uuid)
473 assert_not_includes(item_uuids, not_expect_uuid)
478 test 'get contents with jobs and pipeline instances disabled' do
479 Rails.configuration.disable_api_methods = ['jobs.index', 'pipeline_instances.index']
481 authorize_with :active
482 get :contents, params: {
483 id: groups(:aproject).uuid,
486 check_project_contents_response %w'arvados#pipelineInstance arvados#job'
489 test 'get contents with low max_index_database_read' do
490 # Some result will certainly have at least 12 bytes in a
492 Rails.configuration.max_index_database_read = 12
493 authorize_with :active
494 get :contents, params: {
495 id: groups(:aproject).uuid,
498 assert_response :success
499 assert_not_empty(json_response['items'])
500 assert_operator(json_response['items'].count,
501 :<, json_response['items_available'])
504 test 'get contents, recursive=true' do
505 authorize_with :active
507 id: groups(:aproject).uuid,
511 get :contents, params: params
512 owners = json_response['items'].map do |item|
515 assert_includes(owners, groups(:aproject).uuid)
516 assert_includes(owners, groups(:asubproject).uuid)
519 [false, nil].each do |recursive|
520 test "get contents, recursive=#{recursive.inspect}" do
521 authorize_with :active
523 id: groups(:aproject).uuid,
526 params[:recursive] = false if recursive == false
527 get :contents, params: params
528 owners = json_response['items'].map do |item|
531 assert_includes(owners, groups(:aproject).uuid)
532 refute_includes(owners, groups(:asubproject).uuid)
536 test 'get home project contents, recursive=true' do
537 authorize_with :active
538 get :contents, params: {
539 id: users(:active).uuid,
543 owners = json_response['items'].map do |item|
546 assert_includes(owners, users(:active).uuid)
547 assert_includes(owners, groups(:aproject).uuid)
548 assert_includes(owners, groups(:asubproject).uuid)
551 ### trashed project tests ###
553 [:active, :admin].each do |auth|
554 # project: to query, to untrash, is visible, parent contents listing success
555 [[:trashed_project, [], false, true],
556 [:trashed_project, [:trashed_project], true, true],
557 [:trashed_subproject, [], false, false],
558 [:trashed_subproject, [:trashed_project], true, true],
559 [:trashed_subproject3, [:trashed_project], false, true],
560 [:trashed_subproject3, [:trashed_subproject3], false, false],
561 [:trashed_subproject3, [:trashed_project, :trashed_subproject3], true, true],
562 ].each do |project, untrash, visible, success|
564 test "contents listing #{project} #{untrash} as #{auth}" do
567 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
569 get :contents, params: {
570 id: groups(project).owner_uuid,
574 assert_response :success
575 item_uuids = json_response['items'].map do |item|
579 assert_includes(item_uuids, groups(project).uuid)
581 assert_not_includes(item_uuids, groups(project).uuid)
588 test "contents of #{project} #{untrash} as #{auth}" do
591 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
593 get :contents, params: {
594 id: groups(project).uuid,
598 assert_response :success
604 test "index #{project} #{untrash} as #{auth}" do
607 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
609 get :index, params: {
612 assert_response :success
613 item_uuids = json_response['items'].map do |item|
617 assert_includes(item_uuids, groups(project).uuid)
619 assert_not_includes(item_uuids, groups(project).uuid)
623 test "show #{project} #{untrash} as #{auth}" do
626 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
629 id: groups(project).uuid,
633 assert_response :success
639 test "show include_trash #{project} #{untrash} as #{auth}" do
642 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
645 id: groups(project).uuid,
649 assert_response :success
652 test "index include_trash #{project} #{untrash} as #{auth}" do
655 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
657 get :index, params: {
661 assert_response :success
662 item_uuids = json_response['items'].map do |item|
665 assert_includes(item_uuids, groups(project).uuid)
669 test "delete project #{auth}" do
671 [:trashed_project].each do |pr|
672 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
674 assert !Group.find_by_uuid(groups(:trashed_project).uuid).is_trashed
675 post :destroy, params: {
676 id: groups(:trashed_project).uuid,
679 assert_response :success
680 assert Group.find_by_uuid(groups(:trashed_project).uuid).is_trashed
683 test "untrash project #{auth}" do
685 assert Group.find_by_uuid(groups(:trashed_project).uuid).is_trashed
686 post :untrash, params: {
687 id: groups(:trashed_project).uuid,
690 assert_response :success
691 assert !Group.find_by_uuid(groups(:trashed_project).uuid).is_trashed
694 test "untrash project with name conflict #{auth}" do
696 [:trashed_project].each do |pr|
697 Group.find_by_uuid(groups(pr).uuid).update! is_trashed: false
699 gc = Group.create!({owner_uuid: "zzzzz-j7d0g-trashedproject1",
700 name: "trashed subproject 3",
701 group_class: "project"})
702 post :untrash, params: {
703 id: groups(:trashed_subproject3).uuid,
705 ensure_unique_name: true
707 assert_response :success
708 assert_match /^trashed subproject 3 \(\d{4}-\d\d-\d\d.*?Z\)$/, json_response['name']
711 test "move trashed subproject to new owner #{auth}" do
713 assert_nil Group.readable_by(users(auth)).where(uuid: groups(:trashed_subproject).uuid).first
714 put :update, params: {
715 id: groups(:trashed_subproject).uuid,
717 owner_uuid: users(:active).uuid
722 assert_response :success
723 assert_not_nil Group.readable_by(users(auth)).where(uuid: groups(:trashed_subproject).uuid).first
727 test 'get shared owned by another user' do
728 authorize_with :user_bar_in_sharing_group
730 act_as_system_user do
732 tail_uuid: users(:user_bar_in_sharing_group).uuid,
733 link_class: 'permission',
735 head_uuid: groups(:project_owned_by_foo).uuid)
738 get :shared, params: {:filters => [["group_class", "=", "project"]], :include => "owner_uuid"}
740 assert_equal 1, json_response['items'].length
741 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
743 assert_equal 1, json_response['included'].length
744 assert_equal json_response['included'][0]["uuid"], users(:user_foo_in_sharing_group).uuid
747 test 'get shared, owned by unreadable project' do
748 authorize_with :user_bar_in_sharing_group
750 act_as_system_user do
751 Group.find_by_uuid(groups(:project_owned_by_foo).uuid).update!(owner_uuid: groups(:aproject).uuid)
753 tail_uuid: users(:user_bar_in_sharing_group).uuid,
754 link_class: 'permission',
756 head_uuid: groups(:project_owned_by_foo).uuid)
759 get :shared, params: {:filters => [["group_class", "=", "project"]], :include => "owner_uuid"}
761 assert_equal 1, json_response['items'].length
762 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
764 assert_equal 0, json_response['included'].length
767 test 'get shared, owned by non-project' do
768 authorize_with :user_bar_in_sharing_group
770 act_as_system_user do
771 Group.find_by_uuid(groups(:project_owned_by_foo).uuid).update!(owner_uuid: groups(:group_for_sharing_tests).uuid)
774 get :shared, params: {:filters => [["group_class", "=", "project"]], :include => "owner_uuid"}
776 assert_equal 1, json_response['items'].length
777 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
779 assert_equal 1, json_response['included'].length
780 assert_equal json_response['included'][0]["uuid"], groups(:group_for_sharing_tests).uuid
783 ### contents with exclude_home_project
785 test 'contents, exclude home owned by another user' do
786 authorize_with :user_bar_in_sharing_group
788 act_as_system_user do
790 tail_uuid: users(:user_bar_in_sharing_group).uuid,
791 link_class: 'permission',
793 head_uuid: groups(:project_owned_by_foo).uuid)
795 tail_uuid: users(:user_bar_in_sharing_group).uuid,
796 link_class: 'permission',
798 head_uuid: collections(:collection_owned_by_foo).uuid)
801 get :contents, params: {:include => "owner_uuid", :exclude_home_project => true}
803 assert_equal 2, json_response['items'].length
804 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
805 assert_equal json_response['items'][1]["uuid"], collections(:collection_owned_by_foo).uuid
807 assert_equal 1, json_response['included'].length
808 assert_equal json_response['included'][0]["uuid"], users(:user_foo_in_sharing_group).uuid
811 test 'contents, exclude home, owned by unreadable project' do
812 authorize_with :user_bar_in_sharing_group
814 act_as_system_user do
815 Group.find_by_uuid(groups(:project_owned_by_foo).uuid).update!(owner_uuid: groups(:aproject).uuid)
817 tail_uuid: users(:user_bar_in_sharing_group).uuid,
818 link_class: 'permission',
820 head_uuid: groups(:project_owned_by_foo).uuid)
823 get :contents, params: {:include => "owner_uuid", :exclude_home_project => true}
825 assert_equal 1, json_response['items'].length
826 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
828 assert_equal 0, json_response['included'].length
831 test 'contents, exclude home, owned by non-project' do
832 authorize_with :user_bar_in_sharing_group
834 act_as_system_user do
835 Group.find_by_uuid(groups(:project_owned_by_foo).uuid).update!(owner_uuid: groups(:group_for_sharing_tests).uuid)
838 get :contents, params: {:include => "owner_uuid", :exclude_home_project => true}
840 assert_equal 1, json_response['items'].length
841 assert_equal json_response['items'][0]["uuid"], groups(:project_owned_by_foo).uuid
843 assert_equal 1, json_response['included'].length
844 assert_equal json_response['included'][0]["uuid"], groups(:group_for_sharing_tests).uuid
847 test 'contents, exclude home, with parent specified' do
848 authorize_with :active
850 get :contents, params: {id: groups(:aproject).uuid, :include => "owner_uuid", :exclude_home_project => true}