1 # Copyright (C) The Arvados Authors. All rights reserved.
3 # SPDX-License-Identifier: AGPL-3.0
7 class UserTest < ActiveSupport::TestCase
8 include CurrentApiClient
10 # The fixture services/api/test/fixtures/users.yml serves as the input for this test case
12 # Make sure system_user exists before making "pre-test users" list
16 %w(a aa a0 aA Aa AA A0).each do |username|
17 test "#{username.inspect} is a valid username" do
18 user = User.new(username: username)
23 test "username is not required" do
24 user = User.new(username: nil)
28 test "username beginning with numeral is invalid" do
29 user = User.new(username: "0a")
33 "\\.-_/!@#$%^&*()[]{}".each_char do |bad_char|
34 test "username containing #{bad_char.inspect} is invalid" do
35 user = User.new(username: "bad#{bad_char}username")
40 test "username must be unique" do
41 user = User.new(username: users(:active).username)
45 test "non-admin can't update username" do
46 set_user_from_auth :rominiadmin
47 user = User.find_by_uuid(users(:rominiadmin).uuid)
48 user.username = "selfupdate"
49 assert_not_allowed { user.save }
52 def check_admin_username_change(fixture_name)
53 set_user_from_auth :admin_trustedclient
54 user = User.find_by_uuid(users(fixture_name).uuid)
55 user.username = "newnamefromtest"
59 test "admin can set username" do
60 check_admin_username_change(:active_no_prefs)
63 test "admin can update username" do
64 check_admin_username_change(:active)
67 test "admin can update own username" do
68 check_admin_username_change(:admin)
71 def check_new_username_setting(email_name, expect_name)
72 set_user_from_auth :admin
73 user = User.create!(email: "#{email_name}@example.org")
74 assert_equal(expect_name, user.username)
77 test "new username set from e-mail" do
78 check_new_username_setting("dakota", "dakota")
81 test "new username set from e-mail with leading digits" do
82 check_new_username_setting("1dakota9", "dakota9")
85 test "new username set from e-mail with punctuation" do
86 check_new_username_setting("dakota.9", "dakota9")
89 test "new username set from e-mail with leading digits and punctuation" do
90 check_new_username_setting("1.dakota.z", "dakotaz")
93 test "new username set from e-mail with extra part" do
94 check_new_username_setting("dakota+arvados", "dakota")
97 test "new username set with deduplication" do
98 name = users(:active).username
99 check_new_username_setting(name, "#{name}2")
100 check_new_username_setting(name, "#{name}3")
101 # Insert some out-of-order conflicts, to ensure our "sort by
102 # username, stop when we see a hole" strategy doesn't depend on
104 check_new_username_setting("#{name}13", "#{name}13")
105 check_new_username_setting("#{name}5", "#{name}5")
106 check_new_username_setting(name, "#{name}4")
107 6.upto(12).each do |n|
108 check_new_username_setting(name, "#{name}#{n}")
112 test "new username set avoiding blacklist" do
113 Rails.configuration.Users.AutoSetupUsernameBlacklist = {"root"=>{}}
114 check_new_username_setting("root", "root2")
117 test "no username set when no base available" do
118 check_new_username_setting("_", nil)
121 test "updating username updates repository names" do
122 set_user_from_auth :admin
123 user = users(:active)
124 user.username = "newtestname"
125 assert(user.save, "username update failed")
126 {foo: "newtestname/foo", repository2: "newtestname/foo2"}.
127 each_pair do |repo_sym, expect_name|
128 assert_equal(expect_name, repositories(repo_sym).name)
132 test "admin can clear username when user owns no repositories" do
133 set_user_from_auth :admin
134 user = users(:spectator)
137 assert_nil(user.username)
140 test "admin can't clear username when user owns repositories" do
141 set_user_from_auth :admin
142 user = users(:active)
144 assert_not_allowed { user.save }
145 refute_empty(user.errors[:username])
148 test "failed username update doesn't change repository names" do
149 set_user_from_auth :admin
150 user = users(:active)
151 user.username = users(:fuse).username
152 assert_not_allowed { user.save }
153 assert_equal("active/foo", repositories(:foo).name)
156 [[false, 'foo@example.com', true, nil],
157 [false, 'bar@example.com', nil, true],
158 [true, 'foo@example.com', true, nil],
159 [true, 'bar@example.com', true, true],
160 [false, '', nil, nil],
161 [true, '', true, nil]
162 ].each do |auto_admin_first_user_config, auto_admin_user_config, foo_should_be_admin, bar_should_be_admin|
163 # In each case, 'foo' is created first, then 'bar', then 'bar2', then 'baz'.
164 test "auto admin with auto_admin_first=#{auto_admin_first_user_config} auto_admin=#{auto_admin_user_config}" do
166 if auto_admin_first_user_config
167 # This test requires no admin users exist (except for the system user)
168 act_as_system_user do
169 users(:admin).update_attributes!(is_admin: false)
171 @all_users = User.where("uuid not like '%-000000000000000'").where(:is_admin => true)
172 assert_equal 0, @all_users.count, "No admin users should exist (except for the system user)"
175 Rails.configuration.Users.AutoAdminFirstUser = auto_admin_first_user_config
176 Rails.configuration.Users.AutoAdminUserWithEmail = auto_admin_user_config
178 # See if the foo user has is_admin
180 foo.first_name = 'foo'
181 foo.email = 'foo@example.com'
183 act_as_system_user do
187 foo = User.find(foo.id) # get the user back
188 assert_equal foo_should_be_admin, foo.is_admin, "is_admin is wrong for user foo"
189 assert_equal 'foo', foo.first_name
191 # See if the bar user has is_admin
193 bar.first_name = 'bar'
194 bar.email = 'bar@example.com'
196 act_as_system_user do
200 bar = User.find(bar.id) # get the user back
201 assert_equal bar_should_be_admin, bar.is_admin, "is_admin is wrong for user bar"
202 assert_equal 'bar', bar.first_name
204 # A subsequent user with the bar@example.com address should never be
207 bar2.first_name = 'bar2'
208 bar2.email = 'bar@example.com'
210 act_as_system_user do
214 bar2 = User.find(bar2.id) # get the user back
215 assert !bar2.is_admin, "is_admin is wrong for user bar2"
216 assert_equal 'bar2', bar2.first_name
218 # An ordinary new user should not be elevated to admin
220 baz.first_name = 'baz'
221 baz.email = 'baz@example.com'
223 act_as_system_user do
227 baz = User.find(baz.id) # get the user back
229 assert_equal 'baz', baz.first_name
234 test "check non-admin active user properties" do
235 @active_user = users(:active) # get the active user
236 assert !@active_user.is_admin, 'is_admin should not be set for a non-admin user'
237 assert @active_user.is_active, 'user should be active'
238 assert @active_user.is_invited, 'is_invited should be set'
239 assert_not_nil @active_user.prefs, "user's preferences should be non-null, but may be size zero"
240 assert (@active_user.can? :read=>"#{@active_user.uuid}"), "user should be able to read own object"
241 assert (@active_user.can? :write=>"#{@active_user.uuid}"), "user should be able to write own object"
242 assert (@active_user.can? :manage=>"#{@active_user.uuid}"), "user should be able to manage own object"
244 assert @active_user.groups_i_can(:read).size > 0, "active user should be able read at least one group"
246 # non-admin user cannot manage or write other user objects
247 @uninvited_user = users(:inactive_uninvited) # get the uninvited user
248 assert !(@active_user.can? :read=>"#{@uninvited_user.uuid}")
249 assert !(@active_user.can? :write=>"#{@uninvited_user.uuid}")
250 assert !(@active_user.can? :manage=>"#{@uninvited_user.uuid}")
253 test "check admin user properties" do
254 @admin_user = users(:admin) # get the admin user
255 assert @admin_user.is_admin, 'is_admin should be set for admin user'
256 assert @admin_user.is_active, 'admin user cannot be inactive'
257 assert @admin_user.is_invited, 'is_invited should be set'
258 assert_not_nil @admin_user.uuid.size, "user's uuid should be non-null"
259 assert_not_nil @admin_user.prefs, "user's preferences should be non-null, but may be size zero"
260 assert @admin_user.identity_url.size > 0, "user's identity url is expected"
261 assert @admin_user.can? :read=>"#{@admin_user.uuid}"
262 assert @admin_user.can? :write=>"#{@admin_user.uuid}"
263 assert @admin_user.can? :manage=>"#{@admin_user.uuid}"
265 assert @admin_user.groups_i_can(:read).size > 0, "admin active user should be able read at least one group"
266 assert @admin_user.groups_i_can(:write).size > 0, "admin active user should be able write to at least one group"
267 assert @admin_user.groups_i_can(:manage).size > 0, "admin active user should be able manage at least one group"
269 # admin user can also write or manage other users
270 @uninvited_user = users(:inactive_uninvited) # get the uninvited user
271 assert @admin_user.can? :read=>"#{@uninvited_user.uuid}"
272 assert @admin_user.can? :write=>"#{@uninvited_user.uuid}"
273 assert @admin_user.can? :manage=>"#{@uninvited_user.uuid}"
276 test "check inactive and uninvited user properties" do
277 @uninvited_user = users(:inactive_uninvited) # get the uninvited user
278 assert !@uninvited_user.is_admin, 'is_admin should not be set for a non-admin user'
279 assert !@uninvited_user.is_active, 'user should be inactive'
280 assert !@uninvited_user.is_invited, 'is_invited should not be set'
281 assert @uninvited_user.can? :read=>"#{@uninvited_user.uuid}"
282 assert @uninvited_user.can? :write=>"#{@uninvited_user.uuid}"
283 assert @uninvited_user.can? :manage=>"#{@uninvited_user.uuid}"
285 assert_equal(@uninvited_user.groups_i_can(:read).sort,
286 [@uninvited_user.uuid, groups(:anonymous_group).uuid].sort)
287 assert_equal(@uninvited_user.groups_i_can(:write),
288 [@uninvited_user.uuid])
289 assert_equal(@uninvited_user.groups_i_can(:manage),
290 [@uninvited_user.uuid])
293 test "find user method checks" do
294 User.all.each do |user|
295 assert_not_nil user.uuid, "non-null uuid expected for " + user.full_name
298 user = users(:active) # get the active user
300 found_user = User.find(user.id) # find a user by the row id
302 assert_equal found_user.full_name, user.first_name + ' ' + user.last_name
303 assert_equal found_user.identity_url, user.identity_url
306 test "full name should not contain spurious whitespace" do
307 set_user_from_auth :admin
309 user = User.create ({uuid: 'zzzzz-tpzed-abcdefghijklmno', email: 'foo@example.com' })
311 assert_equal '', user.full_name
313 user.first_name = 'John'
314 user.last_name = 'Smith'
316 assert_equal user.first_name + ' ' + user.last_name, user.full_name
319 test "create new user" do
320 set_user_from_auth :admin
322 @all_users = User.all.to_a
325 user.first_name = "first_name_for_newly_created_user"
328 # verify there is one extra user in the db now
329 assert_equal @all_users.size+1, User.all.count
331 user = User.find(user.id) # get the user back
332 assert_equal(user.first_name, 'first_name_for_newly_created_user')
333 assert_not_nil user.uuid, 'uuid should be set for newly created user'
334 assert_nil user.email, 'email should be null for newly created user, because it was not passed in'
335 assert_nil user.identity_url, 'identity_url should be null for newly created user, because it was not passed in'
337 user.first_name = 'first_name_for_newly_created_user_updated'
339 user = User.find(user.id) # get the user back
340 assert_equal(user.first_name, 'first_name_for_newly_created_user_updated')
343 test "create new user with notifications" do
344 set_user_from_auth :admin
346 create_user_and_verify_setup_and_notifications true, {'active-notify-address@example.com'=>{}}, {'inactive-notify-address@example.com'=>{}}, nil, nil
347 create_user_and_verify_setup_and_notifications true, {'active-notify-address@example.com'=>{}}, {}, nil, nil
348 create_user_and_verify_setup_and_notifications true, {}, [], nil, nil
349 create_user_and_verify_setup_and_notifications false, {'active-notify-address@example.com'=>{}}, {'inactive-notify-address@example.com'=>{}}, nil, nil
350 create_user_and_verify_setup_and_notifications false, {}, {'inactive-notify-address@example.com'=>{}}, nil, nil
351 create_user_and_verify_setup_and_notifications false, {}, {}, nil, nil
355 # Easy inactive user tests.
356 [false, {}, {}, "inactive-none@example.com", false, false, "inactivenone"],
357 [false, {}, {}, "inactive-vm@example.com", true, false, "inactivevm"],
358 [false, {}, {}, "inactive-repo@example.com", false, true, "inactiverepo"],
359 [false, {}, {}, "inactive-both@example.com", true, true, "inactiveboth"],
361 # Easy active user tests.
362 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "active-none@example.com", false, false, "activenone"],
363 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "active-vm@example.com", true, false, "activevm"],
364 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "active-repo@example.com", false, true, "activerepo"],
365 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "active-both@example.com", true, true, "activeboth"],
367 # Test users with malformed e-mail addresses.
368 [false, {}, {}, nil, true, true, nil],
369 [false, {}, {}, "arvados", true, true, nil],
370 [false, {}, {}, "@example.com", true, true, nil],
371 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "*!*@example.com", true, false, nil],
372 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "*!*@example.com", false, false, nil],
374 # Test users with various username transformations.
375 [false, {}, {}, "arvados@example.com", false, false, "arvados2"],
376 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "arvados@example.com", false, false, "arvados2"],
377 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "root@example.com", true, false, "root2"],
378 [false, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "root@example.com", true, false, "root2"],
379 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "roo_t@example.com", false, true, "root2"],
380 [false, {}, {}, "^^incorrect_format@example.com", true, true, "incorrectformat"],
381 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "&4a_d9.@example.com", true, true, "ad9"],
382 [true, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "&4a_d9.@example.com", false, false, "ad9"],
383 [false, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "&4a_d9.@example.com", true, true, "ad9"],
384 [false, {"active-notify@example.com"=>{}}, {"inactive-notify@example.com"=>{}}, "&4a_d9.@example.com", false, false, "ad9"],
385 ].each do |active, new_user_recipients, inactive_recipients, email, auto_setup_vm, auto_setup_repo, expect_username|
386 test "create new user with auto setup #{active} #{email} #{auto_setup_vm} #{auto_setup_repo}" do
387 set_user_from_auth :admin
389 Rails.configuration.Users.AutoSetupNewUsers = true
392 Rails.configuration.Users.AutoSetupNewUsersWithVmUUID = virtual_machines(:testvm)['uuid']
394 Rails.configuration.Users.AutoSetupNewUsersWithVmUUID = ""
397 Rails.configuration.Users.AutoSetupNewUsersWithRepository = auto_setup_repo
399 create_user_and_verify_setup_and_notifications active, new_user_recipients, inactive_recipients, email, expect_username
403 test "update existing user" do
404 set_user_from_auth :active # set active user as current user
406 @active_user = users(:active) # get the active user
408 @active_user.first_name = "first_name_changed"
411 @active_user = User.find(@active_user.id) # get the user back
412 assert_equal(@active_user.first_name, 'first_name_changed')
414 # admin user also should be able to update the "active" user info
415 set_user_from_auth :admin # set admin user as current user
416 @active_user.first_name = "first_name_changed_by_admin_for_active_user"
419 @active_user = User.find(@active_user.id) # get the user back
420 assert_equal(@active_user.first_name, 'first_name_changed_by_admin_for_active_user')
423 test "delete a user and verify" do
424 @active_user = users(:active) # get the active user
425 active_user_uuid = @active_user.uuid
427 set_user_from_auth :admin
430 found_deleted_user = false
431 User.all.each do |user|
432 if user.uuid == active_user_uuid
433 found_deleted_user = true
437 assert !found_deleted_user, "found deleted user: "+active_user_uuid
441 test "create new user as non-admin user" do
442 set_user_from_auth :active
443 assert_not_allowed { User.new.save }
446 test "setup new user" do
447 set_user_from_auth :admin
449 email = 'foo@example.com'
451 user = User.create ({uuid: 'zzzzz-tpzed-abcdefghijklmno', email: email})
453 vm = VirtualMachine.create
455 response = user.setup(repo_name: 'foo/testrepo',
458 resp_user = find_obj_in_resp response, 'User'
459 verify_user resp_user, email
461 group_perm = find_obj_in_resp response, 'Link', 'arvados#group'
462 verify_link group_perm, 'permission', 'can_read', resp_user[:uuid], nil
464 repo_perm = find_obj_in_resp response, 'Link', 'arvados#repository'
465 verify_link repo_perm, 'permission', 'can_manage', resp_user[:uuid], nil
467 vm_perm = find_obj_in_resp response, 'Link', 'arvados#virtualMachine'
468 verify_link vm_perm, 'permission', 'can_login', resp_user[:uuid], vm.uuid
469 assert_equal("foo", vm_perm.properties["username"])
472 test "setup new user with junk in database" do
473 set_user_from_auth :admin
475 email = 'foo@example.com'
477 user = User.create ({uuid: 'zzzzz-tpzed-abcdefghijklmno', email: email})
479 vm = VirtualMachine.create
481 response = user.setup(repo_name: 'foo/testrepo',
484 resp_user = find_obj_in_resp response, 'User'
485 verify_user resp_user, email
487 group_perm = find_obj_in_resp response, 'Link', 'arvados#group'
488 verify_link group_perm, 'permission', 'can_read', resp_user[:uuid], nil
490 repo_perm = find_obj_in_resp response, 'Link', 'arvados#repository'
491 verify_link repo_perm, 'permission', 'can_manage', resp_user[:uuid], nil
493 vm_perm = find_obj_in_resp response, 'Link', 'arvados#virtualMachine'
494 verify_link vm_perm, 'permission', 'can_login', resp_user[:uuid], vm.uuid
495 assert_equal("foo", vm_perm.properties["username"])
498 test "setup new user in multiple steps" do
499 set_user_from_auth :admin
501 email = 'foo@example.com'
503 user = User.create ({uuid: 'zzzzz-tpzed-abcdefghijklmno', email: email})
505 response = user.setup()
507 resp_user = find_obj_in_resp response, 'User'
508 verify_user resp_user, email
510 group_perm = find_obj_in_resp response, 'Link', 'arvados#group'
511 verify_link group_perm, 'permission', 'can_read', resp_user[:uuid], nil
513 # invoke setup again with repo_name
514 response = user.setup(repo_name: 'foo/testrepo')
515 resp_user = find_obj_in_resp response, 'User', nil
516 verify_user resp_user, email
517 assert_equal user.uuid, resp_user[:uuid], 'expected uuid not found'
519 group_perm = find_obj_in_resp response, 'Link', 'arvados#group'
520 verify_link group_perm, 'permission', 'can_read', resp_user[:uuid], nil
522 repo_perm = find_obj_in_resp response, 'Link', 'arvados#repository'
523 verify_link repo_perm, 'permission', 'can_manage', resp_user[:uuid], nil
525 # invoke setup again with a vm_uuid
526 vm = VirtualMachine.create
528 response = user.setup(repo_name: 'foo/testrepo',
531 resp_user = find_obj_in_resp response, 'User', nil
532 verify_user resp_user, email
533 assert_equal user.uuid, resp_user[:uuid], 'expected uuid not found'
535 group_perm = find_obj_in_resp response, 'Link', 'arvados#group'
536 verify_link group_perm, 'permission', 'can_read', resp_user[:uuid], nil
538 repo_perm = find_obj_in_resp response, 'Link', 'arvados#repository'
539 verify_link repo_perm, 'permission', 'can_manage', resp_user[:uuid], nil
541 vm_perm = find_obj_in_resp response, 'Link', 'arvados#virtualMachine'
542 verify_link vm_perm, 'permission', 'can_login', resp_user[:uuid], vm.uuid
543 assert_equal("foo", vm_perm.properties["username"])
546 def find_obj_in_resp (response_items, object_type, head_kind=nil)
548 response_items.each { |x|
553 if object_type == 'User'
554 if ArvadosModel::resource_class_for_uuid(x['uuid']) == User
558 else # looking for a link
559 if ArvadosModel::resource_class_for_uuid(x['head_uuid']).kind == head_kind
568 def verify_user (resp_user, email)
569 assert_not_nil resp_user, 'expected user object'
570 assert_not_nil resp_user['uuid'], 'expected user object'
571 assert_equal email, resp_user['email'], 'expected email not found'
575 def verify_link (link_object, link_class, link_name, tail_uuid, head_uuid)
576 assert_not_nil link_object, "expected link for #{link_class} #{link_name}"
577 assert_not_nil link_object[:uuid],
578 "expected non-nil uuid for link for #{link_class} #{link_name}"
579 assert_equal link_class, link_object[:link_class],
580 "expected link_class not found for #{link_class} #{link_name}"
581 assert_equal link_name, link_object[:name],
582 "expected link_name not found for #{link_class} #{link_name}"
583 assert_equal tail_uuid, link_object[:tail_uuid],
584 "expected tail_uuid not found for #{link_class} #{link_name}"
586 assert_equal head_uuid, link_object[:head_uuid],
587 "expected head_uuid not found for #{link_class} #{link_name}"
591 def create_user_and_verify_setup_and_notifications (active, new_user_recipients, inactive_recipients, email, expect_username)
592 Rails.configuration.Users.NewUserNotificationRecipients = new_user_recipients
593 Rails.configuration.Users.NewInactiveUserNotificationRecipients = inactive_recipients
595 ActionMailer::Base.deliveries = []
597 can_setup = (Rails.configuration.Users.AutoSetupNewUsers and
598 (not expect_username.nil?))
599 expect_repo_name = "#{expect_username}/#{expect_username}"
600 prior_repo = Repository.where(name: expect_repo_name).first
603 user.first_name = "first_name_for_newly_created_user"
605 user.is_active = active
607 assert_equal(expect_username, user.username)
610 verify_link_exists(Rails.configuration.Users.AutoSetupNewUsers || active,
611 groups(:all_users).uuid, user.uuid,
612 "permission", "can_read")
614 # Check for repository.
615 if named_repo = (prior_repo or
616 Repository.where(name: expect_repo_name).first)
617 verify_link_exists((can_setup and prior_repo.nil? and
618 Rails.configuration.Users.AutoSetupNewUsersWithRepository),
619 named_repo.uuid, user.uuid, "permission", "can_manage")
621 # Check for VM login.
622 if (auto_vm_uuid = Rails.configuration.Users.AutoSetupNewUsersWithVmUUID) != ""
623 verify_link_exists(can_setup, auto_vm_uuid, user.uuid,
624 "permission", "can_login", "username", expect_username)
627 # check email notifications
629 new_inactive_user_email = nil
631 new_user_email_subject = "#{Rails.configuration.Users.EmailSubjectPrefix}New user created notification"
632 if Rails.configuration.Users.AutoSetupNewUsers
633 new_user_email_subject = (expect_username or active) ?
634 "#{Rails.configuration.Users.EmailSubjectPrefix}New user created and setup notification" :
635 "#{Rails.configuration.Users.EmailSubjectPrefix}New user created, but not setup notification"
638 ActionMailer::Base.deliveries.each do |d|
639 if d.subject == new_user_email_subject then
641 elsif d.subject == "#{Rails.configuration.Users.EmailSubjectPrefix}New inactive user notification" then
642 new_inactive_user_email = d
646 # both active and inactive user creations should result in new user creation notification mails,
647 # if the new user email recipients config parameter is set
648 if not new_user_recipients.empty? then
649 assert_not_nil new_user_email, 'Expected new user email after setup'
650 assert_equal Rails.configuration.Users.UserNotifierEmailFrom, new_user_email.from[0]
651 assert_equal new_user_recipients.keys.first, new_user_email.to[0]
652 assert_equal new_user_email_subject, new_user_email.subject
654 assert_nil new_user_email, 'Did not expect new user email after setup'
658 if not inactive_recipients.empty? then
659 assert_not_nil new_inactive_user_email, 'Expected new inactive user email after setup'
660 assert_equal Rails.configuration.Users.UserNotifierEmailFrom, new_inactive_user_email.from[0]
661 assert_equal inactive_recipients.keys.first, new_inactive_user_email.to[0]
662 assert_equal "#{Rails.configuration.Users.EmailSubjectPrefix}New inactive user notification", new_inactive_user_email.subject
664 assert_nil new_inactive_user_email, 'Did not expect new inactive user email after setup'
667 assert_nil new_inactive_user_email, 'Expected no inactive user email after setting up active user'
669 ActionMailer::Base.deliveries = []
673 def verify_link_exists link_exists, head_uuid, tail_uuid, link_class, link_name, property_name=nil, property_value=nil
674 all_links = Link.where(head_uuid: head_uuid,
675 tail_uuid: tail_uuid,
676 link_class: link_class,
678 assert_equal link_exists, all_links.any?, "Link #{'not' if link_exists} found for #{link_name} #{link_class} #{property_value}"
679 if link_exists && property_name && property_value
680 all_links.each do |link|
681 assert_equal true, all_links.first.properties[property_name].start_with?(property_value), 'Property not found in link'
687 [:active, 'zzzzz-borkd-abcde12345abcde'],
688 [:active, 'zzzzz-j7d0g-abcde12345abcde'],
689 [:active, 'zzzzz-tpzed-borkd'],
690 [:system_user, 'zzzzz-tpzed-abcde12345abcde'],
691 [:anonymous, 'zzzzz-tpzed-abcde12345abcde'],
692 ].each do |fixture, new_uuid|
693 test "disallow update_uuid #{fixture} -> #{new_uuid}" do
696 act_as_system_user do
698 u.update_uuid(new_uuid: new_uuid)
701 # "Successfully aborted orig->new" outcome looks the same as
702 # "successfully updated new->orig".
703 assert_update_success(old_uuid: new_uuid,
705 expect_owned_objects: fixture == :active)
709 [:active, :spectator, :admin].each do |target|
710 test "update_uuid on #{target} as non-admin user" do
711 act_as_user users(:active) do
712 assert_raises(ArvadosModel::PermissionDeniedError) do
713 users(target).update_uuid(new_uuid: 'zzzzz-tpzed-abcde12345abcde')
719 test "update_uuid to existing uuid" do
722 new_uuid = users(:admin).uuid
723 act_as_system_user do
725 u.update_uuid(new_uuid: new_uuid)
729 assert_equal u.uuid, orig_uuid
730 assert_not_empty Collection.where(owner_uuid: orig_uuid)
731 assert_not_empty Group.where(owner_uuid: orig_uuid)
735 [:active, 'zbbbb-tpzed-abcde12345abcde'],
736 [:active, 'zzzzz-tpzed-abcde12345abcde'],
737 [:admin, 'zbbbb-tpzed-abcde12345abcde'],
738 [:admin, 'zzzzz-tpzed-abcde12345abcde'],
739 ].each do |fixture, new_uuid|
740 test "update_uuid #{fixture} to unused uuid #{new_uuid}" do
743 act_as_system_user do
744 u.update_uuid(new_uuid: new_uuid)
746 assert_update_success(old_uuid: orig_uuid,
748 expect_owned_objects: fixture == :active)
752 def assert_update_success(old_uuid:, new_uuid:, expect_owned_objects: true)
756 [Group, :owner_uuid],
757 [Collection, :owner_uuid],
758 ].each do |klass, attr|
759 assert_empty klass.where(attr => old_uuid)
760 if klass == User || expect_owned_objects
761 assert_not_empty klass.where(attr => new_uuid)
766 test "lookup user by email" do
767 u = User.register({"email" => "active-user@arvados.local", "identity_url" => "different-identity-url"})
768 active = User.find_by_uuid(users(:active).uuid)
769 assert_equal active.uuid, u.uuid
770 assert_equal "active-user@arvados.local", active.email
771 # identity_url is not updated
772 assert_equal "https://active-user.openid.local", active.identity_url
775 test "lookup user by alternate email" do
776 # register method will find that active-user@arvados.local already
777 # exists and return existing 'active' user.
778 u = User.register({"email" => "user@parent-company.com",
779 "alternate_emails" => ["active-user@arvados.local"],
780 "identity_url" => "different-identity-url"})
781 active = User.find_by_uuid(users(:active).uuid)
782 assert_equal active.uuid, u.uuid
784 # email should be updated
785 assert_equal "user@parent-company.com", active.email
787 # identity_url is not updated
788 assert_equal "https://active-user.openid.local", active.identity_url
791 test "register new user" do
792 u = User.register({"email" => "never-before-seen-user@arvados.local",
793 "identity_url" => "different-identity-url",
794 "first_name" => "Robert",
795 "last_name" => "Baratheon",
796 "username" => "bobby"})
797 nbs = User.find_by_uuid(u.uuid)
798 assert_equal nbs.uuid, u.uuid
799 assert_equal "different-identity-url", nbs.identity_url
800 assert_equal "never-before-seen-user@arvados.local", nbs.email
801 assert_equal false, nbs.is_admin
802 assert_equal false , nbs.is_active
803 assert_equal "bobby", nbs.username
804 assert_equal "Robert", nbs.first_name
805 assert_equal "Baratheon", nbs.last_name
808 test "fail when email address is ambiguous" do
809 User.register({"email" => "active-user@arvados.local"})
810 u = User.register({"email" => "never-before-seen-user@arvados.local"})
811 u.email = "active-user@arvados.local"
812 act_as_system_user do
816 User.register({"email" => "active-user@arvados.local"})
820 test "fail lookup without identifiers" do
822 User.register({"first_name" => "Robert", "last_name" => "Baratheon"})
825 User.register({"first_name" => "Robert", "last_name" => "Baratheon", "identity_url" => "", "email" => ""})
829 test "user can update name" do
830 set_user_from_auth :active
831 user = users(:active)
832 user.first_name = "MyNewName"
836 test "user cannot update email" do
837 set_user_from_auth :active
838 user = users(:active)
839 user.email = "new-name@example.com"
840 assert_not_allowed { user.save }
843 test "admin can update email" do
844 set_user_from_auth :admin
845 user = users(:active)
846 user.email = "new-name@example.com"