1 # Copyright (C) The Arvados Authors. All rights reserved.
3 # SPDX-License-Identifier: AGPL-3.0
7 class PermissionsTest < ActionDispatch::IntegrationTest
9 fixtures :users, :groups, :api_client_authorizations, :collections
11 test "adding and removing direct can_read links" do
12 # try to read collection as spectator
13 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
14 params: {:format => :json},
15 headers: auth(:spectator)
18 # try to add permission as spectator
19 post "/arvados/v1/links",
23 tail_uuid: users(:spectator).uuid,
24 link_class: 'permission',
26 head_uuid: collections(:foo_file).uuid,
30 headers: auth(:spectator)
33 # add permission as admin
34 post "/arvados/v1/links",
38 tail_uuid: users(:spectator).uuid,
39 link_class: 'permission',
41 head_uuid: collections(:foo_file).uuid,
46 u = json_response['uuid']
47 assert_response :success
49 # read collection as spectator
50 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
51 params: {:format => :json},
52 headers: auth(:spectator)
53 assert_response :success
55 # try to delete permission as spectator
56 delete "/arvados/v1/links/#{u}",
57 params: {:format => :json},
58 headers: auth(:spectator)
61 # delete permission as admin
62 delete "/arvados/v1/links/#{u}",
63 params: {:format => :json},
65 assert_response :success
67 # try to read collection as spectator
68 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
69 params: {:format => :json},
70 headers: auth(:spectator)
75 test "adding can_read links from user to group, group to collection" do
76 # try to read collection as spectator
77 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
78 params: {:format => :json},
79 headers: auth(:spectator)
82 # add permission for spectator to read group
83 post "/arvados/v1/links",
87 tail_uuid: users(:spectator).uuid,
88 link_class: 'permission',
90 head_uuid: groups(:private_role).uuid,
95 assert_response :success
97 # try to read collection as spectator
98 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
99 params: {:format => :json},
100 headers: auth(:spectator)
103 # add permission for group to read collection
104 post "/arvados/v1/links",
108 tail_uuid: groups(:private_role).uuid,
109 link_class: 'permission',
111 head_uuid: collections(:foo_file).uuid,
115 headers: auth(:admin)
116 u = json_response['uuid']
117 assert_response :success
119 # try to read collection as spectator
120 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
121 params: {:format => :json},
122 headers: auth(:spectator)
123 assert_response :success
125 # delete permission for group to read collection
126 delete "/arvados/v1/links/#{u}",
127 params: {:format => :json},
128 headers: auth(:admin)
129 assert_response :success
131 # try to read collection as spectator
132 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
133 params: {:format => :json},
134 headers: auth(:spectator)
140 test "adding can_read links from group to collection, user to group" do
141 # try to read collection as spectator
142 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
143 params: {:format => :json},
144 headers: auth(:spectator)
147 # add permission for group to read collection
148 post "/arvados/v1/links",
152 tail_uuid: groups(:private_role).uuid,
153 link_class: 'permission',
155 head_uuid: collections(:foo_file).uuid,
159 headers: auth(:admin)
160 assert_response :success
162 # try to read collection as spectator
163 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
164 params: {:format => :json},
165 headers: auth(:spectator)
168 # add permission for spectator to read group
169 post "/arvados/v1/links",
173 tail_uuid: users(:spectator).uuid,
174 link_class: 'permission',
176 head_uuid: groups(:private_role).uuid,
180 headers: auth(:admin)
181 u = json_response['uuid']
182 assert_response :success
184 # try to read collection as spectator
185 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
186 params: {:format => :json},
187 headers: auth(:spectator)
188 assert_response :success
190 # delete permission for spectator to read group
191 delete "/arvados/v1/links/#{u}",
192 params: {:format => :json},
193 headers: auth(:admin)
194 assert_response :success
196 # try to read collection as spectator
197 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
198 params: {:format => :json},
199 headers: auth(:spectator)
204 test "adding can_read links from user to group, group to group, group to collection" do
205 # try to read collection as spectator
206 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
207 params: {:format => :json},
208 headers: auth(:spectator)
211 # add permission for user to read group
212 post "/arvados/v1/links",
216 tail_uuid: users(:spectator).uuid,
217 link_class: 'permission',
219 head_uuid: groups(:private_role).uuid,
223 headers: auth(:admin)
224 assert_response :success
226 # add permission for group to read group
227 post "/arvados/v1/links",
231 tail_uuid: groups(:private_role).uuid,
232 link_class: 'permission',
234 head_uuid: groups(:empty_lonely_group).uuid,
238 headers: auth(:admin)
239 assert_response :success
241 # add permission for group to read collection
242 post "/arvados/v1/links",
246 tail_uuid: groups(:empty_lonely_group).uuid,
247 link_class: 'permission',
249 head_uuid: collections(:foo_file).uuid,
253 headers: auth(:admin)
254 u = json_response['uuid']
255 assert_response :success
257 # try to read collection as spectator
258 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
259 params: {:format => :json},
260 headers: auth(:spectator)
261 assert_response :success
263 # delete permission for group to read collection
264 delete "/arvados/v1/links/#{u}",
265 params: {:format => :json},
266 headers: auth(:admin)
267 assert_response :success
269 # try to read collection as spectator
270 get "/arvados/v1/collections/#{collections(:foo_file).uuid}",
271 params: {:format => :json},
272 headers: auth(:spectator)
276 test "read-only group-admin cannot modify administered user" do
277 put "/arvados/v1/users/#{users(:active).uuid}",
280 first_name: 'KilroyWasHere'
284 headers: auth(:rominiadmin)
288 test "read-only group-admin cannot read or update non-administered user" do
289 get "/arvados/v1/users/#{users(:spectator).uuid}",
290 params: {:format => :json},
291 headers: auth(:rominiadmin)
294 put "/arvados/v1/users/#{users(:spectator).uuid}",
297 first_name: 'KilroyWasHere'
301 headers: auth(:rominiadmin)
305 test "RO group-admin finds user's specimens, RW group-admin can update" do
306 [[:rominiadmin, false],
307 [:miniadmin, true]].each do |which_user, update_should_succeed|
308 get "/arvados/v1/specimens",
309 params: {:format => :json},
310 headers: auth(which_user)
311 assert_response :success
312 resp_uuids = json_response['items'].collect { |i| i['uuid'] }
313 [[true, specimens(:owned_by_active_user).uuid],
314 [true, specimens(:owned_by_private_group).uuid],
315 [false, specimens(:owned_by_spectator).uuid],
316 ].each do |should_find, uuid|
317 assert_equal(should_find, !resp_uuids.index(uuid).nil?,
318 "%s should%s see %s in specimen list" %
320 should_find ? '' : 'not ',
322 put "/arvados/v1/specimens/#{uuid}",
326 miniadmin_was_here: true
331 headers: auth(which_user)
334 elsif !update_should_succeed
337 assert_response :success
343 test "get_permissions returns list" do
344 # First confirm that user :active cannot get permissions on group :public
345 get "/arvados/v1/permissions/#{groups(:public).uuid}",
347 headers: auth(:active)
350 # add some permissions, including can_manage
351 # permission for user :active
352 post "/arvados/v1/links",
356 tail_uuid: users(:spectator).uuid,
357 link_class: 'permission',
359 head_uuid: groups(:public).uuid,
363 headers: auth(:admin)
364 assert_response :success
365 can_read_uuid = json_response['uuid']
367 post "/arvados/v1/links",
371 tail_uuid: users(:inactive).uuid,
372 link_class: 'permission',
374 head_uuid: groups(:public).uuid,
378 headers: auth(:admin)
379 assert_response :success
380 can_write_uuid = json_response['uuid']
382 post "/arvados/v1/links",
386 tail_uuid: users(:active).uuid,
387 link_class: 'permission',
389 head_uuid: groups(:public).uuid,
393 headers: auth(:admin)
394 assert_response :success
395 can_manage_uuid = json_response['uuid']
397 # Now user :active should be able to retrieve permissions
399 get("/arvados/v1/permissions/#{groups(:public).uuid}",
400 params: { :format => :json },
401 headers: auth(:active))
402 assert_response :success
404 perm_uuids = json_response['items'].map { |item| item['uuid'] }
405 assert_includes perm_uuids, can_read_uuid, "can_read_uuid not found"
406 assert_includes perm_uuids, can_write_uuid, "can_write_uuid not found"
407 assert_includes perm_uuids, can_manage_uuid, "can_manage_uuid not found"
410 test "get_permissions returns 404 for nonexistent uuid" do
411 nonexistent = Group.generate_uuid
412 # make sure it really doesn't exist
413 get "/arvados/v1/groups/#{nonexistent}", params: nil, headers: auth(:admin)
416 get "/arvados/v1/permissions/#{nonexistent}", params: nil, headers: auth(:active)
420 test "get_permissions returns 403 if user can read but not manage" do
421 post "/arvados/v1/links",
424 tail_uuid: users(:active).uuid,
425 link_class: 'permission',
427 head_uuid: groups(:public).uuid,
431 headers: auth(:admin)
432 assert_response :success
434 get "/arvados/v1/permissions/#{groups(:public).uuid}",
436 headers: auth(:active)
440 test "active user can read the empty collection" do
441 # The active user should be able to read the empty collection.
443 get("/arvados/v1/collections/#{empty_collection_pdh}",
444 params: {:format => :json},
445 headers: auth(:active))
446 assert_response :success
447 assert_empty json_response['manifest_text'], "empty collection manifest_text is not empty"