services/api/test/unit/permission_test.rb

   1 require 'test_helper'
   2
   3 class PermissionTest < ActiveSupport::TestCase
   4   include CurrentApiClient
   5
   6   test "Grant permissions on an object I own" do
   7     set_user_from_auth :active_trustedclient
   8
   9     ob = Specimen.create
  10     assert ob.save
  11
  12     # Ensure I have permission to manage this group even when its owner changes
  13     perm_link = Link.create(tail_uuid: users(:active).uuid,
  14                             head_uuid: ob.uuid,
  15                             link_class: 'permission',
  16                             name: 'can_manage')
  17     assert perm_link.save, "should give myself permission on my own object"
  18   end
  19
  20   test "Delete permission links when deleting an object" do
  21     set_user_from_auth :active_trustedclient
  22
  23     ob = Specimen.create!
  24     Link.create!(tail_uuid: users(:active).uuid,
  25                  head_uuid: ob.uuid,
  26                  link_class: 'permission',
  27                  name: 'can_manage')
  28     ob_uuid = ob.uuid
  29     assert ob.destroy, "Could not destroy object with 1 permission link"
  30     assert_empty(Link.where(head_uuid: ob_uuid),
  31                  "Permission link was not deleted when object was deleted")
  32   end
  33
  34   test "permission links owned by root" do
  35     set_user_from_auth :active_trustedclient
  36     ob = Specimen.create!
  37     perm_link = Link.create!(tail_uuid: users(:active).uuid,
  38                              head_uuid: ob.uuid,
  39                              link_class: 'permission',
  40                              name: 'can_read')
  41     assert_equal system_user_uuid, perm_link.owner_uuid
  42   end
  43
  44   test "readable_by" do
  45     set_user_from_auth :active_trustedclient
  46
  47     ob = Specimen.create!
  48     Link.create!(tail_uuid: users(:active).uuid,
  49                  head_uuid: ob.uuid,
  50                  link_class: 'permission',
  51                  name: 'can_read')
  52     assert Specimen.readable_by(users(:active)).where(uuid: ob.uuid).any?, "user does not have read permission"
  53   end
  54
  55   test "writable_by" do
  56     set_user_from_auth :active_trustedclient
  57
  58     ob = Specimen.create!
  59     Link.create!(tail_uuid: users(:active).uuid,
  60                  head_uuid: ob.uuid,
  61                  link_class: 'permission',
  62                  name: 'can_write')
  63     assert ob.writable_by.include?(users(:active).uuid), "user does not have write permission"
  64   end
  65
  66   test "writable_by reports requesting user's own uuid for a writable project" do
  67     invited_to_write = users(:project_viewer)
  68     group = groups(:asubproject)
  69
  70     # project_view can read, but cannot see write or see writers list
  71     set_user_from_auth :project_viewer
  72     assert_equal([group.owner_uuid],
  73                  group.writable_by,
  74                  "writers list should just have owner_uuid")
  75
  76     # allow project_viewer to write for the remainder of the test
  77     set_user_from_auth :admin
  78     Link.create!(tail_uuid: invited_to_write.uuid,
  79                  head_uuid: group.uuid,
  80                  link_class: 'permission',
  81                  name: 'can_write')
  82     group.permissions.reload
  83
  84     # project_viewer should see self in writers list (but not all writers)
  85     set_user_from_auth :project_viewer
  86     assert_not_nil(group.writable_by,
  87                     "can write but cannot see writers list")
  88     assert_includes(group.writable_by, invited_to_write.uuid,
  89                     "self missing from writers list")
  90     assert_includes(group.writable_by, group.owner_uuid,
  91                     "project owner missing from writers list")
  92     refute_includes(group.writable_by, users(:active).uuid,
  93                     "saw :active user in writers list")
  94
  95     # active user should see full writers list
  96     set_user_from_auth :active
  97     assert_includes(group.writable_by, invited_to_write.uuid,
  98                     "permission just added, but missing from writers list")
  99
 100     # allow project_viewer to manage for the remainder of the test
 101     set_user_from_auth :admin
 102     Link.create!(tail_uuid: invited_to_write.uuid,
 103                  head_uuid: group.uuid,
 104                  link_class: 'permission',
 105                  name: 'can_manage')
 106     # invite another writer we can test for
 107     Link.create!(tail_uuid: users(:spectator).uuid,
 108                  head_uuid: group.uuid,
 109                  link_class: 'permission',
 110                  name: 'can_write')
 111     group.permissions.reload
 112
 113     set_user_from_auth :project_viewer
 114     assert_not_nil(group.writable_by,
 115                     "can manage but cannot see writers list")
 116     assert_includes(group.writable_by, users(:spectator).uuid,
 117                     ":spectator missing from writers list")
 118   end
 119
 120   test "user owns group, group can_manage object's group, user can add permissions" do
 121     set_user_from_auth :admin
 122
 123     owner_grp = Group.create!(owner_uuid: users(:active).uuid)
 124
 125     sp_grp = Group.create!
 126     sp = Specimen.create!(owner_uuid: sp_grp.uuid)
 127
 128     manage_perm = Link.create!(link_class: 'permission',
 129                                name: 'can_manage',
 130                                tail_uuid: owner_grp.uuid,
 131                                head_uuid: sp_grp.uuid)
 132
 133     # active user owns owner_grp, which has can_manage permission on sp_grp
 134     # user should be able to add permissions on sp.
 135     set_user_from_auth :active_trustedclient
 136     test_perm = Link.create(tail_uuid: users(:active).uuid,
 137                             head_uuid: sp.uuid,
 138                             link_class: 'permission',
 139                             name: 'can_write')
 140     test_uuid = test_perm.uuid
 141     assert test_perm.save, "could not save new permission on target object"
 142     assert test_perm.destroy, "could not delete new permission on target object"
 143   end
 144
 145   # TODO(twp): fix bug #3091, which should fix this test.
 146   test "can_manage permission on a non-group object" do
 147     skip
 148     set_user_from_auth :admin
 149
 150     ob = Specimen.create!
 151     # grant can_manage permission to active
 152     perm_link = Link.create!(tail_uuid: users(:active).uuid,
 153                              head_uuid: ob.uuid,
 154                              link_class: 'permission',
 155                              name: 'can_manage')
 156     # ob is owned by :admin, the link is owned by root
 157     assert_equal users(:admin).uuid, ob.owner_uuid
 158     assert_equal system_user_uuid, perm_link.owner_uuid
 159
 160     # user "active" can modify the permission link
 161     set_user_from_auth :active_trustedclient
 162     perm_link.properties["foo"] = 'bar'
 163     assert perm_link.save, "could not save modified link"
 164
 165     assert_equal 'bar', perm_link.properties['foo'], "link properties do not include foo = bar"
 166   end
 167
 168   test "user without can_manage permission may not modify permission link" do
 169     set_user_from_auth :admin
 170
 171     ob = Specimen.create!
 172     # grant can_manage permission to active
 173     perm_link = Link.create!(tail_uuid: users(:active).uuid,
 174                              head_uuid: ob.uuid,
 175                              link_class: 'permission',
 176                              name: 'can_read')
 177     # ob is owned by :admin, the link is owned by root
 178     assert_equal ob.owner_uuid, users(:admin).uuid
 179     assert_equal perm_link.owner_uuid, system_user_uuid
 180
 181     # user "active" may not modify the permission link
 182     set_user_from_auth :active_trustedclient
 183     perm_link.name = 'can_manage'
 184     assert_raises ArvadosModel::PermissionDeniedError do
 185       perm_link.save
 186     end
 187   end
 188
 189   test "cannot create with owner = unwritable user" do
 190     set_user_from_auth :rominiadmin
 191     assert_raises ArvadosModel::PermissionDeniedError, "created with owner = unwritable user" do
 192       Specimen.create!(owner_uuid: users(:active).uuid)
 193     end
 194   end
 195
 196   test "cannot change owner to unwritable user" do
 197     set_user_from_auth :rominiadmin
 198     ob = Specimen.create!
 199     assert_raises ArvadosModel::PermissionDeniedError, "changed owner to unwritable user" do
 200       ob.update_attributes!(owner_uuid: users(:active).uuid)
 201     end
 202   end
 203
 204   test "cannot create with owner = unwritable group" do
 205     set_user_from_auth :rominiadmin
 206     assert_raises ArvadosModel::PermissionDeniedError, "created with owner = unwritable group" do
 207       Specimen.create!(owner_uuid: groups(:aproject).uuid)
 208     end
 209   end
 210
 211   test "cannot change owner to unwritable group" do
 212     set_user_from_auth :rominiadmin
 213     ob = Specimen.create!
 214     assert_raises ArvadosModel::PermissionDeniedError, "changed owner to unwritable group" do
 215       ob.update_attributes!(owner_uuid: groups(:aproject).uuid)
 216     end
 217   end
 218
 219 end