18865: Support "permission links with me as tail_uuid" query.

[arvados.git] / services / api / test / integration / permissions_test.rb

diff --git a/services/api/test/integration/permissions_test.rb b/services/api/test/integration/permissions_test.rb
index 7502f70e38478ab0e176e9a654911d3869f4cddd..a5e04165e8b28b819723d5ea73274745bcf06c68 100644 (file)
--- a/services/api/test/integration/permissions_test.rb
+++ b/services/api/test/integration/permissions_test.rb
@@ -521,6 +521,22 @@ class PermissionsTest < ActionDispatch::IntegrationTest
       assert_equal can_read_collection_uuid, json_response['items'][0]['uuid']
     end
 
+    # The "spectator-can_read-collection" link should be visible to
+    # the subject user ("spectator") in a filter query, even without
+    # can_manage permission on the target object.
+    [
+      ['tail_uuid', '=', users(:spectator).uuid],
+    ].each do |filter|
+      get "/arvados/v1/links",
+          params: {
+            filters: ([['link_class', '=', 'permission'], filter]).to_json,
+          },
+          headers: auth(:spectator)
+      assert_response :success
+      perm_uuids = json_response['items'].map { |item| item['uuid'] }
+      assert_includes perm_uuids, can_read_collection_uuid, "could not find can_read link using index with filter #{filter}"
+    end
+
     ### Now delete the can_manage link
     delete "/arvados/v1/links/#{can_manage_uuid}",
       headers: auth(:active)