+
+ test "manager user gets permission to minions' articles via can_manage link" do
+ manager = create :active_user, first_name: "Manage", last_name: "Er"
+ minion = create :active_user, first_name: "Min", last_name: "Ion"
+ minions_specimen = act_as_user minion do
+ g = Group.create! name: "minon project", group_class: "project"
+ Collection.create! owner_uuid: g.uuid
+ end
+ # Manager creates a group. (Make sure it doesn't magically give
+ # anyone any additional permissions.)
+ g = nil
+ act_as_user manager do
+ g = create :group, name: "NoBigSecret Lab", group_class: "role"
+ assert_empty(User.readable_by(manager).where(uuid: minion.uuid),
+ "saw a user I shouldn't see")
+ assert_raises(ArvadosModel::PermissionDeniedError,
+ ActiveRecord::RecordInvalid,
+ "gave can_read permission to a user I shouldn't see") do
+ create(:permission_link,
+ name: 'can_read', tail_uuid: minion.uuid, head_uuid: g.uuid)
+ end
+ %w(can_manage can_write can_read).each do |perm_type|
+ assert_raises(ArvadosModel::PermissionDeniedError,
+ ActiveRecord::RecordInvalid,
+ "escalated privileges") do
+ create(:permission_link,
+ name: perm_type, tail_uuid: g.uuid, head_uuid: minion.uuid)
+ end
+ end
+ assert_empty(User.readable_by(manager).where(uuid: minion.uuid),
+ "manager saw minion too soon")
+ assert_empty(User.readable_by(minion).where(uuid: manager.uuid),
+ "minion saw manager too soon")
+ assert_empty(Group.readable_by(minion).where(uuid: g.uuid),
+ "minion saw manager's new NoBigSecret Lab group too soon")
+
+ # Manager declares everybody on the system should be able to see
+ # the NoBigSecret Lab group.
+ create(:permission_link,
+ name: 'can_read',
+ tail_uuid: 'zzzzz-j7d0g-fffffffffffffff',
+ head_uuid: g.uuid)
+ # ...but nobody has joined the group yet. Manager still can't see
+ # minion.
+ assert_empty(User.readable_by(manager).where(uuid: minion.uuid),
+ "manager saw minion too soon")
+ end
+
+ act_as_user minion do
+ # Minion can see the group.
+ assert_not_empty(Group.readable_by(minion).where(uuid: g.uuid),
+ "minion could not see the NoBigSecret Lab group")
+ # Minion joins the group.
+ create(:permission_link,
+ name: 'can_read',
+ tail_uuid: g.uuid,
+ head_uuid: minion.uuid)
+ end
+
+ act_as_user manager do
+ # Now, manager can see minion.
+ assert_not_empty(User.readable_by(manager).where(uuid: minion.uuid),
+ "manager could not see minion")
+ # But cannot obtain further privileges this way.
+ assert_raises(ArvadosModel::PermissionDeniedError,
+ "escalated privileges") do
+ create(:permission_link,
+ name: 'can_manage', tail_uuid: manager.uuid, head_uuid: minion.uuid)
+ end
+ assert_empty(Collection
+ .readable_by(manager)
+ .where(uuid: minions_specimen.uuid),
+ "manager saw the minion's private stuff")
+ assert_raises(ArvadosModel::PermissionDeniedError,
+ "manager could update minion's private stuff") do
+ minions_specimen.update_attributes(properties: {'x' => 'y'})
+ end
+ end
+
+ act_as_system_user do
+ # Root can give Manager more privileges over Minion.
+ create(:permission_link,
+ name: 'can_manage', tail_uuid: g.uuid, head_uuid: minion.uuid)
+ end
+
+ act_as_user manager do
+ # Now, manager can read and write Minion's stuff.
+ assert_not_empty(Collection
+ .readable_by(manager)
+ .where(uuid: minions_specimen.uuid),
+ "manager could not find minion's specimen by uuid")
+ assert_equal(true,
+ minions_specimen.update_attributes(properties: {'x' => 'y'}),
+ "manager could not update minion's specimen object")
+ end
+ end
+
+ test "users with bidirectional read permission in group can see each other, but cannot see each other's private articles" do
+ a = create :active_user, first_name: "A"
+ b = create :active_user, first_name: "B"
+ other = create :active_user, first_name: "OTHER"
+
+ assert_empty(User.readable_by(b).where(uuid: a.uuid),
+ "#{b.first_name} should not be able to see 'a' in the user list")
+ assert_empty(User.readable_by(a).where(uuid: b.uuid),
+ "#{a.first_name} should not be able to see 'b' in the user list")
+
+ act_as_system_user do
+ g = create :group, group_class: "role"
+ [a,b].each do |u|
+ create(:permission_link,
+ name: 'can_read', tail_uuid: u.uuid, head_uuid: g.uuid)
+ create(:permission_link,
+ name: 'can_read', head_uuid: u.uuid, tail_uuid: g.uuid)
+ end
+ end
+
+ assert_not_empty(User.readable_by(b).where(uuid: a.uuid),
+ "#{b.first_name} should be able to see 'a' in the user list")
+ assert_not_empty(User.readable_by(a).where(uuid: b.uuid),
+ "#{a.first_name} should be able to see 'b' in the user list")
+
+ a_specimen = act_as_user a do
+ Collection.create!
+ end
+ assert_not_empty(Collection.readable_by(a).where(uuid: a_specimen.uuid),
+ "A cannot read own Collection, following test probably useless.")
+ assert_empty(Collection.readable_by(b).where(uuid: a_specimen.uuid),
+ "B can read A's Collection")
+ [a,b].each do |u|
+ assert_empty(User.readable_by(u).where(uuid: other.uuid),
+ "#{u.first_name} can see OTHER in the user list")
+ assert_empty(User.readable_by(other).where(uuid: u.uuid),
+ "OTHER can see #{u.first_name} in the user list")
+ act_as_user u do
+ assert_raises ArvadosModel::PermissionDeniedError, "wrote without perm" do
+ other.update_attributes!(prefs: {'pwned' => true})
+ end
+ assert_equal(true, u.update_attributes!(prefs: {'thisisme' => true}),
+ "#{u.first_name} can't update its own prefs")
+ end
+ act_as_user other do
+ assert_raises(ArvadosModel::PermissionDeniedError,
+ "OTHER wrote #{u.first_name} without perm") do
+ u.update_attributes!(prefs: {'pwned' => true})
+ end
+ assert_equal(true, other.update_attributes!(prefs: {'thisisme' => true}),
+ "OTHER can't update its own prefs")
+ end
+ end
+ end
+
+ test "cannot create with owner = unwritable user" do
+ set_user_from_auth :rominiadmin
+ assert_raises ArvadosModel::PermissionDeniedError, "created with owner = unwritable user" do
+ Collection.create!(owner_uuid: users(:active).uuid)
+ end
+ end
+
+ test "cannot change owner to unwritable user" do
+ set_user_from_auth :rominiadmin
+ ob = Collection.create!
+ assert_raises ArvadosModel::PermissionDeniedError, "changed owner to unwritable user" do
+ ob.update_attributes!(owner_uuid: users(:active).uuid)
+ end
+ end
+
+ test "cannot create with owner = unwritable group" do
+ set_user_from_auth :rominiadmin
+ assert_raises ArvadosModel::PermissionDeniedError, "created with owner = unwritable group" do
+ Collection.create!(owner_uuid: groups(:aproject).uuid)
+ end
+ end
+
+ test "cannot change owner to unwritable group" do
+ set_user_from_auth :rominiadmin
+ ob = Collection.create!
+ assert_raises ArvadosModel::PermissionDeniedError, "changed owner to unwritable group" do
+ ob.update_attributes!(owner_uuid: groups(:aproject).uuid)
+ end
+ end
+
+ def container_logs(container, user)
+ Log.readable_by(users(user)).
+ where(object_uuid: containers(container).uuid, event_type: "test")
+ end
+
+ test "container logs created by dispatch are visible to container requestor" do
+ set_user_from_auth :dispatch1
+ Log.create!(object_uuid: containers(:running).uuid,
+ event_type: "test")
+
+ assert_not_empty container_logs(:running, :admin)
+ assert_not_empty container_logs(:running, :active)
+ assert_empty container_logs(:running, :spectator)
+ end
+
+ test "container logs created by dispatch are public if container request is public" do
+ set_user_from_auth :dispatch1
+ Log.create!(object_uuid: containers(:running_older).uuid,
+ event_type: "test")
+
+ assert_not_empty container_logs(:running_older, :anonymous)
+ end
+
+ test "add user to group, then remove them" do
+ set_user_from_auth :admin
+ grp = Group.create!(owner_uuid: system_user_uuid, group_class: "role")
+ col = Collection.create!(owner_uuid: system_user_uuid)
+
+ l0 = Link.create!(tail_uuid: grp.uuid,
+ head_uuid: col.uuid,
+ link_class: 'permission',
+ name: 'can_read')
+
+ assert_empty Collection.readable_by(users(:active)).where(uuid: col.uuid)
+ assert_empty User.readable_by(users(:active)).where(uuid: users(:project_viewer).uuid)
+
+ l1 = Link.create!(tail_uuid: users(:active).uuid,
+ head_uuid: grp.uuid,
+ link_class: 'permission',
+ name: 'can_read')
+ l2 = Link.create!(tail_uuid: grp.uuid,
+ head_uuid: users(:active).uuid,
+ link_class: 'permission',
+ name: 'can_read')
+
+ l3 = Link.create!(tail_uuid: users(:project_viewer).uuid,
+ head_uuid: grp.uuid,
+ link_class: 'permission',
+ name: 'can_read')
+ l4 = Link.create!(tail_uuid: grp.uuid,
+ head_uuid: users(:project_viewer).uuid,
+ link_class: 'permission',
+ name: 'can_read')
+
+ assert Collection.readable_by(users(:active)).where(uuid: col.uuid).first
+ assert User.readable_by(users(:active)).where(uuid: users(:project_viewer).uuid).first
+
+ l1.destroy
+ l2.destroy
+
+ assert_empty Collection.readable_by(users(:active)).where(uuid: col.uuid)
+ assert_empty User.readable_by(users(:active)).where(uuid: users(:project_viewer).uuid)
+
+ end
+
+
+ test "add user to group, then change permission level" do
+ set_user_from_auth :admin
+ grp = Group.create!(owner_uuid: system_user_uuid, group_class: "project")
+ col = Collection.create!(owner_uuid: grp.uuid)
+ assert_empty Collection.readable_by(users(:active)).where(uuid: col.uuid)
+ assert_empty User.readable_by(users(:active)).where(uuid: users(:project_viewer).uuid)
+
+ l1 = Link.create!(tail_uuid: users(:active).uuid,
+ head_uuid: grp.uuid,
+ link_class: 'permission',
+ name: 'can_manage')
+
+ assert Collection.readable_by(users(:active)).where(uuid: col.uuid).first
+ assert users(:active).can?(read: col.uuid)
+ assert users(:active).can?(write: col.uuid)
+ assert users(:active).can?(manage: col.uuid)
+
+ l1.name = 'can_read'
+ l1.save!
+
+ assert Collection.readable_by(users(:active)).where(uuid: col.uuid).first
+ assert users(:active).can?(read: col.uuid)
+ assert !users(:active).can?(write: col.uuid)
+ assert !users(:active).can?(manage: col.uuid)
+
+ l1.name = 'can_write'
+ l1.save!
+
+ assert Collection.readable_by(users(:active)).where(uuid: col.uuid).first
+ assert users(:active).can?(read: col.uuid)
+ assert users(:active).can?(write: col.uuid)
+ assert !users(:active).can?(manage: col.uuid)
+ end
+
+
+ test "add user to group, then add overlapping permission link to group" do
+ set_user_from_auth :admin
+ grp = Group.create!(owner_uuid: system_user_uuid, group_class: "project")
+ col = Collection.create!(owner_uuid: grp.uuid)
+ assert_empty Collection.readable_by(users(:active)).where(uuid: col.uuid)
+ assert_empty User.readable_by(users(:active)).where(uuid: users(:project_viewer).uuid)
+
+ l1 = Link.create!(tail_uuid: users(:active).uuid,
+ head_uuid: grp.uuid,
+ link_class: 'permission',
+ name: 'can_manage')
+
+ assert Collection.readable_by(users(:active)).where(uuid: col.uuid).first
+ assert users(:active).can?(read: col.uuid)
+ assert users(:active).can?(write: col.uuid)
+ assert users(:active).can?(manage: col.uuid)
+
+ l3 = Link.create!(tail_uuid: users(:active).uuid,
+ head_uuid: grp.uuid,
+ link_class: 'permission',
+ name: 'can_read')
+
+ assert Collection.readable_by(users(:active)).where(uuid: col.uuid).first
+ assert users(:active).can?(read: col.uuid)
+ assert users(:active).can?(write: col.uuid)
+ assert users(:active).can?(manage: col.uuid)
+
+ l3.destroy!
+
+ assert Collection.readable_by(users(:active)).where(uuid: col.uuid).first
+ assert users(:active).can?(read: col.uuid)
+ assert users(:active).can?(write: col.uuid)
+ assert users(:active).can?(manage: col.uuid)
+ end
+
+
+ test "add user to group, then add overlapping permission link to subproject" do
+ set_user_from_auth :admin
+ grp = Group.create!(owner_uuid: system_user_uuid, group_class: "role")
+ prj = Group.create!(owner_uuid: system_user_uuid, group_class: "project")
+
+ l0 = Link.create!(tail_uuid: grp.uuid,
+ head_uuid: prj.uuid,
+ link_class: 'permission',
+ name: 'can_manage')
+
+ assert_empty Group.readable_by(users(:active)).where(uuid: prj.uuid)
+ assert_empty User.readable_by(users(:active)).where(uuid: users(:project_viewer).uuid)
+
+ l1 = Link.create!(tail_uuid: users(:active).uuid,
+ head_uuid: grp.uuid,
+ link_class: 'permission',
+ name: 'can_manage')
+ l2 = Link.create!(tail_uuid: grp.uuid,
+ head_uuid: users(:active).uuid,
+ link_class: 'permission',
+ name: 'can_read')
+
+ assert Group.readable_by(users(:active)).where(uuid: prj.uuid).first
+ assert users(:active).can?(read: prj.uuid)
+ assert users(:active).can?(write: prj.uuid)
+ assert users(:active).can?(manage: prj.uuid)
+
+ l3 = Link.create!(tail_uuid: grp.uuid,
+ head_uuid: prj.uuid,
+ link_class: 'permission',
+ name: 'can_read')
+
+ assert Group.readable_by(users(:active)).where(uuid: prj.uuid).first
+ assert users(:active).can?(read: prj.uuid)
+ assert users(:active).can?(write: prj.uuid)
+ assert users(:active).can?(manage: prj.uuid)
+
+ l3.destroy!
+
+ assert Group.readable_by(users(:active)).where(uuid: prj.uuid).first
+ assert users(:active).can?(read: prj.uuid)
+ assert users(:active).can?(write: prj.uuid)
+ assert users(:active).can?(manage: prj.uuid)
+ end
+
+ [system_user_uuid, anonymous_user_uuid].each do |u|
+ test "cannot delete system user #{u}" do
+ act_as_system_user do
+ assert_raises ArvadosModel::PermissionDeniedError do
+ User.find_by_uuid(u).destroy
+ end
+ end
+ end
+ end
+
+ [system_group_uuid, anonymous_group_uuid, public_project_uuid].each do |g|
+ test "cannot delete system group #{g}" do
+ act_as_system_user do
+ assert_raises ArvadosModel::PermissionDeniedError do
+ Group.find_by_uuid(g).destroy
+ end
+ end
+ end
+ end