+ test "setup active user with repo and no vm" do
+ authorize_with :admin
+ active_user = users(:active)
+
+ # invoke setup with a repository
+ post :setup, {
+ repo_name: 'usertestrepo',
+ uuid: active_user['uuid']
+ }
+
+ assert_response :success
+
+ response_items = JSON.parse(@response.body)['items']
+ created = find_obj_in_resp response_items, 'User', nil
+
+ assert_equal active_user[:email], created['email'], 'expected input email'
+
+ # verify links
+ verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
+ 'All users', created['uuid'], 'arvados#group', true, 'Group'
+
+ verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
+ 'active/usertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
+
+ verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login',
+ nil, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
+ end
+
+ test "setup active user with vm and no repo" do
+ authorize_with :admin
+ active_user = users(:active)
+ repos_query = Repository.where(owner_uuid: active_user.uuid)
+ repo_link_query = Link.where(tail_uuid: active_user.uuid,
+ link_class: "permission", name: "can_manage")
+ repos_count = repos_query.count
+ repo_link_count = repo_link_query.count
+
+ # invoke setup with a repository
+ post :setup, {
+ vm_uuid: @vm_uuid,
+ uuid: active_user['uuid'],
+ email: 'junk_email'
+ }
+
+ assert_response :success
+
+ response_items = JSON.parse(@response.body)['items']
+ created = find_obj_in_resp response_items, 'User', nil
+
+ assert_equal active_user['email'], created['email'], 'expected original email'
+
+ # verify links
+ verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
+ 'All users', created['uuid'], 'arvados#group', true, 'Group'
+
+ assert_equal(repos_count, repos_query.count)
+ assert_equal(repo_link_count, repo_link_query.count)
+
+ verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login',
+ @vm_uuid, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine'
+ end
+
+ test "unsetup active user" do
+ active_user = users(:active)
+ assert_not_nil active_user['uuid'], 'expected uuid for the active user'
+ assert active_user['is_active'], 'expected is_active for active user'
+
+ verify_link_existence active_user['uuid'], active_user['email'],
+ false, true, true, true, true
+
+ authorize_with :admin
+
+ # now unsetup this user
+ post :unsetup, id: active_user['uuid']
+ assert_response :success
+
+ response_user = JSON.parse(@response.body)
+ assert_not_nil response_user['uuid'], 'expected uuid for the upsetup user'
+ assert_equal active_user['uuid'], response_user['uuid'], 'expected uuid not found'
+ assert !response_user['is_active'], 'expected user to be inactive'
+ assert !response_user['is_invited'], 'expected user to be uninvited'
+
+ verify_link_existence response_user['uuid'], response_user['email'],
+ false, false, false, false, false
+
+ active_user = User.find_by_uuid(users(:active).uuid)
+ readable_groups = active_user.groups_i_can(:read)
+ all_users_group = Group.all.collect(&:uuid).select { |g| g.match /-f+$/ }
+ refute_includes(readable_groups, all_users_group,
+ "active user can read All Users group after being deactivated")
+ assert_equal(false, active_user.is_invited,
+ "active user is_invited after being deactivated & reloaded")
+ end
+
+ test "setup user with send notification param false and verify no email" do
+ authorize_with :admin
+
+ post :setup, {
+ openid_prefix: 'http://www.example.com/account',
+ send_notification_email: 'false',
+ user: {
+ email: "foo@example.com"
+ }
+ }
+
+ assert_response :success
+ response_items = JSON.parse(@response.body)['items']
+ created = find_obj_in_resp response_items, 'User', nil
+ assert_not_nil created['uuid'], 'expected uuid for the new user'
+ assert_equal created['email'], 'foo@example.com', 'expected given email'
+
+ setup_email = ActionMailer::Base.deliveries.last
+ assert_nil setup_email, 'expected no setup email'
+ end
+
+ test "setup user with send notification param true and verify email" do
+ authorize_with :admin
+
+ post :setup, {
+ openid_prefix: 'http://www.example.com/account',
+ send_notification_email: 'true',
+ user: {
+ email: "foo@example.com"
+ }
+ }
+
+ assert_response :success
+ response_items = JSON.parse(@response.body)['items']
+ created = find_obj_in_resp response_items, 'User', nil
+ assert_not_nil created['uuid'], 'expected uuid for the new user'
+ assert_equal created['email'], 'foo@example.com', 'expected given email'
+
+ setup_email = ActionMailer::Base.deliveries.last
+ assert_not_nil setup_email, 'Expected email after setup'
+
+ assert_equal Rails.configuration.user_notifier_email_from, setup_email.from[0]
+ assert_equal 'foo@example.com', setup_email.to[0]
+ assert_equal 'Welcome to Curoverse - shell account enabled', setup_email.subject
+ assert (setup_email.body.to_s.include? 'Your Arvados shell account has been set up'),
+ 'Expected Your Arvados shell account has been set up in email body'
+ assert (setup_email.body.to_s.include? "#{Rails.configuration.workbench_address}users/#{created['uuid']}/virtual_machines"), 'Expected virtual machines url in email body'
+ end
+
+ test "non-admin user can get basic information about readable users" do
+ authorize_with :spectator
+ get(:index)
+ check_non_admin_index
+ check_readable_users_index [:spectator], [:inactive, :active]
+ end
+
+ test "non-admin user gets only safe attributes from users#show" do
+ g = act_as_system_user do
+ create :group
+ end
+ users = create_list :active_user, 2, join_groups: [g]
+ token = create :token, user: users[0]
+ authorize_with_token token
+ get :show, id: users[1].uuid
+ check_non_admin_show
+ end
+
+ [2, 4].each do |limit|
+ test "non-admin user can limit index to #{limit}" do
+ g = act_as_system_user do
+ create :group
+ end
+ users = create_list :active_user, 4, join_groups: [g]
+ token = create :token, user: users[0]
+
+ authorize_with_token token
+ get(:index, limit: limit)
+ check_non_admin_index
+ assert_equal(limit, json_response["items"].size,
+ "non-admin index limit was ineffective")
+ end
+ end
+
+ test "admin has full index powers" do
+ authorize_with :admin
+ check_inactive_user_findable
+ end
+
+ test "reader token can grant admin index powers" do
+ authorize_with :spectator
+ check_inactive_user_findable(reader_tokens: [api_token(:admin)])
+ end
+
+ test "admin can filter on user.is_active" do
+ authorize_with :admin
+ get(:index, filters: [["is_active", "=", "true"]])
+ assert_response :success
+ check_readable_users_index [:active, :spectator], [:inactive]
+ end
+
+ test "admin can search where user.is_active" do
+ authorize_with :admin
+ get(:index, where: {is_active: true})
+ assert_response :success
+ check_readable_users_index [:active, :spectator], [:inactive]
+ end
+
+ test "update active_no_prefs user profile and expect notification email" do
+ authorize_with :admin
+
+ put :update, {
+ id: users(:active_no_prefs).uuid,
+ user: {
+ prefs: {:profile => {'organization' => 'example.com'}}
+ }
+ }
+ assert_response :success
+
+ found_email = false
+ ActionMailer::Base.deliveries.andand.each do |email|
+ if email.subject == "Profile created by #{users(:active_no_prefs).email}"
+ found_email = true
+ break
+ end
+ end
+ assert_equal true, found_email, 'Expected email after creating profile'
+ end
+
+ test "update active_no_prefs_profile user profile and expect notification email" do
+ authorize_with :admin
+
+ user = {}
+ user[:prefs] = users(:active_no_prefs_profile_no_getting_started_shown).prefs
+ user[:prefs][:profile] = {:profile => {'organization' => 'example.com'}}
+ put :update, {
+ id: users(:active_no_prefs_profile_no_getting_started_shown).uuid,
+ user: user
+ }
+ assert_response :success
+
+ found_email = false
+ ActionMailer::Base.deliveries.andand.each do |email|
+ if email.subject == "Profile created by #{users(:active_no_prefs_profile_no_getting_started_shown).email}"
+ found_email = true
+ break
+ end
+ end
+ assert_equal true, found_email, 'Expected email after creating profile'
+ end
+
+ test "update active user profile and expect no notification email" do
+ authorize_with :admin
+
+ put :update, {
+ id: users(:active).uuid,
+ user: {
+ prefs: {:profile => {'organization' => 'anotherexample.com'}}
+ }
+ }
+ assert_response :success
+
+ found_email = false
+ ActionMailer::Base.deliveries.andand.each do |email|
+ if email.subject == "Profile created by #{users(:active).email}"
+ found_email = true
+ break
+ end
+ end
+ assert_equal false, found_email, 'Expected no email after updating profile'
+ end
+
+ test "user API response includes writable_by" do
+ authorize_with :active
+ get :current
+ assert_response :success
+ assert_includes(json_response["writable_by"], users(:active).uuid,
+ "user's writable_by should include self")
+ assert_includes(json_response["writable_by"], users(:active).owner_uuid,
+ "user's writable_by should include its owner_uuid")