Merge branch '21440-process-panel-reorg' refs #21440

[arvados.git] / services / api / test / functional / arvados / v1 / api_client_authorizations_controller_test.rb

diff --git a/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb b/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb
index bf407afcd7e06ed8cd55438e6f85883ae198aa49..60b4133f9a8ab9fc2dc977fb2d03caf98ea67ab0 100644 (file)
--- a/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb
@@ -199,8 +199,37 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
     assert_not_empty(json_response['uuid'])
   end
 
+  [
+    :active_noscope,
+    :active_all_collections,
+    :active_userlist,
+    :foo_collection_sharing_token,
+  ].each do |auth|
+    test "#{auth} can get current token without the appropriate scope" do
+      authorize_with auth
+      get :current
+      assert_response :success
+    end
+  end
+
   test "get current token, no auth" do
     get :current
     assert_response 401
   end
+
+  # Tests regression #18801
+  test "select param is respected in 'show' response" do
+    authorize_with :active
+    get :show, params: {
+          id: api_client_authorizations(:active).uuid,
+          select: ["uuid"],
+        }
+    assert_response :success
+    assert_raises ActiveModel::MissingAttributeError do
+      assigns(:object).api_token
+    end
+    assert_nil json_response["expires_at"]
+    assert_nil json_response["api_token"]
+    assert_equal api_client_authorizations(:active).uuid, json_response["uuid"]
+  end
 end