@initial_link_count = Link.count
@vm_uuid = virtual_machines(:testvm).uuid
ActionMailer::Base.deliveries = []
+ Rails.configuration.Users.ActivatedUsersAreVisibleToOthers = false
end
test "activate a user after signing UA" do
test "respond 401 if given token exists but user record is missing" do
authorize_with :valid_token_deleted_user
- get :current, {format: :json}
+ get :current, format: :json
assert_response 401
end
verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
"foo/#{repo_name}", created['uuid'], 'arvados#repository', true, 'Repository'
- verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
+ verify_link response_items, 'arvados#group', true, 'permission', 'can_write',
'All users', created['uuid'], 'arvados#group', true, 'Group'
verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login',
# two extra links; system_group, and group
verify_links_added 2
- verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
+ verify_link response_items, 'arvados#group', true, 'permission', 'can_write',
'All users', response_object['uuid'], 'arvados#group', true, 'Group'
verify_link response_items, 'arvados#repository', false, 'permission', 'can_manage',
verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
'foo/usertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
- verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
+ verify_link response_items, 'arvados#group', true, 'permission', 'can_write',
'All users', created['uuid'], 'arvados#group', true, 'Group'
verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login',
verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
'foo/usertestrepo', created['uuid'], 'arvados#repository', true, 'Repository'
- verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
+ verify_link response_items, 'arvados#group', true, 'permission', 'can_write',
'All users', created['uuid'], 'arvados#group', true, 'Group'
verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login',
assert_equal active_user[:email], created['email'], 'expected input email'
# verify links
- verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
+ verify_link response_items, 'arvados#group', true, 'permission', 'can_write',
'All users', created['uuid'], 'arvados#group', true, 'Group'
verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage',
assert_equal active_user['email'], created['email'], 'expected original email'
# verify links
- verify_link response_items, 'arvados#group', true, 'permission', 'can_read',
+ verify_link response_items, 'arvados#group', true, 'permission', 'can_write',
'All users', created['uuid'], 'arvados#group', true, 'Group'
assert_equal(repos_count, repos_query.count)
assert_equal active_user['uuid'], json_response['uuid']
updated = User.where(uuid: active_user['uuid']).first
assert_equal(true, updated.is_active)
- assert_equal({read: true}, updated.group_permissions[all_users_group_uuid])
+ assert_equal({read: true, write: true}, updated.group_permissions[all_users_group_uuid])
end
test "non-admin user can get basic information about readable users" do
get(:index)
check_non_admin_index
check_readable_users_index [:spectator], [:inactive, :active]
+ json_response["items"].each do |u|
+ if u["uuid"] == users(:spectator).uuid
+ assert_equal true, u["can_write"]
+ assert_equal true, u["can_manage"]
+ end
+ end
end
test "non-admin user gets only safe attributes from users#show" do
['dst', :project_viewer_trustedclient]].each do |which_scoped, auth|
test "refuse to merge with scoped #{which_scoped} token" do
act_as_system_user do
- api_client_authorizations(auth).update_attributes(scopes: ["GET /", "POST /", "PUT /"])
+ api_client_authorizations(auth).update(scopes: ["GET /", "POST /", "PUT /"])
end
authorize_with(:active_trustedclient)
post(:merge, params: {
existinguuid = 'remot-tpzed-foobarbazwazqux'
newuuid = 'remot-tpzed-newnarnazwazqux'
unchanginguuid = 'remot-tpzed-nochangingattrs'
+ conflictinguuid1 = 'remot-tpzed-conflictingnam1'
+ conflictinguuid2 = 'remot-tpzed-conflictingnam2'
act_as_system_user do
User.create!(uuid: existinguuid, email: 'root@existing.example.com')
User.create!(uuid: unchanginguuid, email: 'root@unchanging.example.com', prefs: {'foo' => {'bar' => 'baz'}})
end
assert_equal(1, Log.where(object_uuid: unchanginguuid).count)
+ Rails.configuration.Login.LoginCluster = 'remot'
+
authorize_with(:admin)
patch(:batch_update,
params: {
'is_active' => true,
'is_admin' => true,
'prefs' => {'foo' => 'bar'},
+ 'is_invited' => true
},
newuuid => {
'first_name' => 'noot',
'email' => 'root@remot.example.com',
'username' => '',
+ 'is_invited' => true
},
unchanginguuid => {
'email' => 'root@unchanging.example.com',
'prefs' => {'foo' => {'bar' => 'baz'}},
+ 'is_invited' => true
+ },
+ conflictinguuid1 => {
+ 'email' => 'root@conflictingname1.example.com',
+ 'username' => 'active',
+ 'is_invited' => true
+ },
+ conflictinguuid2 => {
+ 'email' => 'root@conflictingname2.example.com',
+ 'username' => 'federatedactive',
+ 'is_invited' => true
},
}})
assert_response(:success)
assert_equal(1, Log.where(object_uuid: unchanginguuid).count)
end
- NON_ADMIN_USER_DATA = ["uuid", "kind", "is_active", "email", "first_name",
- "last_name", "username"].sort
+ NON_ADMIN_USER_DATA = ["uuid", "kind", "is_active", "is_admin", "is_invited", "email", "first_name",
+ "last_name", "username", "can_write", "can_manage"].sort
def check_non_admin_index
assert_response :success