2044: Add share_with permission denied test.

[arvados.git] / apps / workbench / test / functional / projects_controller_test.rb

diff --git a/apps/workbench/test/functional/projects_controller_test.rb b/apps/workbench/test/functional/projects_controller_test.rb
index b338aa818687b92f9cadf5847f30ccd7dacaad35..39ee4b2db3df4191eb55facef5918c2221cc4750 100644 (file)
--- a/apps/workbench/test/functional/projects_controller_test.rb
+++ b/apps/workbench/test/functional/projects_controller_test.rb
@@ -9,4 +9,26 @@ class ProjectsControllerTest < ActionController::TestCase
     assert_template 'user_agreements/index',
     "Inactive user was not presented with a user agreement at the front page"
   end
+
+  test "sharing a project with a user and group" do
+    uuid_list = [api_fixture("groups")["future_project_viewing_group"]["uuid"],
+                 api_fixture("users")["future_project_user"]["uuid"]]
+    post(:share_with, {
+           id: api_fixture("groups")["asubproject"]["uuid"],
+           uuids: uuid_list,
+           format: "json"},
+         session_for(:active))
+    assert_response :success
+    json_response = Oj.load(@response.body)
+    assert_equal(uuid_list, json_response["success"])
+  end
+
+  test "user with project read permission can't add permissions" do
+    post(:share_with, {
+           id: api_fixture("groups")["aproject"]["uuid"],
+           uuids: [api_fixture("users")["spectator"]["uuid"]],
+           format: "json"},
+         session_for(:project_viewer))
+    assert_response 422
+  end
 end