X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/2ba51ef35957ceb5c56ec9cbd0a03b12b17a5c48..7943691e146fecc929f1dcde2f794ab32fadc565:/services/api/test/functional/arvados/v1/users_controller_test.rb diff --git a/services/api/test/functional/arvados/v1/users_controller_test.rb b/services/api/test/functional/arvados/v1/users_controller_test.rb index 4a9d12d2db..55b967162d 100644 --- a/services/api/test/functional/arvados/v1/users_controller_test.rb +++ b/services/api/test/functional/arvados/v1/users_controller_test.rb @@ -10,10 +10,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase test "activate a user after signing UA" do authorize_with :inactive_but_signed_user_agreement - get :current - assert_response :success - me = JSON.parse(@response.body) - post :activate, id: me['uuid'] + post :activate, id: users(:inactive_but_signed_user_agreement).uuid assert_response :success assert_not_nil assigns(:object) me = JSON.parse(@response.body) @@ -44,26 +41,16 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase authorize_with :inactive - get :current - assert_response :success - me = JSON.parse(@response.body) - assert_equal false, me['is_active'] - - post :activate, id: me['uuid'] + post :activate, id: users(:inactive).uuid assert_response 403 - get :current - assert_response :success - me = JSON.parse(@response.body) - assert_equal false, me['is_active'] + response_body = JSON.parse(@response.body) + assert response_body['errors'].first.include? 'Cannot activate without user agreements' end test "activate an already-active user" do authorize_with :active - get :current - assert_response :success - me = JSON.parse(@response.body) - post :activate, id: me['uuid'] + post :activate, id: users(:active).uuid assert_response :success me = JSON.parse(@response.body) assert_equal true, me['is_active'] @@ -131,43 +118,6 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase nil, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine' verify_system_group_permission_link_for created['uuid'] - - # invoke setup again with the same data - post :setup, { - repo_name: repo_name, - vm_uuid: @vm_uuid, - openid_prefix: 'https://www.google.com/accounts/o8/id', - user: { - uuid: 'zzzzz-tpzed-abcdefghijklmno', - first_name: "in_create_test_first_name", - last_name: "test_last_name", - email: "foo@example.com" - } - } - assert_response :success - - response_items = JSON.parse(@response.body)['items'] - - created = find_obj_in_resp response_items, 'User', nil - assert_equal 'in_create_test_first_name', created['first_name'] - assert_not_nil created['uuid'], 'expected non-null uuid for the new user' - assert_equal 'zzzzz-tpzed-abcdefghijklmno', created['uuid'] - assert_not_nil created['email'], 'expected non-nil email' - assert_nil created['identity_url'], 'expected no identity_url' - - # arvados#user, repo link and link add user to 'All users' group - verify_num_links @all_links_at_start, 5 - - verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage', - repo_name, created['uuid'], 'arvados#repository', true, 'Repository' - - verify_link response_items, 'arvados#group', true, 'permission', 'can_read', - 'All users', created['uuid'], 'arvados#group', true, 'Group' - - verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login', - @vm_uuid, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine' - - verify_system_group_permission_link_for created['uuid'] end test "setup user with bogus uuid and expect error" do @@ -232,15 +182,11 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase end test "invoke setup with existing uuid, vm and repo and verify links" do - authorize_with :inactive - get :current - assert_response :success - inactive_user = JSON.parse(@response.body) - authorize_with :admin + inactive_user = users(:inactive) post :setup, { - uuid: inactive_user['uuid'], + uuid: users(:inactive).uuid, repo_name: 'test_repo', vm_uuid: @vm_uuid } @@ -264,12 +210,8 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase end test "invoke setup with existing uuid in user, verify response" do - authorize_with :inactive - get :current - assert_response :success - inactive_user = JSON.parse(@response.body) - authorize_with :admin + inactive_user = users(:inactive) post :setup, { user: {uuid: inactive_user['uuid']}, @@ -288,12 +230,8 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase end test "invoke setup with existing uuid but different email, expect original email" do - authorize_with :inactive - get :current - assert_response :success - inactive_user = JSON.parse(@response.body) - authorize_with :admin + inactive_user = users(:inactive) post :setup, { uuid: inactive_user['uuid'], @@ -367,7 +305,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase verify_num_links @all_links_at_start, 5 end - test "setup user with valid email, no vm and repo as input" do + test "setup user with valid email, no vm and no repo as input" do authorize_with :admin post :setup, { @@ -383,6 +321,18 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase # three extra links; system_group, login, and group verify_num_links @all_links_at_start, 3 + + verify_link response_items, 'arvados#user', true, 'permission', 'can_login', + response_object['uuid'], response_object['email'], 'arvados#user', false, 'User' + + verify_link response_items, 'arvados#group', true, 'permission', 'can_read', + 'All users', response_object['uuid'], 'arvados#group', true, 'Group' + + verify_link response_items, 'arvados#repository', false, 'permission', 'can_manage', + 'test_repo', response_object['uuid'], 'arvados#repository', true, 'Repository' + + verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login', + nil, response_object['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine' end test "setup user with email, first name, repo name and vm uuid" do @@ -410,14 +360,15 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase verify_num_links @all_links_at_start, 5 end - test "setup user twice with email and check two different objects created" do + test "setup user with an exising user email and check different object is created" do authorize_with :admin + inactive_user = users(:inactive) post :setup, { openid_prefix: 'https://www.google.com/accounts/o8/id', repo_name: 'test_repo', user: { - email: 'foo@example.com' + email: inactive_user['email'] } } @@ -425,28 +376,11 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase response_items = JSON.parse(@response.body)['items'] response_object = find_obj_in_resp response_items, 'User', nil assert_not_nil response_object['uuid'], 'expected uuid for new user' - assert_equal response_object['email'], 'foo@example.com', 'expected given email' + assert_not_equal response_object['uuid'], inactive_user['uuid'], + 'expected different uuid after create operation' + assert_equal inactive_user['email'], response_object['email'], 'expected given email' # system_group, openid, group, and repo. No vm link. verify_num_links @all_links_at_start, 4 - - # create again - post :setup, { - user: {email: 'foo@example.com'}, - openid_prefix: 'https://www.google.com/accounts/o8/id' - } - - assert_response :success - response_items = JSON.parse(@response.body)['items'] - response_object2 = find_obj_in_resp response_items, 'User', nil - assert_not_equal response_object['uuid'], response_object2['uuid'], - 'expected same uuid as first create operation' - assert_equal response_object['email'], 'foo@example.com', 'expected given email' - - # +1 extra can_read 'all users' group link - # +1 extra system_group can_manage link pointing to the new User - # +1 extra can_login permission link - # no repo link, no vm link - verify_num_links @all_links_at_start, 7 end test "setup user with openid prefix" do @@ -578,44 +512,14 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase 'Expected Forbidden error' end - test "setup user in multiple steps and verify response" do + test "setup active user with repo and no vm" do authorize_with :admin + active_user = users(:active) + # invoke setup with a repository post :setup, { - openid_prefix: 'http://www.example.com/account', - user: { - email: "foo@example.com" - } - } - - assert_response :success - response_items = JSON.parse(@response.body)['items'] - created = find_obj_in_resp response_items, 'User', nil - - assert_not_nil created['uuid'], 'expected uuid for new user' - assert_not_nil created['email'], 'expected non-nil email' - assert_equal created['email'], 'foo@example.com', 'expected input email' - - # three new links: system_group, arvados#user, and 'All users' group. - verify_num_links @all_links_at_start, 3 - - verify_link response_items, 'arvados#user', true, 'permission', 'can_login', - created['uuid'], created['email'], 'arvados#user', false, 'User' - - verify_link response_items, 'arvados#group', true, 'permission', 'can_read', - 'All users', created['uuid'], 'arvados#group', true, 'Group' - - verify_link response_items, 'arvados#repository', false, 'permission', 'can_manage', - 'test_repo', created['uuid'], 'arvados#repository', true, 'Repository' - - verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login', - nil, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine' - - # invoke setup with a repository - post :setup, { - openid_prefix: 'http://www.example.com/account', repo_name: 'new_repo', - uuid: created['uuid'] + uuid: active_user['uuid'] } assert_response :success @@ -623,7 +527,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase response_items = JSON.parse(@response.body)['items'] created = find_obj_in_resp response_items, 'User', nil - assert_equal 'foo@example.com', created['email'], 'expected input email' + assert_equal active_user[:email], created['email'], 'expected input email' # verify links verify_link response_items, 'arvados#group', true, 'permission', 'can_read', @@ -634,15 +538,17 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login', nil, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine' + end + + test "setup active user with vm and no repo" do + authorize_with :admin + active_user = users(:active) - # invoke setup with a vm_uuid + # invoke setup with a repository post :setup, { vm_uuid: @vm_uuid, - openid_prefix: 'http://www.example.com/account', - user: { - email: 'junk_email' - }, - uuid: created['uuid'] + uuid: active_user['uuid'], + email: 'junk_email' } assert_response :success @@ -650,13 +556,12 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase response_items = JSON.parse(@response.body)['items'] created = find_obj_in_resp response_items, 'User', nil - assert_equal created['email'], 'foo@example.com', 'expected original email' + assert_equal active_user['email'], created['email'], 'expected original email' # verify links verify_link response_items, 'arvados#group', true, 'permission', 'can_read', 'All users', created['uuid'], 'arvados#group', true, 'Group' - # since no repo name in input, we won't get any; even though user has one verify_link response_items, 'arvados#repository', false, 'permission', 'can_manage', 'new_repo', created['uuid'], 'arvados#repository', true, 'Repository' @@ -664,58 +569,10 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase @vm_uuid, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine' end - test "setup and unsetup user" do - authorize_with :admin - - post :setup, { - repo_name: 'test_repo', - vm_uuid: @vm_uuid, - user: {email: 'foo@example.com'}, - openid_prefix: 'https://www.google.com/accounts/o8/id' - } - - assert_response :success - response_items = JSON.parse(@response.body)['items'] - created = find_obj_in_resp response_items, 'User', nil - assert_not_nil created['uuid'], 'expected uuid for the new user' - assert_equal created['email'], 'foo@example.com', 'expected given email' - - # five extra links: system_group, login, group, repo and vm - verify_num_links @all_links_at_start, 5 - - verify_link response_items, 'arvados#user', true, 'permission', 'can_login', - created['uuid'], created['email'], 'arvados#user', false, 'User' - - verify_link response_items, 'arvados#group', true, 'permission', 'can_read', - 'All users', created['uuid'], 'arvados#group', true, 'Group' - - verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage', - 'test_repo', created['uuid'], 'arvados#repository', true, 'Repository' - - verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login', - @vm_uuid, created['uuid'], 'arvados#virtualMachine', false, 'VirtualMachine' - - verify_link_existence created['uuid'], created['email'], true, true, true, true, false - - # now unsetup this user - post :unsetup, id: created['uuid'] - assert_response :success - - created2 = JSON.parse(@response.body) - assert_not_nil created2['uuid'], 'expected uuid for the newly created user' - assert_equal created['uuid'], created2['uuid'], 'expected uuid not found' - - verify_link_existence created['uuid'], created['email'], false, false, false, false, false - end - test "unsetup active user" do - authorize_with :active - get :current - assert_response :success - active_user = JSON.parse(@response.body) + active_user = users(:active) assert_not_nil active_user['uuid'], 'expected uuid for the active user' assert active_user['is_active'], 'expected is_active for active user' - assert active_user['is_invited'], 'expected is_invited for active user' verify_link_existence active_user['uuid'], active_user['email'], false, true, false, true, true @@ -796,34 +653,38 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase 'Expected workbench url in email body' end - test "non-admin user can get basic information about active users" do + test "non-admin user can get basic information about readable users" do authorize_with :spectator get(:index) check_non_admin_index - check_active_users_index + check_readable_users_index [:spectator], [:inactive, :active] end - test "non-admin user can limit index" do - authorize_with :spectator - get(:index, limit: 2) - check_non_admin_index - assert_equal(2, json_response["items"].size, - "non-admin index limit was ineffective") - end - - test "filters are ignored for non-admin index" do - check_index_condition_fails(:spectator, - filters: [["last_name", "=", "__nonexistent__"]]) - end - - test "where is ignored for non-admin index" do - check_index_condition_fails(:spectator, - where: {last_name: "__nonexistent__"}) + test "non-admin user gets only safe attributes from users#show" do + g = act_as_system_user do + create :group + end + users = create_list :active_user, 2, join_groups: [g] + token = create :token, user: users[0] + authorize_with_token token + get :show, id: users[1].uuid + check_non_admin_show end - test "group admin is treated like non-admin for index" do - check_index_condition_fails(:rominiadmin, - filters: [["last_name", "=", "__nonexistent__"]]) + test "non-admin user can limit index" do + g = act_as_system_user do + create :group + end + users = create_list :active_user, 4, join_groups: [g] + token = create :token, user: users[0] + + [2, 4].each do |limit| + authorize_with_token token + get(:index, limit: limit) + check_non_admin_index + assert_equal(limit, json_response["items"].size, + "non-admin index limit was ineffective") + end end test "admin has full index powers" do @@ -840,14 +701,14 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase authorize_with :admin get(:index, filters: [["is_active", "=", "true"]]) assert_response :success - check_active_users_index + check_readable_users_index [:active, :spectator], [:inactive] end test "admin can search where user.is_active" do authorize_with :admin get(:index, where: {is_active: true}) assert_response :success - check_active_users_index + check_readable_users_index [:active, :spectator], [:inactive] end test "update active_no_prefs user profile and expect notification email" do @@ -923,30 +784,33 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase response_items = json_response["items"] assert_not_nil response_items response_items.each do |user_data| - assert_equal(NON_ADMIN_USER_DATA, user_data.keys.sort, - "data in all users response did not match expectations") - assert_equal("arvados#user", user_data["kind"]) + check_non_admin_item user_data assert(user_data["is_active"], "non-admin index returned inactive user") end end - def check_active_users_index + def check_non_admin_show + assert_response :success + check_non_admin_item json_response + end + + def check_non_admin_item user_data + assert_equal(NON_ADMIN_USER_DATA, user_data.keys.sort, + "data in response had missing or extra attributes") + assert_equal("arvados#user", user_data["kind"]) + end + + + def check_readable_users_index expect_present, expect_missing response_uuids = json_response["items"].map { |u| u["uuid"] } - [:admin, :miniadmin, :active, :spectator].each do |user_key| + expect_present.each do |user_key| assert_includes(response_uuids, users(user_key).uuid, "#{user_key} missing from index") end - refute_includes(response_uuids, users(:inactive).uuid, - "inactive user included in index") - end - - def check_index_condition_fails(user_sym, params) - authorize_with user_sym - get(:index, params) - check_non_admin_index - assert(json_response["items"] - .any? { |u| u["last_name"] != "__nonexistent__" }, - "#{params.inspect} successfully applied to non-admin index") + expect_missing.each do |user_key| + refute_includes(response_uuids, users(user_key).uuid, + "#{user_key} included in index") + end end def check_inactive_user_findable(params={})