X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/2e104941dbf1e4bf92e0632cadeb946be0595d67..HEAD:/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb

diff --git a/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb b/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb
index 6c09d8e9f5..60b4133f9a 100644
--- a/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb
@@ -1,3 +1,7 @@
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: AGPL-3.0
+
 require 'test_helper'
 
 class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::TestCase
@@ -9,7 +13,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
 
   test "should not get index with expired auth" do
     authorize_with :expired
-    get :index, format: :json
+    get :index, params: {format: :json}
     assert_response 401
   end
 
@@ -21,20 +25,20 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
 
   test "create system auth" do
     authorize_with :admin_trustedclient
-    post :create_system_auth, scopes: '["test"]'
+    post :create_system_auth, params: {scopes: '["test"]'}
     assert_response :success
     assert_not_nil JSON.parse(@response.body)['uuid']
   end
 
   test "prohibit create system auth with token from non-trusted client" do
     authorize_with :admin
-    post :create_system_auth, scopes: '["test"]'
+    post :create_system_auth, params: {scopes: '["test"]'}
     assert_response 403
   end
 
   test "prohibit create system auth by non-admin" do
     authorize_with :active
-    post :create_system_auth, scopes: '["test"]'
+    post :create_system_auth, params: {scopes: '["test"]'}
     assert_response 403
   end
 
@@ -43,7 +47,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
     expected_tokens = expected.map do |name|
       api_client_authorizations(name).api_token
     end
-    get :index, search_params
+    get :index, params: search_params
     assert_response :success
     got_tokens = JSON.parse(@response.body)['items']
       .map { |a| a['api_token'] }
@@ -77,6 +81,15 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
     end
   end
 
+  [:admin, :active].each do |token|
+    test "using '#{token}', get token details via 'current'" do
+      authorize_with token
+      get :current
+      assert_response 200
+      assert_equal json_response['scopes'], ['all']
+    end
+  end
+
   [# anyone can look up the token they're currently using
    [:admin, :admin, 200, 200, 1],
    [:active, :active, 200, 200, 1],
@@ -90,7 +103,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
   ].each do |user, token, expect_get_response, expect_list_response, expect_list_items|
     test "using '#{user}', get '#{token}' by uuid" do
       authorize_with user
-      get :show, {
+      get :show, params: {
         id: api_client_authorizations(token).uuid,
       }
       assert_response expect_get_response
@@ -98,7 +111,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
 
     test "using '#{user}', update '#{token}' by uuid" do
       authorize_with user
-      put :update, {
+      put :update, params: {
         id: api_client_authorizations(token).uuid,
         api_client_authorization: {},
       }
@@ -107,7 +120,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
 
     test "using '#{user}', delete '#{token}' by uuid" do
       authorize_with user
-      post :destroy, {
+      post :destroy, params: {
         id: api_client_authorizations(token).uuid,
       }
       assert_response expect_get_response
@@ -115,7 +128,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
 
     test "using '#{user}', list '#{token}' by uuid" do
       authorize_with user
-      get :index, {
+      get :index, params: {
         filters: [['uuid','=',api_client_authorizations(token).uuid]],
       }
       assert_response expect_list_response
@@ -128,7 +141,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
     if expect_list_items
       test "using '#{user}', list '#{token}' by uuid with offset" do
         authorize_with user
-        get :index, {
+        get :index, params: {
           filters: [['uuid','=',api_client_authorizations(token).uuid]],
           offset: expect_list_items,
         }
@@ -140,7 +153,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
 
     test "using '#{user}', list '#{token}' by token" do
       authorize_with user
-      get :index, {
+      get :index, params: {
         filters: [['api_token','=',api_client_authorizations(token).api_token]],
       }
       assert_response expect_list_response
@@ -153,7 +166,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
 
   test "scoped token cannot change its own scopes" do
     authorize_with :admin_vm
-    put :update, {
+    put :update, params: {
       id: api_client_authorizations(:admin_vm).uuid,
       api_client_authorization: {scopes: ['all']},
     }
@@ -162,7 +175,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
 
   test "token cannot change its own uuid" do
     authorize_with :admin
-    put :update, {
+    put :update, params: {
       id: api_client_authorizations(:admin).uuid,
       api_client_authorization: {uuid: 'zzzzz-gj3su-zzzzzzzzzzzzzzz'},
     }
@@ -177,8 +190,46 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes
                  api_client_authorizations(:active).api_token)
   end
 
+  test "get current token using SystemRootToken" do
+    Rails.configuration.SystemRootToken = "xyzzy-systemroottoken"
+    authorize_with_token Rails.configuration.SystemRootToken
+    get :current
+    assert_response :success
+    assert_equal(Rails.configuration.SystemRootToken, json_response['api_token'])
+    assert_not_empty(json_response['uuid'])
+  end
+
+  [
+    :active_noscope,
+    :active_all_collections,
+    :active_userlist,
+    :foo_collection_sharing_token,
+  ].each do |auth|
+    test "#{auth} can get current token without the appropriate scope" do
+      authorize_with auth
+      get :current
+      assert_response :success
+    end
+  end
+
   test "get current token, no auth" do
     get :current
     assert_response 401
   end
+
+  # Tests regression #18801
+  test "select param is respected in 'show' response" do
+    authorize_with :active
+    get :show, params: {
+          id: api_client_authorizations(:active).uuid,
+          select: ["uuid"],
+        }
+    assert_response :success
+    assert_raises ActiveModel::MissingAttributeError do
+      assigns(:object).api_token
+    end
+    assert_nil json_response["expires_at"]
+    assert_nil json_response["api_token"]
+    assert_equal api_client_authorizations(:active).uuid, json_response["uuid"]
+  end
 end