X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/3270fbf5a3cbd121dad7327513d5a5866c3583c4..9b3223e5cbcd1eb89193e8421d430025ddf791d1:/apps/workbench/test/controllers/projects_controller_test.rb diff --git a/apps/workbench/test/controllers/projects_controller_test.rb b/apps/workbench/test/controllers/projects_controller_test.rb index 93f794d900..51a4e37d4b 100644 --- a/apps/workbench/test/controllers/projects_controller_test.rb +++ b/apps/workbench/test/controllers/projects_controller_test.rb @@ -1,6 +1,9 @@ require 'test_helper' +require 'helpers/share_object_helper' class ProjectsControllerTest < ActionController::TestCase + include ShareObjectHelper + test "invited user is asked to sign user agreements on front page" do get :index, {}, session_for(:inactive) assert_response :redirect @@ -25,7 +28,7 @@ class ProjectsControllerTest < ActionController::TestCase id: readonly_project_uuid }, session_for(which_user) buttons = css_select('[data-method=post]').select do |el| - el.attributes['href'].match /project.*owner_uuid.*#{readonly_project_uuid}/ + el.attributes['data-remote-href'].match /project.*owner_uuid.*#{readonly_project_uuid}/ end if should_show assert_not_empty(buttons, "did not offer to create a subproject") @@ -61,40 +64,28 @@ class ProjectsControllerTest < ActionController::TestCase "JSON response missing properly formatted sharing error") end - def user_can_manage(user_sym, group_key) - get(:show, {id: api_fixture("groups")[group_key]["uuid"]}, - session_for(user_sym)) - is_manager = assigns(:user_is_manager) - assert_not_nil(is_manager, "user_is_manager flag not set") - if not is_manager - assert_empty(assigns(:share_links), - "non-manager has share links set") - end - is_manager - end - test "admin can_manage aproject" do - assert user_can_manage(:admin, "aproject") + assert user_can_manage(:admin, api_fixture("groups")["aproject"]) end test "owner can_manage aproject" do - assert user_can_manage(:active, "aproject") + assert user_can_manage(:active, api_fixture("groups")["aproject"]) end test "owner can_manage asubproject" do - assert user_can_manage(:active, "asubproject") + assert user_can_manage(:active, api_fixture("groups")["asubproject"]) end test "viewer can't manage aproject" do - refute user_can_manage(:project_viewer, "aproject") + refute user_can_manage(:project_viewer, api_fixture("groups")["aproject"]) end test "viewer can't manage asubproject" do - refute user_can_manage(:project_viewer, "asubproject") + refute user_can_manage(:project_viewer, api_fixture("groups")["asubproject"]) end test "subproject_admin can_manage asubproject" do - assert user_can_manage(:subproject_admin, "asubproject") + assert user_can_manage(:subproject_admin, api_fixture("groups")["asubproject"]) end test "detect ownership loop in project breadcrumbs" do @@ -109,7 +100,9 @@ class ProjectsControllerTest < ActionController::TestCase assert_response :success end - test "project admin can remove items from the project" do + test "project admin can remove collections from the project" do + # Deleting an object that supports 'expires_at' should make it + # completely inaccessible to API queries, not simply moved out of the project. coll_key = "collection_to_remove_from_subproject" coll_uuid = api_fixture("collections")[coll_key]["uuid"] delete(:remove_item, @@ -120,6 +113,56 @@ class ProjectsControllerTest < ActionController::TestCase assert_response :success assert_match(/\b#{coll_uuid}\b/, @response.body, "removed object not named in response") + + use_token :subproject_admin + assert_raise ArvadosApiClient::NotFoundException do + Collection.find(coll_uuid) + end + end + + test "project admin can remove items from project other than collections" do + # An object which does not have an expired_at field (e.g. Specimen) + # should be implicitly moved to the user's Home project when removed. + specimen_uuid = api_fixture('specimens', 'in_asubproject')['uuid'] + delete(:remove_item, + { id: api_fixture('groups', 'asubproject')['uuid'], + item_uuid: specimen_uuid, + format: 'js' }, + session_for(:subproject_admin)) + assert_response :success + assert_match(/\b#{specimen_uuid}\b/, @response.body, + "removed object not named in response") + + use_token :subproject_admin + new_specimen = Specimen.find(specimen_uuid) + assert_equal api_fixture('users', 'subproject_admin')['uuid'], new_specimen.owner_uuid + end + + # An object which does not offer an expired_at field but has a xx_owner_uuid_name_unique constraint + # will be renamed when removed and another object with the same name exists in user's home project. + [ + ['groups', 'subproject_in_asubproject_with_same_name_as_one_in_active_user_home'], + ['pipeline_templates', 'template_in_asubproject_with_same_name_as_one_in_active_user_home'], + ].each do |dm, fixture| + test "removing #{dm} from a subproject results in renaming it when there is another such object with same name in home project" do + object = api_fixture(dm, fixture) + delete(:remove_item, + { id: api_fixture('groups', 'asubproject')['uuid'], + item_uuid: object['uuid'], + format: 'js' }, + session_for(:active)) + assert_response :success + assert_match(/\b#{object['uuid']}\b/, @response.body, + "removed object not named in response") + use_token :active + if dm.eql?('groups') + found = Group.find(object['uuid']) + else + found = PipelineTemplate.find(object['uuid']) + end + assert_equal api_fixture('users', 'active')['uuid'], found.owner_uuid + assert_equal true, found.name.include?(object['name'] + ' removed from ') + end end test 'projects#show tab infinite scroll partial obeys limit' do @@ -191,4 +234,176 @@ class ProjectsControllerTest < ActionController::TestCase }] get :show, encoded_params, session_for(:active) end + + test "visit non-public project as anonymous when anonymous browsing is enabled and expect page not found" do + Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token'] + get(:show, {id: api_fixture('groups')['aproject']['uuid']}) + assert_response 404 + assert_includes @response.inspect, 'you are not logged in' + end + + test "visit home page as anonymous when anonymous browsing is enabled and expect login" do + Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token'] + get(:index) + assert_response :redirect + assert_match /\/users\/welcome/, @response.redirect_url + end + + [ + nil, + :active, + ].each do |user| + test "visit public projects page when anon config is enabled, as user #{user}, and expect page" do + Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token'] + + if user + get :public, {}, session_for(user) + else + get :public + end + + assert_response :success + assert_not_nil assigns(:objects) + project_names = assigns(:objects).collect(&:name) + assert_includes project_names, 'Unrestricted public data' + assert_not_includes project_names, 'A Project' + refute_empty css_select('[href="/projects/public"]') + end + end + + test "visit public projects page when anon config is not enabled as active user and expect 404" do + get :public, {}, session_for(:active) + assert_response 404 + end + + test "visit public projects page when anon config is enabled but public projects page is disabled as active user and expect 404" do + Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token'] + Rails.configuration.enable_public_projects_page = false + get :public, {}, session_for(:active) + assert_response 404 + end + + test "visit public projects page when anon config is not enabled as anonymous and expect login page" do + get :public + assert_response :redirect + assert_match /\/users\/welcome/, @response.redirect_url + assert_empty css_select('[href="/projects/public"]') + end + + test "visit public projects page when anon config is enabled and public projects page is disabled and expect login page" do + Rails.configuration.anonymous_user_token = api_fixture('api_client_authorizations')['anonymous']['api_token'] + Rails.configuration.enable_public_projects_page = false + get :index + assert_response :redirect + assert_match /\/users\/welcome/, @response.redirect_url + assert_empty css_select('[href="/projects/public"]') + end + + test "visit public projects page when anon config is not enabled and public projects page is enabled and expect login page" do + Rails.configuration.enable_public_projects_page = true + get :index + assert_response :redirect + assert_match /\/users\/welcome/, @response.redirect_url + assert_empty css_select('[href="/projects/public"]') + end + + test "find a project and edit its description" do + project = api_fixture('groups')['aproject'] + use_token :active + found = Group.find(project['uuid']) + found.description = 'test description update' + found.save! + get(:show, {id: project['uuid']}, session_for(:active)) + assert_includes @response.body, 'test description update' + end + + test "find a project and edit description to textile description" do + project = api_fixture('groups')['aproject'] + use_token :active + found = Group.find(project['uuid']) + found.description = '*test bold description for textile formatting*' + found.save! + get(:show, {id: project['uuid']}, session_for(:active)) + assert_includes @response.body, 'test bold description for textile formatting' + end + + test "find a project and edit description to html description" do + project = api_fixture('groups')['aproject'] + use_token :active + found = Group.find(project['uuid']) + found.description = 'Textile description with link to home page take me home.' + found.save! + get(:show, {id: project['uuid']}, session_for(:active)) + assert_includes @response.body, 'Textile description with link to home page take me home.' + end + + test "find a project and edit description to textile description with link to object" do + project = api_fixture('groups')['aproject'] + use_token :active + found = Group.find(project['uuid']) + + # uses 'Link to object' as a hyperlink for the object + found.description = '"Link to object":' + api_fixture('groups')['asubproject']['uuid'] + found.save! + get(:show, {id: project['uuid']}, session_for(:active)) + + # check that input was converted to textile, not staying as inputted + refute_includes @response.body,'"Link to object"' + refute_empty css_select('[href="/groups/zzzzz-j7d0g-axqo7eu9pwvna1x"]') + end + + test "project viewer can't see project sharing tab" do + project = api_fixture('groups')['aproject'] + get(:show, {id: project['uuid']}, session_for(:project_viewer)) + refute_includes @response.body, '
Public Projects" + end + end