X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/38e27663cf656f0c9c443a2715f249afe39a8bfb..8735f2aa77b9e3c51449738e429399e4501ec94e:/services/api/test/unit/log_test.rb diff --git a/services/api/test/unit/log_test.rb b/services/api/test/unit/log_test.rb index d6b76fc605..92976e0053 100644 --- a/services/api/test/unit/log_test.rb +++ b/services/api/test/unit/log_test.rb @@ -6,10 +6,10 @@ class LogTest < ActiveSupport::TestCase EVENT_TEST_METHODS = { :create => [:created_at, :assert_nil, :assert_not_nil], :update => [:modified_at, :assert_not_nil, :assert_not_nil], - :destroy => [nil, :assert_not_nil, :assert_nil], + :delete => [nil, :assert_not_nil, :assert_nil], } - def setup + setup do @start_time = Time.now @log_count = 1 end @@ -54,12 +54,13 @@ class LogTest < ActiveSupport::TestCase yield props if block_given? end - def assert_auth_logged_with_clean_properties(auth, event_type) - assert_logged(auth, event_type) do |props| - ['old_attributes', 'new_attributes'].map { |k| props[k] }.compact - .each do |attributes| - refute_includes(attributes, 'api_token', - "auth log properties include sensitive API token") + def assert_logged_with_clean_properties(obj, event_type, excluded_attr) + assert_logged(obj, event_type) do |props| + ['old_attributes', 'new_attributes'].map do |logattr| + attributes = props[logattr] + next if attributes.nil? + refute_includes(attributes, excluded_attr, + "log #{logattr} includes #{excluded_attr}") end yield props if block_given? end @@ -115,7 +116,7 @@ class LogTest < ActiveSupport::TestCase orig_attrs = auth.attributes orig_attrs.delete 'api_token' auth.destroy - assert_logged(auth, :destroy) do |props| + assert_logged(auth, :delete) do |props| assert_equal(orig_etag, props['old_etag'], "destroyed auth etag mismatch") assert_equal(orig_attrs, props['old_attributes'], "destroyed auth attributes mismatch") @@ -224,34 +225,86 @@ class LogTest < ActiveSupport::TestCase auth.user = users(:spectator) auth.api_client = api_clients(:untrusted) auth.save! - assert_auth_logged_with_clean_properties(auth, :create) + assert_logged_with_clean_properties(auth, :create, 'api_token') auth.expires_at = Time.now auth.save! - assert_auth_logged_with_clean_properties(auth, :update) + assert_logged_with_clean_properties(auth, :update, 'api_token') auth.destroy - assert_auth_logged_with_clean_properties(auth, :destroy) + assert_logged_with_clean_properties(auth, :delete, 'api_token') end test "use ownership and permission links to determine which logs a user can see" do + known_logs = [:noop, + :admin_changes_repository2, + :admin_changes_specimen, + :system_adds_foo_file, + :system_adds_baz, + :log_owned_by_active, + :crunchstat_for_running_job] + c = Log.readable_by(users(:admin)).order("id asc").each.to_a - assert_equal 6, c.size - assert_equal 1, c[0].id # no-op - assert_equal 2, c[1].id # admin changes repository foo, which is owned by active user - assert_equal 3, c[2].id # admin changes specimen owned_by_spectator - assert_equal 4, c[3].id # foo collection added, readable by active through link - assert_equal 5, c[4].id # baz collection added, readable by active and spectator through group 'all users' group membership - assert_equal 6, c[5].id # log_owned_by_active + assert_log_result c, known_logs, known_logs c = Log.readable_by(users(:active)).order("id asc").each.to_a - assert_equal 4, c.size - assert_equal 2, c[0].id # admin changes repository foo, which is owned by active user - assert_equal 4, c[1].id # foo collection added, readable by active through link - assert_equal 5, c[2].id # baz collection added, readable by active and spectator through group 'all users' group membership - assert_equal 6, c[3].id # log_owned_by_active + assert_log_result c, known_logs, [:admin_changes_repository2, # owned by active + :system_adds_foo_file, # readable via link + :system_adds_baz, # readable via 'all users' group + :log_owned_by_active, # log owned by active + :crunchstat_for_running_job] # log & job owned by active c = Log.readable_by(users(:spectator)).order("id asc").each.to_a - assert_equal 2, c.size - assert_equal 3, c[0].id # admin changes specimen owned_by_spectator - assert_equal 5, c[1].id # baz collection added, readable by active and spectator through group 'all users' group membership + assert_log_result c, known_logs, [:noop, # object_uuid is spectator + :admin_changes_specimen, # object_uuid is a specimen owned by spectator + :system_adds_baz] # readable via 'all users' group + end + + def assert_log_result result, known_logs, expected_logs + # All of expected_logs must appear in result. Additional logs can + # appear too, but only if they are _not_ listed in known_logs + # (i.e., we do not make any assertions about logs not mentioned in + # either "known" or "expected".) + result_ids = result.collect(&:id) + expected_logs.each do |want| + assert_includes result_ids, logs(want).id + end + (known_logs - expected_logs).each do |notwant| + refute_includes result_ids, logs(notwant).id + end + end + + test "non-empty configuration.unlogged_attributes" do + Rails.configuration.unlogged_attributes = ["manifest_text"] + txt = ". acbd18db4cc2f85cedef654fccc4a4d8+3 0:3:foo\n" + + act_as_system_user do + coll = Collection.create(manifest_text: txt) + assert_logged_with_clean_properties(coll, :create, 'manifest_text') + coll.name = "testing" + coll.save! + assert_logged_with_clean_properties(coll, :update, 'manifest_text') + coll.destroy + assert_logged_with_clean_properties(coll, :delete, 'manifest_text') + end + end + + test "empty configuration.unlogged_attributes" do + Rails.configuration.unlogged_attributes = [] + txt = ". acbd18db4cc2f85cedef654fccc4a4d8+3 0:3:foo\n" + + act_as_system_user do + coll = Collection.create(manifest_text: txt) + assert_logged(coll, :create) do |props| + assert_equal(txt, props['new_attributes']['manifest_text']) + end + coll.update_attributes!(name: "testing") + assert_logged(coll, :update) do |props| + assert_equal(txt, props['old_attributes']['manifest_text']) + assert_equal(txt, props['new_attributes']['manifest_text']) + end + coll.destroy + assert_logged(coll, :delete) do |props| + assert_equal(txt, props['old_attributes']['manifest_text']) + end + end end end