X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/52c4f2b7fe631f3d7ad16105cb2f86cf6c004fc8..e8a76617eeec9429ddf7879048a310ba6e15e0d8:/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb diff --git a/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb b/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb index 0072792563..37e690e0b2 100644 --- a/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb +++ b/services/api/test/functional/arvados/v1/api_client_authorizations_controller_test.rb @@ -23,6 +23,7 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes authorize_with :admin_trustedclient post :create_system_auth, scopes: '["test"]' assert_response :success + assert_not_nil JSON.parse(@response.body)['uuid'] end test "prohibit create system auth with token from non-trusted client" do @@ -37,22 +38,147 @@ class Arvados::V1::ApiClientAuthorizationsControllerTest < ActionController::Tes assert_response 403 end - test "admin search filters where scopes exactly match" do - def check_tokens_by_scopes(scopes, *expected_tokens) - expected_tokens.map! { |name| api_client_authorizations(name).api_token } - get :index, where: {scopes: scopes} - assert_response :success - got_tokens = JSON.parse(@response.body)['items'] - .map { |auth| auth['api_token'] } - assert_equal(expected_tokens.sort, got_tokens.sort, - "wrong results for scopes = #{scopes}") + def assert_found_tokens(auth, search_params, expected) + authorize_with auth + expected_tokens = expected.map do |name| + api_client_authorizations(name).api_token end - authorize_with :admin_trustedclient - check_tokens_by_scopes([], :admin_noscope) - authorize_with :active_trustedclient - check_tokens_by_scopes(["GET /arvados/v1/users"], :active_userlist) - check_tokens_by_scopes(["POST /arvados/v1/api_client_authorizations", - "GET /arvados/v1/api_client_authorizations"], - :active_apitokens) + get :index, search_params + assert_response :success + got_tokens = JSON.parse(@response.body)['items'] + .map { |auth| auth['api_token'] } + assert_equal(expected_tokens.sort, got_tokens.sort, + "wrong results for #{search_params.inspect}") + end + + # Three-tuples with auth to use, scopes to find, and expected tokens. + # Make two tests for each tuple, one searching with where and the other + # with filter. + [[:admin_trustedclient, [], [:admin_noscope]], + [:active_trustedclient, ["GET /arvados/v1/users"], [:active_userlist]], + [:active_trustedclient, + ["POST /arvados/v1/api_client_authorizations", + "GET /arvados/v1/api_client_authorizations"], + [:active_apitokens]], + ].each do |auth, scopes, expected| + test "#{auth.to_s} can find auths where scopes=#{scopes.inspect}" do + assert_found_tokens(auth, {where: {scopes: scopes}}, expected) + end + + test "#{auth.to_s} can find auths filtered with scopes=#{scopes.inspect}" do + assert_found_tokens(auth, {filters: [['scopes', '=', scopes]]}, expected) + end + + test "#{auth.to_s} offset works with filter scopes=#{scopes.inspect}" do + assert_found_tokens(auth, { + offset: expected.length, + filters: [['scopes', '=', scopes]] + }, []) + end + end + + [# anyone can look up the token they're currently using + [:admin, :admin, 200, 200, 1], + [:active, :active, 200, 200, 1], + # cannot look up other tokens (even for same user) if not trustedclient + [:admin, :active, 403, 403], + [:admin, :admin_vm, 403, 403], + [:active, :admin, 403, 403], + # cannot look up other tokens for other users, regardless of trustedclient + [:admin_trustedclient, :active, 404, 200, 0], + [:active_trustedclient, :admin, 404, 200, 0], + ].each do |user, token, expect_get_response, expect_list_response, expect_list_items| + test "using '#{user}', get '#{token}' by uuid" do + authorize_with user + get :show, { + id: api_client_authorizations(token).uuid, + } + assert_response expect_get_response + end + + test "using '#{user}', update '#{token}' by uuid" do + authorize_with user + put :update, { + id: api_client_authorizations(token).uuid, + api_client_authorization: {}, + } + assert_response expect_get_response + end + + test "using '#{user}', delete '#{token}' by uuid" do + authorize_with user + post :destroy, { + id: api_client_authorizations(token).uuid, + } + assert_response expect_get_response + end + + test "using '#{user}', list '#{token}' by uuid" do + authorize_with user + get :index, { + filters: [['uuid','=',api_client_authorizations(token).uuid]], + } + assert_response expect_list_response + if expect_list_items + assert_equal assigns(:objects).length, expect_list_items + assert_equal json_response['items_available'], expect_list_items + end + end + + if expect_list_items + test "using '#{user}', list '#{token}' by uuid with offset" do + authorize_with user + get :index, { + filters: [['uuid','=',api_client_authorizations(token).uuid]], + offset: expect_list_items, + } + assert_response expect_list_response + assert_equal json_response['items_available'], expect_list_items + assert_equal json_response['items'].length, 0 + end + end + + test "using '#{user}', list '#{token}' by token" do + authorize_with user + get :index, { + filters: [['api_token','=',api_client_authorizations(token).api_token]], + } + assert_response expect_list_response + if expect_list_items + assert_equal assigns(:objects).length, expect_list_items + assert_equal json_response['items_available'], expect_list_items + end + end + end + + test "scoped token cannot change its own scopes" do + authorize_with :admin_vm + put :update, { + id: api_client_authorizations(:admin_vm).uuid, + api_client_authorization: {scopes: ['all']}, + } + assert_response 403 + end + + test "token cannot change its own uuid" do + authorize_with :admin + put :update, { + id: api_client_authorizations(:admin).uuid, + api_client_authorization: {uuid: 'zzzzz-gj3su-zzzzzzzzzzzzzzz'}, + } + assert_response 403 + end + + test "get current token" do + authorize_with :active + get :current + assert_response :success + assert_equal(json_response['api_token'], + api_client_authorizations(:active).api_token) + end + + test "get current token, no auth" do + get :current + assert_response 401 end end