X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/659a8c75c837ec30e2f9fb6f1a1859b625626c3e..0eb72b526bf8bbb011551ecf019f604e17a534f1:/services/api/test/unit/user_test.rb diff --git a/services/api/test/unit/user_test.rb b/services/api/test/unit/user_test.rb index 6eabdfd359..3d8fb9da75 100644 --- a/services/api/test/unit/user_test.rb +++ b/services/api/test/unit/user_test.rb @@ -1,3 +1,7 @@ +# Copyright (C) The Arvados Authors. All rights reserved. +# +# SPDX-License-Identifier: AGPL-3.0 + require 'test_helper' class UserTest < ActiveSupport::TestCase @@ -39,14 +43,10 @@ class UserTest < ActiveSupport::TestCase end test "non-admin can't update username" do - set_user_from_auth :active_trustedclient - user = User.find_by_uuid(users(:active).uuid) + set_user_from_auth :rominiadmin + user = User.find_by_uuid(users(:rominiadmin).uuid) user.username = "selfupdate" - begin - refute(user.save) - rescue ArvadosModel::PermissionDeniedError - # That works too. - end + assert_not_allowed { user.save } end def check_admin_username_change(fixture_name) @@ -97,6 +97,16 @@ class UserTest < ActiveSupport::TestCase test "new username set with deduplication" do name = users(:active).username check_new_username_setting(name, "#{name}2") + check_new_username_setting(name, "#{name}3") + # Insert some out-of-order conflicts, to ensure our "sort by + # username, stop when we see a hole" strategy doesn't depend on + # insert order. + check_new_username_setting("#{name}13", "#{name}13") + check_new_username_setting("#{name}5", "#{name}5") + check_new_username_setting(name, "#{name}4") + 6.upto(12).each do |n| + check_new_username_setting(name, "#{name}#{n}") + end end test "new username set avoiding blacklist" do @@ -108,6 +118,41 @@ class UserTest < ActiveSupport::TestCase check_new_username_setting("_", nil) end + test "updating username updates repository names" do + set_user_from_auth :admin + user = users(:active) + user.username = "newtestname" + assert(user.save, "username update failed") + {foo: "newtestname/foo", repository2: "newtestname/foo2"}. + each_pair do |repo_sym, expect_name| + assert_equal(expect_name, repositories(repo_sym).name) + end + end + + test "admin can clear username when user owns no repositories" do + set_user_from_auth :admin + user = users(:spectator) + user.username = nil + assert(user.save) + assert_nil(user.username) + end + + test "admin can't clear username when user owns repositories" do + set_user_from_auth :admin + user = users(:active) + user.username = nil + assert_not_allowed { user.save } + refute_empty(user.errors[:username]) + end + + test "failed username update doesn't change repository names" do + set_user_from_auth :admin + user = users(:active) + user.username = users(:fuse).username + assert_not_allowed { user.save } + assert_equal("active/foo", repositories(:foo).name) + end + [[false, 'foo@example.com', true, nil], [false, 'bar@example.com', nil, true], [true, 'foo@example.com', true, nil], @@ -121,8 +166,8 @@ class UserTest < ActiveSupport::TestCase if auto_admin_first_user_config # This test requires no admin users exist (except for the system user) users(:admin).delete - @all_users = User.where("uuid not like '%-000000000000000'").where(:is_admin => true).find(:all) - assert_equal 0, @all_users.size, "No admin users should exist (except for the system user)" + @all_users = User.where("uuid not like '%-000000000000000'").where(:is_admin => true) + assert_equal 0, @all_users.count, "No admin users should exist (except for the system user)" end Rails.configuration.auto_admin_first_user = auto_admin_first_user_config @@ -235,14 +280,16 @@ class UserTest < ActiveSupport::TestCase assert @uninvited_user.can? :write=>"#{@uninvited_user.uuid}" assert @uninvited_user.can? :manage=>"#{@uninvited_user.uuid}" - assert @uninvited_user.groups_i_can(:read).size == 1, "inactive and uninvited user can only read anonymous user group" - assert @uninvited_user.groups_i_can(:read).first.ends_with? 'anonymouspublic' , "inactive and uninvited user can only read anonymous user group" - assert @uninvited_user.groups_i_can(:write).size == 0, "inactive and uninvited user should not be able write to any groups" - assert @uninvited_user.groups_i_can(:manage).size == 0, "inactive and uninvited user should not be able manage any groups" + assert_equal(@uninvited_user.groups_i_can(:read).sort, + [@uninvited_user.uuid, groups(:anonymous_group).uuid].sort) + assert_equal(@uninvited_user.groups_i_can(:write), + [@uninvited_user.uuid]) + assert_equal(@uninvited_user.groups_i_can(:manage), + [@uninvited_user.uuid]) end test "find user method checks" do - User.find(:all).each do |user| + User.all.each do |user| assert_not_nil user.uuid, "non-null uuid expected for " + user.full_name end @@ -270,14 +317,14 @@ class UserTest < ActiveSupport::TestCase test "create new user" do set_user_from_auth :admin - @all_users = User.find(:all) + @all_users = User.all.to_a user = User.new user.first_name = "first_name_for_newly_created_user" user.save # verify there is one extra user in the db now - assert_equal @all_users.size+1, User.find(:all).size + assert_equal @all_users.size+1, User.all.count user = User.find(user.id) # get the user back assert_equal(user.first_name, 'first_name_for_newly_created_user') @@ -379,7 +426,7 @@ class UserTest < ActiveSupport::TestCase @active_user.delete found_deleted_user = false - User.find(:all).each do |user| + User.all.each do |user| if user.uuid == active_user_uuid found_deleted_user = true break @@ -391,14 +438,7 @@ class UserTest < ActiveSupport::TestCase test "create new user as non-admin user" do set_user_from_auth :active - - begin - user = User.new - user.save - rescue ArvadosModel::PermissionDeniedError => e - end - assert (e.message.include? 'PermissionDeniedError'), - 'Expected PermissionDeniedError' + assert_not_allowed { User.new.save } end test "setup new user" do @@ -411,7 +451,9 @@ class UserTest < ActiveSupport::TestCase vm = VirtualMachine.create - response = User.setup user, openid_prefix, 'test_repo', vm.uuid + response = user.setup(openid_prefix: openid_prefix, + repo_name: 'foo/testrepo', + vm_uuid: vm.uuid) resp_user = find_obj_in_resp response, 'User' verify_user resp_user, email @@ -432,6 +474,7 @@ class UserTest < ActiveSupport::TestCase vm_perm = find_obj_in_resp response, 'Link', 'arvados#virtualMachine' verify_link vm_perm, 'permission', 'can_login', resp_user[:uuid], vm.uuid + assert_equal("foo", vm_perm.properties["username"]) end test "setup new user with junk in database" do @@ -453,7 +496,9 @@ class UserTest < ActiveSupport::TestCase verify_link resp_link, 'permission', 'can_login', email, bad_uuid - response = User.setup user, openid_prefix, 'test_repo', vm.uuid + response = user.setup(openid_prefix: openid_prefix, + repo_name: 'foo/testrepo', + vm_uuid: vm.uuid) resp_user = find_obj_in_resp response, 'User' verify_user resp_user, email @@ -474,6 +519,7 @@ class UserTest < ActiveSupport::TestCase vm_perm = find_obj_in_resp response, 'Link', 'arvados#virtualMachine' verify_link vm_perm, 'permission', 'can_login', resp_user[:uuid], vm.uuid + assert_equal("foo", vm_perm.properties["username"]) end test "setup new user in multiple steps" do @@ -484,7 +530,7 @@ class UserTest < ActiveSupport::TestCase user = User.create ({uuid: 'zzzzz-tpzed-abcdefghijklmno', email: email}) - response = User.setup user, openid_prefix + response = user.setup(openid_prefix: openid_prefix) resp_user = find_obj_in_resp response, 'User' verify_user resp_user, email @@ -499,7 +545,8 @@ class UserTest < ActiveSupport::TestCase verify_link group_perm, 'permission', 'can_read', resp_user[:uuid], nil # invoke setup again with repo_name - response = User.setup user, openid_prefix, 'test_repo' + response = user.setup(openid_prefix: openid_prefix, + repo_name: 'foo/testrepo') resp_user = find_obj_in_resp response, 'User', nil verify_user resp_user, email assert_equal user.uuid, resp_user[:uuid], 'expected uuid not found' @@ -513,7 +560,9 @@ class UserTest < ActiveSupport::TestCase # invoke setup again with a vm_uuid vm = VirtualMachine.create - response = User.setup user, openid_prefix, 'test_repo', vm.uuid + response = user.setup(openid_prefix: openid_prefix, + repo_name: 'foo/testrepo', + vm_uuid: vm.uuid) resp_user = find_obj_in_resp response, 'User', nil verify_user resp_user, email @@ -527,6 +576,7 @@ class UserTest < ActiveSupport::TestCase vm_perm = find_obj_in_resp response, 'Link', 'arvados#virtualMachine' verify_link vm_perm, 'permission', 'can_login', resp_user[:uuid], vm.uuid + assert_equal("foo", vm_perm.properties["username"]) end def find_obj_in_resp (response_items, object_type, head_kind=nil) @@ -582,7 +632,8 @@ class UserTest < ActiveSupport::TestCase can_setup = (Rails.configuration.auto_setup_new_users and (not expect_username.nil?)) - prior_repo = Repository.where(name: expect_username).first + expect_repo_name = "#{expect_username}/#{expect_username}" + prior_repo = Repository.where(name: expect_repo_name).first user = User.new user.first_name = "first_name_for_newly_created_user" @@ -600,7 +651,7 @@ class UserTest < ActiveSupport::TestCase user.uuid, user.email, "permission", "can_login") # Check for repository. if named_repo = (prior_repo or - Repository.where(name: expect_username).first) + Repository.where(name: expect_repo_name).first) verify_link_exists((can_setup and prior_repo.nil? and Rails.configuration.auto_setup_new_users_with_repository), named_repo.uuid, user.uuid, "permission", "can_manage")