X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/7f7cd27d5fc31dc5bbec7f95905fd394a5b317c7..ac30c34ccfacce16cca52e155d2a0e50b0185dc3:/services/api/test/functional/arvados/v1/users_controller_test.rb diff --git a/services/api/test/functional/arvados/v1/users_controller_test.rb b/services/api/test/functional/arvados/v1/users_controller_test.rb index abf1ba1375..28367831e1 100644 --- a/services/api/test/functional/arvados/v1/users_controller_test.rb +++ b/services/api/test/functional/arvados/v1/users_controller_test.rb @@ -13,7 +13,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase get :current assert_response :success me = JSON.parse(@response.body) - post :activate, uuid: me['uuid'] + post :activate, id: me['uuid'] assert_response :success assert_not_nil assigns(:object) me = JSON.parse(@response.body) @@ -21,12 +21,37 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase end test "refuse to activate a user before signing UA" do + act_as_system_user do + required_uuids = Link.where("owner_uuid = ? and link_class = ? and name = ? and tail_uuid = ? and head_uuid like ?", + system_user_uuid, + 'signature', + 'require', + system_user_uuid, + Collection.uuid_like_pattern). + collect(&:head_uuid) + + assert required_uuids.length > 0 + + signed_uuids = Link.where(owner_uuid: system_user_uuid, + link_class: 'signature', + name: 'click', + tail_uuid: users(:inactive).uuid, + head_uuid: required_uuids). + collect(&:head_uuid) + + assert_equal 0, signed_uuids.length + end + authorize_with :inactive + get :current assert_response :success me = JSON.parse(@response.body) - post :activate, uuid: me['uuid'] + assert_equal false, me['is_active'] + + post :activate, id: me['uuid'] assert_response 403 + get :current assert_response :success me = JSON.parse(@response.body) @@ -38,7 +63,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase get :current assert_response :success me = JSON.parse(@response.body) - post :activate, uuid: me['uuid'] + post :activate, id: me['uuid'] assert_response :success me = JSON.parse(@response.body) assert_equal true, me['is_active'] @@ -96,7 +121,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase verify_link response_items, 'arvados#user', true, 'permission', 'can_login', created['uuid'], created['email'], 'arvados#user', false, 'User' - verify_link response_items, 'arvados#repository', true, 'permission', 'can_write', + verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage', repo_name, created['uuid'], 'arvados#repository', true, 'Repository' verify_link response_items, 'arvados#group', true, 'permission', 'can_read', @@ -119,6 +144,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase email: "foo@example.com" } } + assert_response :success response_items = JSON.parse(@response.body)['items'] @@ -132,7 +158,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase # arvados#user, repo link and link add user to 'All users' group verify_num_links @all_links_at_start, 5 - verify_link response_items, 'arvados#repository', true, 'permission', 'can_write', + verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage', repo_name, created['uuid'], 'arvados#repository', true, 'Repository' verify_link response_items, 'arvados#group', true, 'permission', 'can_read', @@ -230,7 +256,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase 'expecting inactive user email' # expect repo and vm links - verify_link response_items, 'arvados#repository', true, 'permission', 'can_write', + verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage', 'test_repo', resp_obj['uuid'], 'arvados#repository', true, 'Repository' verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login', @@ -453,7 +479,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase verify_link response_items, 'arvados#user', true, 'permission', 'can_login', created['uuid'], created['email'], 'arvados#user', false, 'User' - verify_link response_items, 'arvados#repository', true, 'permission', 'can_write', + verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage', 'test_repo', created['uuid'], 'arvados#repository', true, 'Repository' verify_link response_items, 'arvados#group', true, 'permission', 'can_read', @@ -513,7 +539,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase verify_link response_items, 'arvados#user', true, 'permission', 'can_login', created['uuid'], created['email'], 'arvados#user', false, 'User' - verify_link response_items, 'arvados#repository', true, 'permission', 'can_write', + verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage', 'test_repo', created['uuid'], 'arvados#repository', true, 'Repository' verify_link response_items, 'arvados#group', true, 'permission', 'can_read', @@ -579,7 +605,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase verify_link response_items, 'arvados#group', true, 'permission', 'can_read', 'All users', created['uuid'], 'arvados#group', true, 'Group' - verify_link response_items, 'arvados#repository', false, 'permission', 'can_write', + verify_link response_items, 'arvados#repository', false, 'permission', 'can_manage', 'test_repo', created['uuid'], 'arvados#repository', true, 'Repository' verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login', @@ -603,7 +629,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase verify_link response_items, 'arvados#group', true, 'permission', 'can_read', 'All users', created['uuid'], 'arvados#group', true, 'Group' - verify_link response_items, 'arvados#repository', true, 'permission', 'can_write', + verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage', 'new_repo', created['uuid'], 'arvados#repository', true, 'Repository' verify_link response_items, 'arvados#virtualMachine', false, 'permission', 'can_login', @@ -631,7 +657,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase 'All users', created['uuid'], 'arvados#group', true, 'Group' # since no repo name in input, we won't get any; even though user has one - verify_link response_items, 'arvados#repository', false, 'permission', 'can_write', + verify_link response_items, 'arvados#repository', false, 'permission', 'can_manage', 'new_repo', created['uuid'], 'arvados#repository', true, 'Repository' verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login', @@ -663,7 +689,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase verify_link response_items, 'arvados#group', true, 'permission', 'can_read', 'All users', created['uuid'], 'arvados#group', true, 'Group' - verify_link response_items, 'arvados#repository', true, 'permission', 'can_write', + verify_link response_items, 'arvados#repository', true, 'permission', 'can_manage', 'test_repo', created['uuid'], 'arvados#repository', true, 'Repository' verify_link response_items, 'arvados#virtualMachine', true, 'permission', 'can_login', @@ -672,7 +698,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase verify_link_existence created['uuid'], created['email'], true, true, true, true, false # now unsetup this user - post :unsetup, uuid: created['uuid'] + post :unsetup, id: created['uuid'] assert_response :success created2 = JSON.parse(@response.body) @@ -692,12 +718,12 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase assert active_user['is_invited'], 'expected is_invited for active user' verify_link_existence active_user['uuid'], active_user['email'], - false, false, false, true, true + false, true, false, true, true authorize_with :admin # now unsetup this user - post :unsetup, uuid: active_user['uuid'] + post :unsetup, id: active_user['uuid'] assert_response :success response_user = JSON.parse(@response.body) @@ -762,6 +788,106 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase 'Expected workbench url in email body' end + test "non-admin user can get basic information about active users" do + authorize_with :spectator + get(:index) + check_non_admin_index + check_active_users_index + end + + test "non-admin user can limit index" do + authorize_with :spectator + get(:index, limit: 2) + check_non_admin_index + assert_equal(2, json_response["items"].size, + "non-admin index limit was ineffective") + end + + test "filters are ignored for non-admin index" do + check_index_condition_fails(:spectator, + filters: [["last_name", "=", "__nonexistent__"]]) + end + + test "where is ignored for non-admin index" do + check_index_condition_fails(:spectator, + where: {last_name: "__nonexistent__"}) + end + + test "group admin is treated like non-admin for index" do + check_index_condition_fails(:rominiadmin, + filters: [["last_name", "=", "__nonexistent__"]]) + end + + test "admin has full index powers" do + authorize_with :admin + check_inactive_user_findable + end + + test "reader token can grant admin index powers" do + authorize_with :spectator + check_inactive_user_findable(reader_tokens: [api_token(:admin)]) + end + + test "admin can filter on user.is_active" do + authorize_with :admin + get(:index, filters: [["is_active", "=", "true"]]) + assert_response :success + check_active_users_index + end + + test "admin can search where user.is_active" do + authorize_with :admin + get(:index, where: {is_active: true}) + assert_response :success + check_active_users_index + end + + NON_ADMIN_USER_DATA = ["uuid", "kind", "is_active", "email", "first_name", + "last_name"].sort + + def check_non_admin_index + assert_response :success + response_items = json_response["items"] + assert_not_nil response_items + response_items.each do |user_data| + assert_equal(NON_ADMIN_USER_DATA, user_data.keys.sort, + "data in all users response did not match expectations") + assert_equal("arvados#user", user_data["kind"]) + assert(user_data["is_active"], "non-admin index returned inactive user") + end + end + + def check_active_users_index + response_uuids = json_response["items"].map { |u| u["uuid"] } + [:admin, :miniadmin, :active, :spectator].each do |user_key| + assert_includes(response_uuids, users(user_key).uuid, + "#{user_key} missing from index") + end + refute_includes(response_uuids, users(:inactive).uuid, + "inactive user included in index") + end + + def check_index_condition_fails(user_sym, params) + authorize_with user_sym + get(:index, params) + check_non_admin_index + assert(json_response["items"] + .any? { |u| u["last_name"] != "__nonexistent__" }, + "#{params.inspect} successfully applied to non-admin index") + end + + def check_inactive_user_findable(params={}) + inactive_user = users(:inactive) + get(:index, params.merge(filters: [["email", "=", inactive_user.email]])) + assert_response :success + user_list = json_response["items"] + assert_equal(1, user_list.andand.count) + # This test needs to check a column non-admins have no access to, + # to ensure that admins see all user information. + assert_equal(inactive_user.identity_url, user_list.first["identity_url"], + "admin's filtered index did not return inactive user") + end + def verify_num_links (original_links, expected_additional_links) links_now = Link.all assert_equal expected_additional_links, Link.all.size-original_links.size, @@ -770,6 +896,7 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase def find_obj_in_resp (response_items, object_type, head_kind=nil) return_obj = nil + response_items response_items.each { |x| if !x next @@ -836,8 +963,8 @@ class Arvados::V1::UsersControllerTest < ActionController::TestCase end repo_perms = Link.where(tail_uuid: uuid, - link_class: 'permission', - name: 'can_write').where("head_uuid like ?", Repository.uuid_like_pattern) + link_class: 'permission', + name: 'can_manage').where("head_uuid like ?", Repository.uuid_like_pattern) if expect_repo_perms assert repo_perms.any?, "expected repo_perms" else