X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/94c762ed797f2567c1dcc70d12582c7d640da7bb..0eb72b526bf8bbb011551ecf019f604e17a534f1:/services/api/test/integration/permissions_test.rb diff --git a/services/api/test/integration/permissions_test.rb b/services/api/test/integration/permissions_test.rb index bd9685bd5f..f8f1e254bf 100644 --- a/services/api/test/integration/permissions_test.rb +++ b/services/api/test/integration/permissions_test.rb @@ -1,8 +1,18 @@ +# Copyright (C) The Arvados Authors. All rights reserved. +# +# SPDX-License-Identifier: AGPL-3.0 + require 'test_helper' class PermissionsTest < ActionDispatch::IntegrationTest + include DbCurrentTime + include CurrentApiClient # for empty_collection fixtures :users, :groups, :api_client_authorizations, :collections + teardown do + User.invalidate_permissions_cache db_current_time.to_i + end + test "adding and removing direct can_read links" do # try to read collection as spectator get "/arvados/v1/collections/#{collections(:foo_file).uuid}", {:format => :json}, auth(:spectator) @@ -12,11 +22,9 @@ class PermissionsTest < ActionDispatch::IntegrationTest post "/arvados/v1/links", { :format => :json, :link => { - tail_kind: 'arvados#user', tail_uuid: users(:spectator).uuid, link_class: 'permission', name: 'can_read', - head_kind: 'arvados#collection', head_uuid: collections(:foo_file).uuid, properties: {} } @@ -27,16 +35,14 @@ class PermissionsTest < ActionDispatch::IntegrationTest post "/arvados/v1/links", { :format => :json, :link => { - tail_kind: 'arvados#user', tail_uuid: users(:spectator).uuid, link_class: 'permission', name: 'can_read', - head_kind: 'arvados#collection', head_uuid: collections(:foo_file).uuid, properties: {} } }, auth(:admin) - u = jresponse['uuid'] + u = json_response['uuid'] assert_response :success # read collection as spectator @@ -66,11 +72,9 @@ class PermissionsTest < ActionDispatch::IntegrationTest post "/arvados/v1/links", { :format => :json, :link => { - tail_kind: 'arvados#user', tail_uuid: users(:spectator).uuid, link_class: 'permission', name: 'can_read', - head_kind: 'arvados#group', head_uuid: groups(:private).uuid, properties: {} } @@ -85,16 +89,14 @@ class PermissionsTest < ActionDispatch::IntegrationTest post "/arvados/v1/links", { :format => :json, :link => { - tail_kind: 'arvados#group', tail_uuid: groups(:private).uuid, link_class: 'permission', name: 'can_read', - head_kind: 'arvados#collection', head_uuid: collections(:foo_file).uuid, properties: {} } }, auth(:admin) - u = jresponse['uuid'] + u = json_response['uuid'] assert_response :success # try to read collection as spectator @@ -108,7 +110,7 @@ class PermissionsTest < ActionDispatch::IntegrationTest # try to read collection as spectator get "/arvados/v1/collections/#{collections(:foo_file).uuid}", {:format => :json}, auth(:spectator) assert_response 404 - + end @@ -121,11 +123,9 @@ class PermissionsTest < ActionDispatch::IntegrationTest post "/arvados/v1/links", { :format => :json, :link => { - tail_kind: 'arvados#group', tail_uuid: groups(:private).uuid, link_class: 'permission', name: 'can_read', - head_kind: 'arvados#collection', head_uuid: collections(:foo_file).uuid, properties: {} } @@ -140,16 +140,14 @@ class PermissionsTest < ActionDispatch::IntegrationTest post "/arvados/v1/links", { :format => :json, :link => { - tail_kind: 'arvados#user', tail_uuid: users(:spectator).uuid, link_class: 'permission', name: 'can_read', - head_kind: 'arvados#group', head_uuid: groups(:private).uuid, properties: {} } }, auth(:admin) - u = jresponse['uuid'] + u = json_response['uuid'] assert_response :success # try to read collection as spectator @@ -163,7 +161,7 @@ class PermissionsTest < ActionDispatch::IntegrationTest # try to read collection as spectator get "/arvados/v1/collections/#{collections(:foo_file).uuid}", {:format => :json}, auth(:spectator) assert_response 404 - + end test "adding can_read links from user to group, group to group, group to collection" do @@ -175,11 +173,9 @@ class PermissionsTest < ActionDispatch::IntegrationTest post "/arvados/v1/links", { :format => :json, :link => { - tail_kind: 'arvados#user', tail_uuid: users(:spectator).uuid, link_class: 'permission', name: 'can_read', - head_kind: 'arvados#group', head_uuid: groups(:private).uuid, properties: {} } @@ -190,11 +186,9 @@ class PermissionsTest < ActionDispatch::IntegrationTest post "/arvados/v1/links", { :format => :json, :link => { - tail_kind: 'arvados#group', tail_uuid: groups(:private).uuid, link_class: 'permission', name: 'can_read', - head_kind: 'arvados#group', head_uuid: groups(:empty_lonely_group).uuid, properties: {} } @@ -205,16 +199,14 @@ class PermissionsTest < ActionDispatch::IntegrationTest post "/arvados/v1/links", { :format => :json, :link => { - tail_kind: 'arvados#group', tail_uuid: groups(:empty_lonely_group).uuid, link_class: 'permission', name: 'can_read', - head_kind: 'arvados#collection', head_uuid: collections(:foo_file).uuid, properties: {} } }, auth(:admin) - u = jresponse['uuid'] + u = json_response['uuid'] assert_response :success # try to read collection as spectator @@ -230,18 +222,6 @@ class PermissionsTest < ActionDispatch::IntegrationTest assert_response 404 end - test "read-only group-admin sees correct subset of user list" do - get "/arvados/v1/users", {:format => :json}, auth(:rominiadmin) - assert_response :success - resp_uuids = jresponse['items'].collect { |i| i['uuid'] } - [[true, users(:rominiadmin).uuid], - [true, users(:active).uuid], - [false, users(:miniadmin).uuid], - [false, users(:spectator).uuid]].each do |should_find, uuid| - assert_equal should_find, !resp_uuids.index(uuid).nil?, "rominiadmin should #{'not ' if !should_find}see #{uuid} in user list" - end - end - test "read-only group-admin cannot modify administered user" do put "/arvados/v1/users/#{users(:active).uuid}", { :user => { @@ -272,7 +252,7 @@ class PermissionsTest < ActionDispatch::IntegrationTest [:miniadmin, true]].each do |which_user, update_should_succeed| get "/arvados/v1/specimens", {:format => :json}, auth(which_user) assert_response :success - resp_uuids = jresponse['items'].collect { |i| i['uuid'] } + resp_uuids = json_response['items'].collect { |i| i['uuid'] } [[true, specimens(:owned_by_active_user).uuid], [true, specimens(:owned_by_private_group).uuid], [false, specimens(:owned_by_spectator).uuid], @@ -301,4 +281,98 @@ class PermissionsTest < ActionDispatch::IntegrationTest end end + test "get_permissions returns list" do + # First confirm that user :active cannot get permissions on group :public + get "/arvados/v1/permissions/#{groups(:public).uuid}", nil, auth(:active) + assert_response 404 + + # add some permissions, including can_manage + # permission for user :active + post "/arvados/v1/links", { + :format => :json, + :link => { + tail_uuid: users(:spectator).uuid, + link_class: 'permission', + name: 'can_read', + head_uuid: groups(:public).uuid, + properties: {} + } + }, auth(:admin) + assert_response :success + can_read_uuid = json_response['uuid'] + + post "/arvados/v1/links", { + :format => :json, + :link => { + tail_uuid: users(:inactive).uuid, + link_class: 'permission', + name: 'can_write', + head_uuid: groups(:public).uuid, + properties: {} + } + }, auth(:admin) + assert_response :success + can_write_uuid = json_response['uuid'] + + post "/arvados/v1/links", { + :format => :json, + :link => { + tail_uuid: users(:active).uuid, + link_class: 'permission', + name: 'can_manage', + head_uuid: groups(:public).uuid, + properties: {} + } + }, auth(:admin) + assert_response :success + can_manage_uuid = json_response['uuid'] + + # Now user :active should be able to retrieve permissions + # on group :public. + get("/arvados/v1/permissions/#{groups(:public).uuid}", + { :format => :json }, + auth(:active)) + assert_response :success + + perm_uuids = json_response['items'].map { |item| item['uuid'] } + assert_includes perm_uuids, can_read_uuid, "can_read_uuid not found" + assert_includes perm_uuids, can_write_uuid, "can_write_uuid not found" + assert_includes perm_uuids, can_manage_uuid, "can_manage_uuid not found" + end + + test "get_permissions returns 404 for nonexistent uuid" do + nonexistent = Group.generate_uuid + # make sure it really doesn't exist + get "/arvados/v1/groups/#{nonexistent}", nil, auth(:admin) + assert_response 404 + + get "/arvados/v1/permissions/#{nonexistent}", nil, auth(:active) + assert_response 404 + end + + test "get_permissions returns 403 if user can read but not manage" do + post "/arvados/v1/links", { + :link => { + tail_uuid: users(:active).uuid, + link_class: 'permission', + name: 'can_read', + head_uuid: groups(:public).uuid, + properties: {} + } + }, auth(:admin) + assert_response :success + + get "/arvados/v1/permissions/#{groups(:public).uuid}", nil, auth(:active) + assert_response 403 + end + + test "active user can read the empty collection" do + # The active user should be able to read the empty collection. + + get("/arvados/v1/collections/#{empty_collection_uuid}", + { :format => :json }, + auth(:active)) + assert_response :success + assert_empty json_response['manifest_text'], "empty collection manifest_text is not empty" + end end