X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/98911cfe4792b20798858cefb353c451460e1a80..97d2da2083d046057cb589115867eec430706d68:/services/keep-web/handler_test.go

diff --git a/services/keep-web/handler_test.go b/services/keep-web/handler_test.go
index 4894ceb70b..7a015c91f9 100644
--- a/services/keep-web/handler_test.go
+++ b/services/keep-web/handler_test.go
@@ -12,10 +12,12 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
 
+	"git.curoverse.com/arvados.git/sdk/go/arvados"
 	"git.curoverse.com/arvados.git/sdk/go/arvadostest"
 	"git.curoverse.com/arvados.git/sdk/go/auth"
 	check "gopkg.in/check.v1"
@@ -27,7 +29,7 @@ type UnitSuite struct{}
 
 func (s *UnitSuite) TestCORSPreflight(c *check.C) {
 	h := handler{Config: DefaultConfig()}
-	u, _ := url.Parse("http://keep-web.example/c=" + arvadostest.FooCollection + "/foo")
+	u := mustParseURL("http://keep-web.example/c=" + arvadostest.FooCollection + "/foo")
 	req := &http.Request{
 		Method:     "OPTIONS",
 		Host:       u.Host,
@@ -45,8 +47,8 @@ func (s *UnitSuite) TestCORSPreflight(c *check.C) {
 	c.Check(resp.Code, check.Equals, http.StatusOK)
 	c.Check(resp.Body.String(), check.Equals, "")
 	c.Check(resp.Header().Get("Access-Control-Allow-Origin"), check.Equals, "*")
-	c.Check(resp.Header().Get("Access-Control-Allow-Methods"), check.Equals, "COPY, DELETE, GET, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PUT, RMCOL")
-	c.Check(resp.Header().Get("Access-Control-Allow-Headers"), check.Equals, "Authorization, Content-Type, Range")
+	c.Check(resp.Header().Get("Access-Control-Allow-Methods"), check.Equals, "COPY, DELETE, GET, LOCK, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, RMCOL, UNLOCK")
+	c.Check(resp.Header().Get("Access-Control-Allow-Headers"), check.Equals, "Authorization, Content-Type, Range, Depth, Destination, If, Lock-Token, Overwrite, Timeout")
 
 	// Check preflight for a disallowed request
 	resp = httptest.NewRecorder()
@@ -68,8 +70,7 @@ func (s *UnitSuite) TestInvalidUUID(c *check.C) {
 		"http://" + bogusID + ".keep-web/t=" + token + "/" + bogusID + "/foo",
 	} {
 		c.Log(trial)
-		u, err := url.Parse(trial)
-		c.Assert(err, check.IsNil)
+		u := mustParseURL(trial)
 		req := &http.Request{
 			Method:     "GET",
 			Host:       u.Host,
@@ -349,6 +350,28 @@ func (s *IntegrationSuite) TestVhostRedirectQueryTokenSiteFS(c *check.C) {
 	c.Check(resp.Header().Get("Content-Disposition"), check.Matches, "attachment(;.*)?")
 }
 
+func (s *IntegrationSuite) TestPastCollectionVersionFileAccess(c *check.C) {
+	s.testServer.Config.AttachmentOnlyHost = "download.example.com"
+	resp := s.testVhostRedirectTokenToCookie(c, "GET",
+		"download.example.com/c="+arvadostest.WazVersion1Collection+"/waz",
+		"?api_token="+arvadostest.ActiveToken,
+		"",
+		"",
+		http.StatusOK,
+		"waz",
+	)
+	c.Check(resp.Header().Get("Content-Disposition"), check.Matches, "attachment(;.*)?")
+	resp = s.testVhostRedirectTokenToCookie(c, "GET",
+		"download.example.com/by_id/"+arvadostest.WazVersion1Collection+"/waz",
+		"?api_token="+arvadostest.ActiveToken,
+		"",
+		"",
+		http.StatusOK,
+		"waz",
+	)
+	c.Check(resp.Header().Get("Content-Disposition"), check.Matches, "attachment(;.*)?")
+}
+
 func (s *IntegrationSuite) TestVhostRedirectQueryTokenTrustAllContent(c *check.C) {
 	s.testServer.Config.TrustAllContent = true
 	s.testVhostRedirectTokenToCookie(c, "GET",
@@ -430,6 +453,38 @@ func (s *IntegrationSuite) TestAnonymousTokenError(c *check.C) {
 	)
 }
 
+func (s *IntegrationSuite) TestSpecialCharsInPath(c *check.C) {
+	s.testServer.Config.AttachmentOnlyHost = "download.example.com"
+
+	client := s.testServer.Config.Client
+	client.AuthToken = arvadostest.ActiveToken
+	fs, err := (&arvados.Collection{}).FileSystem(&client, nil)
+	c.Assert(err, check.IsNil)
+	f, err := fs.OpenFile("https:\\\"odd' path chars", os.O_CREATE, 0777)
+	c.Assert(err, check.IsNil)
+	f.Close()
+	mtxt, err := fs.MarshalManifest(".")
+	c.Assert(err, check.IsNil)
+	coll := arvados.Collection{ManifestText: mtxt}
+	err = client.RequestAndDecode(&coll, "POST", "arvados/v1/collections", client.UpdateBody(coll), nil)
+	c.Assert(err, check.IsNil)
+
+	u, _ := url.Parse("http://download.example.com/c=" + coll.UUID + "/")
+	req := &http.Request{
+		Method:     "GET",
+		Host:       u.Host,
+		URL:        u,
+		RequestURI: u.RequestURI(),
+		Header: http.Header{
+			"Authorization": {"Bearer " + client.AuthToken},
+		},
+	}
+	resp := httptest.NewRecorder()
+	s.testServer.Handler.ServeHTTP(resp, req)
+	c.Check(resp.Code, check.Equals, http.StatusOK)
+	c.Check(resp.Body.String(), check.Matches, `(?ms).*href="./https:%5c%22odd%27%20path%20chars"\S+https:\\"odd' path chars.*`)
+}
+
 // XHRs can't follow redirect-with-cookie so they rely on method=POST
 // and disposition=attachment (telling us it's acceptable to respond
 // with content instead of a redirect) and an Origin header that gets
@@ -479,7 +534,7 @@ func (s *IntegrationSuite) testVhostRedirectTokenToCookie(c *check.C, method, ho
 	if resp.Code != http.StatusSeeOther {
 		return resp
 	}
-	c.Check(resp.Body.String(), check.Matches, `.*href="//`+regexp.QuoteMeta(html.EscapeString(hostPath))+`(\?[^"]*)?".*`)
+	c.Check(resp.Body.String(), check.Matches, `.*href="http://`+regexp.QuoteMeta(html.EscapeString(hostPath))+`(\?[^"]*)?".*`)
 	cookies := (&http.Response{Header: resp.Header()}).Cookies()
 
 	u, _ = u.Parse(resp.Header().Get("Location"))
@@ -623,6 +678,18 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) {
 			header: authHeader,
 			expect: nil,
 		},
+		{
+			uri:     "download.example.com/c=" + arvadostest.WazVersion1Collection,
+			header:  authHeader,
+			expect:  []string{"waz"},
+			cutDirs: 1,
+		},
+		{
+			uri:     "download.example.com/by_id/" + arvadostest.WazVersion1Collection,
+			header:  authHeader,
+			expect:  []string{"waz"},
+			cutDirs: 2,
+		},
 	} {
 		c.Logf("HTML: %q => %q", trial.uri, trial.expect)
 		resp := httptest.NewRecorder()
@@ -632,7 +699,7 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) {
 			Host:       u.Host,
 			URL:        u,
 			RequestURI: u.RequestURI(),
-			Header:     trial.header,
+			Header:     copyHeader(trial.header),
 		}
 		s.testServer.Handler.ServeHTTP(resp, req)
 		var cookies []*http.Cookie
@@ -643,7 +710,7 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) {
 				Host:       u.Host,
 				URL:        u,
 				RequestURI: u.RequestURI(),
-				Header:     trial.header,
+				Header:     copyHeader(trial.header),
 			}
 			cookies = append(cookies, (&http.Response{Header: resp.Header()}).Cookies()...)
 			for _, c := range cookies {
@@ -660,7 +727,7 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) {
 		} else {
 			c.Check(resp.Code, check.Equals, http.StatusOK)
 			for _, e := range trial.expect {
-				c.Check(resp.Body.String(), check.Matches, `(?ms).*href="`+e+`".*`)
+				c.Check(resp.Body.String(), check.Matches, `(?ms).*href="./`+e+`".*`)
 			}
 			c.Check(resp.Body.String(), check.Matches, `(?ms).*--cut-dirs=`+fmt.Sprintf("%d", trial.cutDirs)+` .*`)
 		}
@@ -671,7 +738,7 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) {
 			Host:       u.Host,
 			URL:        u,
 			RequestURI: u.RequestURI(),
-			Header:     trial.header,
+			Header:     copyHeader(trial.header),
 			Body:       ioutil.NopCloser(&bytes.Buffer{}),
 		}
 		resp = httptest.NewRecorder()
@@ -687,7 +754,7 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) {
 			Host:       u.Host,
 			URL:        u,
 			RequestURI: u.RequestURI(),
-			Header:     trial.header,
+			Header:     copyHeader(trial.header),
 			Body:       ioutil.NopCloser(&bytes.Buffer{}),
 		}
 		resp = httptest.NewRecorder()
@@ -703,6 +770,43 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) {
 	}
 }
 
+func (s *IntegrationSuite) TestDeleteLastFile(c *check.C) {
+	arv := arvados.NewClientFromEnv()
+	var newCollection arvados.Collection
+	err := arv.RequestAndDecode(&newCollection, "POST", "arvados/v1/collections", arv.UpdateBody(&arvados.Collection{
+		OwnerUUID:    arvadostest.ActiveUserUUID,
+		ManifestText: ". acbd18db4cc2f85cedef654fccc4a4d8+3 0:3:foo.txt 0:3:bar.txt\n",
+		Name:         "keep-web test collection",
+	}), map[string]bool{"ensure_unique_name": true})
+	c.Assert(err, check.IsNil)
+	defer arv.RequestAndDecode(&newCollection, "DELETE", "arvados/v1/collections/"+newCollection.UUID, nil, nil)
+
+	var updated arvados.Collection
+	for _, fnm := range []string{"foo.txt", "bar.txt"} {
+		s.testServer.Config.AttachmentOnlyHost = "example.com"
+		u, _ := url.Parse("http://example.com/c=" + newCollection.UUID + "/" + fnm)
+		req := &http.Request{
+			Method:     "DELETE",
+			Host:       u.Host,
+			URL:        u,
+			RequestURI: u.RequestURI(),
+			Header: http.Header{
+				"Authorization": {"Bearer " + arvadostest.ActiveToken},
+			},
+		}
+		resp := httptest.NewRecorder()
+		s.testServer.Handler.ServeHTTP(resp, req)
+		c.Check(resp.Code, check.Equals, http.StatusNoContent)
+
+		updated = arvados.Collection{}
+		err = arv.RequestAndDecode(&updated, "GET", "arvados/v1/collections/"+newCollection.UUID, nil, nil)
+		c.Check(err, check.IsNil)
+		c.Check(updated.ManifestText, check.Not(check.Matches), `(?ms).*\Q`+fnm+`\E.*`)
+		c.Logf("updated manifest_text %q", updated.ManifestText)
+	}
+	c.Check(updated.ManifestText, check.Equals, "")
+}
+
 func (s *IntegrationSuite) TestHealthCheckPing(c *check.C) {
 	s.testServer.Config.ManagementToken = arvadostest.ManagementToken
 	authHeader := http.Header{
@@ -723,3 +827,11 @@ func (s *IntegrationSuite) TestHealthCheckPing(c *check.C) {
 	c.Check(resp.Code, check.Equals, http.StatusOK)
 	c.Check(resp.Body.String(), check.Matches, `{"health":"OK"}\n`)
 }
+
+func copyHeader(h http.Header) http.Header {
+	hc := http.Header{}
+	for k, v := range h {
+		hc[k] = append([]string(nil), v...)
+	}
+	return hc
+}