X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/a93774da6449567a2759672cf329be6ec96f91e3..fc5742654641a10e765ed81d25ca44cb47976d02:/services/api/test/unit/user_test.rb diff --git a/services/api/test/unit/user_test.rb b/services/api/test/unit/user_test.rb index 6d2157b144..596cd415fb 100644 --- a/services/api/test/unit/user_test.rb +++ b/services/api/test/unit/user_test.rb @@ -165,7 +165,9 @@ class UserTest < ActiveSupport::TestCase if auto_admin_first_user_config # This test requires no admin users exist (except for the system user) - users(:admin).delete + act_as_system_user do + users(:admin).update_attributes!(is_admin: false) + end @all_users = User.where("uuid not like '%-000000000000000'").where(:is_admin => true) assert_equal 0, @all_users.count, "No admin users should exist (except for the system user)" end @@ -445,27 +447,17 @@ class UserTest < ActiveSupport::TestCase set_user_from_auth :admin email = 'foo@example.com' - openid_prefix = 'http://openid/prefix' user = User.create ({uuid: 'zzzzz-tpzed-abcdefghijklmno', email: email}) vm = VirtualMachine.create - response = user.setup(openid_prefix: openid_prefix, - repo_name: 'foo/testrepo', + response = user.setup(repo_name: 'foo/testrepo', vm_uuid: vm.uuid) resp_user = find_obj_in_resp response, 'User' verify_user resp_user, email - oid_login_perm = find_obj_in_resp response, 'Link', 'arvados#user' - - verify_link oid_login_perm, 'permission', 'can_login', resp_user[:email], - resp_user[:uuid] - - assert_equal openid_prefix, oid_login_perm[:properties]['identity_url_prefix'], - 'expected identity_url_prefix not found for oid_login_perm' - group_perm = find_obj_in_resp response, 'Link', 'arvados#group' verify_link group_perm, 'permission', 'can_read', resp_user[:uuid], nil @@ -481,7 +473,6 @@ class UserTest < ActiveSupport::TestCase set_user_from_auth :admin email = 'foo@example.com' - openid_prefix = 'http://openid/prefix' user = User.create ({uuid: 'zzzzz-tpzed-abcdefghijklmno', email: email}) @@ -496,21 +487,12 @@ class UserTest < ActiveSupport::TestCase verify_link resp_link, 'permission', 'can_login', email, bad_uuid - response = user.setup(openid_prefix: openid_prefix, - repo_name: 'foo/testrepo', + response = user.setup(repo_name: 'foo/testrepo', vm_uuid: vm.uuid) resp_user = find_obj_in_resp response, 'User' verify_user resp_user, email - oid_login_perm = find_obj_in_resp response, 'Link', 'arvados#user' - - verify_link oid_login_perm, 'permission', 'can_login', resp_user[:email], - resp_user[:uuid] - - assert_equal openid_prefix, oid_login_perm[:properties]['identity_url_prefix'], - 'expected identity_url_prefix not found for oid_login_perm' - group_perm = find_obj_in_resp response, 'Link', 'arvados#group' verify_link group_perm, 'permission', 'can_read', resp_user[:uuid], nil @@ -526,27 +508,19 @@ class UserTest < ActiveSupport::TestCase set_user_from_auth :admin email = 'foo@example.com' - openid_prefix = 'http://openid/prefix' user = User.create ({uuid: 'zzzzz-tpzed-abcdefghijklmno', email: email}) - response = user.setup(openid_prefix: openid_prefix) + response = user.setup() resp_user = find_obj_in_resp response, 'User' verify_user resp_user, email - oid_login_perm = find_obj_in_resp response, 'Link', 'arvados#user' - verify_link oid_login_perm, 'permission', 'can_login', resp_user[:email], - resp_user[:uuid] - assert_equal openid_prefix, oid_login_perm[:properties]['identity_url_prefix'], - 'expected identity_url_prefix not found for oid_login_perm' - group_perm = find_obj_in_resp response, 'Link', 'arvados#group' verify_link group_perm, 'permission', 'can_read', resp_user[:uuid], nil # invoke setup again with repo_name - response = user.setup(openid_prefix: openid_prefix, - repo_name: 'foo/testrepo') + response = user.setup(repo_name: 'foo/testrepo') resp_user = find_obj_in_resp response, 'User', nil verify_user resp_user, email assert_equal user.uuid, resp_user[:uuid], 'expected uuid not found' @@ -560,8 +534,7 @@ class UserTest < ActiveSupport::TestCase # invoke setup again with a vm_uuid vm = VirtualMachine.create - response = user.setup(openid_prefix: openid_prefix, - repo_name: 'foo/testrepo', + response = user.setup(repo_name: 'foo/testrepo', vm_uuid: vm.uuid) resp_user = find_obj_in_resp response, 'User', nil @@ -646,9 +619,7 @@ class UserTest < ActiveSupport::TestCase verify_link_exists(Rails.configuration.Users.AutoSetupNewUsers || active, groups(:all_users).uuid, user.uuid, "permission", "can_read") - # Check for OID login link. - verify_link_exists(Rails.configuration.Users.AutoSetupNewUsers || active, - user.uuid, user.email, "permission", "can_login") + # Check for repository. if named_repo = (prior_repo or Repository.where(name: expect_repo_name).first) @@ -800,4 +771,89 @@ class UserTest < ActiveSupport::TestCase end end end + + test "lookup user by email" do + u = User.register({"email" => "active-user@arvados.local", "identity_url" => "different-identity-url"}) + active = User.find_by_uuid(users(:active).uuid) + assert_equal active.uuid, u.uuid + assert_equal "active-user@arvados.local", active.email + # identity_url is not updated + assert_equal "https://active-user.openid.local", active.identity_url + end + + test "lookup user by alternate email" do + # register method will find that active-user@arvados.local already + # exists and return existing 'active' user. + u = User.register({"email" => "user@parent-company.com", + "alternate_emails" => ["active-user@arvados.local"], + "identity_url" => "different-identity-url"}) + active = User.find_by_uuid(users(:active).uuid) + assert_equal active.uuid, u.uuid + + # email should be updated + assert_equal "user@parent-company.com", active.email + + # identity_url is not updated + assert_equal "https://active-user.openid.local", active.identity_url + end + + test "register new user" do + u = User.register({"email" => "never-before-seen-user@arvados.local", + "identity_url" => "different-identity-url", + "first_name" => "Robert", + "last_name" => "Baratheon", + "username" => "bobby"}) + nbs = User.find_by_uuid(u.uuid) + assert_equal nbs.uuid, u.uuid + assert_equal "different-identity-url", nbs.identity_url + assert_equal "never-before-seen-user@arvados.local", nbs.email + assert_equal false, nbs.is_admin + assert_equal false , nbs.is_active + assert_equal "bobby", nbs.username + assert_equal "Robert", nbs.first_name + assert_equal "Baratheon", nbs.last_name + end + + test "fail when email address is ambiguous" do + User.register({"email" => "active-user@arvados.local"}) + u = User.register({"email" => "never-before-seen-user@arvados.local"}) + u.email = "active-user@arvados.local" + act_as_system_user do + u.save! + end + assert_raises do + User.register({"email" => "active-user@arvados.local"}) + end + end + + test "fail lookup without identifiers" do + assert_raises do + User.register({"first_name" => "Robert", "last_name" => "Baratheon"}) + end + assert_raises do + User.register({"first_name" => "Robert", "last_name" => "Baratheon", "identity_url" => "", "email" => ""}) + end + end + + test "user can update name" do + set_user_from_auth :active + user = users(:active) + user.first_name = "MyNewName" + assert user.save + end + + test "user cannot update email" do + set_user_from_auth :active + user = users(:active) + user.email = "new-name@example.com" + assert_not_allowed { user.save } + end + + test "admin can update email" do + set_user_from_auth :admin + user = users(:active) + user.email = "new-name@example.com" + assert user.save + end + end