2044: All users can give all other users folder permissions.

This supports a Workbench sharing button, the same way that the
changes to users#index does.

diff --git a/services/api/app/models/link.rb b/services/api/app/models/link.rb
index bb069ee97d3dc6399ea2e48371b1f30952416723..6321145045fe2443206bcf67e2a8a035c11c2921 100644 (file)
--- a/services/api/app/models/link.rb
+++ b/services/api/app/models/link.rb
@@ -104,4 +104,15 @@ class Link < ArvadosModel
       super
     end
   end
+
+  # A user can give all other users permissions on folders.
+  def skip_uuid_read_permission_check
+    skipped_attrs = super
+    if link_class == "permission" and
+        (ArvadosModel.resource_class_for_uuid(head_uuid) == Group) and
+        (ArvadosModel.resource_class_for_uuid(tail_uuid) == User)
+      skipped_attrs << "tail_uuid"
+    end
+    skipped_attrs
+  end
 end

diff --git a/services/api/test/unit/link_test.rb b/services/api/test/unit/link_test.rb
index e40326504a1283bed77f6d571a14d18051bb2fd9..640b26c64d29fcf5a101e279045be0371225108a 100644 (file)
--- a/services/api/test/unit/link_test.rb
+++ b/services/api/test/unit/link_test.rb
@@ -61,4 +61,46 @@ class LinkTest < ActiveSupport::TestCase
       ob.destroy
     end
   end
+
+  def new_active_link_valid?(link_attrs)
+    set_user_from_auth :active
+    begin
+      Link.
+        create({link_class: "permission",
+                 name: "can_read",
+                 head_uuid: groups(:aproject).uuid,
+               }.merge(link_attrs)).
+        valid?
+    rescue ArvadosModel::PermissionDeniedError
+      false
+    end
+  end
+
+  test "link granting permission to nonexistent user is invalid" do
+    refute new_active_link_valid?(tail_uuid:
+                                  users(:active).uuid.sub(/-\w+$/, "-#{'z' * 15}"))
+  end
+
+  test "link granting non-project permission to unreadable user is invalid" do
+    refute new_active_link_valid?(tail_uuid: users(:admin).uuid,
+                                  head_uuid: collections(:bar_file).uuid)
+  end
+
+  test "user can't add a Collection to a Project without permission" do
+    refute new_active_link_valid?(link_class: "name",
+                                  name: "Permission denied test name",
+                                  tail_uuid: collections(:bar_file).uuid)
+  end
+
+  test "user can't add a User to a Project" do
+    # Users *can* give other users permissions to projects.
+    # This test helps ensure that that exception is specific to permissions.
+    refute new_active_link_valid?(link_class: "name",
+                                  name: "Permission denied test name",
+                                  tail_uuid: users(:admin).uuid)
+  end
+
+  test "link granting project permissions to unreadable user is valid" do
+    assert new_active_link_valid?(tail_uuid: users(:admin).uuid)
+  end
 end