5160: Workbench hides anonymous sharing when browsing disabled.

This commit updates Workbench to filter out the anonymous group from
the group sharing modal when anonymous browsing is disabled.  That
helps avoid situations where users think their work is publicly
sharable, but that's been disabled by the administrator.

diff --git a/apps/workbench/app/views/application/_show_sharing.html.erb b/apps/workbench/app/views/application/_show_sharing.html.erb
index 23795d3f04a3a56ec99f30be5d4e438fb7d33875..4b7beb30592832261722e32be0dca21af35044ca 100644 (file)
--- a/apps/workbench/app/views/application/_show_sharing.html.erb
+++ b/apps/workbench/app/views/application/_show_sharing.html.erb
@@ -22,6 +22,15 @@
    choose_filters = {
      "groups" => [["group_class", "=", "role"]],
    }
+   if not Rails.configuration.anonymous_user_token
+     # It would be ideal to filter out the anonymous group by UUID,
+     # but that's not readily doable.  Workbench can't generate the
+     # UUID for a != filter, because it can't introspect the API
+     # server's UUID prefix.  And we can't say "uuid not like
+     # %-anonymouspublic", because the API server doesn't support a
+     # "not like" filter.
+     choose_filters["groups"] << ["name", "!=", "Anonymous users"]
+   end
    choose_filters.default = []
    owner_icon = fa_icon_class_for_uuid(@object.owner_uuid)
    if owner_icon == "fa-users"

diff --git a/apps/workbench/test/integration/projects_test.rb b/apps/workbench/test/integration/projects_test.rb
index 7f051f673f6f3d87cead8657f35e8d7732b09c34..73a23d6d35c9eae078be49028ed6f93cc89bb3b2 100644 (file)
--- a/apps/workbench/test/integration/projects_test.rb
+++ b/apps/workbench/test/integration/projects_test.rb
@@ -172,6 +172,34 @@ class ProjectsTest < ActionDispatch::IntegrationTest
            "Project 5678 should now be inside project 1234")
   end
 
+  def open_groups_sharing(project_name="aproject", token_name="active")
+    project = api_fixture("groups", project_name)
+    visit(page_with_token(token_name, "/projects/#{project['uuid']}"))
+    click_on "Sharing"
+    click_on "Share with groups"
+  end
+
+  def group_name(group_key)
+    api_fixture("groups", group_key, "name")
+  end
+
+  test "projects not publicly sharable when anonymous browsing disabled" do
+    Rails.configuration.anonymous_user_token = false
+    open_groups_sharing
+    # Check for a group we do expect first, to make sure the modal's loaded.
+    assert_selector(".modal-container .selectable",
+                    text: group_name("all_users"))
+    assert_no_selector(".modal-container .selectable",
+                       text: group_name("anonymous_group"))
+  end
+
+  test "projects publicly sharable when anonymous browsing enabled" do
+    Rails.configuration.anonymous_user_token = "testonlytoken"
+    open_groups_sharing
+    assert_selector(".modal-container .selectable",
+                    text: group_name("anonymous_group"))
+  end
+
   test "project viewer can't see project sharing tab" do
     show_object_using('project_viewer', 'groups', 'aproject', 'A Project')
     assert(page.has_no_link?("Sharing"),