From: Tom Clegg <tom@curii.com>
Date: Thu, 17 Mar 2022 18:20:07 +0000 (-0400)
Subject: 18691: Test that write permission is insufficient to unfreeze.
X-Git-Tag: 2.4.0~36^2~5
X-Git-Url: https://git.arvados.org/arvados.git/commitdiff_plain/0b547182f8d7225e4ebefb90eaf33b5136051e23

18691: Test that write permission is insufficient to unfreeze.

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>
---

diff --git a/services/api/test/unit/group_test.rb b/services/api/test/unit/group_test.rb
index 11c7da0905..1f1d379084 100644
--- a/services/api/test/unit/group_test.rb
+++ b/services/api/test/unit/group_test.rb
@@ -460,6 +460,16 @@ update links set tail_uuid='#{g5}' where uuid='#{l1.uuid}'
         end
       end
 
+      # User with write permission (but not manage) cannot unfreeze
+      act_as_user users(:spectator) do
+        # First confirm we have write permission on the parent project
+        assert Collection.create(name: 'bar', owner_uuid: parent.uuid)
+        assert_raises(ArvadosModel::PermissionDeniedError) do
+          proj.update_attributes!(frozen_by_uuid: nil)
+        end
+      end
+      proj.reload
+
       # User with manage permission can unfreeze, then create items
       # inside it and its children
       assert proj.update_attributes(frozen_by_uuid: nil)