From 66fa80a47802b23a75b217e7e9a92e0bf6781b3e Mon Sep 17 00:00:00 2001
From: Ward Vandewege <ward@curii.com>
Date: Wed, 3 Mar 2021 16:04:54 -0500
Subject: [PATCH] 17119: add filter validation for filter groups. Add a test
 for the        'is_a' filter.

Arvados-DCO-1.1-Signed-off-by: Ward Vandewege <ward@curii.com>
---
 sdk/go/arvados/fs_project_test.go     |  9 +++++++
 sdk/go/arvados/fs_site_test.go        |  1 +
 services/api/app/models/group.rb      | 35 +++++++++++++++++++++++++++
 services/api/test/fixtures/groups.yml | 13 ++++++++++
 4 files changed, 58 insertions(+)

diff --git a/sdk/go/arvados/fs_project_test.go b/sdk/go/arvados/fs_project_test.go
index 9d77c31d85..0564e2fae6 100644
--- a/sdk/go/arvados/fs_project_test.go
+++ b/sdk/go/arvados/fs_project_test.go
@@ -64,6 +64,15 @@ func (s *SiteFSSuite) TestFilterGroup(c *check.C) {
 
 	_, err = s.fs.OpenFile("/fg2/A Project", 0, 0)
 	c.Assert(err, check.IsNil)
+
+	// An 'is_a' 'arvados#collection' filter means only collections should be returned.
+	s.fs.MountProject("fg3", fixtureAFilterGroupThreeUUID)
+
+	_, err = s.fs.OpenFile("/fg3/baz_file", 0, 0)
+	c.Assert(err, check.IsNil)
+
+	_, err = s.fs.OpenFile("/fg3/A Subproject", 0, 0)
+	c.Assert(err, check.Not(check.IsNil))
 }
 
 func (s *SiteFSSuite) TestCurrentUserHome(c *check.C) {
diff --git a/sdk/go/arvados/fs_site_test.go b/sdk/go/arvados/fs_site_test.go
index 02f21ded56..b1c627f89c 100644
--- a/sdk/go/arvados/fs_site_test.go
+++ b/sdk/go/arvados/fs_site_test.go
@@ -20,6 +20,7 @@ const (
 	fixtureAProjectUUID            = "zzzzz-j7d0g-v955i6s2oi1cbso"
 	fixtureThisFilterGroupUUID     = "zzzzz-j7d0g-thisfiltergroup"
 	fixtureAFilterGroupTwoUUID     = "zzzzz-j7d0g-afiltergrouptwo"
+	fixtureAFilterGroupThreeUUID   = "zzzzz-j7d0g-filtergroupthre"
 	fixtureFooAndBarFilesInDirUUID = "zzzzz-4zz18-foonbarfilesdir"
 	fixtureFooCollectionName       = "zzzzz-4zz18-fy296fx3hot09f7 added sometime"
 	fixtureFooCollectionPDH        = "1f4b0bc7583c2a7f9102c395f4ffc5e3+45"
diff --git a/services/api/app/models/group.rb b/services/api/app/models/group.rb
index 870e0d0c45..1bf2cf5d5d 100644
--- a/services/api/app/models/group.rb
+++ b/services/api/app/models/group.rb
@@ -18,6 +18,7 @@ class Group < ArvadosModel
 
   validate :ensure_filesystem_compatible_name
   validate :check_group_class
+  validate :check_filter_group_filters
   before_create :assign_name
   after_create :after_ownership_change
   after_create :update_trash
@@ -56,6 +57,40 @@ class Group < ArvadosModel
     end
   end
 
+  def check_filter_group_filters
+    if group_class == 'filter'
+      if !self.properties.key?("filters")
+        return
+      end
+      if !self.properties["filters"].is_a?(Array)
+        errors.add :properties, "filters property must be an array of arrays, each with 3 elements"
+        return
+      end
+      self.properties["filters"].each do |filter|
+        if !filter.is_a?(Array)
+          errors.add :properties, "filters property must be an array of arrays, each with 3 elements"
+          return
+        end
+        if filter.length() != 3
+          errors.add :properties, "filters property must be an array of arrays, each with 3 elements"
+          return
+        end
+        if !filter[0].include?(".") and filter[0].downcase != "uuid"
+          errors.add :properties, "filter attribute must be 'uuid' or contain a dot (e.g. groups.name)"
+          return
+        end
+        if (filter[0].downcase != "uuid" and filter[1].downcase == "is_a")
+          errors.add :properties, "when filter operator is 'is_a', attribute must be 'uuid'"
+          return
+        end
+        if ! ["=","<","<=",">",">=","!=","like","ilike","in","not in","is_a","exists"].include?(filter[1].downcase)
+          errors.add :properties, "filter operator is not valid (must be =,<,<=,>,>=,!=,like,ilike,in,not in,is_a,exists)"
+          return
+        end
+      end
+    end
+  end
+
   def update_trash
     if saved_change_to_trash_at? or saved_change_to_owner_uuid?
       # The group was added or removed from the trash.
diff --git a/services/api/test/fixtures/groups.yml b/services/api/test/fixtures/groups.yml
index da20f8be9e..48925a2702 100644
--- a/services/api/test/fixtures/groups.yml
+++ b/services/api/test/fixtures/groups.yml
@@ -133,6 +133,19 @@ afiltergroup2:
   properties:
     filters: []
 
+afiltergroup3:
+  uuid: zzzzz-j7d0g-filtergroupthre
+  owner_uuid: zzzzz-tpzed-xurymjxw79nv3jz
+  created_at: 2014-04-21 15:37:48 -0400
+  modified_by_client_uuid: zzzzz-ozdt8-brczlopd8u8d0jr
+  modified_by_user_uuid: zzzzz-tpzed-xurymjxw79nv3jz
+  modified_at: 2014-04-21 15:37:48 -0400
+  updated_at: 2014-04-21 15:37:48 -0400
+  name: A filter group with an is_a collection filter
+  group_class: filter
+  properties:
+    filters: [["uuid", "is_a", "arvados#collection"]]
+
 future_project_viewing_group:
   uuid: zzzzz-j7d0g-futrprojviewgrp
   owner_uuid: zzzzz-tpzed-000000000000000
-- 
2.30.2