[arvados] created: 2.1.0-2703-g3d9b93ddd

[git repository hosting]

        at  3d9b93ddd3839239b0b0aec112bed409a2c5b819 (commit)


commit 3d9b93ddd3839239b0b0aec112bed409a2c5b819
Author: Lucas Di Pentima <lucas.dipentima at curii.com>
Date:   Thu Jul 14 11:01:46 2022 -0300

    19139: Fixes bug by always setting owner_uuid to the system root user's UUID.
    
    Arvados-DCO-1.1-Signed-off-by: Lucas Di Pentima <lucas.dipentima at curii.com>

diff --git a/services/api/app/models/user.rb b/services/api/app/models/user.rb
index d39695e27..1662278cc 100644
--- a/services/api/app/models/user.rb
+++ b/services/api/app/models/user.rb
@@ -350,6 +350,11 @@ SELECT target_uuid, perm_level
     self.save!
   end
 
+  # Called from ArvadosModel
+  def set_default_owner
+    self.owner_uuid = system_user_uuid
+  end
+
   def must_unsetup_to_deactivate
     if !self.new_record? &&
        self.uuid[0..4] == Rails.configuration.Login.LoginCluster &&

commit a7cf8b19d9a2839f21225723899ff960a6547d88
Author: Lucas Di Pentima <lucas.dipentima at curii.com>
Date:   Thu Jul 14 10:59:41 2022 -0300

    19139: Adds tests related to user creation.
    
    * Confirms that non-admin users cannot create user records.
    * Exposes bug where user's owner_uuid fields were populated with the UUID of
      the creating admin user instead of using the system root user's UUID.
    
    Arvados-DCO-1.1-Signed-off-by: Lucas Di Pentima <lucas.dipentima at curii.com>

diff --git a/services/api/test/integration/users_test.rb b/services/api/test/integration/users_test.rb
index 3660d35ba..77e3c0815 100644
--- a/services/api/test/integration/users_test.rb
+++ b/services/api/test/integration/users_test.rb
@@ -493,4 +493,31 @@ class UsersTest < ActionDispatch::IntegrationTest
       headers: auth(:admin))
     assert_response 422
   end
+
+  test "creating users only accepted for admins" do
+    assert_false users(:active).is_admin
+    post '/arvados/v1/users',
+      params: {
+        "user" => {
+          "email" => 'foo at example.com',
+          "username" => "barney"
+        }
+      },
+      headers: auth(:active)
+    assert_response 403
+  end
+
+  test "create users assigns the system root user as their owner" do
+    post '/arvados/v1/users',
+      params: {
+        "user" => {
+          "email" => 'foo at example.com',
+          "username" => "barney"
+        }
+      },
+      headers: auth(:admin)
+    assert_response :success
+    assert_not_nil json_response["uuid"]
+    assert_equal users(:system_user).uuid, json_response["owner_uuid"]
+  end
 end

-----------------------------------------------------------------------


hooks/post-receive
--