api2_tests.py 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788
  1. #!/usr/bin/env python
  2. # -*- coding: utf-8 -*-
  3. # Licensed to Cloudera, Inc. under one
  4. # or more contributor license agreements. See the NOTICE file
  5. # distributed with this work for additional information
  6. # regarding copyright ownership. Cloudera, Inc. licenses this file
  7. # to you under the Apache License, Version 2.0 (the
  8. # "License"); you may not use this file except in compliance
  9. # with the License. You may obtain a copy of the License at
  10. #
  11. # http://www.apache.org/licenses/LICENSE-2.0
  12. #
  13. # Unless required by applicable law or agreed to in writing, software
  14. # distributed under the License is distributed on an "AS IS" BASIS,
  15. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. # See the License for the specific language governing permissions and
  17. # limitations under the License.
  18. from builtins import object
  19. import json
  20. import re
  21. from nose.tools import assert_true, assert_false, assert_equal, assert_not_equal, assert_raises
  22. from beeswax.conf import HIVE_SERVER_HOST
  23. from useradmin.models import get_default_user_group, User
  24. from desktop.conf import ENABLE_GIST_PREVIEW
  25. from desktop.lib.django_test_util import make_logged_in_client
  26. from desktop.models import Document2, Directory
  27. class TestApi2(object):
  28. def setUp(self):
  29. self.client = make_logged_in_client(username="api2_user", groupname="default", recreate=True, is_superuser=False)
  30. self.user = User.objects.get(username="api2_user")
  31. def test_search_entities_interactive_xss(self):
  32. query = Document2.objects.create(
  33. name='<script>alert(5)</script>',
  34. description='<script>alert(5)</script>',
  35. type='query-hive',
  36. owner=self.user
  37. )
  38. try:
  39. response = self.client.post('/desktop/api/search/entities_interactive/', data={
  40. 'sources': json.dumps(['documents']),
  41. 'query_s': json.dumps('alert')
  42. })
  43. results = json.loads(response.content)['results']
  44. assert_true(results)
  45. result_json = json.dumps(results)
  46. assert_false(re.match('<(?!em)', result_json), result_json)
  47. assert_false(re.match('(?!em)>', result_json), result_json)
  48. assert_false('<script>' in result_json, result_json)
  49. assert_false('</script>' in result_json, result_json)
  50. assert_true('&lt;' in result_json, result_json)
  51. assert_true('&gt;' in result_json, result_json)
  52. finally:
  53. query.delete()
  54. def test_get_hue_config(self):
  55. client = make_logged_in_client(username="api2_superuser", groupname="default", recreate=True, is_superuser=True)
  56. user = User.objects.get(username="api2_superuser")
  57. response = client.get('/desktop/api2/get_hue_config', data={})
  58. # It should have multiple config sections in json
  59. config = json.loads(response.content)['config']
  60. assert_true(len(config) > 1)
  61. # It should only allow superusers
  62. client_not_me = make_logged_in_client(username='not_me', is_superuser=False, groupname='test')
  63. response = client_not_me.get('/desktop/api2/get_hue_config', data={})
  64. assert_true(b"You must be a superuser" in response.content, response.content)
  65. # It should contain a config parameter
  66. CANARY = b"abracadabra"
  67. clear = HIVE_SERVER_HOST.set_for_testing(CANARY)
  68. try:
  69. response = client.get('/desktop/api2/get_hue_config', data={})
  70. assert_true(CANARY in response.content, response.content)
  71. finally:
  72. clear()
  73. def test_get_hue_config_private(self):
  74. client = make_logged_in_client(username="api2_superuser", groupname="default", recreate=True, is_superuser=True)
  75. user = User.objects.get(username="api2_superuser")
  76. # Not showing private if not asked for
  77. response = client.get('/desktop/api2/get_hue_config', data={})
  78. assert_false(b'bind_password' in response.content)
  79. # Masking passwords if private
  80. private_response = client.get('/desktop/api2/get_hue_config', data={'private': True})
  81. assert_true(b'bind_password' in private_response.content)
  82. config_json = json.loads(private_response.content)
  83. desktop_config = [conf for conf in config_json['config'] if conf['key'] == 'desktop']
  84. ldap_desktop_config = [val for conf in desktop_config for val in conf['values'] if val['key'] == 'ldap']
  85. assert_true( # Note: level 1 might not be hidden, e.g. secret_key_script
  86. any(
  87. val['value'] == '**********'
  88. for conf in ldap_desktop_config for val in conf['values'] if val['key'] == 'bind_password'
  89. ),
  90. ldap_desktop_config
  91. )
  92. # There should be more private than non-private
  93. assert_true(len(response.content) < len(private_response.content))
  94. def test_get_config(self):
  95. response = self.client.get('/desktop/api2/get_config')
  96. assert_equal(200, response.status_code)
  97. config = json.loads(response.content)
  98. assert_true('types' in config['documents'])
  99. assert_false('query-TestApi2.test_get_config' in config['documents']['types'], config)
  100. doc = Document2.objects.create(
  101. name='Query xxx',
  102. type='query-TestApi2.test_get_config',
  103. owner=self.user
  104. )
  105. doc2 = Document2.objects.create(
  106. name='Query xxx 2',
  107. type='query-TestApi2.test_get_config',
  108. owner=self.user
  109. )
  110. try:
  111. response = self.client.get('/desktop/api2/get_config')
  112. assert_equal(200, response.status_code)
  113. config = json.loads(response.content)
  114. assert_true('query-TestApi2.test_get_config' in config['documents']['types'], config)
  115. assert_equal(1, len([t for t in config['documents']['types'] if t == 'query-TestApi2.test_get_config']))
  116. finally:
  117. doc.delete()
  118. class TestDocumentApiSharingPermissions(object):
  119. def setUp(self):
  120. self.client = make_logged_in_client(username="perm_user", groupname="default", recreate=True, is_superuser=False)
  121. self.client_not_me = make_logged_in_client(username="not_perm_user", groupname="default", recreate=True, is_superuser=False)
  122. self.user = User.objects.get(username="perm_user")
  123. self.user_not_me = User.objects.get(username="not_perm_user")
  124. def _add_doc(self, name):
  125. return Document2.objects.create(
  126. name=name,
  127. type='query-hive',
  128. owner=self.user
  129. )
  130. def share_doc(self, doc, permissions, client=None):
  131. if client is None:
  132. client = self.client
  133. return client.post("/desktop/api2/doc/share", {
  134. 'uuid': json.dumps(doc.uuid),
  135. 'data': json.dumps(permissions)
  136. })
  137. def share_link_doc(self, doc, perm, client=None):
  138. if client is None:
  139. client = self.client
  140. return client.post("/desktop/api2/doc/share/link", {
  141. 'uuid': json.dumps(doc.uuid),
  142. 'perm': json.dumps(perm)
  143. })
  144. def test_update_permissions(self):
  145. doc = self._add_doc('test_update_permissions')
  146. response = self.share_doc(
  147. doc,
  148. {
  149. 'read': {
  150. 'user_ids': [self.user_not_me.id],
  151. 'group_ids': []
  152. }
  153. }
  154. )
  155. assert_equal(0, json.loads(response.content)['status'], response.content)
  156. def test_share_document_permissions(self):
  157. # No doc
  158. response = self.client.get('/desktop/api2/docs/')
  159. assert_false(json.loads(response.content)['documents'])
  160. response = self.client_not_me.get('/desktop/api2/docs/')
  161. assert_false(json.loads(response.content)['documents'])
  162. # Add doc
  163. doc = self._add_doc('test_update_permissions')
  164. doc_id = '%s' % doc.id
  165. response = self.client.get('/desktop/api2/docs/')
  166. assert_true(json.loads(response.content)['documents'])
  167. response = self.client_not_me.get('/desktop/api2/docs/')
  168. assert_false(json.loads(response.content)['documents'])
  169. assert_true(doc.can_read(self.user))
  170. assert_true(doc.can_write(self.user))
  171. assert_false(doc.can_read(self.user_not_me))
  172. assert_false(doc.can_write(self.user_not_me))
  173. # Share by user
  174. response = self.share_doc(doc, {
  175. 'read': {
  176. 'user_ids': [
  177. self.user_not_me.id
  178. ],
  179. 'group_ids': []
  180. },
  181. 'write': {
  182. 'user_ids': [],
  183. 'group_ids': []
  184. }
  185. }
  186. )
  187. assert_equal(0, json.loads(response.content)['status'], response.content)
  188. assert_true(doc.can_read(self.user))
  189. assert_true(doc.can_write(self.user))
  190. assert_true(doc.can_read(self.user_not_me))
  191. assert_false(doc.can_write(self.user_not_me))
  192. response = self.client.get('/desktop/api2/docs/')
  193. assert_true(json.loads(response.content)['documents'])
  194. response = self.client_not_me.get('/desktop/api2/docs/')
  195. assert_true(json.loads(response.content)['documents'])
  196. # Un-share
  197. response = self.share_doc(doc, {
  198. 'read': {
  199. 'user_ids': [
  200. ],
  201. 'group_ids': []
  202. },
  203. 'write': {
  204. 'user_ids': [],
  205. 'group_ids': []
  206. }
  207. }
  208. )
  209. assert_equal(0, json.loads(response.content)['status'], response.content)
  210. assert_true(doc.can_read(self.user))
  211. assert_true(doc.can_write(self.user))
  212. assert_false(doc.can_read(self.user_not_me))
  213. assert_false(doc.can_write(self.user_not_me))
  214. response = self.client.get('/desktop/api2/docs/')
  215. assert_true(json.loads(response.content)['documents'])
  216. response = self.client_not_me.get('/desktop/api2/docs/')
  217. assert_false(json.loads(response.content)['documents'])
  218. # Share by group
  219. default_group = get_default_user_group()
  220. response = self.share_doc(doc, {
  221. 'read': {
  222. 'user_ids': [
  223. ],
  224. 'group_ids': []
  225. },
  226. 'write': {
  227. 'user_ids': [],
  228. 'group_ids': [default_group.id]
  229. }
  230. }
  231. )
  232. assert_equal(0, json.loads(response.content)['status'], response.content)
  233. assert_true(doc.can_read(self.user))
  234. assert_true(doc.can_write(self.user))
  235. assert_true(doc.can_read(self.user_not_me))
  236. assert_true(doc.can_write(self.user_not_me))
  237. response = self.client.get('/desktop/api2/docs/')
  238. assert_true(json.loads(response.content)['documents'])
  239. response = self.client_not_me.get('/desktop/api2/docs/')
  240. assert_true(json.loads(response.content)['documents'])
  241. # Un-share
  242. response = self.share_doc(doc, {
  243. 'read': {
  244. 'user_ids': [
  245. ],
  246. 'group_ids': []
  247. },
  248. 'write': {
  249. 'user_ids': [],
  250. 'group_ids': []
  251. }
  252. }
  253. )
  254. assert_equal(0, json.loads(response.content)['status'], response.content)
  255. assert_true(doc.can_read(self.user))
  256. assert_true(doc.can_write(self.user))
  257. assert_false(doc.can_read(self.user_not_me))
  258. assert_false(doc.can_write(self.user_not_me))
  259. response = self.client.get('/desktop/api2/docs/')
  260. assert_true(json.loads(response.content)['documents'])
  261. response = self.client_not_me.get('/desktop/api2/docs/')
  262. assert_false(json.loads(response.content)['documents'])
  263. # Modify by other user
  264. response = self.share_doc(doc, {
  265. 'read': {
  266. 'user_ids': [
  267. ],
  268. 'group_ids': []
  269. },
  270. 'write': {
  271. 'user_ids': [self.user_not_me.id],
  272. 'group_ids': []
  273. }
  274. }
  275. )
  276. assert_equal(0, json.loads(response.content)['status'], response.content)
  277. assert_true(doc.can_read(self.user))
  278. assert_true(doc.can_write(self.user))
  279. assert_true(doc.can_read(self.user_not_me))
  280. assert_true(doc.can_write(self.user_not_me))
  281. response = self.client.get('/desktop/api2/docs/')
  282. assert_true(json.loads(response.content)['documents'])
  283. response = self.client_not_me.get('/desktop/api2/docs/')
  284. assert_true(json.loads(response.content)['documents'])
  285. # Un-share
  286. response = self.share_doc(doc, {
  287. 'read': {
  288. 'user_ids': [
  289. ],
  290. 'group_ids': []
  291. },
  292. 'write': {
  293. 'user_ids': [],
  294. 'group_ids': []
  295. }
  296. }
  297. )
  298. assert_equal(0, json.loads(response.content)['status'], response.content)
  299. assert_true(doc.can_read(self.user))
  300. assert_true(doc.can_write(self.user))
  301. assert_false(doc.can_read(self.user_not_me))
  302. assert_false(doc.can_write(self.user_not_me))
  303. response = self.client.get('/desktop/api2/docs/')
  304. assert_true(json.loads(response.content)['documents'])
  305. response = self.client_not_me.get('/desktop/api2/docs/')
  306. assert_false(json.loads(response.content)['documents'])
  307. # Modify by group
  308. response = self.share_doc(doc, {
  309. 'read': {
  310. 'user_ids': [
  311. ],
  312. 'group_ids': []
  313. },
  314. 'write': {
  315. 'user_ids': [],
  316. 'group_ids': [default_group.id]
  317. }
  318. }
  319. )
  320. assert_equal(0, json.loads(response.content)['status'], response.content)
  321. assert_true(doc.can_read(self.user))
  322. assert_true(doc.can_write(self.user))
  323. assert_true(doc.can_read(self.user_not_me))
  324. assert_true(doc.can_write(self.user_not_me))
  325. response = self.client.get('/desktop/api2/docs/')
  326. assert_true(json.loads(response.content)['documents'])
  327. response = self.client_not_me.get('/desktop/api2/docs/')
  328. assert_true(json.loads(response.content)['documents'])
  329. # Un-share
  330. response = self.share_doc(doc, {
  331. 'read': {
  332. 'user_ids': [
  333. ],
  334. 'group_ids': []
  335. },
  336. 'write': {
  337. 'user_ids': [],
  338. 'group_ids': []
  339. }
  340. }
  341. )
  342. assert_equal(0, json.loads(response.content)['status'], response.content)
  343. assert_true(doc.can_read(self.user))
  344. assert_true(doc.can_write(self.user))
  345. assert_false(doc.can_read(self.user_not_me))
  346. assert_false(doc.can_write(self.user_not_me))
  347. response = self.client.get('/desktop/api2/docs/')
  348. assert_true(json.loads(response.content)['documents'])
  349. response = self.client_not_me.get('/desktop/api2/docs/')
  350. assert_false(json.loads(response.content)['documents'])
  351. def test_update_permissions_cannot_escalate_privileges(self):
  352. doc = self._add_doc('test_update_permissions_cannot_escape_privileges')
  353. # Share read permissions
  354. response = self.share_doc(doc, {
  355. 'read': {
  356. 'user_ids': [
  357. self.user_not_me.id
  358. ],
  359. 'group_ids': []
  360. },
  361. 'write': {
  362. 'user_ids': [],
  363. 'group_ids': []
  364. }
  365. }
  366. )
  367. assert_equal(0, json.loads(response.content)['status'], response.content)
  368. assert_true(doc.can_read(self.user))
  369. assert_true(doc.can_write(self.user))
  370. assert_true(doc.can_read(self.user_not_me))
  371. assert_false(doc.can_write(self.user_not_me))
  372. # Try, and fail to escalate privileges.
  373. response = self.share_doc(doc, {
  374. 'read': {
  375. 'user_ids': [
  376. self.user_not_me.id
  377. ],
  378. 'group_ids': []
  379. },
  380. 'write': {
  381. 'user_ids': [
  382. self.user_not_me.id,
  383. ],
  384. 'group_ids': []
  385. }
  386. },
  387. self.client_not_me
  388. )
  389. content = json.loads(response.content)
  390. assert_equal(content['status'], -1)
  391. assert_true("Document does not exist or you don\'t have the permission to access it." in content['message'], content['message'])
  392. assert_true(doc.can_read(self.user))
  393. assert_true(doc.can_write(self.user))
  394. assert_true(doc.can_read(self.user_not_me))
  395. assert_false(doc.can_write(self.user_not_me))
  396. def test_link_sharing_permissions(self):
  397. # Add doc
  398. doc = self._add_doc('test_link_sharing_permissions')
  399. doc_id = '%s' % doc.id
  400. response = self.client.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  401. assert_true(json.loads(response.content)['documents'])
  402. response = self.client_not_me.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  403. assert_false(json.loads(response.content)['documents'])
  404. response = self.client.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  405. assert_equal(0, json.loads(response.content)['status'], response.content)
  406. response = self.client_not_me.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  407. assert_equal(-1, json.loads(response.content)['status'], response.content)
  408. assert_true(doc.can_read(self.user))
  409. assert_true(doc.can_write(self.user))
  410. assert_false(doc.can_read(self.user_not_me))
  411. assert_false(doc.can_write(self.user_not_me))
  412. # Share by read link
  413. response = self.share_link_doc(doc, perm='read')
  414. assert_equal(0, json.loads(response.content)['status'], response.content)
  415. assert_true(doc.can_read(self.user))
  416. assert_true(doc.can_write(self.user))
  417. assert_true(doc.can_read(self.user_not_me))
  418. assert_false(doc.can_write(self.user_not_me))
  419. response = self.client.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  420. assert_true(json.loads(response.content)['documents'])
  421. response = self.client_not_me.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  422. assert_false(json.loads(response.content)['documents']) # Link sharing does not list docs in Home, only provides direct access
  423. response = self.client.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  424. assert_equal(0, json.loads(response.content)['status'], response.content)
  425. response = self.client_not_me.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  426. assert_equal(0, json.loads(response.content)['status'], response.content)
  427. # Un-share
  428. response = self.share_link_doc(doc, perm='off')
  429. assert_equal(0, json.loads(response.content)['status'], response.content)
  430. assert_true(doc.can_read(self.user))
  431. assert_true(doc.can_write(self.user))
  432. assert_false(doc.can_read(self.user_not_me))
  433. assert_false(doc.can_write(self.user_not_me))
  434. response = self.client.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  435. assert_true(json.loads(response.content)['documents'])
  436. response = self.client_not_me.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  437. assert_false(json.loads(response.content)['documents'])
  438. response = self.client.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  439. assert_equal(0, json.loads(response.content)['status'], response.content)
  440. response = self.client_not_me.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  441. assert_equal(-1, json.loads(response.content)['status'], response.content)
  442. # Share by write link
  443. response = self.share_link_doc(doc, perm='write')
  444. assert_equal(0, json.loads(response.content)['status'], response.content)
  445. assert_true(doc.can_read(self.user))
  446. assert_true(doc.can_write(self.user))
  447. assert_true(doc.can_read(self.user_not_me))
  448. assert_true(doc.can_write(self.user_not_me))
  449. response = self.client.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  450. assert_true(json.loads(response.content)['documents'])
  451. response = self.client_not_me.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  452. assert_false(json.loads(response.content)['documents'])
  453. response = self.client.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  454. assert_equal(0, json.loads(response.content)['status'], response.content)
  455. response = self.client_not_me.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  456. assert_equal(0, json.loads(response.content)['status'], response.content)
  457. # Demote to read link
  458. response = self.share_link_doc(doc, perm='read')
  459. assert_equal(0, json.loads(response.content)['status'], response.content)
  460. assert_true(doc.can_read(self.user))
  461. assert_true(doc.can_write(self.user))
  462. assert_true(doc.can_read(self.user_not_me))
  463. assert_false(doc.can_write(self.user_not_me)) # Back to false
  464. response = self.client.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  465. assert_true(json.loads(response.content)['documents'])
  466. response = self.client_not_me.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  467. assert_false(json.loads(response.content)['documents']) # Link sharing does not list docs in Home, only provides direct access
  468. response = self.client.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  469. assert_equal(0, json.loads(response.content)['status'], response.content)
  470. response = self.client_not_me.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  471. assert_equal(0, json.loads(response.content)['status'], response.content)
  472. # Un-share
  473. response = self.share_link_doc(doc, perm='off')
  474. assert_equal(0, json.loads(response.content)['status'], response.content)
  475. assert_true(doc.can_read(self.user))
  476. assert_true(doc.can_write(self.user))
  477. assert_false(doc.can_read(self.user_not_me))
  478. assert_false(doc.can_write(self.user_not_me))
  479. response = self.client.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  480. assert_true(json.loads(response.content)['documents'])
  481. response = self.client_not_me.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
  482. assert_false(json.loads(response.content)['documents'])
  483. response = self.client.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  484. assert_equal(0, json.loads(response.content)['status'], response.content)
  485. response = self.client_not_me.get('/desktop/api2/doc/?uuid=%s' % doc_id)
  486. assert_equal(-1, json.loads(response.content)['status'], response.content)
  487. class TestDocumentGist(object):
  488. def setUp(self):
  489. self.client = make_logged_in_client(username="gist_user", groupname="default", recreate=True, is_superuser=False)
  490. self.client_not_me = make_logged_in_client(username="other_gist_user", groupname="default", recreate=True, is_superuser=False)
  491. self.user = User.objects.get(username="gist_user")
  492. self.user_not_me = User.objects.get(username="other_gist_user")
  493. def _create_gist(self, statement, doc_type, name='', description='', client=None):
  494. if client is None:
  495. client = self.client
  496. return client.post("/desktop/api2/gist/create", {
  497. 'statement': statement,
  498. 'doc_type': doc_type,
  499. 'name': name,
  500. 'description': description,
  501. },
  502. )
  503. def _get_gist(self, uuid, client=None, is_crawler_bot=False):
  504. if client is None:
  505. client = self.client
  506. if is_crawler_bot:
  507. headers = {'HTTP_USER_AGENT': 'Slackbot-LinkExpanding 1.0 (+https://api.slack.com/robots)'}
  508. else:
  509. headers = {}
  510. return client.get("/desktop/api2/gist/open", {
  511. 'uuid': uuid,
  512. },
  513. **headers
  514. )
  515. def test_create(self):
  516. assert_false(Document2.objects.filter(type='gist', name='test_gist_create'))
  517. response = self._create_gist(
  518. statement='SELECT 1',
  519. doc_type='hive-query',
  520. name='test_gist_create',
  521. )
  522. gist = json.loads(response.content)
  523. assert_true(Document2.objects.filter(type='gist', name='test_gist_create'))
  524. assert_true(Document2.objects.filter(type='gist', uuid=gist['uuid']))
  525. assert_equal(
  526. 'SELECT 1',
  527. json.loads(Document2.objects.get(type='gist', uuid=gist['uuid']).data)['statement_raw']
  528. )
  529. response2 = self._create_gist(
  530. statement='SELECT 2',
  531. doc_type='hive-query',
  532. name='test_gist_create2',
  533. )
  534. gist2 = json.loads(response2.content)
  535. assert_true(Document2.objects.filter(type='gist', name='test_gist_create2'))
  536. assert_true(Document2.objects.filter(type='gist', uuid=gist2['uuid']))
  537. assert_equal(
  538. 'SELECT 2',
  539. json.loads(Document2.objects.get(type='gist', uuid=gist2['uuid']).data)['statement_raw']
  540. )
  541. # Create multiple gist directories and then make a new gist
  542. home_dir = Directory.objects.get_home_directory(self.user)
  543. gist_dir2 = Directory.objects.create(name='Gist', owner=self.user, parent_directory=home_dir)
  544. assert_equal(2, Directory.objects.filter(name='Gist', type='directory').count())
  545. response3 = self._create_gist(
  546. statement='SELECT 3',
  547. doc_type='hive-query',
  548. name='test_gist_create3',
  549. )
  550. gist3 = json.loads(response3.content)
  551. # Gist directories merged into one
  552. assert_equal(1, Directory.objects.filter(name='Gist', type='directory').count())
  553. assert_true(Document2.objects.filter(type='gist', name='test_gist_create3'))
  554. assert_true(Document2.objects.filter(type='gist', uuid=gist3['uuid']))
  555. assert_equal(
  556. 'SELECT 3',
  557. json.loads(Document2.objects.get(type='gist', uuid=gist3['uuid']).data)['statement_raw']
  558. )
  559. def test_get(self):
  560. response = self._create_gist(
  561. statement='SELECT 1',
  562. doc_type='hive-query',
  563. name='test_gist_get',
  564. )
  565. gist = json.loads(response.content)
  566. response = self._get_gist(uuid=gist['uuid'])
  567. assert_equal(302, response.status_code)
  568. assert_equal('/hue/editor?gist=%(uuid)s&type=hive-query' % gist, response.url)
  569. response = self._get_gist(uuid=gist['uuid'], client=self.client_not_me)
  570. assert_equal(302, response.status_code)
  571. assert_equal('/hue/editor?gist=%(uuid)s&type=hive-query' % gist, response.url)
  572. def test_gist_directory_creation(self):
  573. home_dir = Directory.objects.get_home_directory(self.user)
  574. assert_false(home_dir.children.filter(name='Gist').exists())
  575. Document2.objects.get_gist_directory(self.user)
  576. assert_true(home_dir.children.filter(name='Gist').exists())
  577. def test_get_unfurl(self):
  578. # Unfurling on
  579. f = ENABLE_GIST_PREVIEW.set_for_testing(True)
  580. try:
  581. response = self._create_gist(
  582. statement='SELECT 1',
  583. doc_type='hive-query',
  584. name='test_gist_get',
  585. )
  586. gist = json.loads(response.content)
  587. response = self._get_gist(
  588. uuid=gist['uuid'],
  589. is_crawler_bot=True
  590. )
  591. assert_equal(200, response.status_code)
  592. assert_true(b'<meta name="twitter:card" content="summary">' in response.content, response.content)
  593. assert_true(b'<meta property="og:description" content="SELECT 1"/>' in response.content, response.content)
  594. finally:
  595. f()
  596. # Unfurling off
  597. f = ENABLE_GIST_PREVIEW.set_for_testing(False)
  598. try:
  599. response = self._get_gist(
  600. uuid=gist['uuid'],
  601. is_crawler_bot=True
  602. )
  603. assert_equal(302, response.status_code)
  604. assert_equal('/hue/editor?gist=%(uuid)s&type=hive-query' % gist, response.url)
  605. finally:
  606. f()