f80dd8df-9068-4528-9db5-46316f3a9521

Committed 06 Feb 2025 03:36PM UTC coverage: 84.222% (+0.05%) from 84.171%

Build # f80dd8df-9068-4528-9db5-46316f3a9521

Build Type

Pull #1290

circleci

Committed by

carolyncole

Commit Message

Moving access check to a before filter
getting tests to pass

Pull Request Pull Request #1290: Only allow projects access to users that are specified as part of the project

Run Details

4 of 4 branches covered (100.0%)

14 of 14 new or added lines in 2 files covered. (100.0%)

14 existing lines in 1 file now uncovered.

2354 of 2795 relevant lines covered (84.22%)

390.37 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

82.76

/app/controllers/projects_controller.rb

# frozen_string_literal: true
class ProjectsController < ApplicationController

  before_action :set_breadcrumbs

  def new
    add_breadcrumb("New Project Request")
    return build_new_project if current_user.eligible_sponsor?

    redirect_to root_path
  end

  def project_params
    params.dup
  end

  def create
    metadata_params = params.dup
    metadata_params[:status] = Project::PENDING_STATUS
    metadata_params[:created_by] = current_user.uid
    metadata_params[:created_on] = Time.current.in_time_zone("America/New_York").iso8601
    project_metadata = ProjectMetadata.new_from_params(metadata_params)

    build_new_project # calling private method to build a new project and set a class variable @project
    project.create!(initial_metadata: project_metadata, user: current_user)
    if project.metadata_model.project_id != nil
      begin
        mailer = TigerdataMailer.with(project_id: project.id)
        message_delivery = mailer.project_creation
        message_delivery.deliver_later

        redirect_to project_confirmation_path(project)
      rescue StandardError => mailer_error
        raise(TigerData::MailerError, mailer_error)
      end
    else
      render :new
    end
  rescue TigerData::MailerError => mailer_error
    logger_message = "Error encountered creating the project #{project.id} as user #{current_user.email}"
    Rails.logger.error(logger_message)
    honeybadger_context = {
      current_user_email: current_user.email,
      project_id: project.id,
      project_metadata: project.metadata
    }
    Honeybadger.notify(mailer_error, context: honeybadger_context)

    error_message = "We are sorry, while the project was successfully created, an error was encountered which prevents the delivery of an e-mail message confirming this. Please know that this error has been logged, and shall be reviewed by members of RDSS."
    flash[:notice] = error_message

    render :new
  rescue StandardError => error
    logger_message = if project.persisted?
                      "Error encountered creating the project #{project.id} as user #{current_user.email}"
                     else
                      "Error encountered creating the project #{metadata_params[:title]} as user #{current_user.email}"
                     end
    Rails.logger.error(logger_message)
    honeybadger_context = {
      current_user_email: current_user.email,
      project_id: project.id,
      project_metadata: project.metadata
    }
    Honeybadger.notify(error, context: honeybadger_context)

    error_message = "We are sorry, the project was not successfully created, and an error was encountered which prevents the delivery of an e-mail message confirming this. Please know that this error has been logged, and shall be reviewed by members of RDSS promptly."

    flash[:notice] = error_message
    render :new
  end

  def details
    return if project.blank?

    add_breadcrumb(project.title, project_path)
    add_breadcrumb("Details")

    @departments = project.departments.join(", ")
    @project_metadata = project.metadata_model

    @data_sponsor = User.find_by(uid: @project_metadata.data_sponsor)
    @data_manager = User.find_by(uid: @project_metadata.data_manager)

    read_only_uids = @project_metadata.ro_users
    data_read_only_users = read_only_uids.map { |uid| ReadOnlyUser.find_by(uid:) }.reject(&:blank?)

    read_write_uids = @project_metadata.rw_users
    data_read_write_users = read_write_uids.map { |uid| User.find_by(uid:) }.reject(&:blank?)

    unsorted_data_users = data_read_only_users + data_read_write_users
    sorted_data_users = unsorted_data_users.sort_by { |u| u.family_name || u.uid }
    @data_users = sorted_data_users.uniq { |u| u.uid }
    user_model_names = @data_users.map(&:display_name_safe)
    @data_user_names = user_model_names.join(", ")

    @provenance_events = project.provenance_events.where.not(event_type: ProvenanceEvent::STATUS_UPDATE_EVENT_TYPE)

    @project_eligible_to_edit = true if project.status == Project::APPROVED_STATUS && eligible_editor?

    @project_metadata = @project.metadata
    @project_id = @project_metadata[:project_id] || {}
    @storage_capacity = @project_metadata[:storage_capacity]
    @size = @storage_capacity[:size]
    @unit = @storage_capacity[:unit]

    @requested_size = @size[:requested]
    @requested_unit = @unit[:requested]

    @approved_size = @size[:approved]
    @approved_unit = @unit[:approved]

    @storage_expectations = @project_metadata[:storage_performance_expectations]
    @requested_storage_expectations = @storage_expectations[:requested]
    @approved_storage_expectations = @storage_expectations[:approved]

    @project_purpose = @project_metadata[:project_purpose]


    @project_session = "details"


    respond_to do |format|
      format.html do
        @project = ProjectShowPresenter.new(project)
      end
      format.json do
        render json: project.to_json
      end
      format.xml do
        render xml: project.to_xml
      end
    end
  end

  def edit
    add_breadcrumb(project.title, project_path)
    add_breadcrumb("Edit")
    project
    if project.metadata_model.status != Project::APPROVED_STATUS
      flash[:notice] = "Pending projects can not be edited."
      redirect_to project
    elsif project.metadata_model.status == Project::APPROVED_STATUS && !eligible_editor? #check if the current user is a sponsor or a manager
      flash[:notice] = "Only data sponsors and data managers can revise this project."
      redirect_to project
    end
  end

  def update
    @project = Project.find(params[:id])
    #Approve action
    if params.key?("mediaflux_id")
      @project.metadata_model.update_with_params(params, current_user)
      @project.approve!(mediaflux_id: params["mediaflux_id"],current_user:)
    end

    #Edit action
    if params.key?("title")
      @project.metadata_model.status = @project.metadata_model.status || Project::PENDING_STATUS
      @project.metadata_model.update_with_params(params, current_user)
    end

    # @todo ProjectMetadata should be refactored to implement ProjectMetadata.valid?(updated_metadata)
    if project.save and params.key?("mediaflux_id")
      redirect_to project_approval_received_path(@project)
    elsif project.save and params.key?("title")
      redirect_to project_revision_confirmation_path(@project)
    else
      render :edit
    end
  end

  def index
    @projects = Project.all
  end

  def confirmation; end
  def revision_confirmation; end

  def show
    return if project.blank?

    add_breadcrumb(project.title, project_path)
    add_breadcrumb("Contents")

    @latest_completed_download = current_user.user_requests.where(project_id: @project.id, state: "completed").order(:completion_time).last
    @storage_usage = project.storage_usage(session_id: current_user.mediaflux_session)
    @storage_capacity = project.storage_capacity(session_id: current_user.mediaflux_session)

    @num_files = project.asset_count(session_id: current_user.mediaflux_session)

    @file_list = project.file_list(session_id: current_user.mediaflux_session, size: 100)
    @files = @file_list[:files]
    @files.sort_by!(&:path)
    @project = ProjectShowPresenter.new(project)

    @project_session = "content"
  end

  def project_job_service
    @project_job_service ||= ProjectJobService.new(project:)
  end

  def list_contents
    project_job_service.list_contents_job(user: current_user)

    json_response = {
      message: "File list for \"#{project.title}\" is being generated in the background. A link to the downloadable file list will be available in the \"Recent Activity\" section of your dashboard when it is available. You may safely navigate away from this page or close this tab."
    }
    render json: json_response
  rescue => ex
    message = "Error producing document list (project id: #{project&.id}): #{ex.message}"
    Rails.logger.error(message)
    Honeybadger.notify(message)
    render json: { message: "Document list could not be generated." }
  end

  def file_list_download
    job_id = params[:job_id]
    user_request = FileInventoryRequest.where(job_id:job_id).first
    if user_request.nil?
      # TODO: handle error
      redirect_to "/"
    else
      filename = user_request.output_file
      send_data File.read(filename), type: "text/plain", filename: "filelist.csv", disposition: "attachment"
    end
  end

  def approve
    if current_user.eligible_sysadmin?
      add_breadcrumb(project.title, project_path)
      add_breadcrumb("Approval Settings", project_approve_path)
      add_breadcrumb("Edit")
      project
      @departments = project.departments.join(", ")
      @project_metadata = project.metadata
      sponsor_uid = @project_metadata[:data_sponsor]
      @data_sponsor = User.find_by(uid: sponsor_uid)
      @provenance_events = project.provenance_events.where.not(event_type: ProvenanceEvent::STATUS_UPDATE_EVENT_TYPE)

      @title = @project_metadata["title"]
    else redirect_to root_path
    end
  end

  def create_script
    project_id = params[:id]
    project = Project.find(project_id)
    service = MediafluxScriptFactory.new(project: project)
    respond_to do |format|
      format.json { render json: {script: service.aterm_script} }
    end
  end

  private

    def build_new_project
      @project ||= Project.new
    end

    def project
      @project ||= begin
        project = Project.find(params[:id])
        if project.user_has_access?(user: current_user)
          project
        else
          flash[:alert] = "Access Denied"
          redirect_to root_path
          nil
        end
      end
    end

    def eligible_editor?
      return true if current_user.eligible_sponsor? or current_user.eligible_manager?
    end

    def shared_file_location(filename)
      raise "Shared location is not configured" if Rails.configuration.mediaflux["shared_files_location"].blank?
      location = Pathname.new(Rails.configuration.mediaflux["shared_files_location"])
      location.join(filename).to_s
    end

    def set_breadcrumbs
      add_breadcrumb("Dashboard","/")
    end
end

1	# frozen_string_literal: true
2	class ProjectsController < ApplicationController	1✔
3
4	before_action :set_breadcrumbs	1✔
5
6	def new	1✔
7	add_breadcrumb("New Project Request")	16✔
8	return build_new_project if current_user.eligible_sponsor?	16✔
9
10	redirect_to root_path	2✔
11	end
12
13	def project_params	1✔
14	params.dup	×
15	end
16
17	def create	1✔
18	metadata_params = params.dup	12✔
19	metadata_params[:status] = Project::PENDING_STATUS	12✔
20	metadata_params[:created_by] = current_user.uid	12✔
21	metadata_params[:created_on] = Time.current.in_time_zone("America/New_York").iso8601	12✔
22	project_metadata = ProjectMetadata.new_from_params(metadata_params)	12✔
23
24	build_new_project # calling private method to build a new project and set a class variable @project	12✔
25	project.create!(initial_metadata: project_metadata, user: current_user)	12✔
26	if project.metadata_model.project_id != nil	12✔
27	begin
28	mailer = TigerdataMailer.with(project_id: project.id)	12✔
29	message_delivery = mailer.project_creation	12✔
30	message_delivery.deliver_later	12✔
31
32	redirect_to project_confirmation_path(project)	11✔
33	rescue StandardError => mailer_error
34	raise(TigerData::MailerError, mailer_error)	2✔
35	end
36	else
37	render :new	×
38	end
39	rescue TigerData::MailerError => mailer_error
40	logger_message = "Error encountered creating the project #{project.id} as user #{current_user.email}"	2✔
41	Rails.logger.error(logger_message)	2✔
42	honeybadger_context = {
43	current_user_email: current_user.email,	2✔
44	project_id: project.id,
45	project_metadata: project.metadata
46	}
47	Honeybadger.notify(mailer_error, context: honeybadger_context)	2✔
48
49	error_message = "We are sorry, while the project was successfully created, an error was encountered which prevents the delivery of an e-mail message confirming this. Please know that this error has been logged, and shall be reviewed by members of RDSS."	2✔
50	flash[:notice] = error_message	2✔
51
52	render :new	2✔
53	rescue StandardError => error
54	logger_message = if project.persisted?	×
55	"Error encountered creating the project #{project.id} as user #{current_user.email}"	×
56	else
57	"Error encountered creating the project #{metadata_params[:title]} as user #{current_user.email}"	×
58	end
59	Rails.logger.error(logger_message)	×
60	honeybadger_context = {
61	current_user_email: current_user.email,	×
62	project_id: project.id,
63	project_metadata: project.metadata
64	}
65	Honeybadger.notify(error, context: honeybadger_context)	×
66
67	error_message = "We are sorry, the project was not successfully created, and an error was encountered which prevents the delivery of an e-mail message confirming this. Please know that this error has been logged, and shall be reviewed by members of RDSS promptly."	×
68
69	flash[:notice] = error_message	×
70	render :new	×
71	end
72
73	def details	1✔
74	return if project.blank?	33✔
75
76	add_breadcrumb(project.title, project_path)	32✔
77	add_breadcrumb("Details")	32✔
78
79	@departments = project.departments.join(", ")	32✔
80	@project_metadata = project.metadata_model	32✔
81
82	@data_sponsor = User.find_by(uid: @project_metadata.data_sponsor)	32✔
83	@data_manager = User.find_by(uid: @project_metadata.data_manager)	32✔
84
85	read_only_uids = @project_metadata.ro_users	32✔
86	data_read_only_users = read_only_uids.map { \|uid\| ReadOnlyUser.find_by(uid:) }.reject(&:blank?)	48✔
87
88	read_write_uids = @project_metadata.rw_users	32✔
89	data_read_write_users = read_write_uids.map { \|uid\| User.find_by(uid:) }.reject(&:blank?)	44✔
90
91	unsorted_data_users = data_read_only_users + data_read_write_users	32✔
92	sorted_data_users = unsorted_data_users.sort_by { \|u\| u.family_name \|\| u.uid }	60✔
93	@data_users = sorted_data_users.uniq { \|u\| u.uid }	52✔
94	user_model_names = @data_users.map(&:display_name_safe)	32✔
95	@data_user_names = user_model_names.join(", ")	32✔
96
97	@provenance_events = project.provenance_events.where.not(event_type: ProvenanceEvent::STATUS_UPDATE_EVENT_TYPE)	32✔
98
99	@project_eligible_to_edit = true if project.status == Project::APPROVED_STATUS && eligible_editor?	32✔
100
101	@project_metadata = @project.metadata	32✔
102	@project_id = @project_metadata[:project_id] \|\| {}	32✔
103	@storage_capacity = @project_metadata[:storage_capacity]	32✔
104	@size = @storage_capacity[:size]	32✔
105	@unit = @storage_capacity[:unit]	32✔
106
107	@requested_size = @size[:requested]	32✔
108	@requested_unit = @unit[:requested]	32✔
109
110	@approved_size = @size[:approved]	32✔
111	@approved_unit = @unit[:approved]	32✔
112
113	@storage_expectations = @project_metadata[:storage_performance_expectations]	32✔
114	@requested_storage_expectations = @storage_expectations[:requested]	32✔
115	@approved_storage_expectations = @storage_expectations[:approved]	32✔
116
117	@project_purpose = @project_metadata[:project_purpose]	32✔
118
119
120	@project_session = "details"	32✔
121
122
123	respond_to do \|format\|	32✔
124	format.html do	32✔
125	@project = ProjectShowPresenter.new(project)	29✔
126	end
127	format.json do	32✔
128	render json: project.to_json	2✔
129	end
130	format.xml do	32✔
131	render xml: project.to_xml	1✔
132	end
133	end
134	end
135
136	def edit	1✔
137	add_breadcrumb(project.title, project_path)	16✔
138	add_breadcrumb("Edit")	16✔
139	project	16✔
140	if project.metadata_model.status != Project::APPROVED_STATUS	16✔
141	flash[:notice] = "Pending projects can not be edited."	1✔
142	redirect_to project	1✔
143	elsif project.metadata_model.status == Project::APPROVED_STATUS && !eligible_editor? #check if the current user is a sponsor or a manager	15✔
144	flash[:notice] = "Only data sponsors and data managers can revise this project."	2✔
145	redirect_to project	2✔
146	end
147	end
148
149	def update	1✔
150	@project = Project.find(params[:id])	8✔
151	#Approve action
152	if params.key?("mediaflux_id")	8✔
153	@project.metadata_model.update_with_params(params, current_user)	2✔
154	@project.approve!(mediaflux_id: params["mediaflux_id"],current_user:)	2✔
155	end
156
157	#Edit action
158	if params.key?("title")	8✔
159	@project.metadata_model.status = @project.metadata_model.status \|\| Project::PENDING_STATUS	6✔
160	@project.metadata_model.update_with_params(params, current_user)	6✔
161	end
162
163	# @todo ProjectMetadata should be refactored to implement ProjectMetadata.valid?(updated_metadata)
164	if project.save and params.key?("mediaflux_id")	8✔
165	redirect_to project_approval_received_path(@project)	2✔
166	elsif project.save and params.key?("title")	6✔
167	redirect_to project_revision_confirmation_path(@project)	6✔
168	else
169	render :edit	×
170	end
171	end
172
173	def index	1✔
174	@projects = Project.all	2✔
175	end
176
177	def confirmation; end	1✔
178	def revision_confirmation; end	1✔
179
180	def show	1✔
181	return if project.blank?	32✔
182
183	add_breadcrumb(project.title, project_path)	31✔
184	add_breadcrumb("Contents")	31✔
185
186	@latest_completed_download = current_user.user_requests.where(project_id: @project.id, state: "completed").order(:completion_time).last	31✔
187	@storage_usage = project.storage_usage(session_id: current_user.mediaflux_session)	31✔
188	@storage_capacity = project.storage_capacity(session_id: current_user.mediaflux_session)	27✔
189
190	@num_files = project.asset_count(session_id: current_user.mediaflux_session)	27✔
191
192	@file_list = project.file_list(session_id: current_user.mediaflux_session, size: 100)	27✔
193	@files = @file_list[:files]	27✔
194	@files.sort_by!(&:path)	27✔
195	@project = ProjectShowPresenter.new(project)	27✔
196
197	@project_session = "content"	27✔
198	end
199
200	def project_job_service	1✔
201	@project_job_service \|\|= ProjectJobService.new(project:)	1✔
202	end
203
204	def list_contents	1✔
205	project_job_service.list_contents_job(user: current_user)	1✔
206
207	json_response = {
208	message: "File list for \"#{project.title}\" is being generated in the background. A link to the downloadable file list will be available in the \"Recent Activity\" section of your dashboard when it is available. You may safely navigate away from this page or close this tab."	1✔
209	}
210	render json: json_response	1✔
211	rescue => ex
UNCOV 212	message = "Error producing document list (project id: #{project&.id}): #{ex.message}"	×
UNCOV 213	Rails.logger.error(message)	×
UNCOV 214	Honeybadger.notify(message)	×
UNCOV 215	render json: { message: "Document list could not be generated." }	×
216	end
217
218	def file_list_download	1✔
219	job_id = params[:job_id]	×
220	user_request = FileInventoryRequest.where(job_id:job_id).first	×
221	if user_request.nil?	×
222	# TODO: handle error
UNCOV 223	redirect_to "/"	×
224	else
UNCOV 225	filename = user_request.output_file	×
226	send_data File.read(filename), type: "text/plain", filename: "filelist.csv", disposition: "attachment"	×
227	end
228	end
229
230	def approve	1✔
231	if current_user.eligible_sysadmin?	7✔
232	add_breadcrumb(project.title, project_path)	4✔
233	add_breadcrumb("Approval Settings", project_approve_path)	4✔
234	add_breadcrumb("Edit")	4✔
235	project	4✔
236	@departments = project.departments.join(", ")	4✔
237	@project_metadata = project.metadata	4✔
238	sponsor_uid = @project_metadata[:data_sponsor]	4✔
239	@data_sponsor = User.find_by(uid: sponsor_uid)	4✔
240	@provenance_events = project.provenance_events.where.not(event_type: ProvenanceEvent::STATUS_UPDATE_EVENT_TYPE)	4✔
241
242	@title = @project_metadata["title"]	4✔
243	else redirect_to root_path	3✔
244	end
245	end
246
247	def create_script	1✔
UNCOV 248	project_id = params[:id]	×
UNCOV 249	project = Project.find(project_id)	×
UNCOV 250	service = MediafluxScriptFactory.new(project: project)	×
UNCOV 251	respond_to do \|format\|	×
UNCOV 252	format.json { render json: {script: service.aterm_script} }	×
253	end
254	end
255
256	private	1✔
257
258	def build_new_project	1✔
259	@project \|\|= Project.new	26✔
260	end
261
262	def project	1✔
263	@project \|\|= begin	582✔
264	project = Project.find(params[:id])	84✔
265	if project.user_has_access?(user: current_user)	84✔
266	project	82✔
267	else
268	flash[:alert] = "Access Denied"	2✔
269	redirect_to root_path	2✔
270	nil	2✔
271	end
272	end
273	end
274
275	def eligible_editor?	1✔
276	return true if current_user.eligible_sponsor? or current_user.eligible_manager?	22✔
277	end
278
279	def shared_file_location(filename)	1✔
UNCOV 280	raise "Shared location is not configured" if Rails.configuration.mediaflux["shared_files_location"].blank?	×
UNCOV 281	location = Pathname.new(Rails.configuration.mediaflux["shared_files_location"])	×
UNCOV 282	location.join(filename).to_s	×
283	end
284
285	def set_breadcrumbs	1✔
286	add_breadcrumb("Dashboard","/")	140✔
287	end
288	end

pulibrary / tigerdata-app / f80dd8df-9068-4528-9db5-46316f3a9521

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous