<commit_before>(ns cmr.system-int-test.search.acls.collection-acl-search-test
  "Tests searching for collections with ACLs in place"
  (:require [clojure.test :refer :all]
            [clojure.string :as s]
            [cmr.common.services.messages :as msg]
            [cmr.system-int-test.utils.ingest-util :as ingest]
            [cmr.system-int-test.utils.search-util :as search]
            [cmr.system-int-test.utils.index-util :as index]
            [cmr.system-int-test.data2.collection :as dc]
            [cmr.system-int-test.data2.core :as d]
            [cmr.system-int-test.utils.echo-util :as e]))


(use-fixtures :each (ingest/reset-fixture {"provguid1" "PROV1" "provguid2" "PROV2"} false))

;; TODO add test for searching with an invalid security token.

(deftest collection-search-with-acls-test
  ;; Grant permissions before creating data
  ;; Grant guests permission to coll1
  (e/grant-guest (e/coll-catalog-item-id "provguid1" ["coll1"]))
  ;; restriction flag acl grants matches coll4
  (e/grant-guest (e/coll-catalog-item-id "provguid1" ["coll4"] {:min-value 4 :max-value 6}))
  ;; all collections in prov2 granted to guests
  (e/grant-guest (e/coll-catalog-item-id "provguid2"))
  ;; grant registered users permission to coll2 and coll4
  (e/grant-registered-users (e/coll-catalog-item-id "provguid1" ["coll2" "coll4"]))
  ;; grant specific group permission to coll3 and coll6
  (e/grant-group "group-guid1" (e/coll-catalog-item-id "provguid1" ["coll3"]))
  (e/grant-group "group-guid2" (e/coll-catalog-item-id "provguid2" ["coll6"]))


  (let [coll1 (d/ingest "PROV1" (dc/collection {:entry-title "coll1"}))
        coll2 (d/ingest "PROV1" (dc/collection {:entry-title "coll2"}))
        coll3 (d/ingest "PROV1" (dc/collection {:entry-title "coll3"}))
        coll4 (d/ingest "PROV1" (dc/collection {:entry-title "coll4"
                                                :access-value 5}))
        ;; no permission granted on coll5
        coll5 (d/ingest "PROV1" (dc/collection {:entry-title "coll5"}))

        ;; PROV2
        coll6 (d/ingest "PROV2" (dc/collection {:entry-title "coll6"}))
        coll7 (d/ingest "PROV2" (dc/collection {:entry-title "coll7"}))

        guest-token (e/login-guest)
        user1-token (e/login "user1")
        user2-token (e/login "user2" ["group-guid1"])
        user3-token (e/login "user3" ["group-guid1" "group-guid2"])]

    (index/refresh-elastic-index)

    (testing "parameter search acl enforcement"
     (are [token items]
             (d/refs-match? items (search/find-refs :collection (when token {:token token})))

             ;; not logged in should be guest
             nil [coll1 coll4 coll6 coll7]

             ;; login and use guest token
             guest-token [coll1 coll4 coll6 coll7]

             ;; test searching as a user
             user1-token [coll2 coll4]

             ;; Test searching with users in groups
             user2-token [coll2 coll4 coll3]
             user3-token [coll2 coll4 coll3 coll6]))
    (testing "token can be sent through a header"
      (is (d/refs-match? [coll2 coll4]
                         (search/find-refs :collection {} {:headers {"Echo-Token" user1-token}}))))
    (testing "aql search parameter enforcement"
      (is (d/refs-match? [coll2 coll4]
                         (search/find-refs-with-aql :collection [] {} {:headers {"Echo-Token" user1-token}}))))
    (testing "Retrieve collection metadata acl enforcement"
      ;; TODO test that we can retrieve the items directly and ACLs are enforced
      )
    (testing "Direct transformer retrieval acl enforcement"
      ;; TODO test that the transformer type queries will enforce ACLs
      ;; TODO ingest some diff collections above so we can test it with them
      )))


;; This tests that when acls change after collections have been indexed that collections will be
;; reindexed when ingest detects the acl hash has change.
(deftest acl-change-test
  (let [acl1 (e/grant-guest (e/coll-catalog-item-id "provguid1" ["coll1"]))
        acl2 (e/grant-guest (e/coll-catalog-item-id "provguid2" ["coll3"]))
        coll1 (d/ingest "PROV1" (dc/collection {:entry-title "coll1"}))
        coll2 (d/ingest "PROV1" (dc/collection {:entry-title "coll2"}))
        coll3 (d/ingest "PROV2" (dc/collection {:entry-title "coll3"}))<commit_msg>Added collection acl tests for direct transformer queries and DIF collections.<commit_after>(ns cmr.system-int-test.search.acls.collection-acl-search-test
  "Tests searching for collections with ACLs in place"
  (:require [clojure.test :refer :all]
            [clojure.string :as s]
            [cmr.common.services.messages :as msg]
            [cmr.system-int-test.utils.ingest-util :as ingest]
            [cmr.system-int-test.utils.search-util :as search]
            [cmr.system-int-test.utils.index-util :as index]
            [cmr.system-int-test.data2.collection :as dc]
            [cmr.system-int-test.data2.core :as d]
            [cmr.system-int-test.utils.echo-util :as e]))


(use-fixtures :each (ingest/reset-fixture {"provguid1" "PROV1" "provguid2" "PROV2"} false))

(comment
  (ingest/reset)
  (ingest/create-provider "PROV1")
  (ingest/create-provider "PROV2")
  (e/create-providers {"provguid1" "PROV1" "provguid2" "PROV2"})

)

;; TODO add caching of sids information from token

;; TODO add test for searching with an invalid security token.

(deftest collection-search-with-acls-test
  ;; Grant permissions before creating data
  ;; Grant guests permission to coll1
  (e/grant-guest (e/coll-catalog-item-id "provguid1" ["coll1"]))
  ;; restriction flag acl grants matches coll4
  (e/grant-guest (e/coll-catalog-item-id "provguid1" ["coll4"] {:min-value 4 :max-value 6}))
  ;; all collections in prov2 granted to guests
  (e/grant-guest (e/coll-catalog-item-id "provguid2"))
  ;; grant registered users permission to coll2 and coll4
  (e/grant-registered-users (e/coll-catalog-item-id "provguid1" ["coll2" "coll4"]))
  ;; grant specific group permission to coll3, coll6, and coll8
  (e/grant-group "group-guid1" (e/coll-catalog-item-id "provguid1" ["coll3"]))
  (e/grant-group "group-guid2" (e/coll-catalog-item-id "provguid2" ["coll6" "coll8"]))


  (let [coll1 (d/ingest "PROV1" (dc/collection {:entry-title "coll1"}))
        coll2 (d/ingest "PROV1" (dc/collection {:entry-title "coll2"}))
        coll3 (d/ingest "PROV1" (dc/collection {:entry-title "coll3"}))
        coll4 (d/ingest "PROV1" (dc/collection {:entry-title "coll4"
                                                :access-value 5}))
        ;; no permission granted on coll5
        coll5 (d/ingest "PROV1" (dc/collection {:entry-title "coll5"}))

        ;; PROV2
        coll6 (d/ingest "PROV2" (dc/collection {:entry-title "coll6"}))
        coll7 (d/ingest "PROV2" (dc/collection {:entry-title "coll7"}))
        ;; A dif collection
        coll8 (d/ingest "PROV2" (dc/collection {:entry-title "coll8"
                                                :entry-id "S8"
                                                :short-name "S8"
                                                :version-id "V8"
                                                :long-name "coll8"}) :dif)

        all-colls [coll1 coll2 coll3 coll4 coll5 coll6 coll7 coll8]
        guest-token (e/login-guest)
        user1-token (e/login "user1")
        user2-token (e/login "user2" ["group-guid1"])
        user3-token (e/login "user3" ["group-guid1" "group-guid2"])]

    (index/refresh-elastic-index)

    (testing "parameter search acl enforcement"
      (are [token items]
           (d/refs-match? items (search/find-refs :collection (when token {:token token})))

           ;; not logged in should be guest
           nil [coll1 coll4 coll6 coll7 coll8]

           ;; login and use guest token
           guest-token [coll1 coll4 coll6 coll7 coll8]

           ;; test searching as a user
           user1-token [coll2 coll4]

           ;; Test searching with users in groups
           user2-token [coll2 coll4 coll3]
           user3-token [coll2 coll4 coll3 coll6 coll8]))
    (testing "token can be sent through a header"
      (is (d/refs-match? [coll2 coll4]
                         (search/find-refs :collection {} {:headers {"Echo-Token" user1-token}}))))
    (testing "aql search parameter enforcement"
      (is (d/refs-match? [coll2 coll4]
                         (search/find-refs-with-aql :collection [] {} {:headers {"Echo-Token" user1-token}}))))
    (testing "Retrieve collection metadata acl enforcement"
      ;; TODO test that we can retrieve the items directly and ACLs are enforced
      )
    (testing "Direct transformer retrieval acl enforcement"
      (testing "registered user"
        (d/assert-metadata-results-match
          :echo10 [coll2 coll4]
          (search/find-metadata :collection :echo10 {:token user1-token
                                                     :concept-id (conj (map :concept-id all-colls)
                                                                       "C9999-PROV1")})))
      (testing "guest access"
        (d/assert-metadata-results-match
          :echo10 [coll1 coll4 coll6 coll7 coll8]
          (search/find-metadata :collection :echo10 {:token guest-token
                                                     :concept-id (map :concept-id all-colls)})))
      (testing "user in groups"
        (d/assert-metadata-results-match
          :echo10 [coll4 coll6 coll3 coll8 coll2]
          (search/find-metadata :collection :echo10 {:token user3-token
                                                     :concept-id (map :concept-id all-colls)}))))))


;; This tests that when acls change after collections have been indexed that collections will be
;; reindexed when ingest detects the acl hash has change.
(deftest acl-change-test
  (let [acl1 (e/grant-guest (e/coll-catalog-item-id "provguid1" ["coll1"]))
        acl2 (e/grant-guest (e/coll-catalog-item-id "provguid2" ["coll3"]))
        coll1 (d/ingest "PROV1" (dc/collection {:entry-title "coll1"}))
        coll2 (d/ingest "PROV1" (dc/collection {:entry-title "coll2"}))
        coll3 (d/ingest "PROV2" (dc/collection {:entry-title "coll3"}))
{'fraction_non_alphanumeric': 0.1315168207751328, 'fraction_numerical': 0.0258705488884517, 'mean_word_length': 2.406030150753769, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 21, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1463939', 'n_tokens_mistral': 3310, 'n_tokens_neox': 3148, 'n_words': 868}