From f88e99ecc37e38db52ae96cbebce28c5e3f6b65f Mon Sep 17 00:00:00 2001 From: Kevin De Pelseneer Date: Wed, 26 Jun 2024 09:35:43 +0200 Subject: [PATCH 1/7] Add function to propagate the assay stream's permission to the child assays. --- app/controllers/assays_controller.rb | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/app/controllers/assays_controller.rb b/app/controllers/assays_controller.rb index 4aa210b8b5..e2ae7d747a 100644 --- a/app/controllers/assays_controller.rb +++ b/app/controllers/assays_controller.rb @@ -19,6 +19,8 @@ class AssaysController < ApplicationController # => Rearrange positions after_action :rearrange_assay_positions_at_destroy, only: :destroy + before_action :propagate_permissions_to_children, only: :manage_update + include Seek::Publishing::PublishingCommon include Seek::IsaGraphExtensions @@ -160,6 +162,26 @@ def show private + def propagate_permissions_to_children + return unless params[:propagate_permissions] + + # flash[:error] = 'You do not have the necessary permissions to propagate permissions to children' + + errors = [] + @assay.child_assays.map do |assay| + unless assay.can_manage? + msg = "
  • You do not have the necessary permissions to propagate permissions to #{t('assay').downcase} [#{assay.id}]: '#{assay.title}'
    • " + errors.append(msg) + next + end + + assay.update(assay_params) + update_sharing_policies assay + end + # Add an error message to the flash + flash[:error] = "".html_safe unless errors.empty? + end + def delete_linked_sample_types return unless @assay.is_isa_json_compliant? return if @assay.sample_type.nil? @@ -191,8 +213,7 @@ def assay_params { placeholders_attributes: %i[asset_id direction relationship_type_id] }, { publication_ids: [] }, { extended_metadata_attributes: determine_extended_metadata_keys }, - { discussion_links_attributes:[:id, :url, :label, :_destroy] } - ).tap do |assay_params| + { discussion_links_attributes: %i[id url label _destroy] }).tap do |assay_params| assay_params[:document_ids].select! { |id| Document.find_by_id(id).try(:can_view?) } if assay_params.key?(:document_ids) assay_params[:sop_ids].select! { |id| Sop.find_by_id(id).try(:can_view?) } if assay_params.key?(:sop_ids) assay_params[:model_ids].select! { |id| Model.find_by_id(id).try(:can_view?) } if assay_params.key?(:model_ids) From c8b37c32ae9b44c3632767da50b6f42c81856ce7 Mon Sep 17 00:00:00 2001 From: Kevin De Pelseneer Date: Wed, 26 Jun 2024 09:36:44 +0200 Subject: [PATCH 2/7] Add a checkbox to the form --- app/views/sharing/_form.html.erb | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/app/views/sharing/_form.html.erb b/app/views/sharing/_form.html.erb index 803abae2cd..7fb86e342b 100644 --- a/app/views/sharing/_form.html.erb +++ b/app/views/sharing/_form.html.erb @@ -9,6 +9,7 @@ else projects = [] end + is_assay_stream = object.respond_to?("is_assay_stream?") ? object.is_assay_stream? : false %> <%= folding_panel('Sharing', false, id: 'sharing_form', @@ -52,4 +53,12 @@ <% end %> <%= render partial: 'sharing/permissions_table', locals: { object: object, policy: policy, projects: projects } %> + <% if is_assay_stream %> +
    + <%= check_box_tag 'propagate_permissions' %> + +
    + <% end %> <% end %> From 0c6ce362d4b4d5210888d18cf50f71172348d833 Mon Sep 17 00:00:00 2001 From: Kevin De Pelseneer Date: Wed, 26 Jun 2024 09:36:58 +0200 Subject: [PATCH 3/7] Create a test --- test/functional/assays_controller_test.rb | 28 +++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/test/functional/assays_controller_test.rb b/test/functional/assays_controller_test.rb index 3102f4a868..1c8ab2fb27 100644 --- a/test/functional/assays_controller_test.rb +++ b/test/functional/assays_controller_test.rb @@ -2159,4 +2159,32 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links assert_equal end_assay.position, 1 end end + + test 'assay stream permissions propagation' do + with_config_value(:isa_json_compliance_enabled, true) do + person = FactoryBot.create(:person) + other_person = FactoryBot.create(:person) + project = person.projects.first + investigation = FactoryBot.create(:investigation, is_isa_json_compliant: true, contributor: person) + study = FactoryBot.create(:isa_json_compliant_study, investigation: ) + assay_stream = FactoryBot.create(:assay_stream, study: , contributor: person, position: 0) + + authorized_child_assay = FactoryBot.create(:assay, contributor: person, study: , assay_stream:, position: 0) + unauthorized_child_assay = FactoryBot.create(:assay, contributor: other_person, study: , assay_stream:, position: 1) + + login_as(person) + refute unauthorized_child_assay.can_manage? + refute authorized_child_assay.can_manage?(other_person) + patch :manage_update, params: { id: assay_stream, propagate_permissions: '1', assay: {creator_ids: [other_person.id]}, policy_attributes: {access_type: Policy::VISIBLE, permissions_attributes: {'1' => {contributor_type: 'Person', contributor_id: other_person.id, access_type: Policy::MANAGING}}}} + + # assert the flash[:error] text. The permissions of the unauthorized assay should not be propagated + assert flash[:error], "
    • You do not have the necessary permissions to propagate permissions to #{t('assay').downcase} [#{unauthorized_child_assay.id}]: '#{unauthorized_child_assay.title}'
    " + assert_redirected_to assay_path(assay_stream) + + # assert that the permissions of the authorized assay were propagated + authorized_child_assay.reload + assert authorized_child_assay.can_manage?(other_person) + end + end + end From 8843ffa0ce7daa9c36d4f2c87e7b7640e08a9f70 Mon Sep 17 00:00:00 2001 From: Kevin De Pelseneer Date: Wed, 26 Jun 2024 16:37:31 +0200 Subject: [PATCH 4/7] Change to after_action --- app/controllers/assays_controller.rb | 10 +++++++--- test/functional/assays_controller_test.rb | 4 ++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/app/controllers/assays_controller.rb b/app/controllers/assays_controller.rb index e2ae7d747a..de8dcd4488 100644 --- a/app/controllers/assays_controller.rb +++ b/app/controllers/assays_controller.rb @@ -19,7 +19,7 @@ class AssaysController < ApplicationController # => Rearrange positions after_action :rearrange_assay_positions_at_destroy, only: :destroy - before_action :propagate_permissions_to_children, only: :manage_update + after_action :propagate_permissions_to_children, only: :manage_update include Seek::Publishing::PublishingCommon @@ -165,7 +165,8 @@ def show def propagate_permissions_to_children return unless params[:propagate_permissions] - # flash[:error] = 'You do not have the necessary permissions to propagate permissions to children' + # Should only propagate permissions to child assays if the assay is an assay stream + return unless @assay.is_assay_stream? errors = [] @assay.child_assays.map do |assay| @@ -175,7 +176,10 @@ def propagate_permissions_to_children next end - assay.update(assay_params) + current_assay_policy = assay.policy + # Clone the policy from the parent assay + assay.update(policy: @assay.policy.deep_copy) + current_assay_policy.destroy if current_assay_policy update_sharing_policies assay end # Add an error message to the flash diff --git a/test/functional/assays_controller_test.rb b/test/functional/assays_controller_test.rb index 1c8ab2fb27..971367c3f0 100644 --- a/test/functional/assays_controller_test.rb +++ b/test/functional/assays_controller_test.rb @@ -2160,7 +2160,7 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links end end - test 'assay stream permissions propagation' do + test 'Should propagate assay stream permissions' do with_config_value(:isa_json_compliance_enabled, true) do person = FactoryBot.create(:person) other_person = FactoryBot.create(:person) @@ -2175,7 +2175,7 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links login_as(person) refute unauthorized_child_assay.can_manage? refute authorized_child_assay.can_manage?(other_person) - patch :manage_update, params: { id: assay_stream, propagate_permissions: '1', assay: {creator_ids: [other_person.id]}, policy_attributes: {access_type: Policy::VISIBLE, permissions_attributes: {'1' => {contributor_type: 'Person', contributor_id: other_person.id, access_type: Policy::MANAGING}}}} + patch :manage_update, params: { id: assay_stream, propagate_permissions: '1', assay: {creator_ids: [other_person.id]}, policy_attributes: {access_type: Policy::NO_ACCESS, permissions_attributes: {'1' => {contributor_type: 'Person', contributor_id: other_person.id, access_type: Policy::MANAGING}}}} # assert the flash[:error] text. The permissions of the unauthorized assay should not be propagated assert flash[:error], "
    • You do not have the necessary permissions to propagate permissions to #{t('assay').downcase} [#{unauthorized_child_assay.id}]: '#{unauthorized_child_assay.title}'
    " From 4b6080ee7403a89302c130f2307cbd0063bd603d Mon Sep 17 00:00:00 2001 From: Kevin De Pelseneer Date: Wed, 26 Jun 2024 16:50:40 +0200 Subject: [PATCH 5/7] Add test for the visibility of the propagate permissions checkbox --- test/functional/assays_controller_test.rb | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/test/functional/assays_controller_test.rb b/test/functional/assays_controller_test.rb index 971367c3f0..55be9db459 100644 --- a/test/functional/assays_controller_test.rb +++ b/test/functional/assays_controller_test.rb @@ -2160,6 +2160,25 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links end end + test 'visibility of the propagate permissions button' do + with_config_value(:isa_json_compliance_enabled, true) do + person = FactoryBot.create(:person) + login_as(person) + investigation = FactoryBot.create(:investigation, is_isa_json_compliant: true, contributor: person) + study = FactoryBot.create(:isa_json_compliant_study, investigation: ) + assay_stream = FactoryBot.create(:assay_stream, study: , contributor: person, position: 0) + experimental_assay = FactoryBot.create(:assay, contributor: person, study: , assay_stream:, position: 0) + + get :manage, params: { id: assay_stream } + assert_response :success + assert_select 'input[type=checkbox][name=propagate_permissions]', count: 1 + + get :manage, params: { id: experimental_assay } + assert_response :success + assert_select 'input[type=checkbox][name=propagate_permissions]', count: 0 + end + end + test 'Should propagate assay stream permissions' do with_config_value(:isa_json_compliance_enabled, true) do person = FactoryBot.create(:person) From 4c533bad5e9b2425c5ab7f789404ea51a4ba2578 Mon Sep 17 00:00:00 2001 From: Kevin De Pelseneer Date: Wed, 26 Jun 2024 17:08:19 +0200 Subject: [PATCH 6/7] Add test for non-authorized samples --- test/functional/assays_controller_test.rb | 35 +++++++++++++++++++---- 1 file changed, 29 insertions(+), 6 deletions(-) diff --git a/test/functional/assays_controller_test.rb b/test/functional/assays_controller_test.rb index 55be9db459..fd2b4177ba 100644 --- a/test/functional/assays_controller_test.rb +++ b/test/functional/assays_controller_test.rb @@ -2183,26 +2183,49 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links with_config_value(:isa_json_compliance_enabled, true) do person = FactoryBot.create(:person) other_person = FactoryBot.create(:person) - project = person.projects.first investigation = FactoryBot.create(:investigation, is_isa_json_compliant: true, contributor: person) study = FactoryBot.create(:isa_json_compliant_study, investigation: ) assay_stream = FactoryBot.create(:assay_stream, study: , contributor: person, position: 0) authorized_child_assay = FactoryBot.create(:assay, contributor: person, study: , assay_stream:, position: 0) - unauthorized_child_assay = FactoryBot.create(:assay, contributor: other_person, study: , assay_stream:, position: 1) login_as(person) - refute unauthorized_child_assay.can_manage? refute authorized_child_assay.can_manage?(other_person) patch :manage_update, params: { id: assay_stream, propagate_permissions: '1', assay: {creator_ids: [other_person.id]}, policy_attributes: {access_type: Policy::NO_ACCESS, permissions_attributes: {'1' => {contributor_type: 'Person', contributor_id: other_person.id, access_type: Policy::MANAGING}}}} + # assert that the permissions of the authorized assay were propagated + # other_person should see the assay stream and the authorized assay + assay_stream.reload + assert assay_stream.can_manage?(other_person) + authorized_child_assay.reload + assert authorized_child_assay.can_manage?(other_person) + end + end + + test 'should not propagate assay stream permissions when not authorized' do + with_config_value(:isa_json_compliance_enabled, true) do + person = FactoryBot.create(:person) + second_person = FactoryBot.create(:person) + third_person = FactoryBot.create(:person) + + investigation = FactoryBot.create(:investigation, is_isa_json_compliant: true, contributor: person) + study = FactoryBot.create(:isa_json_compliant_study, investigation: ) + assay_stream = FactoryBot.create(:assay_stream, study: , contributor: person, position: 0) + unauthorized_child_assay = FactoryBot.create(:assay, contributor: second_person, study: , assay_stream:, position: 0) + + login_as(person) + patch :manage_update, params: { id: assay_stream, propagate_permissions: '1', assay: {creator_ids: [third_person.id]}, policy_attributes: {access_type: Policy::NO_ACCESS, permissions_attributes: {'1' => {contributor_type: 'Person', contributor_id: third_person.id, access_type: Policy::MANAGING}}}} + # assert the flash[:error] text. The permissions of the unauthorized assay should not be propagated assert flash[:error], "
    • You do not have the necessary permissions to propagate permissions to #{t('assay').downcase} [#{unauthorized_child_assay.id}]: '#{unauthorized_child_assay.title}'
    " assert_redirected_to assay_path(assay_stream) - # assert that the permissions of the authorized assay were propagated - authorized_child_assay.reload - assert authorized_child_assay.can_manage?(other_person) + # assert that the permissions of the unauthorized assay were not propagated + # third_person should not see the unauthorized assay but still see the assay stream + assay_stream.reload + assert assay_stream.can_manage?(third_person) + unauthorized_child_assay.reload + refute unauthorized_child_assay.can_manage?(third_person) end end From c6915004382ad0ae58360fb3941974c437e16bed Mon Sep 17 00:00:00 2001 From: Kevin De Pelseneer Date: Wed, 26 Jun 2024 17:19:56 +0200 Subject: [PATCH 7/7] Add test for when checkbox is not checked --- app/controllers/assays_controller.rb | 2 +- test/functional/assays_controller_test.rb | 68 +++++++++++++++++------ 2 files changed, 51 insertions(+), 19 deletions(-) diff --git a/app/controllers/assays_controller.rb b/app/controllers/assays_controller.rb index de8dcd4488..a6ba0721cb 100644 --- a/app/controllers/assays_controller.rb +++ b/app/controllers/assays_controller.rb @@ -163,7 +163,7 @@ def show private def propagate_permissions_to_children - return unless params[:propagate_permissions] + return unless params[:propagate_permissions] == '1' # Should only propagate permissions to child assays if the assay is an assay stream return unless @assay.is_assay_stream? diff --git a/test/functional/assays_controller_test.rb b/test/functional/assays_controller_test.rb index fd2b4177ba..53041d3239 100644 --- a/test/functional/assays_controller_test.rb +++ b/test/functional/assays_controller_test.rb @@ -1929,15 +1929,15 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links sample_collection_st = FactoryBot.create(:isa_sample_collection_sample_type, contributor: person, projects: [project], linked_sample_type: source_st) - study = FactoryBot.create(:study, investigation: , contributor: person, + study = FactoryBot.create(:study, investigation:, contributor: person, policy: FactoryBot.create(:private_policy, permissions: [FactoryBot.create(:permission, contributor: person, access_type: Policy::MANAGING)]), sops: [FactoryBot.create(:sop, policy: FactoryBot.create(:public_policy))], sample_types: [source_st, sample_collection_st]) - assay_stream = FactoryBot.create(:assay_stream, study: , contributor: person) + assay_stream = FactoryBot.create(:assay_stream, study:, contributor: person) assay_sample_type = FactoryBot.create :isa_assay_material_sample_type, linked_sample_type: sample_collection_st, contributor: person, isa_template: FactoryBot.build(:isa_assay_material_template) assay = FactoryBot.create(:assay, - study: , + study:, policy: FactoryBot.create(:private_policy, permissions:[FactoryBot.create(:permission,contributor: person, access_type:Policy::EDITING)]), sample_type: assay_sample_type, contributor: person, @@ -1983,8 +1983,8 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links sops: [FactoryBot.create(:sop, policy: FactoryBot.create(:public_policy))], sample_types: [source_st, sample_collection_st]) - assay_stream = FactoryBot.create(:assay_stream, study: , contributor: person) - assay1 = FactoryBot.create(:assay, study: , contributor: person, sample_type: assay_st1, + assay_stream = FactoryBot.create(:assay_stream, study:, contributor: person) + assay1 = FactoryBot.create(:assay, study:, contributor: person, sample_type: assay_st1, policy: FactoryBot.create(:private_policy, permissions: [FactoryBot.create(:permission, contributor: person, access_type: Policy::MANAGING)]), position: 0, assay_stream: ) assay2 = FactoryBot.create(:assay, study: study, contributor: person, sample_type: assay_st2, @@ -2036,7 +2036,7 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links login_as(current_user) investigation = FactoryBot.create(:investigation, is_isa_json_compliant: true, contributor: current_user.person) study = FactoryBot.create(:isa_json_compliant_study, investigation: ) - assay_stream = FactoryBot.create(:assay_stream, study: , contributor: current_user.person) + assay_stream = FactoryBot.create(:assay_stream, study:, contributor: current_user.person) get :show, params: { id: assay_stream } assert_response :success @@ -2044,7 +2044,7 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links assert_select 'a', text: /Design #{I18n.t('assay')}/i, count: 1 assay_sample_type1 = FactoryBot.create(:isa_assay_material_sample_type, linked_sample_type: study.sample_types.second) - assay1 = FactoryBot.create(:assay, contributor: current_user.person, study: , assay_stream:, sample_type: assay_sample_type1) + assay1 = FactoryBot.create(:assay, contributor: current_user.person, study:, assay_stream:, sample_type: assay_sample_type1) assert_equal assay_stream.study, assay1.study @@ -2061,7 +2061,7 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links assert_select 'a', text: /Design the next #{I18n.t('assay')}/i, count: 1 assay_sample_type2 = FactoryBot.create(:isa_assay_material_sample_type, linked_sample_type: assay_sample_type1) - assay2 = FactoryBot.create(:assay, contributor: current_user.person, study: , assay_stream:, sample_type: assay_sample_type2) + assay2 = FactoryBot.create(:assay, contributor: current_user.person, study:, assay_stream:, sample_type: assay_sample_type2) get :show, params: { id: assay1 } assert_response :success @@ -2137,16 +2137,16 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links login_as(person) investigation = FactoryBot.create(:investigation, is_isa_json_compliant: true, contributor: person) study = FactoryBot.create(:isa_json_compliant_study, investigation: ) - assay_stream = FactoryBot.create(:assay_stream, study: , contributor: person, position: 0) + assay_stream = FactoryBot.create(:assay_stream, study:, contributor: person, position: 0) begin_assay_sample_type = FactoryBot.create(:isa_assay_material_sample_type, linked_sample_type: study.sample_types.second, projects: [project], contributor: person) - begin_assay = FactoryBot.create(:assay, contributor: person, study: , assay_stream:, sample_type: begin_assay_sample_type, position: 0) + begin_assay = FactoryBot.create(:assay, contributor: person, study:, assay_stream:, sample_type: begin_assay_sample_type, position: 0) middle_assay_sample_type = FactoryBot.create(:isa_assay_material_sample_type, linked_sample_type: begin_assay_sample_type, projects: [project], contributor: person) - middle_assay = FactoryBot.create(:assay, contributor: person, study: , assay_stream:, sample_type: middle_assay_sample_type, position: 1) + middle_assay = FactoryBot.create(:assay, contributor: person, study:, assay_stream:, sample_type: middle_assay_sample_type, position: 1) end_assay_sample_type = FactoryBot.create(:isa_assay_data_file_sample_type, linked_sample_type: middle_assay_sample_type, projects: [project], contributor: person) - end_assay = FactoryBot.create(:assay, contributor: person, study: , assay_stream:, sample_type: end_assay_sample_type, position: 2) + end_assay = FactoryBot.create(:assay, contributor: person, study:, assay_stream:, sample_type: end_assay_sample_type, position: 2) assert_difference('Assay.count', -1) do assert_difference('SampleType.count', -1) do @@ -2166,8 +2166,8 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links login_as(person) investigation = FactoryBot.create(:investigation, is_isa_json_compliant: true, contributor: person) study = FactoryBot.create(:isa_json_compliant_study, investigation: ) - assay_stream = FactoryBot.create(:assay_stream, study: , contributor: person, position: 0) - experimental_assay = FactoryBot.create(:assay, contributor: person, study: , assay_stream:, position: 0) + assay_stream = FactoryBot.create(:assay_stream, study:, contributor: person, position: 0) + experimental_assay = FactoryBot.create(:assay, contributor: person, study:, assay_stream:, position: 0) get :manage, params: { id: assay_stream } assert_response :success @@ -2185,9 +2185,9 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links other_person = FactoryBot.create(:person) investigation = FactoryBot.create(:investigation, is_isa_json_compliant: true, contributor: person) study = FactoryBot.create(:isa_json_compliant_study, investigation: ) - assay_stream = FactoryBot.create(:assay_stream, study: , contributor: person, position: 0) + assay_stream = FactoryBot.create(:assay_stream, study:, contributor: person, position: 0) - authorized_child_assay = FactoryBot.create(:assay, contributor: person, study: , assay_stream:, position: 0) + authorized_child_assay = FactoryBot.create(:assay, contributor: person, study:, assay_stream:, position: 0) login_as(person) refute authorized_child_assay.can_manage?(other_person) @@ -2210,8 +2210,8 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links investigation = FactoryBot.create(:investigation, is_isa_json_compliant: true, contributor: person) study = FactoryBot.create(:isa_json_compliant_study, investigation: ) - assay_stream = FactoryBot.create(:assay_stream, study: , contributor: person, position: 0) - unauthorized_child_assay = FactoryBot.create(:assay, contributor: second_person, study: , assay_stream:, position: 0) + assay_stream = FactoryBot.create(:assay_stream, study:, contributor: person, position: 0) + unauthorized_child_assay = FactoryBot.create(:assay, contributor: second_person, study:, assay_stream:, position: 0) login_as(person) patch :manage_update, params: { id: assay_stream, propagate_permissions: '1', assay: {creator_ids: [third_person.id]}, policy_attributes: {access_type: Policy::NO_ACCESS, permissions_attributes: {'1' => {contributor_type: 'Person', contributor_id: third_person.id, access_type: Policy::MANAGING}}}} @@ -2228,5 +2228,37 @@ def check_fixtures_for_authorization_of_sops_and_datafiles_links refute unauthorized_child_assay.can_manage?(third_person) end end + + test 'Should not propagate assay stream permissions when propagate_permissions param is not true' do + with_config_value(:isa_json_compliance_enabled, true) do + person = FactoryBot.create(:person) + other_person = FactoryBot.create(:person) + investigation = FactoryBot.create(:investigation, is_isa_json_compliant: true, contributor: person) + study = FactoryBot.create(:isa_json_compliant_study, investigation: ) + assay_stream = FactoryBot.create(:assay_stream, study:, contributor: person, position: 0) + authorized_child_assay = FactoryBot.create(:assay, contributor: person, study:, assay_stream:, position: 0) + + login_as(person) + refute authorized_child_assay.can_manage?(other_person) + patch :manage_update, params: { id: assay_stream, assay: {creator_ids: [other_person.id] }, policy_attributes: {access_type: Policy::NO_ACCESS, permissions_attributes: {'1' => {contributor_type: 'Person', contributor_id: other_person.id, access_type: Policy::MANAGING}}}} + + assert flash[:error].nil? + + # assert that the permissions of the authorized assay were not propagated + # other_person should not see the authorized assay + authorized_child_assay.reload + refute authorized_child_assay.can_manage?(other_person) + + patch :manage_update, params: { id: assay_stream, propagate_permissions: '0', assay: {creator_ids: [other_person.id] }, policy_attributes: {access_type: Policy::NO_ACCESS, permissions_attributes: {'1' => {contributor_type: 'Person', contributor_id: other_person.id, access_type: Policy::MANAGING}}}} + + assert flash[:error].nil? + + # assert that the permissions of the authorized assay were not propagated + # other_person should not see the authorized assay + authorized_child_assay.reload + refute authorized_child_assay.can_manage?(other_person) + + end + end end