Users emulating SysAdmins should be able to approve requests

app/controllers/application_controller.rb

@@ -77,10 +77,18 @@ def session_error_handler
       @retry_count < 3 # If the session is expired we should not have to retry more than once, but let's have a little wiggle room
     end
 
+    # rubocop:disable Metrics/AbcSize
+    # rubocop:disable Metrics/CyclomaticComplexity
+    # rubocop:disable Metrics/PerceivedComplexity
+    # rubocop:disable Metrics/MethodLength
     def emulate_user
       return if Rails.env.production?
       return if current_user.blank? || !current_user.trainer
 
+      if session[:emulation_role] != "System Administrator"
+        revoke_request if grant_request
+      end
+
       if session[:emulation_role]
         if session[:emulation_role] == "Eligible Data Sponsor"
           emulate_sponsor
@@ -95,6 +103,10 @@ def emulate_user
         end
       end
     end
+    # rubocop:enable Metrics/AbcSize
+    # rubocop:enable Metrics/CyclomaticComplexity
+    # rubocop:enable Metrics/PerceivedComplexity
+    # rubocop:enable Metrics/MethodLength
 
     def emulate_sponsor
       current_user.eligible_sponsor = true
@@ -112,6 +124,7 @@ def emulate_sysadmin
       current_user.sysadmin = true
       current_user.eligible_manager = false
       current_user.eligible_sponsor = false
+      grant_request
     end
 
     def emulate_data_user
@@ -127,6 +140,22 @@ def return_to_self
       current_user.sysadmin = false
     end
 
+    def grant_request
+      @granted ||= true
+      grant_role_request = Mediaflux::ActorGrantRoleRequest.new(session_token: SystemUser.mediaflux_session, user: current_user, type: "user", role: "pu-lib:developer")
+      grant_role_request.resolve
+      raise grant_role_request.response_error[:message] if grant_role_request.error?
+      @granted
+    end
+
+    def revoke_request
+      revoke_role_request = Mediaflux::ActorRevokeRoleRequest.new(session_token: SystemUser.mediaflux_session, user: current_user, type: "user", role: "pu-lib:developer")
+      revoke_role_request.resolve
+      @granted = false
+      raise revoke_role_request.response_error[:message] if revoke_role_request.error?
+      @granted
+    end
+
     def downtime_check
       if Flipflop.disable_login?
         if current_user.eligible_sysadmin?

app/models/mediaflux/actor_grant_role_request.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+module Mediaflux
+  class ActorGrantRoleRequest < Request
+    # Constructor
+    # @param session_token [String] the API token for the authenticated session
+    def initialize(session_token:, user:, type:, role:)
+      super(session_token: session_token)
+      @user = user
+      @type = type
+      @uid = user.uid
+
+      @user_name = "princeton:#{@uid}"
+      @role_name = role
+    end
+
+    # Specifies the Mediaflux service to use
+    # @return [String]
+    def self.service
+      "actor.grant"
+      # "actor.grant :type user :name princeton:[netid]] :role -type role pu-lib:developer"
+    end
+
+    def roles
+      xml_roles = response_xml.xpath("/response/reply/result")
+      xml_roles.map(&:text).sort
+    end
+
+  private
+
+    #
+    def build_http_request_body(name:)
+      super do |xml|
+        xml.args do
+          xml.type @type # e.g. :type user
+          xml.name @user_name # e.g. princeton:jsmith
+          xml.role @role do # e.g. :role
+            xml.parent.set_attribute("type", "role") # e.g. -type role
+            xml.text(@role_name) # e.g. pu-lib:developer
+          end
+        end
+      end
+    end
+  end
+end

app/models/mediaflux/actor_revoke_role_request.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+module Mediaflux
+  class ActorRevokeRoleRequest < Request
+    # Constructor
+    # @param session_token [String] the API token for the authenticated session
+    def initialize(session_token:, user:, type:, role:)
+      super(session_token: session_token)
+      @user = user
+      @type = type
+      @uid = user.uid
+
+      @user_name = "princeton:#{@uid}"
+      @role_name = role
+    end
+
+    # Specifies the Mediaflux service to use
+    # @return [String]
+    def self.service
+      "actor.revoke"
+      # "actor.revoke :type user :name princeton:[netid]] :role -type role pu-lib:developer"
+    end
+
+    def roles
+      xml_roles = response_xml.xpath("/response/reply/result")
+      xml_roles.map(&:text).sort
+    end
+
+  private
+
+    #
+    def build_http_request_body(name:)
+      super do |xml|
+        xml.args do
+          xml.type @type # e.g. :type user
+          xml.name @user_name # e.g. princeton:jsmith
+          xml.role @role do # e.g. :role
+            xml.parent.set_attribute("type", "role") # e.g. -type role
+            xml.text(@role_name) # e.g. pu-lib:developer
+          end
+        end
+      end
+    end
+  end
+end

spec/controllers/dashboard_controller_spec.rb

@@ -8,7 +8,7 @@
   end
 
   context "when a user is logged in", connect_to_mediaflux: true do
-    let(:user) { FactoryBot.create :user, mediaflux_session: SystemUser.mediaflux_session }
+    let(:user) { FactoryBot.create :user, uid: "tigerdatatester", mediaflux_session: SystemUser.mediaflux_session }
     before do
       sign_in user
     end

spec/models/mediaflux/actor_grant_role_request.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+require "rails_helper"
+
+RSpec.describe Mediaflux::ActorGrantRoleRequest, connect_to_mediaflux: true, type: :model do
+  let(:user) { FactoryBot.create(:user, uid: "tigerdatatester", mediaflux_session: SystemUser.mediaflux_session) }
+
+  describe "#resolve" do
+    it "Adds a user to the pu-lib:developer group", :integration do
+      grant_role_request = described_class.new(session_token: user.mediaflux_session, type: "user", user: user, role: "pu-lib:developer")
+      grant_role_request.resolve
+
+      expect(grant_role_request.error?).to be false
+      expect(grant_role_request.roles).to eq [""]
+    end
+  end
+end

spec/models/mediaflux/actor_revoke_role_request.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+require "rails_helper"
+
+RSpec.describe Mediaflux::ActorRevokeRoleRequest, connect_to_mediaflux: true, type: :model do
+  let(:user) { FactoryBot.create(:user, uid: "tigerdatatester", mediaflux_session: SystemUser.mediaflux_session) }
+
+  describe "#resolve" do
+    it "Removes a user from the pu-lib:developer group", :integration do
+      revoke_role_request = described_class.new(session_token: user.mediaflux_session, type: "user", user: user, role: "pu-lib:developer")
+      revoke_role_request.resolve
+
+      expect(revoke_role_request.error?).to be false
+      expect(revoke_role_request.roles).to eq [""]
+    end
+  end
+end

spec/system/dashboard_spec.rb

@@ -11,7 +11,7 @@
   end
 
   context "authenticated user" do
-    let(:current_user) { FactoryBot.create(:user, uid: "pul123", mediaflux_session: SystemUser.mediaflux_session) }
+    let(:current_user) { FactoryBot.create(:user, uid: "tigerdatatester", mediaflux_session: SystemUser.mediaflux_session) }
     let(:admin_user) { FactoryBot.create(:sysadmin, uid: "admin123") }
     let(:other_user) { FactoryBot.create(:user, uid: "zz123") }
     let(:no_projects_user) { FactoryBot.create(:user, uid: "qw999") }

spec/system/emulator_spec.rb

@@ -3,7 +3,7 @@
 require "rails_helper"
 
 describe "Website banner", type: :system, connect_to_mediaflux: true, js: true do
-  let(:current_user) { FactoryBot.create(:trainer, uid: "pul123") }
+  let(:current_user) { FactoryBot.create(:trainer, uid: "tigerdatatester") }
   it "has the banner on the homepage" do
     sign_in current_user
     visit "/"

spec/system/users_spec.rb

@@ -3,7 +3,7 @@
 require "rails_helper"
 
 describe "Current Users page", type: :system, connect_to_mediaflux: false, js: true do
-  let(:current_user) { FactoryBot.create(:user, uid: "pul123") }
+  let(:current_user) { FactoryBot.create(:user, uid: "tigerdatatester") }
   let(:sponsor_user) { FactoryBot.create(:project_sponsor, uid: "pul456", mediaflux_session: SystemUser.mediaflux_session) }
   let(:sysadmin_user) { FactoryBot.create(:sysadmin, uid: "puladmin", mediaflux_session: SystemUser.mediaflux_session) }
   let(:developer) { FactoryBot.create(:developer, uid: "root", mediaflux_session: SystemUser.mediaflux_session) }