Merge branch 'series-4.1'

.circleci/config.yml

@@ -0,0 +1,65 @@
+# Python CircleCI 2.0 configuration file
+#
+# Check https://circleci.com/docs/2.0/language-python/ for more details
+#
+version: 2
+jobs:
+  build:
+    docker:
+      # specify the version you desire here
+      # use `-browsers` prefix for selenium tests, e.g. `3.6.1-browsers`
+      - image: circleci/python:3.5.9-stretch
+
+      # Specify service dependencies here if necessary
+      # CircleCI maintains a library of pre-built images
+      # documented at https://circleci.com/docs/2.0/circleci-images/
+      # - image: circleci/postgres:9.4
+
+    working_directory: ~/repo
+
+    steps:
+      - checkout
+
+      # Download and install prerequisites
+      - run:
+          name: install prerequisites
+          command: |
+              sudo apt-get update -yqq
+              sudo apt-get -yqq install --no-install-recommends -o=Dpkg::Use-Pty=0 \
+                libldap2-dev libsasl2-dev libmagic-dev libmagickwand-dev \
+                libssl-dev libxml2-dev libxslt1-dev zlib1g-dev \
+                libfreetype6-dev libjpeg-dev
+
+      # Download and cache dependencies
+      - restore_cache:
+          keys:
+            - v1-dependencies-{{ checksum "requirements.txt" }}
+            # fallback to using the latest cache if no exact match is found
+            - v1-dependencies-
+
+      - run:
+          name: install dependencies
+          command: |
+            python3 -m venv venv
+            . venv/bin/activate
+            pip install -r requirements.txt
+
+      - save_cache:
+          paths:
+            - ./venv
+          key: v1-dependencies-{{ checksum "requirements.txt" }}
+
+      # Run tests!
+      # Set DOCKER_BUILD environment variable, used by
+      # tardis/tardis_portal/tests/test_tar_download.py
+      - run:
+          name: run tests
+          command: |
+            . venv/bin/activate
+            mkdir -p var/store
+            python test.py
+          environment:
+            DOCKER_BUILD: 'true'
+      - store_artifacts:
+          path: test-reports
+          destination: test-reports

README.rst

@@ -110,12 +110,12 @@ included. It will move to newer versions automatically. Follow this branch
 if you want to stay up to date in a production environment.
 
 Each version has its own branch named by version number. At the time of
-writing, the latest release is ``4.1.4``, tagged from the ``series-4.1``
+writing, the latest release is ``4.1.5``, tagged from the ``series-4.1``
 branch. Follow this branch for your production installation and
 perform version upgrades manually.
 
 Each bug fix or set of fixes bumps the minor version and each new release is
-tagged, eg. ``4.1.5``. Use tagged releases if you are paranoid about changes to
+tagged, eg. ``4.1.6``. Use tagged releases if you are paranoid about changes to
 the code you have not tested yourself.
 
 To follow development, please see the contributing section below.

docs/changelog.rst

@@ -1,6 +1,13 @@
 Releases
 ========
 
+4.1.5
+-----
+* Update AngularJS to address the SNYK-JS-ANGULAR-534884 vulnerability.
+* Update the handlebars version in package-lock.json to avoid having
+  "npm install" report high severity vulnerabilities.
+* Fix the dataset metadata API test which was failing on Python 3.5.
+
 4.1.4
 -----
 * Fixed duplicate form submission bugs for create experiment/dataset

package.json

@@ -1,6 +1,6 @@
 {
   "name": "mytardis",
-  "version": "4.1.4",
+  "version": "4.1.5",
   "license": "GPL-3.0-only",
   "repository": {
     "type": "git",
@@ -11,7 +11,7 @@
     "@babel/plugin-proposal-class-properties": "^7.5.5",
     "@babel/preset-env": "^7.6.3",
     "@babel/preset-react": "^7.6.3",
-    "angular": "1.7.8",
+    "angular": "1.7.9",
     "angular-resource": "1.7.8",
     "babel-loader": "^8.0.6",
     "backbone": "^0.9.2",

tardis/tardis_portal/api.py

@@ -713,6 +713,21 @@ def get_datafiles(self, request, **kwargs):
         df_res = DataFileResource()
         return df_res.dispatch('list', request, **kwargs)
 
+    def hydrate_m2m(self, bundle):
+        '''
+        Create experiment-dataset associations first, because they affect
+        authorization for adding other related resources, e.g. metadata
+        '''
+        if getattr(bundle.obj, 'id', False):
+            for exp_uri in bundle.data.get('experiments', []):
+                try:
+                    exp = ExperimentResource.get_via_uri(
+                        ExperimentResource(), exp_uri, bundle.request)
+                    bundle.obj.experiments.add(exp)
+                except NotFound:
+                    pass
+        return super(DatasetResource, self).hydrate_m2m(bundle)
+
 
 class DataFileResource(MyTardisModelResource):
     dataset = fields.ForeignKey(DatasetResource, 'dataset')

tardis/tardis_portal/tests/api/__init__.py

@@ -39,6 +39,8 @@ def setUp(self):
                        'last_name': 'MyTardis API',
                        'email': 'api_test@mytardis.org'},
             auth_method="None")
+        self.user.user_permissions.add(
+            Permission.objects.get(codename='change_experiment'))
         self.user.user_permissions.add(
             Permission.objects.get(codename='change_dataset'))
         self.user.user_permissions.add(

tardis/tardis_portal/tests/api/test_dataset_metadata_resources.py

@@ -109,6 +109,8 @@ def test_create_dataset_pset_no_auth(self):
             '/api/v1/datasetparameterset/',
             data=post_data,
             authentication=self.get_credentials()))
+        self.user.user_permissions.add(
+            Permission.objects.get(codename='change_dataset'))
 
 
 class DatasetParameterResourceTest(MyTardisResourceTestCase):

tardis/tardis_portal/tests/api/test_dataset_resource.py

@@ -90,11 +90,18 @@ def test_post_dataset(self):
             ],
             "immutable": False}
         dataset_count = Dataset.objects.count()
-        self.assertHttpCreated(self.api_client.post(
+        response = self.api_client.post(
             '/api/v1/dataset/',
             data=post_data,
-            authentication=self.get_credentials()))
+            authentication=self.get_credentials())
+        self.assertHttpCreated(response)
         self.assertEqual(dataset_count + 1, Dataset.objects.count())
+        created_dataset_uri = response['Location']
+        created_dataset_id = created_dataset_uri.split('/')[-2]
+        created_dataset = Dataset.objects.get(id=created_dataset_id)
+        self.assertEqual(created_dataset.experiments.count(), 1)
+        self.assertEqual(
+            created_dataset.experiments.first().id, exp_id)
 
     def test_get_dataset_files(self):
         ds_id = self.ds_no_instrument.id