added get_all analyses tests

api/api.py

@@ -192,6 +192,8 @@ endpoints = [
 
             route('/<cid:{gid}>/<list_name:tags>',                           TagsListHandler, m=['POST']),
             route('/<cid:{gid}>/<list_name:tags>/<value:{tag}>',             TagsListHandler, m=['GET', 'PUT', 'DELETE']),
+
+            route( '/<cid:{gid}>/analyses',                                     AnalysesHandler, h='get_all',       m=['GET']),
         ]),
 
 

api/handlers/refererhandler.py

@@ -156,6 +156,11 @@ class AnalysesHandler(RefererHandler):
         if cont_name not in parent_names:
             self.abort(400, "Analysis list not supported for {}".format(cont_name))
 
+        # Check that user has permission to container
+        container = storages[cont_name].get_container(cid)
+        permchecker = self.get_permchecker(container)
+        permchecker(noop)('GET')
+
         parent_tree = {
             cont_name: [cid]
         }
@@ -168,11 +173,13 @@ class AnalysesHandler(RefererHandler):
 
             # For each parent id, find all of its children and add them to the list of child ids in the parent tree
             for parent_id in parent_tree[parent_name]:
-                parent_tree[child_name] = parent_tree[child_name] + [cont["_id"] for cont in storage.get_children(parent_id, projection={'_id':1})]
+                parent_tree[child_name] = parent_tree[child_name] + [cont["_id"] for cont in storage.get_children(parent_id, projection={'_id':1}, uid=self.uid)]
 
             parent_name = child_name
         # We only need a list of all the ids, no need for the tree anymore
         parents = [pid for parent in parent_tree.keys() for pid in parent_tree[parent]]
+
+        # We set User to None because we check for permission when finding the parents
         analyses = containerstorage.AnalysisStorage().get_all_el({'parent.id':{'$in':parents}},None,{'info': 0, 'files.info': 0})
         return analyses
 

tests/integration_tests/python/test_containers.py

@@ -174,7 +174,7 @@ def test_project_template(data_builder, file_form, as_admin):
     assert 'project_has_template' not in r.json()
 
 
-def test_get_all_containers(data_builder, as_public):
+def test_get_all_containers(data_builder, as_admin, as_user, as_public, file_form):
     project_1 = data_builder.create_project()
     project_2 = data_builder.create_project()
     session = data_builder.create_session(project=project_1)
@@ -209,6 +209,25 @@ def test_get_all_containers(data_builder, as_public):
     })
     assert r.ok
 
+    # Test get_all analyses
+    project_3 = data_builder.create_project(public=False)
+    session_2 = data_builder.create_session(project=project_3)
+
+    analysis_1 = as_admin.post('/sessions/' + session_2 + '/analyses', files=file_form(
+        'analysis.csv', meta={'label': 'no-job', 'inputs': [{'name': 'analysis.csv'}]})).json()["_id"]
+    session_3 = data_builder.create_session(project=project_3)
+    acquisition = data_builder.create_acquisition(session=session_3)
+    analysis_2 = as_admin.post('/acquisitions/' + acquisition + '/analyses', files=file_form(
+        'analysis.csv', meta={'label': 'no-job', 'inputs': [{'name': 'analysis.csv'}]})).json()["_id"]
+
+    r = as_admin.get('/projects/' + project_3 + '/analyses')
+    assert r.ok
+    assert len(r.json()) == 2
+
+    r = as_user.get('/projects/' + project_3 + '/analyses')
+    assert r.status_code == 403
+
+
 
 def test_get_all_for_user(as_admin, as_public):
     r = as_admin.get('/users/self')