Skip to content
Please note that GitHub no longer supports your web browser.

We recommend upgrading to the latest Google Chrome or Firefox.

Learn more
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tests & API keys #40

Open
wibeasley opened this issue Jan 2, 2020 · 9 comments
Open

tests & API keys #40

wibeasley opened this issue Jan 2, 2020 · 9 comments
Assignees
Labels

Comments

@wibeasley
Copy link
Contributor

@wibeasley wibeasley commented Jan 2, 2020

There needs to be a different approach to initiating the test suite. Right now [tests that should fail... still pass. It's because testthat::test_check() currently won't run if the API key isn't found as an environmental variable.

I'm open to ideas as always. Currently I'm thinking:

  1. Test only against demo.dataverse.org. (A few weeks ago @pdurbin advocated this in a phone call for several reasons, including that Dataverse's retrieval stats won't be misleading --because one article gets hundreds of hits a month just from automated tests.)

  2. create a (demo) Dataverse account dedicated to testing. At this point, I don't think it needs to be kept secret. There's not really a need to keep it secret. It could even be set in tests/testthat.R.

    @pdurbin, will you please check my claim --especially from a security standpoint?

  3. If the above is safe, the api key might be kept in a yaml file in the inst/ directory.

  4. If the API key to the demo server needs to be protected,

    1. we could save it as Travis environmental variables (ref 1 & ref 2)

    2. it would prevent other people from testing the packages on their own machine, so we'll get fewer quality contributions from others.


@skasberger, @rliebz, @tainguyenbui, and any others, I'd appreciate any advice from your experience with pyDataverse, dataverse-client-python, and dataverse-client-javascript. I'm not experienced with your languages, but looks like pyDataverse doesn't pass an API key, while client-python posts their API key to the demo server.


(This is different from #4 & #29, which involve the battery of tests/comparisons. Not the management of API keys or how testthat is initiated.)

@wibeasley wibeasley self-assigned this Jan 2, 2020
wibeasley added a commit that referenced this issue Jan 2, 2020
ref #40
wibeasley added a commit that referenced this issue Jan 2, 2020
wibeasley added a commit that referenced this issue Jan 2, 2020
ref #40
wibeasley added a commit that referenced this issue Jan 2, 2020
This interferes with all the assignments that happens within the function parameter defaults.  And also the tests.

ref #40
wibeasley added a commit that referenced this issue Jan 2, 2020
@pdurbin

This comment has been minimized.

Copy link
Member

@pdurbin pdurbin commented Jan 2, 2020

@wibeasley my first thought is that you could create a one-off user for every run on the demo site like this:

curl -d @user-add.json -H "Content-type:application/json" "$SERVER_URL/api/builtin-users?password=$NEWUSER_PASSWORD&key=$BUILTIN_USERS_KEY"

That's from http://guides.dataverse.org/en/4.18.1/api/native-api.html#create-a-builtin-user

I just tested it on the demo server and it worked with these environment variables:

export SERVER_URL=https://demo.dataverse.org

export NEWUSER_PASSWORD=password1

export BUILTIN_USERS_KEY=burrito

You'd have to vary the JSON you send each time to avoid errors about non-unique usernames or email addresses. In the link above this is what we provide as an example:

{
  "firstName": "Lisa",
  "lastName": "Simpson",
  "userName": "lsimpson",
  "affiliation": "Springfield",
  "position": "Student",
  "email": "lsimpson@mailinator.com"
}
@tainguyenbui

This comment has been minimized.

Copy link

@tainguyenbui tainguyenbui commented Jan 2, 2020

Is there any chance that the real environments are not hit? You could create mocks and just make sure that the http request is being made with the right parameters.

@pdurbin

This comment has been minimized.

Copy link
Member

@pdurbin pdurbin commented Jan 2, 2020

Oh and to be clear the JSON response you get back should include the API token, which you'd use for subsequent operations. Using jq you could grab it like this:

jq '.data.apiToken'

But I assume you'd want to implement all of this "create user and assign the API token to a variable" stuff in R.

@wibeasley

This comment has been minimized.

Copy link
Contributor Author

@wibeasley wibeasley commented Jan 4, 2020

During a meeting Friday, @pdurbin tentatively planned that

  • the initial test dataverses will be static on the demo server (e.g., https://demo.dataverse.org/dataverse/dataverse-client-r), as described in the initial post. As long as we're using only the demo server, we don't think it's necessary to keep the token secret, so we don't have to deploy environmental variables to Travis.
  • accumulate tests until (a) we have good code coverage and decent corner-case coverage, and (b) the design that is stable
  • add some dynamic features that follows @pdurbin's preference of ephemeral resources, such a the temporary users and dataverses. This will help the packages me deployed to things like Jenkins

@tainguyenbui, right now I think the mocks might be overkill for the current goals. I do appreciate that it could isolate problems of the client from problems of the server software. But the server seems pretty stable, and might require less maintenance that whatever mock I develop. Tell me if you think I'm overlooking something important.

@skasberger

This comment has been minimized.

Copy link

@skasberger skasberger commented Jan 10, 2020

Some thoughts from me (pyDataverse).

I think it would be great, to have a test-instance somewhere with the latest Dataverse version, so the clients can be tested there before (or after) the release. If there is one user for all, or one for each client, I don't know.

pyDataverse passes an API key if it is passed in the init of an Api() object.

@pdurbin

This comment has been minimized.

Copy link
Member

@pdurbin pdurbin commented Jan 10, 2020

Related is the idea of setting up a beta server that runs "develop" - IQSS/dataverse.harvard.edu#20

Also, a new instance of Dataverse is spun up after every pull request is merged at https://jenkins.dataverse.org/job/IQSS-dataverse-develop/ but then it gets terminated a few hours later.

Finally, https://demo.dataverse.org always runs the latest release. It's the officially blessed server for testing releases: http://guides.dataverse.org/en/4.18.1/api/getting-started.html#servers-you-can-test-with

@adam3smith

This comment has been minimized.

Copy link
Contributor

@adam3smith adam3smith commented Jan 10, 2020

If I understand this correctly and the decision is made, could you publish the dataverse on demo? I don't like the idea of writing tests that will have to be re-written.

@pdurbin

This comment has been minimized.

Copy link
Member

@pdurbin pdurbin commented Jan 10, 2020

@adam3smith I assume your question is for @wibeasley

You both have my blessing to publish whatever you want on https://demo.dataverse.org , especially if you're testing dataverse-client-r! 😄 🎉

@adam3smith

This comment has been minimized.

Copy link
Contributor

@adam3smith adam3smith commented Jan 10, 2020

Yes, this is referring to https://demo.dataverse.org/dataverse/dataverse-client-r which is unpublished, sorry for the confusion.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants
You can’t perform that action at this time.