github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-11-21 20:47:08 -05:00
Code Issues Projects Releases Packages Wiki Activity

Working token-based access

Browse source
This commit is contained in:
Shane Kilkelly 2017-09-27 14:01:52 +01:00
parent ee32648bf4
commit 574b115022
10 changed files with 217 additions and 173 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

71
services/web/app/coffee/Features/Authorization/AuthorizationManager.coffee
View file

@ -5,34 +5,48 @@ PrivilegeLevels = require("./PrivilegeLevels")
PublicAccessLevels = require("./PublicAccessLevels") PublicAccessLevels = require("./PublicAccessLevels")
Errors = require("../Errors/Errors") Errors = require("../Errors/Errors")
ObjectId = require("mongojs").ObjectId ObjectId = require("mongojs").ObjectId
TokenAccessHandler = require('../TokenAccess/TokenAccessHandler')
module.exports = AuthorizationManager = module.exports = AuthorizationManager =
# Get the privilege level that the user has for the project # Get the privilege level that the user has for the project
# Returns: # Returns:
# * privilegeLevel: "owner", "readAndWrite", of "readOnly" if the user has # * privilegeLevel: "owner", "readAndWrite", of "readOnly" if the user has
# access. false if the user does not have access # access. false if the user does not have access
# * becausePublic: true if the access level is only because the project is public. # * becausePublic: true if the access level is only because the project is public.
getPrivilegeLevelForProject: (user_id, project_id, callback = (error, privilegeLevel, becausePublic) ->) -> getPrivilegeLevelForProject: (req, user_id, project_id,
getPublicAccessLevel = () -> callback = (error, privilegeLevel, becausePublic) ->) ->
getPublicAccessLevel = (project_id, cb=(err, level)->) ->
if !ObjectId.isValid(project_id) if !ObjectId.isValid(project_id)
return callback(new Error("invalid project id")) return cb(new Error("invalid project id"))
Project.findOne { _id: project_id }, { publicAccesLevel: 1 }, (error, project) -> Project.findOne { _id: project_id }, { publicAccesLevel: 1 }, (error, project) ->
return callback(error) if error? return cb(error) if error?
if !project? if !project?
return callback new Errors.NotFoundError("no project found with id #{project_id}") return cb new Errors.NotFoundError("no project found with id #{project_id}")
if project.publicAccesLevel == PublicAccessLevels.READ_ONLY cb null, project.publicAccesLevel
return callback null, PrivilegeLevels.READ_ONLY, true
else if project.publicAccesLevel == PublicAccessLevels.READ_AND_WRITE
return callback null, PrivilegeLevels.READ_AND_WRITE, true
else if project.publicAccesLevel == PublicAccessLevels.TOKEN_BASED
return callback null, PrivilegeLevels.READ_ONLY, false
else
return callback null, PrivilegeLevels.NONE, false
if !user_id? if !user_id?
getPublicAccessLevel() # User is Anonymous, Try Token-based access
getPublicAccessLevel project_id, (err, publicAccessLevel) ->
return callback(err) if err?
if publicAccessLevel == PublicAccessLevels.TOKEN_BASED
TokenAccessHandler.requestHasReadOnlyTokenAccess req, project_id, (err, allowed) ->
return callback(err) if err?
if allowed
callback null, PrivilegeLevels.READ_ONLY, false
else
callback null, PrivilegeLevels.NONE, false
else if publicAccessLevel == PublicAccessLevels.READ_ONLY
callback null, PrivilegeLevels.READ_ONLY, true
else if publicAccessLevel == PublicAccessLevels.READ_AND_WRITE
callback null, PrivilegeLevels.READ_AND_WRITE, true
else
callback null, PrivilegeLevels.NONE, false
else else
# User is present, get their privilege level from database
CollaboratorsHandler.getMemberIdPrivilegeLevel user_id, project_id, (error, privilegeLevel) -> CollaboratorsHandler.getMemberIdPrivilegeLevel user_id, project_id, (error, privilegeLevel) ->
return callback(error) if error? return callback(error) if error?
if privilegeLevel? and privilegeLevel != PrivilegeLevels.NONE if privilegeLevel? and privilegeLevel != PrivilegeLevels.NONE
@ -44,20 +58,29 @@ module.exports = AuthorizationManager =
if isAdmin if isAdmin
callback null, PrivilegeLevels.OWNER, false callback null, PrivilegeLevels.OWNER, false
else else
getPublicAccessLevel() # Legacy public-access system
# User is present (not anonymous), but does not have direct access
getPublicAccessLevel project_id, (err, publicAccessLevel) ->
return callback(err) if err?
if publicAccessLevel == PublicAccessLevels.READ_ONLY
callback null, PrivilegeLevels.READ_ONLY, true
if publicAccessLevel == PublicAccessLevels.READ_AND_WRITE
callback null, PrivilegeLevels.READ_AND_WRITE, true
else
callback null, PrivilegeLevels.NONE, false
canUserReadProject: (user_id, project_id, callback = (error, canRead) ->) -> canUserReadProject: (req, user_id, project_id, callback = (error, canRead) ->) ->
AuthorizationManager.getPrivilegeLevelForProject user_id, project_id, (error, privilegeLevel) -> AuthorizationManager.getPrivilegeLevelForProject req, user_id, project_id, (error, privilegeLevel) ->
return callback(error) if error? return callback(error) if error?
return callback null, (privilegeLevel in [PrivilegeLevels.OWNER, PrivilegeLevels.READ_AND_WRITE, PrivilegeLevels.READ_ONLY]) return callback null, (privilegeLevel in [PrivilegeLevels.OWNER, PrivilegeLevels.READ_AND_WRITE, PrivilegeLevels.READ_ONLY])
canUserWriteProjectContent: (user_id, project_id, callback = (error, canWriteContent) ->) -> canUserWriteProjectContent: (req, user_id, project_id, callback = (error, canWriteContent) ->) ->
AuthorizationManager.getPrivilegeLevelForProject user_id, project_id, (error, privilegeLevel) -> AuthorizationManager.getPrivilegeLevelForProject req, user_id, project_id, (error, privilegeLevel) ->
return callback(error) if error? return callback(error) if error?
return callback null, (privilegeLevel in [PrivilegeLevels.OWNER, PrivilegeLevels.READ_AND_WRITE]) return callback null, (privilegeLevel in [PrivilegeLevels.OWNER, PrivilegeLevels.READ_AND_WRITE])
canUserWriteProjectSettings: (user_id, project_id, callback = (error, canWriteSettings) ->) -> canUserWriteProjectSettings: (req, user_id, project_id, callback = (error, canWriteSettings) ->) ->
AuthorizationManager.getPrivilegeLevelForProject user_id, project_id, (error, privilegeLevel, becausePublic) -> AuthorizationManager.getPrivilegeLevelForProject req, user_id, project_id, (error, privilegeLevel, becausePublic) ->
return callback(error) if error? return callback(error) if error?
if privilegeLevel == PrivilegeLevels.OWNER if privilegeLevel == PrivilegeLevels.OWNER
return callback null, true return callback null, true
@ -66,8 +89,8 @@ module.exports = AuthorizationManager =
else else
return callback null, false return callback null, false
canUserAdminProject: (user_id, project_id, callback = (error, canAdmin) ->) -> canUserAdminProject: (req, user_id, project_id, callback = (error, canAdmin) ->) ->
AuthorizationManager.getPrivilegeLevelForProject user_id, project_id, (error, privilegeLevel) -> AuthorizationManager.getPrivilegeLevelForProject req, user_id, project_id, (error, privilegeLevel) ->
return callback(error) if error? return callback(error) if error?
return callback null, (privilegeLevel == PrivilegeLevels.OWNER) return callback null, (privilegeLevel == PrivilegeLevels.OWNER)
@ -76,4 +99,4 @@ module.exports = AuthorizationManager =
return callback null, false return callback null, false
User.findOne { _id: user_id }, { isAdmin: 1 }, (error, user) -> User.findOne { _id: user_id }, { isAdmin: 1 }, (error, user) ->
return callback(error) if error? return callback(error) if error?
return callback null, (user?.isAdmin == true) return callback null, (user?.isAdmin == true)

10
services/web/app/coffee/Features/Authorization/AuthorizationMiddlewear.coffee
View file

@ -13,7 +13,7 @@ module.exports = AuthorizationMiddlewear =
# Remove the projects we have access to. Note rejectSeries doesn't use # Remove the projects we have access to. Note rejectSeries doesn't use
# errors in callbacks # errors in callbacks
async.rejectSeries project_ids, (project_id, cb) -> async.rejectSeries project_ids, (project_id, cb) ->
AuthorizationManager.canUserReadProject user_id, project_id, (error, canRead) -> AuthorizationManager.canUserReadProject req, user_id, project_id, (error, canRead) ->
return next(error) if error? return next(error) if error?
cb(canRead) cb(canRead)
, (unauthorized_project_ids) -> , (unauthorized_project_ids) ->
@ -25,7 +25,7 @@ module.exports = AuthorizationMiddlewear =
ensureUserCanReadProject: (req, res, next) -> ensureUserCanReadProject: (req, res, next) ->
AuthorizationMiddlewear._getUserAndProjectId req, (error, user_id, project_id) -> AuthorizationMiddlewear._getUserAndProjectId req, (error, user_id, project_id) ->
return next(error) if error? return next(error) if error?
AuthorizationManager.canUserReadProject user_id, project_id, (error, canRead) -> AuthorizationManager.canUserReadProject req, user_id, project_id, (error, canRead) ->
return next(error) if error? return next(error) if error?
if canRead if canRead
logger.log {user_id, project_id}, "allowing user read access to project" logger.log {user_id, project_id}, "allowing user read access to project"
@ -37,7 +37,7 @@ module.exports = AuthorizationMiddlewear =
ensureUserCanWriteProjectSettings: (req, res, next) -> ensureUserCanWriteProjectSettings: (req, res, next) ->
AuthorizationMiddlewear._getUserAndProjectId req, (error, user_id, project_id) -> AuthorizationMiddlewear._getUserAndProjectId req, (error, user_id, project_id) ->
return next(error) if error? return next(error) if error?
AuthorizationManager.canUserWriteProjectSettings user_id, project_id, (error, canWrite) -> AuthorizationManager.canUserWriteProjectSettings req, user_id, project_id, (error, canWrite) ->
return next(error) if error? return next(error) if error?
if canWrite if canWrite
logger.log {user_id, project_id}, "allowing user write access to project settings" logger.log {user_id, project_id}, "allowing user write access to project settings"
@ -49,7 +49,7 @@ module.exports = AuthorizationMiddlewear =
ensureUserCanWriteProjectContent: (req, res, next) -> ensureUserCanWriteProjectContent: (req, res, next) ->
AuthorizationMiddlewear._getUserAndProjectId req, (error, user_id, project_id) -> AuthorizationMiddlewear._getUserAndProjectId req, (error, user_id, project_id) ->
return next(error) if error? return next(error) if error?
AuthorizationManager.canUserWriteProjectContent user_id, project_id, (error, canWrite) -> AuthorizationManager.canUserWriteProjectContent req, user_id, project_id, (error, canWrite) ->
return next(error) if error? return next(error) if error?
if canWrite if canWrite
logger.log {user_id, project_id}, "allowing user write access to project content" logger.log {user_id, project_id}, "allowing user write access to project content"
@ -61,7 +61,7 @@ module.exports = AuthorizationMiddlewear =
ensureUserCanAdminProject: (req, res, next) -> ensureUserCanAdminProject: (req, res, next) ->
AuthorizationMiddlewear._getUserAndProjectId req, (error, user_id, project_id) -> AuthorizationMiddlewear._getUserAndProjectId req, (error, user_id, project_id) ->
return next(error) if error? return next(error) if error?
AuthorizationManager.canUserAdminProject user_id, project_id, (error, canAdmin) -> AuthorizationManager.canUserAdminProject req, user_id, project_id, (error, canAdmin) ->
return next(error) if error? return next(error) if error?
if canAdmin if canAdmin
logger.log {user_id, project_id}, "allowing user admin access to project" logger.log {user_id, project_id}, "allowing user admin access to project"

6
services/web/app/coffee/Features/Editor/EditorHttpController.coffee
View file

@ -20,7 +20,7 @@ module.exports = EditorHttpController =
user_id = null user_id = null
logger.log {user_id, project_id}, "join project request" logger.log {user_id, project_id}, "join project request"
Metrics.inc "editor.join-project" Metrics.inc "editor.join-project"
EditorHttpController._buildJoinProjectView project_id, user_id, (error, project, privilegeLevel) -> EditorHttpController._buildJoinProjectView req, project_id, user_id, (error, project, privilegeLevel) ->
return next(error) if error? return next(error) if error?
res.json { res.json {
project: project project: project
@ -30,7 +30,7 @@ module.exports = EditorHttpController =
if project?.deletedByExternalDataSource if project?.deletedByExternalDataSource
ProjectDeleter.unmarkAsDeletedByExternalSource project_id ProjectDeleter.unmarkAsDeletedByExternalSource project_id
_buildJoinProjectView: (project_id, user_id, callback = (error, project, privilegeLevel) ->) -> _buildJoinProjectView: (req, project_id, user_id, callback = (error, project, privilegeLevel) ->) ->
logger.log {project_id, user_id}, "building the joinProject view" logger.log {project_id, user_id}, "building the joinProject view"
ProjectGetter.getProjectWithoutDocLines project_id, (error, project) -> ProjectGetter.getProjectWithoutDocLines project_id, (error, project) ->
return callback(error) if error? return callback(error) if error?
@ -39,7 +39,7 @@ module.exports = EditorHttpController =
return callback(error) if error? return callback(error) if error?
UserGetter.getUser user_id, { isAdmin: true }, (error, user) -> UserGetter.getUser user_id, { isAdmin: true }, (error, user) ->
return callback(error) if error? return callback(error) if error?
AuthorizationManager.getPrivilegeLevelForProject user_id, project_id, (error, privilegeLevel) -> AuthorizationManager.getPrivilegeLevelForProject req, user_id, project_id, (error, privilegeLevel) ->
return callback(error) if error? return callback(error) if error?
if !privilegeLevel? or privilegeLevel == PrivilegeLevels.NONE if !privilegeLevel? or privilegeLevel == PrivilegeLevels.NONE
logger.log {project_id, user_id, privilegeLevel}, "not an acceptable privilege level, returning null" logger.log {project_id, user_id, privilegeLevel}, "not an acceptable privilege level, returning null"

2
services/web/app/coffee/Features/Project/ProjectController.coffee
View file

@ -260,7 +260,7 @@ module.exports = ProjectController =
daysSinceLastUpdated = (new Date() - project.lastUpdated) /86400000 daysSinceLastUpdated = (new Date() - project.lastUpdated) /86400000
logger.log project_id:project_id, daysSinceLastUpdated:daysSinceLastUpdated, "got db results for loading editor" logger.log project_id:project_id, daysSinceLastUpdated:daysSinceLastUpdated, "got db results for loading editor"
AuthorizationManager.getPrivilegeLevelForProject user_id, project_id, (error, privilegeLevel)-> AuthorizationManager.getPrivilegeLevelForProject req, user_id, project_id, (error, privilegeLevel)->
return next(error) if error? return next(error) if error?
if !privilegeLevel? or privilegeLevel == PrivilegeLevels.NONE if !privilegeLevel? or privilegeLevel == PrivilegeLevels.NONE
return res.sendStatus 401 return res.sendStatus 401

8
services/web/app/coffee/Features/TokenAccess/TokenAccessController.coffee
View file

@ -28,7 +28,7 @@ module.exports = TokenAccessController =
logger.err {err, token, userId, projectId: project._id}, logger.err {err, token, userId, projectId: project._id},
"error adding user to project with readAndWrite token" "error adding user to project with readAndWrite token"
return next(err) return next(err)
return res.redirect("/project/#{project._id}") return res.redirect(307, "/project/#{project._id}")
readOnlyToken: (req, res, next) -> readOnlyToken: (req, res, next) ->
userId = AuthenticationController.getLoggedInUserId(req) userId = AuthenticationController.getLoggedInUserId(req)
@ -46,8 +46,8 @@ module.exports = TokenAccessController =
if !userId? if !userId?
logger.log {userId, projectId: project._id}, logger.log {userId, projectId: project._id},
"adding anonymous user to project with readOnly token" "adding anonymous user to project with readOnly token"
TokenAccessHandler.grantAnonymousUserTokenAccessViaSession(req, project._id) TokenAccessHandler.grantSessionReadOnlyTokenAccess(req, project._id, token)
return res.redirect("/project/#{project._id}") return res.redirect(307, "/project/#{project._id}")
else else
logger.log {userId, projectId: project._id}, logger.log {userId, projectId: project._id},
"adding user to project with readOnly token" "adding user to project with readOnly token"
@ -56,6 +56,6 @@ module.exports = TokenAccessController =
logger.err {err, token, userId, projectId: project._id}, logger.err {err, token, userId, projectId: project._id},
"error adding user to project with readAndWrite token" "error adding user to project with readAndWrite token"
return next(err) return next(err)
res.redirect("/project/#{project._id}") res.redirect(307, "/project/#{project._id}")

26
services/web/app/coffee/Features/TokenAccess/TokenAccessHandler.coffee
View file

@ -10,7 +10,7 @@ module.exports = TokenAccessHandler =
Project.findOne { Project.findOne {
'tokens.readOnly': token, 'tokens.readOnly': token,
'publicAccesLevel': PublicAccessLevels.TOKEN_BASED 'publicAccesLevel': PublicAccessLevels.TOKEN_BASED
}, {_id: 1}, (err, project) -> }, {_id: 1, publicAccesLevel: 1}, (err, project) ->
return callback(err) if err? return callback(err) if err?
callback(null, project) callback(null, project)
@ -18,7 +18,7 @@ module.exports = TokenAccessHandler =
Project.findOne { Project.findOne {
'tokens.readAndWrite': token, 'tokens.readAndWrite': token,
'publicAccesLevel': PublicAccessLevels.TOKEN_BASED 'publicAccesLevel': PublicAccessLevels.TOKEN_BASED
}, {_id: 1}, (err, project) -> }, {_id: 1, publicAccesLevel: 1}, (err, project) ->
return callback(err) if err? return callback(err) if err?
callback(null, project) callback(null, project)
@ -42,13 +42,25 @@ module.exports = TokenAccessHandler =
}, (err) -> }, (err) ->
callback(err) callback(err)
grantAnonymousUserTokenAccessViaSession: (req, projectId) -> grantSessionReadOnlyTokenAccess: (req, projectId, token) ->
if req.session? if req.session?
if !req.session.anonReadOnlyTokenAccess? if !req.session.anonReadOnlyTokenAccess?
req.session.anonReadOnlyTokenAccess = {} req.session.anonReadOnlyTokenAccess = {}
req.session.anonReadOnlyTokenAccess[projectId.toString()] = true req.session.anonReadOnlyTokenAccess[projectId.toString()] = token.toString()
anonymousUserHasTokenAccessViaSession: (req, projectId) ->
req?.session?.anonReadOnlyTokenAccess?[projectId.toString()] == true
requestHasReadOnlyTokenAccess: (req, projectId, callback=(err, allowed)->) ->
token = (
req?.session?.anonReadOnlyTokenAccess?[projectId.toString()] or
req.headers['x-sl-anon-token']
)
if !token
return callback null, false
TokenAccessHandler.findProjectWithReadOnlyToken token, (err, project) ->
return callback(err) if err?
isAllowed = (
project? and
project.publicAccesLevel == PublicAccessLevels.TOKEN_BASED and
project._id.toString() == projectId.toString()
)
callback null, isAllowed

223
services/web/test/UnitTests/coffee/Authorization/AuthorizationManagerTests.coffee
View file

@ -5,6 +5,7 @@ expect = chai.expect
modulePath = "../../../../app/js/Features/Authorization/AuthorizationManager.js" modulePath = "../../../../app/js/Features/Authorization/AuthorizationManager.js"
SandboxedModule = require('sandboxed-module') SandboxedModule = require('sandboxed-module')
Errors = require "../../../../app/js/Features/Errors/Errors.js" Errors = require "../../../../app/js/Features/Errors/Errors.js"
MockRequest = require '../helpers/MockRequest'
describe "AuthorizationManager", -> describe "AuthorizationManager", ->
beforeEach -> beforeEach ->
@ -13,6 +14,9 @@ describe "AuthorizationManager", ->
"../../models/Project": Project: @Project = {} "../../models/Project": Project: @Project = {}
"../../models/User": User: @User = {} "../../models/User": User: @User = {}
"../Errors/Errors": Errors "../Errors/Errors": Errors
"../TokenAccess/TokenAccessHandler": @TokenAccessHandler = {
requestHasReadOnlyTokenAccess: sinon.stub().callsArgWith(2, null, false)
}
@user_id = "user-id-1" @user_id = "user-id-1"
@project_id = "project-id-1" @project_id = "project-id-1"
@callback = sinon.stub() @callback = sinon.stub()
@ -25,53 +29,54 @@ describe "AuthorizationManager", ->
describe "with a private project", -> describe "with a private project", ->
beforeEach -> beforeEach ->
@req = new MockRequest()
@Project.findOne @Project.findOne
.withArgs({ _id: @project_id }, { publicAccesLevel: 1 }) .withArgs({ _id: @project_id }, { publicAccesLevel: 1 })
.yields(null, { publicAccesLevel: "private" }) .yields(null, { publicAccesLevel: "private" })
describe "with a user_id with a privilege level", -> describe "with a user_id with a privilege level", ->
beforeEach -> beforeEach ->
@AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, false) @AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, false)
@CollaboratorsHandler.getMemberIdPrivilegeLevel @CollaboratorsHandler.getMemberIdPrivilegeLevel
.withArgs(@user_id, @project_id) .withArgs(@user_id, @project_id)
.yields(null, "readOnly") .yields(null, "readOnly")
@AuthorizationManager.getPrivilegeLevelForProject @user_id, @project_id, @callback @AuthorizationManager.getPrivilegeLevelForProject @req, @user_id, @project_id, @callback
it "should return the user's privilege level", -> it "should return the user's privilege level", ->
@callback.calledWith(null, "readOnly", false).should.equal true @callback.calledWith(null, "readOnly", false).should.equal true
describe "with a user_id with no privilege level", -> describe "with a user_id with no privilege level", ->
beforeEach -> beforeEach ->
@AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, false) @AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, false)
@CollaboratorsHandler.getMemberIdPrivilegeLevel @CollaboratorsHandler.getMemberIdPrivilegeLevel
.withArgs(@user_id, @project_id) .withArgs(@user_id, @project_id)
.yields(null, false) .yields(null, false)
@AuthorizationManager.getPrivilegeLevelForProject @user_id, @project_id, @callback @AuthorizationManager.getPrivilegeLevelForProject @req, @user_id, @project_id, @callback
it "should return false", -> it "should return false", ->
@callback.calledWith(null, false, false).should.equal true @callback.calledWith(null, false, false).should.equal true
describe "with a user_id who is an admin", -> describe "with a user_id who is an admin", ->
beforeEach -> beforeEach ->
@AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, true) @AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, true)
@CollaboratorsHandler.getMemberIdPrivilegeLevel @CollaboratorsHandler.getMemberIdPrivilegeLevel
.withArgs(@user_id, @project_id) .withArgs(@user_id, @project_id)
.yields(null, false) .yields(null, false)
@AuthorizationManager.getPrivilegeLevelForProject @user_id, @project_id, @callback @AuthorizationManager.getPrivilegeLevelForProject @req, @user_id, @project_id, @callback
it "should return the user as an owner", -> it "should return the user as an owner", ->
@callback.calledWith(null, "owner", false).should.equal true @callback.calledWith(null, "owner", false).should.equal true
describe "with no user (anonymous)", -> describe "with no user (anonymous)", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject null, @project_id, @callback @AuthorizationManager.getPrivilegeLevelForProject @req, null, @project_id, @callback
it "should not call CollaboratorsHandler.getMemberIdPrivilegeLevel", -> it "should not call CollaboratorsHandler.getMemberIdPrivilegeLevel", ->
@CollaboratorsHandler.getMemberIdPrivilegeLevel.called.should.equal false @CollaboratorsHandler.getMemberIdPrivilegeLevel.called.should.equal false
it "should not call AuthorizationManager.isUserSiteAdmin", -> it "should not call AuthorizationManager.isUserSiteAdmin", ->
@AuthorizationManager.isUserSiteAdmin.called.should.equal false @AuthorizationManager.isUserSiteAdmin.called.should.equal false
it "should return false", -> it "should return false", ->
@callback.calledWith(null, false, false).should.equal true @callback.calledWith(null, false, false).should.equal true
@ -80,61 +85,61 @@ describe "AuthorizationManager", ->
@Project.findOne @Project.findOne
.withArgs({ _id: @project_id }, { publicAccesLevel: 1 }) .withArgs({ _id: @project_id }, { publicAccesLevel: 1 })
.yields(null, { publicAccesLevel: "readAndWrite" }) .yields(null, { publicAccesLevel: "readAndWrite" })
describe "with a user_id with a privilege level", -> describe "with a user_id with a privilege level", ->
beforeEach -> beforeEach ->
@AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, false) @AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, false)
@CollaboratorsHandler.getMemberIdPrivilegeLevel @CollaboratorsHandler.getMemberIdPrivilegeLevel
.withArgs(@user_id, @project_id) .withArgs(@user_id, @project_id)
.yields(null, "readOnly") .yields(null, "readOnly")
@AuthorizationManager.getPrivilegeLevelForProject @user_id, @project_id, @callback @AuthorizationManager.getPrivilegeLevelForProject @req, @user_id, @project_id, @callback
it "should return the user's privilege level", -> it "should return the user's privilege level", ->
@callback.calledWith(null, "readOnly", false).should.equal true @callback.calledWith(null, "readOnly", false).should.equal true
describe "with a user_id with no privilege level", -> describe "with a user_id with no privilege level", ->
beforeEach -> beforeEach ->
@AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, false) @AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, false)
@CollaboratorsHandler.getMemberIdPrivilegeLevel @CollaboratorsHandler.getMemberIdPrivilegeLevel
.withArgs(@user_id, @project_id) .withArgs(@user_id, @project_id)
.yields(null, false) .yields(null, false)
@AuthorizationManager.getPrivilegeLevelForProject @user_id, @project_id, @callback @AuthorizationManager.getPrivilegeLevelForProject @req, @user_id, @project_id, @callback
it "should return the public privilege level", -> it "should return the public privilege level", ->
@callback.calledWith(null, "readAndWrite", true).should.equal true @callback.calledWith(null, "readAndWrite", true).should.equal true
describe "with a user_id who is an admin", -> describe "with a user_id who is an admin", ->
beforeEach -> beforeEach ->
@AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, true) @AuthorizationManager.isUserSiteAdmin.withArgs(@user_id).yields(null, true)
@CollaboratorsHandler.getMemberIdPrivilegeLevel @CollaboratorsHandler.getMemberIdPrivilegeLevel
.withArgs(@user_id, @project_id) .withArgs(@user_id, @project_id)
.yields(null, false) .yields(null, false)
@AuthorizationManager.getPrivilegeLevelForProject @user_id, @project_id, @callback @AuthorizationManager.getPrivilegeLevelForProject @req, @user_id, @project_id, @callback
it "should return the user as an owner", -> it "should return the user as an owner", ->
@callback.calledWith(null, "owner", false).should.equal true @callback.calledWith(null, "owner", false).should.equal true
describe "with no user (anonymous)", -> describe "with no user (anonymous)", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject null, @project_id, @callback @AuthorizationManager.getPrivilegeLevelForProject @req, null, @project_id, @callback
it "should not call CollaboratorsHandler.getMemberIdPrivilegeLevel", -> it "should not call CollaboratorsHandler.getMemberIdPrivilegeLevel", ->
@CollaboratorsHandler.getMemberIdPrivilegeLevel.called.should.equal false @CollaboratorsHandler.getMemberIdPrivilegeLevel.called.should.equal false
it "should not call AuthorizationManager.isUserSiteAdmin", -> it "should not call AuthorizationManager.isUserSiteAdmin", ->
@AuthorizationManager.isUserSiteAdmin.called.should.equal false @AuthorizationManager.isUserSiteAdmin.called.should.equal false
it "should return the public privilege level", -> it "should return the public privilege level", ->
@callback.calledWith(null, "readAndWrite", true).should.equal true @callback.calledWith(null, "readAndWrite", true).should.equal true
describe "when the project doesn't exist", -> describe "when the project doesn't exist", ->
beforeEach -> beforeEach ->
@Project.findOne @Project.findOne
.withArgs({ _id: @project_id }, { publicAccesLevel: 1 }) .withArgs({ _id: @project_id }, { publicAccesLevel: 1 })
.yields(null, null) .yields(null, null)
it "should return a NotFoundError", -> it "should return a NotFoundError", ->
@AuthorizationManager.getPrivilegeLevelForProject @user_id, @project_id, (error) -> @AuthorizationManager.getPrivilegeLevelForProject @req, @user_id, @project_id, (error) ->
error.should.be.instanceof Errors.NotFoundError error.should.be.instanceof Errors.NotFoundError
describe "when the project id is not valid", -> describe "when the project id is not valid", ->
@ -145,214 +150,218 @@ describe "AuthorizationManager", ->
.yields(null, "readOnly") .yields(null, "readOnly")
it "should return a error", (done)-> it "should return a error", (done)->
@AuthorizationManager.getPrivilegeLevelForProject undefined, "not project id", (err) => @AuthorizationManager.getPrivilegeLevelForProject @req, undefined, "not project id", (err) =>
@Project.findOne.called.should.equal false @Project.findOne.called.should.equal false
expect(err).to.exist expect(err).to.exist
done() done()
describe "canUserReadProject", -> describe "canUserReadProject", ->
beforeEach -> beforeEach ->
@req = new MockRequest()
@AuthorizationManager.getPrivilegeLevelForProject = sinon.stub() @AuthorizationManager.getPrivilegeLevelForProject = sinon.stub()
describe "when user is owner", -> describe "when user is owner", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "owner", false) .yields(null, "owner", false)
it "should return true", (done) -> it "should return true", (done) ->
@AuthorizationManager.canUserReadProject @user_id, @project_id, (error, canRead) -> @AuthorizationManager.canUserReadProject @req, @user_id, @project_id, (error, canRead) ->
expect(canRead).to.equal true expect(canRead).to.equal true
done() done()
describe "when user has read-write access", -> describe "when user has read-write access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "readAndWrite", false) .yields(null, "readAndWrite", false)
it "should return true", (done) -> it "should return true", (done) ->
@AuthorizationManager.canUserReadProject @user_id, @project_id, (error, canRead) -> @AuthorizationManager.canUserReadProject @req, @user_id, @project_id, (error, canRead) ->
expect(canRead).to.equal true expect(canRead).to.equal true
done() done()
describe "when user has read-only access", -> describe "when user has read-only access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "readOnly", false) .yields(null, "readOnly", false)
it "should return true", (done) -> it "should return true", (done) ->
@AuthorizationManager.canUserReadProject @user_id, @project_id, (error, canRead) -> @AuthorizationManager.canUserReadProject @req, @user_id, @project_id, (error, canRead) ->
expect(canRead).to.equal true expect(canRead).to.equal true
done() done()
describe "when user has no access", -> describe "when user has no access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, false, false) .yields(null, false, false)
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.canUserReadProject @user_id, @project_id, (error, canRead) -> @AuthorizationManager.canUserReadProject @req, @user_id, @project_id, (error, canRead) ->
expect(canRead).to.equal false expect(canRead).to.equal false
done() done()
describe "canUserWriteProjectContent", -> describe "canUserWriteProjectContent", ->
beforeEach -> beforeEach ->
@req = new MockRequest()
@AuthorizationManager.getPrivilegeLevelForProject = sinon.stub() @AuthorizationManager.getPrivilegeLevelForProject = sinon.stub()
describe "when user is owner", -> describe "when user is owner", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "owner", false) .yields(null, "owner", false)
it "should return true", (done) -> it "should return true", (done) ->
@AuthorizationManager.canUserWriteProjectContent @user_id, @project_id, (error, canWrite) -> @AuthorizationManager.canUserWriteProjectContent @req, @user_id, @project_id, (error, canWrite) ->
expect(canWrite).to.equal true expect(canWrite).to.equal true
done() done()
describe "when user has read-write access", -> describe "when user has read-write access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "readAndWrite", false) .yields(null, "readAndWrite", false)
it "should return true", (done) -> it "should return true", (done) ->
@AuthorizationManager.canUserWriteProjectContent @user_id, @project_id, (error, canWrite) -> @AuthorizationManager.canUserWriteProjectContent @req, @user_id, @project_id, (error, canWrite) ->
expect(canWrite).to.equal true expect(canWrite).to.equal true
done() done()
describe "when user has read-only access", -> describe "when user has read-only access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "readOnly", false) .yields(null, "readOnly", false)
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.canUserWriteProjectContent @user_id, @project_id, (error, canWrite) -> @AuthorizationManager.canUserWriteProjectContent @req, @user_id, @project_id, (error, canWrite) ->
expect(canWrite).to.equal false expect(canWrite).to.equal false
done() done()
describe "when user has no access", -> describe "when user has no access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, false, false) .yields(null, false, false)
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.canUserWriteProjectContent @user_id, @project_id, (error, canWrite) -> @AuthorizationManager.canUserWriteProjectContent @req, @user_id, @project_id, (error, canWrite) ->
expect(canWrite).to.equal false expect(canWrite).to.equal false
done() done()
describe "canUserWriteProjectSettings", -> describe "canUserWriteProjectSettings", ->
beforeEach -> beforeEach ->
@req = new MockRequest()
@AuthorizationManager.getPrivilegeLevelForProject = sinon.stub() @AuthorizationManager.getPrivilegeLevelForProject = sinon.stub()
describe "when user is owner", -> describe "when user is owner", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "owner", false) .yields(null, "owner", false)
it "should return true", (done) -> it "should return true", (done) ->
@AuthorizationManager.canUserWriteProjectSettings @user_id, @project_id, (error, canWrite) -> @AuthorizationManager.canUserWriteProjectSettings @req, @user_id, @project_id, (error, canWrite) ->
expect(canWrite).to.equal true expect(canWrite).to.equal true
done() done()
describe "when user has read-write access as a collaborator", -> describe "when user has read-write access as a collaborator", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "readAndWrite", false) .yields(null, "readAndWrite", false)
it "should return true", (done) -> it "should return true", (done) ->
@AuthorizationManager.canUserWriteProjectSettings @user_id, @project_id, (error, canWrite) -> @AuthorizationManager.canUserWriteProjectSettings @req, @user_id, @project_id, (error, canWrite) ->
expect(canWrite).to.equal true expect(canWrite).to.equal true
done() done()
describe "when user has read-write access as the public", -> describe "when user has read-write access as the public", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "readAndWrite", true) .yields(null, "readAndWrite", true)
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.canUserWriteProjectSettings @user_id, @project_id, (error, canWrite) -> @AuthorizationManager.canUserWriteProjectSettings @req, @user_id, @project_id, (error, canWrite) ->
expect(canWrite).to.equal false expect(canWrite).to.equal false
done() done()
describe "when user has read-only access", -> describe "when user has read-only access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "readOnly", false) .yields(null, "readOnly", false)
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.canUserWriteProjectSettings @user_id, @project_id, (error, canWrite) -> @AuthorizationManager.canUserWriteProjectSettings @req, @user_id, @project_id, (error, canWrite) ->
expect(canWrite).to.equal false expect(canWrite).to.equal false
done() done()
describe "when user has no access", -> describe "when user has no access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, false, false) .yields(null, false, false)
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.canUserWriteProjectSettings @user_id, @project_id, (error, canWrite) -> @AuthorizationManager.canUserWriteProjectSettings @req, @user_id, @project_id, (error, canWrite) ->
expect(canWrite).to.equal false expect(canWrite).to.equal false
done() done()
describe "canUserAdminProject", -> describe "canUserAdminProject", ->
beforeEach -> beforeEach ->
@req = new MockRequest()
@AuthorizationManager.getPrivilegeLevelForProject = sinon.stub() @AuthorizationManager.getPrivilegeLevelForProject = sinon.stub()
describe "when user is owner", -> describe "when user is owner", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "owner", false) .yields(null, "owner", false)
it "should return true", (done) -> it "should return true", (done) ->
@AuthorizationManager.canUserAdminProject @user_id, @project_id, (error, canAdmin) -> @AuthorizationManager.canUserAdminProject @req, @user_id, @project_id, (error, canAdmin) ->
expect(canAdmin).to.equal true expect(canAdmin).to.equal true
done() done()
describe "when user has read-write access", -> describe "when user has read-write access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "readAndWrite", false) .yields(null, "readAndWrite", false)
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.canUserAdminProject @user_id, @project_id, (error, canAdmin) -> @AuthorizationManager.canUserAdminProject @req, @user_id, @project_id, (error, canAdmin) ->
expect(canAdmin).to.equal false expect(canAdmin).to.equal false
done() done()
describe "when user has read-only access", -> describe "when user has read-only access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, "readOnly", false) .yields(null, "readOnly", false)
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.canUserAdminProject @user_id, @project_id, (error, canAdmin) -> @AuthorizationManager.canUserAdminProject @req, @user_id, @project_id, (error, canAdmin) ->
expect(canAdmin).to.equal false expect(canAdmin).to.equal false
done() done()
describe "when user has no access", -> describe "when user has no access", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.withArgs(@user_id, @project_id) .withArgs(@req, @user_id, @project_id)
.yields(null, false, false) .yields(null, false, false)
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.canUserAdminProject @user_id, @project_id, (error, canAdmin) -> @AuthorizationManager.canUserAdminProject @req, @user_id, @project_id, (error, canAdmin) ->
expect(canAdmin).to.equal false expect(canAdmin).to.equal false
done() done()
describe "isUserSiteAdmin", -> describe "isUserSiteAdmin", ->
beforeEach -> beforeEach ->
@User.findOne = sinon.stub() @User.findOne = sinon.stub()
@ -362,34 +371,34 @@ describe "AuthorizationManager", ->
@User.findOne @User.findOne
.withArgs({ _id: @user_id }, { isAdmin: 1 }) .withArgs({ _id: @user_id }, { isAdmin: 1 })
.yields(null, { isAdmin: true }) .yields(null, { isAdmin: true })
it "should return true", (done) -> it "should return true", (done) ->
@AuthorizationManager.isUserSiteAdmin @user_id, (error, isAdmin) -> @AuthorizationManager.isUserSiteAdmin @user_id, (error, isAdmin) ->
expect(isAdmin).to.equal true expect(isAdmin).to.equal true
done() done()
describe "when user is not admin", -> describe "when user is not admin", ->
beforeEach -> beforeEach ->
@User.findOne @User.findOne
.withArgs({ _id: @user_id }, { isAdmin: 1 }) .withArgs({ _id: @user_id }, { isAdmin: 1 })
.yields(null, { isAdmin: false }) .yields(null, { isAdmin: false })
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.isUserSiteAdmin @user_id, (error, isAdmin) -> @AuthorizationManager.isUserSiteAdmin @user_id, (error, isAdmin) ->
expect(isAdmin).to.equal false expect(isAdmin).to.equal false
done() done()
describe "when user is not found", -> describe "when user is not found", ->
beforeEach -> beforeEach ->
@User.findOne @User.findOne
.withArgs({ _id: @user_id }, { isAdmin: 1 }) .withArgs({ _id: @user_id }, { isAdmin: 1 })
.yields(null, null) .yields(null, null)
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.isUserSiteAdmin @user_id, (error, isAdmin) -> @AuthorizationManager.isUserSiteAdmin @user_id, (error, isAdmin) ->
expect(isAdmin).to.equal false expect(isAdmin).to.equal false
done() done()
describe "when no user is passed", -> describe "when no user is passed", ->
it "should return false", (done) -> it "should return false", (done) ->
@AuthorizationManager.isUserSiteAdmin null, (error, isAdmin) => @AuthorizationManager.isUserSiteAdmin null, (error, isAdmin) =>

24
services/web/test/UnitTests/coffee/Authorization/AuthorizationMiddlewearTests.coffee
View file

@ -55,7 +55,7 @@ describe "AuthorizationMiddlewear", ->
describe "when user has permission", -> describe "when user has permission", ->
beforeEach -> beforeEach ->
@AuthorizationManager[managerMethod] @AuthorizationManager[managerMethod]
.withArgs(@user_id, @project_id) .withArgs(sinon.match.any, @user_id, @project_id)
.yields(null, true) .yields(null, true)
it "should return next", -> it "should return next", ->
@ -65,7 +65,7 @@ describe "AuthorizationMiddlewear", ->
describe "when user doesn't have permission", -> describe "when user doesn't have permission", ->
beforeEach -> beforeEach ->
@AuthorizationManager[managerMethod] @AuthorizationManager[managerMethod]
.withArgs(@user_id, @project_id) .withArgs(sinon.match.any, @user_id, @project_id)
.yields(null, false) .yields(null, false)
it "should redirect to redirectToRestricted", -> it "should redirect to redirectToRestricted", ->
@ -80,7 +80,7 @@ describe "AuthorizationMiddlewear", ->
beforeEach -> beforeEach ->
@AuthenticationController.getLoggedInUserId.returns(null) @AuthenticationController.getLoggedInUserId.returns(null)
@AuthorizationManager[managerMethod] @AuthorizationManager[managerMethod]
.withArgs(null, @project_id) .withArgs(@req, null, @project_id)
.yields(null, true) .yields(null, true)
it "should return next", -> it "should return next", ->
@ -91,7 +91,7 @@ describe "AuthorizationMiddlewear", ->
beforeEach -> beforeEach ->
@AuthenticationController.getLoggedInUserId.returns(null) @AuthenticationController.getLoggedInUserId.returns(null)
@AuthorizationManager[managerMethod] @AuthorizationManager[managerMethod]
.withArgs(null, @project_id) .withArgs(@req, null, @project_id)
.yields(null, false) .yields(null, false)
it "should redirect to redirectToRestricted", -> it "should redirect to redirectToRestricted", ->
@ -184,10 +184,10 @@ describe "AuthorizationMiddlewear", ->
describe "when user has permission to access all projects", -> describe "when user has permission to access all projects", ->
beforeEach -> beforeEach ->
@AuthorizationManager.canUserReadProject @AuthorizationManager.canUserReadProject
.withArgs(@user_id, "project1") .withArgs(sinon.match.any, @user_id, "project1")
.yields(null, true) .yields(null, true)
@AuthorizationManager.canUserReadProject @AuthorizationManager.canUserReadProject
.withArgs(@user_id, "project2") .withArgs(sinon.match.any, @user_id, "project2")
.yields(null, true) .yields(null, true)
it "should return next", -> it "should return next", ->
@ -197,10 +197,10 @@ describe "AuthorizationMiddlewear", ->
describe "when user doesn't have permission to access one of the projects", -> describe "when user doesn't have permission to access one of the projects", ->
beforeEach -> beforeEach ->
@AuthorizationManager.canUserReadProject @AuthorizationManager.canUserReadProject
.withArgs(@user_id, "project1") .withArgs(sinon.match.any, @user_id, "project1")
.yields(null, true) .yields(null, true)
@AuthorizationManager.canUserReadProject @AuthorizationManager.canUserReadProject
.withArgs(@user_id, "project2") .withArgs(sinon.match.any, @user_id, "project2")
.yields(null, false) .yields(null, false)
it "should redirect to redirectToRestricted", -> it "should redirect to redirectToRestricted", ->
@ -216,10 +216,10 @@ describe "AuthorizationMiddlewear", ->
beforeEach -> beforeEach ->
@AuthenticationController.getLoggedInUserId.returns(null) @AuthenticationController.getLoggedInUserId.returns(null)
@AuthorizationManager.canUserReadProject @AuthorizationManager.canUserReadProject
.withArgs(null, "project1") .withArgs(sinon.match.any, null, "project1")
.yields(null, true) .yields(null, true)
@AuthorizationManager.canUserReadProject @AuthorizationManager.canUserReadProject
.withArgs(null, "project2") .withArgs(sinon.match.any, null, "project2")
.yields(null, true) .yields(null, true)
it "should return next", -> it "should return next", ->
@ -230,10 +230,10 @@ describe "AuthorizationMiddlewear", ->
beforeEach -> beforeEach ->
@AuthenticationController.getLoggedInUserId.returns(null) @AuthenticationController.getLoggedInUserId.returns(null)
@AuthorizationManager.canUserReadProject @AuthorizationManager.canUserReadProject
.withArgs(null, "project1") .withArgs(sinon.match.any, null, "project1")
.yields(null, true) .yields(null, true)
@AuthorizationManager.canUserReadProject @AuthorizationManager.canUserReadProject
.withArgs(null, "project2") .withArgs(sinon.match.any, null, "project2")
.yields(null, false) .yields(null, false)
it "should redirect to redirectToRestricted", -> it "should redirect to redirectToRestricted", ->

16
services/web/test/UnitTests/coffee/Editor/EditorHttpControllerTests.coffee
View file

@ -39,7 +39,7 @@ describe "EditorHttpController", ->
@projectView = { @projectView = {
_id: @project_id _id: @project_id
} }
@EditorHttpController._buildJoinProjectView = sinon.stub().callsArgWith(2, null, @projectView, "owner") @EditorHttpController._buildJoinProjectView = sinon.stub().callsArgWith(3, null, @projectView, "owner")
@ProjectDeleter.unmarkAsDeletedByExternalSource = sinon.stub() @ProjectDeleter.unmarkAsDeletedByExternalSource = sinon.stub()
describe "successfully", -> describe "successfully", ->
@ -48,7 +48,7 @@ describe "EditorHttpController", ->
it "should get the project view", -> it "should get the project view", ->
@EditorHttpController._buildJoinProjectView @EditorHttpController._buildJoinProjectView
.calledWith(@project_id, @user_id) .calledWith(@req, @project_id, @user_id)
.should.equal true .should.equal true
it "should return the project and privilege level", -> it "should return the project and privilege level", ->
@ -87,7 +87,7 @@ describe "EditorHttpController", ->
it "should pass the user id as null", -> it "should pass the user id as null", ->
@EditorHttpController._buildJoinProjectView @EditorHttpController._buildJoinProjectView
.calledWith(@project_id, null) .calledWith(@req, @project_id, null)
.should.equal true .should.equal true
describe "_buildJoinProjectView", -> describe "_buildJoinProjectView", ->
@ -116,8 +116,8 @@ describe "EditorHttpController", ->
describe "when authorized", -> describe "when authorized", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject = @AuthorizationManager.getPrivilegeLevelForProject =
sinon.stub().callsArgWith(2, null, "owner") sinon.stub().callsArgWith(3, null, "owner")
@EditorHttpController._buildJoinProjectView(@project_id, @user_id, @callback) @EditorHttpController._buildJoinProjectView(@req, @project_id, @user_id, @callback)
it "should find the project without doc lines", -> it "should find the project without doc lines", ->
@ProjectGetter.getProjectWithoutDocLines @ProjectGetter.getProjectWithoutDocLines
@ -136,7 +136,7 @@ describe "EditorHttpController", ->
it "should check the privilege level", -> it "should check the privilege level", ->
@AuthorizationManager.getPrivilegeLevelForProject @AuthorizationManager.getPrivilegeLevelForProject
.calledWith(@user_id, @project_id) .calledWith(@req, @user_id, @project_id)
.should.equal true .should.equal true
it 'should include the invites', -> it 'should include the invites', ->
@ -150,8 +150,8 @@ describe "EditorHttpController", ->
describe "when not authorized", -> describe "when not authorized", ->
beforeEach -> beforeEach ->
@AuthorizationManager.getPrivilegeLevelForProject = @AuthorizationManager.getPrivilegeLevelForProject =
sinon.stub().callsArgWith(2, null, null) sinon.stub().callsArgWith(3, null, null)
@EditorHttpController._buildJoinProjectView(@project_id, @user_id, @callback) @EditorHttpController._buildJoinProjectView(@req, @project_id, @user_id, @callback)
it "should return false in the callback", -> it "should return false in the callback", ->
@callback.calledWith(null, null, false).should.equal true @callback.calledWith(null, null, false).should.equal true

4
services/web/test/UnitTests/coffee/Project/ProjectControllerTests.coffee
View file

@ -302,7 +302,7 @@ describe "ProjectController", ->
@ProjectGetter.getProject.callsArgWith 2, null, @project @ProjectGetter.getProject.callsArgWith 2, null, @project
@UserModel.findById.callsArgWith(1, null, @user) @UserModel.findById.callsArgWith(1, null, @user)
@SubscriptionLocator.getUsersSubscription.callsArgWith(1, null, {}) @SubscriptionLocator.getUsersSubscription.callsArgWith(1, null, {})
@AuthorizationManager.getPrivilegeLevelForProject.callsArgWith 2, null, "owner" @AuthorizationManager.getPrivilegeLevelForProject.callsArgWith 3, null, "owner"
@ProjectDeleter.unmarkAsDeletedByExternalSource = sinon.stub() @ProjectDeleter.unmarkAsDeletedByExternalSource = sinon.stub()
@InactiveProjectManager.reactivateProjectIfRequired.callsArgWith(1) @InactiveProjectManager.reactivateProjectIfRequired.callsArgWith(1)
@AnalyticsManager.getLastOccurance.yields(null, {"mock": "event"}) @AnalyticsManager.getLastOccurance.yields(null, {"mock": "event"})
@ -335,7 +335,7 @@ describe "ProjectController", ->
@ProjectController.loadEditor @req, @res @ProjectController.loadEditor @req, @res
it "should not render the page if the project can not be accessed", (done)-> it "should not render the page if the project can not be accessed", (done)->
@AuthorizationManager.getPrivilegeLevelForProject = sinon.stub().callsArgWith 2, null, null @AuthorizationManager.getPrivilegeLevelForProject = sinon.stub().callsArgWith 3, null, null
@res.sendStatus = (resCode, opts)=> @res.sendStatus = (resCode, opts)=>
resCode.should.equal 401 resCode.should.equal 401
done() done()