github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2025-04-27 13:42:45 +00:00
Code Issues Projects Releases Packages Wiki Activity

Validate privilege levels when sending /invite request (#23533)

Browse source 
* Validate privilege levels when sending /invite request

* add acceptance tests

GitOrigin-RevId: 4ccd0ad3504c3c5770f5ee2b2f6d34ef746d1430
This commit is contained in:
Domagoj Kriskovic 2025-02-13 10:20:07 +01:00 • committed by Copybot
parent d2738fda73
commit 8183c0785c
2 changed files with 66 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
services/web/app/src/Features/Collaborators/CollaboratorsRouter.mjs
View file

@ -103,6 +103,18 @@ export default {
}),
CaptchaMiddleware.validateCaptcha('invite'),
AuthenticationController.requireLogin(),
validate({
body: Joi.object({
email: Joi.string().required(),
privileges: Joi.string()
.valid(
PrivilegeLevels.READ_ONLY,
PrivilegeLevels.READ_AND_WRITE,
PrivilegeLevels.REVIEW
)
.required(),
}),
}),
AuthorizationMiddleware.ensureUserCanAdminProject,
CollaboratorsInviteController.inviteToProject
)

54
services/web/test/acceptance/src/ProjectInviteTests.mjs
View file

@ -361,6 +361,60 @@ describe('ProjectInviteTests', function () {
)
})
it('should fail if email is not a string', function (done) {
this.sendingUser.getCsrfToken(err => {
if (err) {
return done(err)
}
this.sendingUser.request.post(
{
uri: `/project/${this.projectId}/invite`,
json: {
email: {},
privileges: 'readAndWrite',
},
},
(err, response, body) => {
if (err) {
return done(err)
}
expect(response.statusCode).to.equal(400)
expect(response.body.validation.body.message).to.equal(
'"email" must be a string'
)
done()
}
)
})
})
it('should fail on invalid privileges', function (done) {
this.sendingUser.getCsrfToken(err => {
if (err) {
return done(err)
}
this.sendingUser.request.post(
{
uri: `/project/${this.projectId}/invite`,
json: {
email: this.email,
privileges: 'invalid-privilege',
},
},
(err, response, body) => {
if (err) {
return done(err)
}
expect(response.statusCode).to.equal(400)
expect(response.body.validation.body.message).to.equal(
'"privileges" must be one of [readOnly, readAndWrite, review]'
)
done()
}
)
})
})
it('should allow the project owner to create and remove invites', function (done) {
Async.series(
[