github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-11-21 20:47:08 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #11353 from overleaf/jk-remove-deprecated-public-access-levels

Browse source 
[web] Disallow deprecated access levels from being set

GitOrigin-RevId: cf276e849692be210a2dc7d896820579efc46952
This commit is contained in:
June Kelly 2023-02-01 11:06:14 +00:00 committed by Copybot
parent be7b424a63
commit ac83dd9bb3
5 changed files with 28 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
services/web/app/src/Features/Authorization/PublicAccessLevels.js
View file

@ -1,3 +1,14 @@
/**
* Note:
* It used to be that `project.publicAccessLevel` could be set to `private`,
* `readOnly` or `readAndWrite`, the latter of which made the project publicly
* accessible.
*
* This system was replaced with "link sharing", therafter the valid values are
* `private` or `tokenBased`. While it is no longer possible to set
* `publicAccessLevel` to the legacy values, there are projects in the system
* that already have those values set.
*/
module.exports = {
READ_ONLY: 'readOnly', // LEGACY
READ_AND_WRITE: 'readAndWrite', // LEGACY

9
services/web/app/src/Features/Project/ProjectDetailsHandler.js
View file

@ -181,18 +181,11 @@ function fixProjectName(name) {
}
async function setPublicAccessLevel(projectId, newAccessLevel) {
// DEPRECATED: `READ_ONLY` and `READ_AND_WRITE` are still valid in, but should no longer
// be passed here. Remove after token-based access has been live for a while
if (
projectId != null &&
newAccessLevel != null &&
_.include(
[
PublicAccessLevels.READ_ONLY,
PublicAccessLevels.READ_AND_WRITE,
PublicAccessLevels.PRIVATE,
PublicAccessLevels.TOKEN_BASED,
],
[PublicAccessLevels.PRIVATE, PublicAccessLevels.TOKEN_BASED],
newAccessLevel
)
) {

8
services/web/test/acceptance/src/AuthorizationTests.js
View file

@ -633,6 +633,10 @@ describe('Authorization', function () {
})
describe('public read-write project', function () {
/**
* Note: this is a test for the legacy "public access" feature.
* See documentation comment in `Authorization/PublicAccessLevels`
* */
beforeEach(function (done) {
this.owner.createProject('public-rw-project', (error, projectId) => {
if (error != null) {
@ -693,6 +697,10 @@ describe('Authorization', function () {
})
describe('public read-only project', function () {
/**
* Note: this is a test for the legacy "public access" feature.
* See documentation comment in `Authorization/PublicAccessLevels`
* */
beforeEach(function (done) {
this.owner.createProject('public-ro-project', (error, projectId) => {
if (error != null) {

20
services/web/test/acceptance/src/helpers/User.js
View file

@ -624,19 +624,13 @@ class User {
}
makePublic(projectId, level, callback) {
this.request.post(
{
url: `/project/${projectId}/settings/admin`,
json: {
publicAccessLevel: level,
},
},
(error, response, body) => {
if (error != null) {
return callback(error)
}
callback(null)
}
// A fudge, to get around the fact that `readOnly` and `readAndWrite` are now disallowed
// via the API, but we still need to test the behaviour of projects with these values set.
db.projects.updateOne(
{ _id: ObjectId(projectId) },
// NOTE: Yes, there is a typo in the db schema.
{ $set: { publicAccesLevel: level } },
callback
)
}

2
services/web/test/unit/src/Project/ProjectDetailsHandlerTests.js
View file

@ -443,7 +443,7 @@ describe('ProjectDetailsHandler', function () {
describe('setPublicAccessLevel', function () {
beforeEach(function () {
this.accessLevel = 'readOnly'
this.accessLevel = 'tokenBased'
})
it('should update the project with the new level', async function () {