github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-09-16 02:52:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #6729 from overleaf/jpa-cleanup-staff-access

Browse source 
[web] admin privilege does not imply staffAccess

GitOrigin-RevId: 89760c7a9a8f0b0c82ebee40ca3236e9894ab9fa
This commit is contained in:
Jakob Ackermann 2022-03-31 11:35:51 +01:00 committed by Copybot
parent d59b154f07
commit c881829e04
3 changed files with 1 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
services/web/app/src/Features/Helpers/AuthorizationHelper.js
View file

@ -1,14 +1,10 @@
const { UserSchema } = require('../../models/User')
const { hasAdminAccess } = require('./AdminAuthorizationHelper')
module.exports = {
hasAnyStaffAccess,
}
function hasAnyStaffAccess(user) {
if (hasAdminAccess(user)) {
return true
}
if (!user.staffAccess) {
return false
}

4
services/web/app/src/Features/UserMembership/UserMembershipAuthorization.js
View file

@ -1,13 +1,9 @@
const { hasAdminAccess } = require('../Helpers/AdminAuthorizationHelper')
const UserMembershipAuthorization = {
hasStaffAccess(requiredStaffAccess) {
return req => {
if (!req.user) {
return false
}
if (hasAdminAccess(req.user)) {
return true
}
return (
requiredStaffAccess &&
req.user.staffAccess &&

2
services/web/test/unit/src/HelperFiles/AuthorizationHelperTests.js
View file

@ -43,7 +43,7 @@ describe('AuthorizationHelper', function () {
it('with admin user', function () {
const user = { isAdmin: true }
this.AdminAuthorizationHelper.hasAdminAccess.returns(true)
expect(this.AuthorizationHelper.hasAnyStaffAccess(user)).to.be.true
expect(this.AuthorizationHelper.hasAnyStaffAccess(user)).to.be.false
})
it('with staff user', function () {