mirror of
https://github.com/overleaf/overleaf.git
synced 2024-10-24 21:12:38 -04:00
757ae39487
Decaf cleanup: Remove implicit return from 'it' and 'describe' in tests GitOrigin-RevId: f297820e6212dddc0d60697a2fe1612ef27403b6
440 lines
15 KiB
JavaScript
440 lines
15 KiB
JavaScript
/* eslint-disable
|
|
camelcase,
|
|
max-len,
|
|
no-return-assign,
|
|
no-unused-vars,
|
|
*/
|
|
// TODO: This file was created by bulk-decaffeinate.
|
|
// Fix any style issues and re-enable lint.
|
|
/*
|
|
* decaffeinate suggestions:
|
|
* DS102: Remove unnecessary code created because of implicit returns
|
|
* Full docs: https://github.com/decaffeinate/decaffeinate/blob/master/docs/suggestions.md
|
|
*/
|
|
const sinon = require('sinon')
|
|
const chai = require('chai')
|
|
const should = chai.should()
|
|
const { expect } = chai
|
|
const modulePath =
|
|
'../../../../app/src/Features/Authorization/AuthorizationMiddleware.js'
|
|
const SandboxedModule = require('sandboxed-module')
|
|
const Errors = require('../../../../app/src/Features/Errors/Errors.js')
|
|
|
|
describe('AuthorizationMiddleware', function() {
|
|
beforeEach(function() {
|
|
this.user_id = 'user-id-123'
|
|
this.project_id = 'project-id-123'
|
|
this.token = 'some-token'
|
|
this.AuthenticationController = {
|
|
getLoggedInUserId: sinon.stub().returns(this.user_id),
|
|
isUserLoggedIn: sinon.stub().returns(true)
|
|
}
|
|
this.AuthorizationMiddleware = SandboxedModule.require(modulePath, {
|
|
requires: {
|
|
'./AuthorizationManager': (this.AuthorizationManager = {}),
|
|
'logger-sharelatex': { log() {} },
|
|
mongojs: {
|
|
ObjectId: (this.ObjectId = {})
|
|
},
|
|
'../Errors/Errors': Errors,
|
|
'../Authentication/AuthenticationController': this
|
|
.AuthenticationController,
|
|
'../TokenAccess/TokenAccessHandler': (this.TokenAccessHandler = {
|
|
getRequestToken: sinon.stub().returns(this.token)
|
|
})
|
|
}
|
|
})
|
|
this.req = {}
|
|
this.res = {}
|
|
this.ObjectId.isValid = sinon.stub()
|
|
this.ObjectId.isValid.withArgs(this.project_id).returns(true)
|
|
return (this.next = sinon.stub())
|
|
})
|
|
|
|
describe('_getUserId', function() {
|
|
beforeEach(function() {
|
|
return (this.req = {})
|
|
})
|
|
|
|
it('should get the user from session', function(done) {
|
|
this.AuthenticationController.getLoggedInUserId = sinon
|
|
.stub()
|
|
.returns('1234')
|
|
return this.AuthorizationMiddleware._getUserId(
|
|
this.req,
|
|
(err, user_id) => {
|
|
expect(err).to.not.exist
|
|
expect(user_id).to.equal('1234')
|
|
return done()
|
|
}
|
|
)
|
|
})
|
|
|
|
it('should get oauth_user from request', function(done) {
|
|
this.AuthenticationController.getLoggedInUserId = sinon
|
|
.stub()
|
|
.returns(null)
|
|
this.req.oauth_user = { _id: '5678' }
|
|
return this.AuthorizationMiddleware._getUserId(
|
|
this.req,
|
|
(err, user_id) => {
|
|
expect(err).to.not.exist
|
|
expect(user_id).to.equal('5678')
|
|
return done()
|
|
}
|
|
)
|
|
})
|
|
|
|
it('should fall back to null', function(done) {
|
|
this.AuthenticationController.getLoggedInUserId = sinon
|
|
.stub()
|
|
.returns(null)
|
|
this.req.oauth_user = undefined
|
|
return this.AuthorizationMiddleware._getUserId(
|
|
this.req,
|
|
(err, user_id) => {
|
|
expect(err).to.not.exist
|
|
expect(user_id).to.equal(null)
|
|
return done()
|
|
}
|
|
)
|
|
})
|
|
})
|
|
|
|
const METHODS_TO_TEST = {
|
|
ensureUserCanReadProject: 'canUserReadProject',
|
|
ensureUserCanWriteProjectSettings: 'canUserWriteProjectSettings',
|
|
ensureUserCanWriteProjectContent: 'canUserWriteProjectContent',
|
|
ensureUserCanAdminProject: 'canUserAdminProject'
|
|
}
|
|
for (let middlewareMethod in METHODS_TO_TEST) {
|
|
const managerMethod = METHODS_TO_TEST[middlewareMethod]
|
|
;((middlewareMethod, managerMethod) =>
|
|
describe(middlewareMethod, function() {
|
|
beforeEach(function() {
|
|
this.req.params = { project_id: this.project_id }
|
|
this.AuthorizationManager[managerMethod] = sinon.stub()
|
|
return (this.AuthorizationMiddleware.redirectToRestricted = sinon.stub())
|
|
})
|
|
|
|
describe('with missing project_id', function() {
|
|
beforeEach(function() {
|
|
return (this.req.params = {})
|
|
})
|
|
|
|
it('should return an error to next', function() {
|
|
this.AuthorizationMiddleware[middlewareMethod](
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
return this.next.calledWith(new Error()).should.equal(true)
|
|
})
|
|
})
|
|
|
|
describe('with logged in user', function() {
|
|
beforeEach(function() {
|
|
return this.AuthenticationController.getLoggedInUserId.returns(
|
|
this.user_id
|
|
)
|
|
})
|
|
|
|
describe('when user has permission', function() {
|
|
beforeEach(function() {
|
|
return this.AuthorizationManager[managerMethod]
|
|
.withArgs(this.user_id, this.project_id, this.token)
|
|
.yields(null, true)
|
|
})
|
|
|
|
it('should return next', function() {
|
|
this.AuthorizationMiddleware[middlewareMethod](
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
return this.next.called.should.equal(true)
|
|
})
|
|
})
|
|
|
|
describe("when user doesn't have permission", function() {
|
|
beforeEach(function() {
|
|
return this.AuthorizationManager[managerMethod]
|
|
.withArgs(this.user_id, this.project_id, this.token)
|
|
.yields(null, false)
|
|
})
|
|
|
|
it('should redirect to redirectToRestricted', function() {
|
|
this.AuthorizationMiddleware[middlewareMethod](
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
this.next.called.should.equal(false)
|
|
return this.AuthorizationMiddleware.redirectToRestricted
|
|
.calledWith(this.req, this.res, this.next)
|
|
.should.equal(true)
|
|
})
|
|
})
|
|
})
|
|
|
|
describe('with anonymous user', function() {
|
|
describe('when user has permission', function() {
|
|
beforeEach(function() {
|
|
this.AuthenticationController.getLoggedInUserId.returns(null)
|
|
return this.AuthorizationManager[managerMethod]
|
|
.withArgs(null, this.project_id, this.token)
|
|
.yields(null, true)
|
|
})
|
|
|
|
it('should return next', function() {
|
|
this.AuthorizationMiddleware[middlewareMethod](
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
return this.next.called.should.equal(true)
|
|
})
|
|
})
|
|
|
|
describe("when user doesn't have permission", function() {
|
|
beforeEach(function() {
|
|
this.AuthenticationController.getLoggedInUserId.returns(null)
|
|
return this.AuthorizationManager[managerMethod]
|
|
.withArgs(null, this.project_id, this.token)
|
|
.yields(null, false)
|
|
})
|
|
|
|
it('should redirect to redirectToRestricted', function() {
|
|
this.AuthorizationMiddleware[middlewareMethod](
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
this.next.called.should.equal(false)
|
|
return this.AuthorizationMiddleware.redirectToRestricted
|
|
.calledWith(this.req, this.res, this.next)
|
|
.should.equal(true)
|
|
})
|
|
})
|
|
})
|
|
|
|
describe('with malformed project id', function() {
|
|
beforeEach(function() {
|
|
this.req.params = { project_id: 'blah' }
|
|
return (this.ObjectId.isValid = sinon.stub().returns(false))
|
|
})
|
|
|
|
it('should return a not found error', function(done) {
|
|
return this.AuthorizationMiddleware[middlewareMethod](
|
|
this.req,
|
|
this.res,
|
|
function(error) {
|
|
error.should.be.instanceof(Errors.NotFoundError)
|
|
return done()
|
|
}
|
|
)
|
|
})
|
|
})
|
|
}))(middlewareMethod, managerMethod)
|
|
}
|
|
|
|
describe('ensureUserIsSiteAdmin', function() {
|
|
beforeEach(function() {
|
|
this.AuthorizationManager.isUserSiteAdmin = sinon.stub()
|
|
return (this.AuthorizationMiddleware.redirectToRestricted = sinon.stub())
|
|
})
|
|
|
|
describe('with logged in user', function() {
|
|
beforeEach(function() {
|
|
return this.AuthenticationController.getLoggedInUserId.returns(
|
|
this.user_id
|
|
)
|
|
})
|
|
|
|
describe('when user has permission', function() {
|
|
beforeEach(function() {
|
|
return this.AuthorizationManager.isUserSiteAdmin
|
|
.withArgs(this.user_id)
|
|
.yields(null, true)
|
|
})
|
|
|
|
it('should return next', function() {
|
|
this.AuthorizationMiddleware.ensureUserIsSiteAdmin(
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
return this.next.called.should.equal(true)
|
|
})
|
|
})
|
|
|
|
describe("when user doesn't have permission", function() {
|
|
beforeEach(function() {
|
|
return this.AuthorizationManager.isUserSiteAdmin
|
|
.withArgs(this.user_id)
|
|
.yields(null, false)
|
|
})
|
|
|
|
it('should redirect to redirectToRestricted', function() {
|
|
this.AuthorizationMiddleware.ensureUserIsSiteAdmin(
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
this.next.called.should.equal(false)
|
|
return this.AuthorizationMiddleware.redirectToRestricted
|
|
.calledWith(this.req, this.res, this.next)
|
|
.should.equal(true)
|
|
})
|
|
})
|
|
})
|
|
|
|
describe('with anonymous user', function() {
|
|
describe('when user has permission', function() {
|
|
beforeEach(function() {
|
|
this.AuthenticationController.getLoggedInUserId.returns(null)
|
|
return this.AuthorizationManager.isUserSiteAdmin
|
|
.withArgs(null)
|
|
.yields(null, true)
|
|
})
|
|
|
|
it('should return next', function() {
|
|
this.AuthorizationMiddleware.ensureUserIsSiteAdmin(
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
return this.next.called.should.equal(true)
|
|
})
|
|
})
|
|
|
|
describe("when user doesn't have permission", function() {
|
|
beforeEach(function() {
|
|
this.AuthenticationController.getLoggedInUserId.returns(null)
|
|
return this.AuthorizationManager.isUserSiteAdmin
|
|
.withArgs(null)
|
|
.yields(null, false)
|
|
})
|
|
|
|
it('should redirect to redirectToRestricted', function() {
|
|
this.AuthorizationMiddleware.ensureUserIsSiteAdmin(
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
this.next.called.should.equal(false)
|
|
return this.AuthorizationMiddleware.redirectToRestricted
|
|
.calledWith(this.req, this.res, this.next)
|
|
.should.equal(true)
|
|
})
|
|
})
|
|
})
|
|
})
|
|
|
|
describe('ensureUserCanReadMultipleProjects', function() {
|
|
beforeEach(function() {
|
|
this.AuthorizationManager.canUserReadProject = sinon.stub()
|
|
this.AuthorizationMiddleware.redirectToRestricted = sinon.stub()
|
|
return (this.req.query = { project_ids: 'project1,project2' })
|
|
})
|
|
|
|
describe('with logged in user', function() {
|
|
beforeEach(function() {
|
|
return this.AuthenticationController.getLoggedInUserId.returns(
|
|
this.user_id
|
|
)
|
|
})
|
|
|
|
describe('when user has permission to access all projects', function() {
|
|
beforeEach(function() {
|
|
this.AuthorizationManager.canUserReadProject
|
|
.withArgs(this.user_id, 'project1', this.token)
|
|
.yields(null, true)
|
|
return this.AuthorizationManager.canUserReadProject
|
|
.withArgs(this.user_id, 'project2', this.token)
|
|
.yields(null, true)
|
|
})
|
|
|
|
it('should return next', function() {
|
|
this.AuthorizationMiddleware.ensureUserCanReadMultipleProjects(
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
return this.next.called.should.equal(true)
|
|
})
|
|
})
|
|
|
|
describe("when user doesn't have permission to access one of the projects", function() {
|
|
beforeEach(function() {
|
|
this.AuthorizationManager.canUserReadProject
|
|
.withArgs(this.user_id, 'project1', this.token)
|
|
.yields(null, true)
|
|
return this.AuthorizationManager.canUserReadProject
|
|
.withArgs(this.user_id, 'project2', this.token)
|
|
.yields(null, false)
|
|
})
|
|
|
|
it('should redirect to redirectToRestricted', function() {
|
|
this.AuthorizationMiddleware.ensureUserCanReadMultipleProjects(
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
this.next.called.should.equal(false)
|
|
return this.AuthorizationMiddleware.redirectToRestricted
|
|
.calledWith(this.req, this.res, this.next)
|
|
.should.equal(true)
|
|
})
|
|
})
|
|
})
|
|
|
|
describe('with anonymous user', () =>
|
|
describe('when user has permission', function() {
|
|
describe('when user has permission to access all projects', function() {
|
|
beforeEach(function() {
|
|
this.AuthenticationController.getLoggedInUserId.returns(null)
|
|
this.AuthorizationManager.canUserReadProject
|
|
.withArgs(null, 'project1', this.token)
|
|
.yields(null, true)
|
|
return this.AuthorizationManager.canUserReadProject
|
|
.withArgs(null, 'project2', this.token)
|
|
.yields(null, true)
|
|
})
|
|
|
|
it('should return next', function() {
|
|
this.AuthorizationMiddleware.ensureUserCanReadMultipleProjects(
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
return this.next.called.should.equal(true)
|
|
})
|
|
})
|
|
|
|
describe("when user doesn't have permission to access one of the projects", function() {
|
|
beforeEach(function() {
|
|
this.AuthenticationController.getLoggedInUserId.returns(null)
|
|
this.AuthorizationManager.canUserReadProject
|
|
.withArgs(null, 'project1', this.token)
|
|
.yields(null, true)
|
|
return this.AuthorizationManager.canUserReadProject
|
|
.withArgs(null, 'project2', this.token)
|
|
.yields(null, false)
|
|
})
|
|
|
|
it('should redirect to redirectToRestricted', function() {
|
|
this.AuthorizationMiddleware.ensureUserCanReadMultipleProjects(
|
|
this.req,
|
|
this.res,
|
|
this.next
|
|
)
|
|
this.next.called.should.equal(false)
|
|
return this.AuthorizationMiddleware.redirectToRestricted
|
|
.calledWith(this.req, this.res, this.next)
|
|
.should.equal(true)
|
|
})
|
|
})
|
|
}))
|
|
})
|
|
})
|