Merge pull request #17830 from overleaf/rh-reduce-staff-access-session

[web] Reduce size of staffAccess field in session GitOrigin-RevId: 7745dc595e8096caef04fd140b47532f0775f165
2024-04-12 08:06:35 +00:00
parent f5ac5b0ed3
commit 754609f379
2 changed files with 100 additions and 2 deletions
@@ -24,6 +24,34 @@ describe('AuthenticationController', function () {
      referal_id: 1234,
      isAdmin: false,
    }
+    this.staffUser = {
+      ...this.user,
+      staffAccess: {
+        publisherMetrics: true,
+        publisherManagement: false,
+        institutionMetrics: true,
+        institutionManagement: false,
+        groupMetrics: true,
+        groupManagement: false,
+        adminMetrics: true,
+        splitTestMetrics: false,
+        splitTestManagement: true,
+      },
+    }
+    this.noStaffAccessUser = {
+      ...this.user,
+      staffAccess: {
+        publisherMetrics: false,
+        publisherManagement: false,
+        institutionMetrics: false,
+        institutionManagement: false,
+        groupMetrics: false,
+        groupManagement: false,
+        adminMetrics: false,
+        splitTestMetrics: false,
+        splitTestManagement: false,
+      },
+    }
    this.password = 'banana'
    this.req = new MockRequest()
    this.res = new MockResponse()
@@ -181,6 +209,57 @@ describe('AuthenticationController', function () {
    })
  })

+  describe('serializeUser', function () {
+    describe('when isAdmin is false', function () {
+      it('does not return an isAdmin field', function () {
+        const isAdminMatcher = sinon.match(value => {
+          return !('isAdmin' in value)
+        })
+
+        this.AuthenticationController.serializeUser(this.user, this.callback)
+        expect(this.callback).to.have.been.calledWith(null, isAdminMatcher)
+      })
+    })
+
+    describe('when staffAccess fields are provided', function () {
+      it('only returns the fields set to true', function () {
+        const expectedStaffAccess = {
+          publisherMetrics: true,
+          institutionMetrics: true,
+          groupMetrics: true,
+          adminMetrics: true,
+          splitTestManagement: true,
+        }
+        const staffAccessMatcher = sinon.match(value => {
+          return (
+            Object.keys(value.staffAccess).length ===
+            Object.keys(expectedStaffAccess).length
+          )
+        })
+
+        this.AuthenticationController.serializeUser(
+          this.staffUser,
+          this.callback
+        )
+        expect(this.callback).to.have.been.calledWith(null, staffAccessMatcher)
+      })
+    })
+
+    describe('when all staffAccess fields are false', function () {
+      it('no staffAccess attribute is set', function () {
+        const staffAccessMatcher = sinon.match(value => {
+          return !('staffAccess' in value)
+        })
+
+        this.AuthenticationController.serializeUser(
+          this.noStaffAccessUser,
+          this.callback
+        )
+        expect(this.callback).to.have.been.calledWith(null, staffAccessMatcher)
+      })
+    })
+  })
+
  describe('passportLogin', function () {
    beforeEach(function () {
      this.info = null