alois/Verso
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2176 from overleaf/em-ta-json-auth

Browse Source 
Make ensureUserCanAdminProject always raise a 403

GitOrigin-RevId: 4dd1eca1cfb171d92392bc3c8208b61cbf7c6815
This commit is contained in:
Eric Mc Sween
2019-09-30 13:36:48 +00:00
committed by sharelatex
parent 039b5eaba0
commit a87a731d25
6 changed files with 396 additions and 338 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/web/test/unit/src/Authorization/AuthorizationMiddlewareTests.js
+214 -112
View File
@@ -1,76 +1,68 @@
/* eslint-disable
camelcase,
max-len,
no-return-assign,
no-unused-vars,
*/
// TODO: This file was created by bulk-decaffeinate.
// Fix any style issues and re-enable lint.
/*
* decaffeinate suggestions:
* DS102: Remove unnecessary code created because of implicit returns
* Full docs: https://github.com/decaffeinate/decaffeinate/blob/master/docs/suggestions.md
*/
const sinon = require('sinon')
const chai = require('chai')
const should = chai.should()
const { expect } = chai
const modulePath =
'../../../../app/src/Features/Authorization/AuthorizationMiddleware.js'
const { expect } = require('chai')
const SandboxedModule = require('sandboxed-module')
const HttpErrors = require('@overleaf/o-error/http')
const Errors = require('../../../../app/src/Features/Errors/Errors.js')
const MODULE_PATH =
'../../../../app/src/Features/Authorization/AuthorizationMiddleware.js'
describe('AuthorizationMiddleware', function() {
beforeEach(function() {
this.user_id = 'user-id-123'
this.userId = 'user-id-123'
this.project_id = 'project-id-123'
this.token = 'some-token'
this.AuthenticationController = {
getLoggedInUserId: sinon.stub().returns(this.user_id),
getLoggedInUserId: sinon.stub().returns(this.userId),
isUserLoggedIn: sinon.stub().returns(true)
}
this.AuthorizationMiddleware = SandboxedModule.require(modulePath, {
this.AuthorizationManager = {}
this.TokenAccessHandler = {
getRequestToken: sinon.stub().returns(this.token)
}
this.ObjectId = {
isValid: sinon
.stub()
.withArgs(this.project_id)
.returns(true)
}
this.AuthorizationManager = {}
this.AuthorizationMiddleware = SandboxedModule.require(MODULE_PATH, {
globals: {
console: console
},
requires: {
'./AuthorizationManager': (this.AuthorizationManager = {}),
'./AuthorizationManager': this.AuthorizationManager,
'logger-sharelatex': { log() {} },
mongojs: {
ObjectId: (this.ObjectId = {})
ObjectId: this.ObjectId
},
'@overleaf/o-error/http': HttpErrors,
'../Errors/Errors': Errors,
'../Authentication/AuthenticationController': this
.AuthenticationController,
'../TokenAccess/TokenAccessHandler': (this.TokenAccessHandler = {
getRequestToken: sinon.stub().returns(this.token)
})
'../TokenAccess/TokenAccessHandler': this.TokenAccessHandler
}
})
this.req = {}
this.res = {}
this.ObjectId.isValid = sinon.stub()
this.ObjectId.isValid.withArgs(this.project_id).returns(true)
return (this.next = sinon.stub())
this.next = sinon.stub()
})
describe('_getUserId', function() {
beforeEach(function() {
return (this.req = {})
this.req = {}
})
it('should get the user from session', function(done) {
this.AuthenticationController.getLoggedInUserId = sinon
.stub()
.returns('1234')
return this.AuthorizationMiddleware._getUserId(
this.req,
(err, user_id) => {
expect(err).to.not.exist
expect(user_id).to.equal('1234')
return done()
}
)
this.AuthorizationMiddleware._getUserId(this.req, (err, userId) => {
expect(err).to.not.exist
expect(userId).to.equal('1234')
done()
})
})
it('should get oauth_user from request', function(done) {
@@ -78,14 +70,11 @@ describe('AuthorizationMiddleware', function() {
.stub()
.returns(null)
this.req.oauth_user = { _id: '5678' }
return this.AuthorizationMiddleware._getUserId(
this.req,
(err, user_id) => {
expect(err).to.not.exist
expect(user_id).to.equal('5678')
return done()
}
)
this.AuthorizationMiddleware._getUserId(this.req, (err, userId) => {
expect(err).to.not.exist
expect(userId).to.equal('5678')
done()
})
})
it('should fall back to null', function(done) {
@@ -93,36 +82,31 @@ describe('AuthorizationMiddleware', function() {
.stub()
.returns(null)
this.req.oauth_user = undefined
return this.AuthorizationMiddleware._getUserId(
this.req,
(err, user_id) => {
expect(err).to.not.exist
expect(user_id).to.equal(null)
return done()
}
)
this.AuthorizationMiddleware._getUserId(this.req, (err, userId) => {
expect(err).to.not.exist
expect(userId).to.equal(null)
done()
})
})
})
const METHODS_TO_TEST = {
ensureUserCanReadProject: 'canUserReadProject',
ensureUserCanWriteProjectSettings: 'canUserWriteProjectSettings',
ensureUserCanWriteProjectContent: 'canUserWriteProjectContent',
ensureUserCanAdminProject: 'canUserAdminProject'
ensureUserCanWriteProjectContent: 'canUserWriteProjectContent'
}
for (let middlewareMethod in METHODS_TO_TEST) {
const managerMethod = METHODS_TO_TEST[middlewareMethod]
;((middlewareMethod, managerMethod) =>
Object.entries(METHODS_TO_TEST).forEach(
([middlewareMethod, managerMethod]) => {
describe(middlewareMethod, function() {
beforeEach(function() {
this.req.params = { project_id: this.project_id }
this.AuthorizationManager[managerMethod] = sinon.stub()
return (this.AuthorizationMiddleware.redirectToRestricted = sinon.stub())
this.AuthorizationMiddleware.redirectToRestricted = sinon.stub()
})
describe('with missing project_id', function() {
beforeEach(function() {
return (this.req.params = {})
this.req.params = {}
})
it('should return an error to next', function() {
@@ -131,21 +115,19 @@ describe('AuthorizationMiddleware', function() {
this.res,
this.next
)
return this.next.calledWith(new Error()).should.equal(true)
this.next.calledWith(new Error()).should.equal(true)
})
})
describe('with logged in user', function() {
beforeEach(function() {
return this.AuthenticationController.getLoggedInUserId.returns(
this.user_id
)
this.AuthenticationController.getLoggedInUserId.returns(this.userId)
})
describe('when user has permission', function() {
beforeEach(function() {
return this.AuthorizationManager[managerMethod]
.withArgs(this.user_id, this.project_id, this.token)
this.AuthorizationManager[managerMethod]
.withArgs(this.userId, this.project_id, this.token)
.yields(null, true)
})
@@ -155,25 +137,25 @@ describe('AuthorizationMiddleware', function() {
this.res,
this.next
)
return this.next.called.should.equal(true)
this.next.called.should.equal(true)
})
})
describe("when user doesn't have permission", function() {
beforeEach(function() {
return this.AuthorizationManager[managerMethod]
.withArgs(this.user_id, this.project_id, this.token)
this.AuthorizationManager[managerMethod]
.withArgs(this.userId, this.project_id, this.token)
.yields(null, false)
})
it('should redirect to redirectToRestricted', function() {
it('should raise a 403', function() {
this.AuthorizationMiddleware[middlewareMethod](
this.req,
this.res,
this.next
)
this.next.called.should.equal(false)
return this.AuthorizationMiddleware.redirectToRestricted
this.AuthorizationMiddleware.redirectToRestricted
.calledWith(this.req, this.res, this.next)
.should.equal(true)
})
@@ -184,7 +166,7 @@ describe('AuthorizationMiddleware', function() {
describe('when user has permission', function() {
beforeEach(function() {
this.AuthenticationController.getLoggedInUserId.returns(null)
return this.AuthorizationManager[managerMethod]
this.AuthorizationManager[managerMethod]
.withArgs(null, this.project_id, this.token)
.yields(null, true)
})
@@ -195,14 +177,14 @@ describe('AuthorizationMiddleware', function() {
this.res,
this.next
)
return this.next.called.should.equal(true)
this.next.called.should.equal(true)
})
})
describe("when user doesn't have permission", function() {
beforeEach(function() {
this.AuthenticationController.getLoggedInUserId.returns(null)
return this.AuthorizationManager[managerMethod]
this.AuthorizationManager[managerMethod]
.withArgs(null, this.project_id, this.token)
.yields(null, false)
})
@@ -214,7 +196,7 @@ describe('AuthorizationMiddleware', function() {
this.next
)
this.next.called.should.equal(false)
return this.AuthorizationMiddleware.redirectToRestricted
this.AuthorizationMiddleware.redirectToRestricted
.calledWith(this.req, this.res, this.next)
.should.equal(true)
})
@@ -224,11 +206,11 @@ describe('AuthorizationMiddleware', function() {
describe('with malformed project id', function() {
beforeEach(function() {
this.req.params = { project_id: 'blah' }
return (this.ObjectId.isValid = sinon.stub().returns(false))
this.ObjectId.isValid = sinon.stub().returns(false)
})
it('should return a not found error', function(done) {
return this.AuthorizationMiddleware[middlewareMethod](
this.AuthorizationMiddleware[middlewareMethod](
this.req,
this.res,
error => {
@@ -238,26 +220,148 @@ describe('AuthorizationMiddleware', function() {
)
})
})
}))(middlewareMethod, managerMethod)
}
})
}
)
describe('ensureUserIsSiteAdmin', function() {
describe('ensureUserCanAdminProject', function() {
beforeEach(function() {
this.AuthorizationManager.isUserSiteAdmin = sinon.stub()
return (this.AuthorizationMiddleware.redirectToRestricted = sinon.stub())
this.req.params = { project_id: this.project_id }
this.AuthorizationManager.canUserAdminProject = sinon.stub()
this.AuthorizationMiddleware.redirectToRestricted = sinon.stub()
})
describe('with missing project_id', function() {
beforeEach(function() {
this.req.params = {}
})
it('should return an error to next', function() {
this.AuthorizationMiddleware.ensureUserCanAdminProject(
this.req,
this.res,
this.next
)
this.next.calledWith(new Error()).should.equal(true)
})
})
describe('with logged in user', function() {
beforeEach(function() {
return this.AuthenticationController.getLoggedInUserId.returns(
this.user_id
)
this.AuthenticationController.getLoggedInUserId.returns(this.userId)
})
describe('when user has permission', function() {
beforeEach(function() {
return this.AuthorizationManager.isUserSiteAdmin
.withArgs(this.user_id)
this.AuthorizationManager.canUserAdminProject
.withArgs(this.userId, this.project_id, this.token)
.yields(null, true)
})
it('should return next', function() {
this.AuthorizationMiddleware.ensureUserCanAdminProject(
this.req,
this.res,
this.next
)
this.next.called.should.equal(true)
})
})
describe("when user doesn't have permission", function() {
beforeEach(function() {
this.AuthorizationManager.canUserAdminProject
.withArgs(this.userId, this.project_id, this.token)
.yields(null, false)
})
it('should raise a 403', function(done) {
this.AuthorizationMiddleware.ensureUserCanAdminProject(
this.req,
this.res,
err => {
expect(err).to.be.an.instanceof(HttpErrors.ForbiddenError)
done()
}
)
})
})
})
describe('with anonymous user', function() {
describe('when user has permission', function() {
beforeEach(function() {
this.AuthenticationController.getLoggedInUserId.returns(null)
this.AuthorizationManager.canUserAdminProject
.withArgs(null, this.project_id, this.token)
.yields(null, true)
})
it('should return next', function() {
this.AuthorizationMiddleware.ensureUserCanAdminProject(
this.req,
this.res,
this.next
)
this.next.called.should.equal(true)
})
})
describe("when user doesn't have permission", function() {
beforeEach(function() {
this.AuthenticationController.getLoggedInUserId.returns(null)
this.AuthorizationManager.canUserAdminProject
.withArgs(null, this.project_id, this.token)
.yields(null, false)
})
it('should raise a 403', function(done) {
this.AuthorizationMiddleware.ensureUserCanAdminProject(
this.req,
this.res,
err => {
expect(err).to.be.an.instanceof(HttpErrors.ForbiddenError)
done()
}
)
})
})
})
describe('with malformed project id', function() {
beforeEach(function() {
this.req.params = { project_id: 'blah' }
this.ObjectId.isValid = sinon.stub().returns(false)
})
it('should return a not found error', function(done) {
this.AuthorizationMiddleware.ensureUserCanAdminProject(
this.req,
this.res,
error => {
error.should.be.instanceof(Errors.NotFoundError)
return done()
}
)
})
})
})
describe('ensureUserIsSiteAdmin', function() {
beforeEach(function() {
this.AuthorizationManager.isUserSiteAdmin = sinon.stub()
this.AuthorizationMiddleware.redirectToRestricted = sinon.stub()
})
describe('with logged in user', function() {
beforeEach(function() {
this.AuthenticationController.getLoggedInUserId.returns(this.userId)
})
describe('when user has permission', function() {
beforeEach(function() {
this.AuthorizationManager.isUserSiteAdmin
.withArgs(this.userId)
.yields(null, true)
})
@@ -267,14 +371,14 @@ describe('AuthorizationMiddleware', function() {
this.res,
this.next
)
return this.next.called.should.equal(true)
this.next.called.should.equal(true)
})
})
describe("when user doesn't have permission", function() {
beforeEach(function() {
return this.AuthorizationManager.isUserSiteAdmin
.withArgs(this.user_id)
this.AuthorizationManager.isUserSiteAdmin
.withArgs(this.userId)
.yields(null, false)
})
@@ -285,7 +389,7 @@ describe('AuthorizationMiddleware', function() {
this.next
)
this.next.called.should.equal(false)
return this.AuthorizationMiddleware.redirectToRestricted
this.AuthorizationMiddleware.redirectToRestricted
.calledWith(this.req, this.res, this.next)
.should.equal(true)
})
@@ -296,7 +400,7 @@ describe('AuthorizationMiddleware', function() {
describe('when user has permission', function() {
beforeEach(function() {
this.AuthenticationController.getLoggedInUserId.returns(null)
return this.AuthorizationManager.isUserSiteAdmin
this.AuthorizationManager.isUserSiteAdmin
.withArgs(null)
.yields(null, true)
})
@@ -307,14 +411,14 @@ describe('AuthorizationMiddleware', function() {
this.res,
this.next
)
return this.next.called.should.equal(true)
this.next.called.should.equal(true)
})
})
describe("when user doesn't have permission", function() {
beforeEach(function() {
this.AuthenticationController.getLoggedInUserId.returns(null)
return this.AuthorizationManager.isUserSiteAdmin
this.AuthorizationManager.isUserSiteAdmin
.withArgs(null)
.yields(null, false)
})
@@ -326,7 +430,7 @@ describe('AuthorizationMiddleware', function() {
this.next
)
this.next.called.should.equal(false)
return this.AuthorizationMiddleware.redirectToRestricted
this.AuthorizationMiddleware.redirectToRestricted
.calledWith(this.req, this.res, this.next)
.should.equal(true)
})
@@ -338,23 +442,21 @@ describe('AuthorizationMiddleware', function() {
beforeEach(function() {
this.AuthorizationManager.canUserReadProject = sinon.stub()
this.AuthorizationMiddleware.redirectToRestricted = sinon.stub()
return (this.req.query = { project_ids: 'project1,project2' })
this.req.query = { project_ids: 'project1,project2' }
})
describe('with logged in user', function() {
beforeEach(function() {
return this.AuthenticationController.getLoggedInUserId.returns(
this.user_id
)
this.AuthenticationController.getLoggedInUserId.returns(this.userId)
})
describe('when user has permission to access all projects', function() {
beforeEach(function() {
this.AuthorizationManager.canUserReadProject
.withArgs(this.user_id, 'project1', this.token)
.withArgs(this.userId, 'project1', this.token)
.yields(null, true)
return this.AuthorizationManager.canUserReadProject
.withArgs(this.user_id, 'project2', this.token)
this.AuthorizationManager.canUserReadProject
.withArgs(this.userId, 'project2', this.token)
.yields(null, true)
})
@@ -364,17 +466,17 @@ describe('AuthorizationMiddleware', function() {
this.res,
this.next
)
return this.next.called.should.equal(true)
this.next.called.should.equal(true)
})
})
describe("when user doesn't have permission to access one of the projects", function() {
beforeEach(function() {
this.AuthorizationManager.canUserReadProject
.withArgs(this.user_id, 'project1', this.token)
.withArgs(this.userId, 'project1', this.token)
.yields(null, true)
return this.AuthorizationManager.canUserReadProject
.withArgs(this.user_id, 'project2', this.token)
this.AuthorizationManager.canUserReadProject
.withArgs(this.userId, 'project2', this.token)
.yields(null, false)
})
@@ -385,7 +487,7 @@ describe('AuthorizationMiddleware', function() {
this.next
)
this.next.called.should.equal(false)
return this.AuthorizationMiddleware.redirectToRestricted
this.AuthorizationMiddleware.redirectToRestricted
.calledWith(this.req, this.res, this.next)
.should.equal(true)
})
@@ -400,7 +502,7 @@ describe('AuthorizationMiddleware', function() {
this.AuthorizationManager.canUserReadProject
.withArgs(null, 'project1', this.token)
.yields(null, true)
return this.AuthorizationManager.canUserReadProject
this.AuthorizationManager.canUserReadProject
.withArgs(null, 'project2', this.token)
.yields(null, true)
})
@@ -411,7 +513,7 @@ describe('AuthorizationMiddleware', function() {
this.res,
this.next
)
return this.next.called.should.equal(true)
this.next.called.should.equal(true)
})
})
@@ -421,7 +523,7 @@ describe('AuthorizationMiddleware', function() {
this.AuthorizationManager.canUserReadProject
.withArgs(null, 'project1', this.token)
.yields(null, true)
return this.AuthorizationManager.canUserReadProject
this.AuthorizationManager.canUserReadProject
.withArgs(null, 'project2', this.token)
.yields(null, false)
})
@@ -433,7 +535,7 @@ describe('AuthorizationMiddleware', function() {
this.next
)
this.next.called.should.equal(false)
return this.AuthorizationMiddleware.redirectToRestricted
this.AuthorizationMiddleware.redirectToRestricted
.calledWith(this.req, this.res, this.next)
.should.equal(true)
})