Merge pull request #13717 from overleaf/bg-managed-users-block-affiliations-fix

fix for block affiliations for managed users

GitOrigin-RevId: cac54288592323ea3f1cd7655d4e2b89ee301002

services/web/test/unit/src/User/UserControllerTests.js

@@ -928,12 +928,18 @@ describe('UserController', function () {
         ]
         this.Features.hasFeature.withArgs('affiliations').returns(true)
         this.req.query.ensureAffiliation = true
+        this.req.assertPermission = sinon.stub()
         await this.UserController.promises.ensureAffiliationMiddleware(
           this.req,
           this.res,
           this.next
         )
       })
+      it('should check the user has permission', function () {
+        expect(this.req.assertPermission).to.have.been.calledWith(
+          'add-affiliation'
+        )
+      })
       it('should unflag the emails but not confirm', function () {
         expect(
           this.UserUpdater.promises.addAffiliationForNewUser
@@ -960,12 +966,18 @@ describe('UserController', function () {
         ]
         this.Features.hasFeature.withArgs('affiliations').returns(true)
         this.req.query.ensureAffiliation = true
+        this.req.assertPermission = sinon.stub()
         await this.UserController.promises.ensureAffiliationMiddleware(
           this.req,
           this.res,
           this.next
         )
       })
+      it('should check the user has permission', function () {
+        expect(this.req.assertPermission).to.have.been.calledWith(
+          'add-affiliation'
+        )
+      })
       it('should add affiliation to v1, unflag and confirm on v2', function () {
         expect(this.UserUpdater.promises.addAffiliationForNewUser).to.have.not
           .been.called
@@ -992,12 +1004,18 @@ describe('UserController', function () {
         ]
         this.Features.hasFeature.withArgs('affiliations').returns(true)
         this.req.query.ensureAffiliation = true
+        this.req.assertPermission = sinon.stub()
         await this.UserController.promises.ensureAffiliationMiddleware(
           this.req,
           this.res,
           this.next
         )
       })
+      it('should check the user has permission', function () {
+        expect(this.req.assertPermission).to.have.been.calledWith(
+          'add-affiliation'
+        )
+      })
       it('should return the error', function () {
         expect(this.next).to.be.calledWith(sinon.match.instanceOf(Error))
       })