alois/Verso
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #17289 from overleaf/jel-permissions-controller

Browse Source 
[web] Move user permissions check to manager

GitOrigin-RevId: 8c59d053da3d8d452cd424b04baa05f5d7d9057a
This commit is contained in:
Jessica Lawshe
2024-02-29 09:04:37 +00:00
committed by Copybot
parent 84c3dc1fff
commit cb3f70f7ab
3 changed files with 153 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/web/test/unit/src/Authorization/PermissionsManagerTests.js
+116 -1
View File
@@ -1,12 +1,22 @@
const sinon = require('sinon')
const { expect } = require('chai')
const modulePath =
'../../../../app/src/Features/Authorization/PermissionsManager.js'
const SandboxedModule = require('sandboxed-module')
const { ForbiddenError } = require('../../../../app/src/Features/Errors/Errors')
describe('PermissionsManager', function () {
beforeEach(function () {
this.PermissionsManager = SandboxedModule.require(modulePath, {
requires: {},
requires: {
'../../infrastructure/Modules': (this.Modules = {
promises: {
hooks: {
fire: (this.hooksFire = sinon.stub().resolves([{}])),
},
},
}),
},
})
this.PermissionsManager.registerCapability('capability1', {
default: true,
@@ -389,4 +399,109 @@ describe('PermissionsManager', function () {
)
})
})
describe('checkUserPermissions', function () {
describe('allowed', function () {
it('should not error when managedUsersEnabled is not enabled for user', async function () {
const result =
await this.PermissionsManager.promises.checkUserPermissions(
{ _id: 'user123' },
['add-secondary-email']
)
expect(result).to.be.undefined
})
it('should not error when default capability is true', async function () {
this.PermissionsManager.registerCapability('some-policy-to-check', {
default: true,
})
this.hooksFire.resolves([
{
managedUsersEnabled: true,
groupPolicy: {},
},
])
const result =
await this.PermissionsManager.promises.checkUserPermissions(
{ _id: 'user123' },
['some-policy-to-check']
)
expect(result).to.be.undefined
})
it('should not error when default permission is false but user has permission', async function () {
this.PermissionsManager.registerCapability('some-policy-to-check', {
default: false,
})
this.PermissionsManager.registerPolicy('userCanDoSomePolicy', {
'some-policy-to-check': true,
})
this.hooksFire.resolves([
{
managedUsersEnabled: true,
groupPolicy: {
userCanDoSomePolicy: true,
},
},
])
const result =
await this.PermissionsManager.promises.checkUserPermissions(
{ _id: 'user123' },
['some-policy-to-check']
)
expect(result).to.be.undefined
})
})
describe('not allowed', function () {
it('should return error when managedUsersEnabled is enabled for user but there is no group policy', async function () {
this.hooksFire.resolves([{ managedUsersEnabled: true }])
await expect(
this.PermissionsManager.promises.checkUserPermissions(
{ _id: 'user123' },
['add-secondary-email']
)
).to.be.rejectedWith(Error, 'unknown capability: add-secondary-email')
})
it('should return error when default permission is false', async function () {
this.PermissionsManager.registerCapability('some-policy-to-check', {
default: false,
})
this.hooksFire.resolves([
{
managedUsersEnabled: true,
groupPolicy: {},
},
])
await expect(
this.PermissionsManager.promises.checkUserPermissions(
{ _id: 'user123' },
['some-policy-to-check']
)
).to.be.rejectedWith(ForbiddenError)
})
it('should return error when default permission is true but user does not have permission', async function () {
this.PermissionsManager.registerCapability('some-policy-to-check', {
default: true,
})
this.PermissionsManager.registerPolicy('userCannotDoSomePolicy', {
'some-policy-to-check': false,
})
this.hooksFire.resolves([
{
managedUsersEnabled: true,
groupPolicy: { userCannotDoSomePolicy: true },
},
])
await expect(
this.PermissionsManager.promises.checkUserPermissions(
{ _id: 'user123' },
['some-policy-to-check']
)
).to.be.rejectedWith(ForbiddenError)
})
})
})
})