Skip to content

Commit 3a7f1ad

Browse files
maxceemmaxceem
authored
Merge pull request #570 from gets0ul/issue_561
Fix for Issue #561 Return empty invites for user without enough permission
2 parents 6103784 + 4d29820 commit 3a7f1ad

File tree

7 files changed

+148
-40
lines changed

7 files changed

+148
-40
lines changed

‎docs/permissions.html‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -636,8 +636,8 @@ <h2 class="anchor-container">
636636

637637
<div>
638638
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
639-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
640-
<span class="badge badge-dark" title="Allowed Topcoder Role">read:project-members</span>
639+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
640+
<span class="badge badge-dark" title="Allowed Topcoder Role">read:project-invites</span>
641641
</div>
642642
</div>
643643
</div>
@@ -670,8 +670,8 @@ <h2 class="anchor-container">
670670

671671
<div>
672672
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
673-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
674-
<span class="badge badge-dark" title="Allowed Topcoder Role">read:project-members</span>
673+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
674+
<span class="badge badge-dark" title="Allowed Topcoder Role">read:project-invites</span>
675675
</div>
676676
</div>
677677
</div>
@@ -704,8 +704,8 @@ <h2 class="anchor-container">
704704

705705
<div>
706706
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
707-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
708-
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-members</span>
707+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
708+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-invites</span>
709709
</div>
710710
</div>
711711
</div>
@@ -734,8 +734,8 @@ <h2 class="anchor-container">
734734

735735
<div>
736736
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
737-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
738-
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-members</span>
737+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
738+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-invites</span>
739739
</div>
740740
</div>
741741
</div>
@@ -759,8 +759,8 @@ <h2 class="anchor-container">
759759

760760
<div>
761761
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
762-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
763-
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-members</span>
762+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
763+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-invites</span>
764764
</div>
765765
</div>
766766
</div>
@@ -782,8 +782,8 @@ <h2 class="anchor-container">
782782

783783
<div>
784784
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
785-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
786-
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-members</span>
785+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
786+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-invites</span>
787787
</div>
788788
</div>
789789
</div>
@@ -806,8 +806,8 @@ <h2 class="anchor-container">
806806

807807
<div>
808808
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
809-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
810-
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-members</span>
809+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
810+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-invites</span>
811811
</div>
812812
</div>
813813
</div>
@@ -831,8 +831,8 @@ <h2 class="anchor-container">
831831

832832
<div>
833833
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
834-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
835-
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-members</span>
834+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
835+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-invites</span>
836836
</div>
837837
</div>
838838
</div>
@@ -854,8 +854,8 @@ <h2 class="anchor-container">
854854

855855
<div>
856856
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
857-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
858-
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-members</span>
857+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
858+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-invites</span>
859859
</div>
860860
</div>
861861
</div>
@@ -879,8 +879,8 @@ <h2 class="anchor-container">
879879

880880
<div>
881881
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
882-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
883-
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-members</span>
882+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
883+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-invites</span>
884884
</div>
885885
</div>
886886
</div>
@@ -909,8 +909,8 @@ <h2 class="anchor-container">
909909

910910
<div>
911911
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
912-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
913-
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-members</span>
912+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
913+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-invites</span>
914914
</div>
915915
</div>
916916
</div>
@@ -934,8 +934,8 @@ <h2 class="anchor-container">
934934

935935
<div>
936936
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
937-
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-members</span>
938-
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-members</span>
937+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:project-invites</span>
938+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:project-invites</span>
939939
</div>
940940
</div>
941941
</div>

‎src/constants.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,6 +281,11 @@ export const M2M_SCOPES = {
281281
READ: 'read:project-members',
282282
WRITE: 'write:project-members',
283283
},
284+
PROJECT_INVITES: {
285+
ALL: 'all:project-invites',
286+
READ: 'read:project-invites',
287+
WRITE: 'write:project-invites',
288+
},
284289
};
285290

286291
export const TIMELINE_REFERENCES = {

‎src/permissions/constants.js‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,18 @@ const SCOPES_PROJECT_MEMBERS_WRITE = [
9191
M2M_SCOPES.PROJECT_MEMBERS.WRITE,
9292
];
9393

94+
const SCOPES_PROJECT_INVITES_READ = [
95+
M2M_SCOPES.CONNECT_PROJECT_ADMIN,
96+
M2M_SCOPES.PROJECT_INVITES.ALL,
97+
M2M_SCOPES.PROJECT_INVITES.READ,
98+
];
99+
100+
const SCOPES_PROJECT_INVITES_WRITE = [
101+
M2M_SCOPES.CONNECT_PROJECT_ADMIN,
102+
M2M_SCOPES.PROJECT_INVITES.ALL,
103+
M2M_SCOPES.PROJECT_INVITES.WRITE,
104+
];
105+
94106
export const PERMISSION = { // eslint-disable-line import/prefer-default-export
95107
/*
96108
* Project
@@ -303,7 +315,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
303315
description: 'Who can view own invite.',
304316
},
305317
topcoderRoles: ALL,
306-
scopes: SCOPES_PROJECT_MEMBERS_READ,
318+
scopes: SCOPES_PROJECT_INVITES_READ,
307319
},
308320

309321
READ_PROJECT_INVITE_NOT_OWN: {
@@ -314,7 +326,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
314326
},
315327
topcoderRoles: TOPCODER_ROLES_MANAGERS_AND_ADMINS,
316328
projectRoles: ALL,
317-
scopes: SCOPES_PROJECT_MEMBERS_READ,
329+
scopes: SCOPES_PROJECT_INVITES_READ,
318330
},
319331

320332
CREATE_PROJECT_INVITE_CUSTOMER: {
@@ -325,7 +337,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
325337
},
326338
topcoderRoles: TOPCODER_ROLES_MANAGERS_AND_ADMINS,
327339
projectRoles: ALL,
328-
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
340+
scopes: SCOPES_PROJECT_INVITES_WRITE,
329341
},
330342

331343
CREATE_PROJECT_INVITE_NON_CUSTOMER: {
@@ -336,7 +348,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
336348
},
337349
topcoderRoles: TOPCODER_ROLES_ADMINS,
338350
projectRoles: PROJECT_ROLES_MANAGEMENT,
339-
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
351+
scopes: SCOPES_PROJECT_INVITES_WRITE,
340352
},
341353

342354
CREATE_PROJECT_INVITE_COPILOT_DIRECTLY: {
@@ -349,7 +361,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
349361
...TOPCODER_ROLES_ADMINS,
350362
USER_ROLE.COPILOT_MANAGER,
351363
],
352-
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
364+
scopes: SCOPES_PROJECT_INVITES_WRITE,
353365
},
354366

355367
UPDATE_PROJECT_INVITE_OWN: {
@@ -359,7 +371,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
359371
description: 'Who can update own invite.',
360372
},
361373
topcoderRoles: ALL,
362-
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
374+
scopes: SCOPES_PROJECT_INVITES_WRITE,
363375
},
364376

365377
UPDATE_PROJECT_INVITE_NOT_OWN: {
@@ -369,7 +381,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
369381
description: 'Who can update invites for other members.',
370382
},
371383
topcoderRoles: TOPCODER_ROLES_ADMINS,
372-
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
384+
scopes: SCOPES_PROJECT_INVITES_WRITE,
373385
},
374386

375387
UPDATE_PROJECT_INVITE_REQUESTED: {
@@ -382,7 +394,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
382394
...TOPCODER_ROLES_ADMINS,
383395
USER_ROLE.COPILOT_MANAGER,
384396
],
385-
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
397+
scopes: SCOPES_PROJECT_INVITES_WRITE,
386398
},
387399

388400
DELETE_PROJECT_INVITE_OWN: {
@@ -392,7 +404,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
392404
description: 'Who can delete own invite.',
393405
},
394406
topcoderRoles: ALL,
395-
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
407+
scopes: SCOPES_PROJECT_INVITES_WRITE,
396408
},
397409

398410
DELETE_PROJECT_INVITE_NOT_OWN_CUSTOMER: {
@@ -403,7 +415,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
403415
},
404416
topcoderRoles: TOPCODER_ROLES_ADMINS,
405417
projectRoles: ALL,
406-
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
418+
scopes: SCOPES_PROJECT_INVITES_WRITE,
407419
},
408420

409421
DELETE_PROJECT_INVITE_NOT_OWN_NON_CUSTOMER: {
@@ -414,7 +426,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
414426
},
415427
topcoderRoles: TOPCODER_ROLES_ADMINS,
416428
projectRoles: PROJECT_ROLES_MANAGEMENT,
417-
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
429+
scopes: SCOPES_PROJECT_INVITES_WRITE,
418430
},
419431

420432
DELETE_PROJECT_INVITE_REQUESTED: {
@@ -427,7 +439,7 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
427439
...TOPCODER_ROLES_ADMINS,
428440
USER_ROLE.COPILOT_MANAGER,
429441
],
430-
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
442+
scopes: SCOPES_PROJECT_INVITES_WRITE,
431443
},
432444

433445
/**

‎src/routes/projects/get.js‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,26 @@ const retrieveProjectFromES = (projectId, req) => {
117117
const es = util.getElasticSearchClient();
118118
es.search(searchCriteria).then((docs) => {
119119
const rows = _.map(docs.hits.hits, single => single._source); // eslint-disable-line no-underscore-dangle
120-
accept(rows[0]);
120+
const project = rows[0];
121+
if (project && project.invites) {
122+
if (!util.hasPermissionByReq(PERMISSION.READ_PROJECT_INVITE_NOT_OWN, req)) {
123+
let invites;
124+
if (util.hasPermissionByReq(PERMISSION.READ_PROJECT_INVITE_OWN, req)) {
125+
// only include own invites
126+
const currentUserId = req.authUser.userId;
127+
const currentUserEmail = req.authUser.email;
128+
invites = _.filter(project.invites, invite => (
129+
(invite.userId !== null && invite.userId === currentUserId) ||
130+
(invite.email && currentUserEmail && invite.email.toLowerCase() === currentUserEmail.toLowerCase())
131+
));
132+
} else {
133+
// return empty invites
134+
invites = [];
135+
}
136+
_.set(project, 'invites', invites);
137+
}
138+
}
139+
accept(project);
121140
}).catch(reject);
122141
});
123142
};
@@ -160,7 +179,17 @@ const retrieveProjectFromDB = (projectId, req) => {
160179
if (attachments) {
161180
project.attachments = attachments;
162181
}
163-
return models.ProjectMemberInvite.getPendingAndReguestedInvitesForProject(projectId);
182+
if (util.hasPermissionByReq(PERMISSION.READ_PROJECT_INVITE_NOT_OWN, req)) {
183+
// include all invites
184+
return models.ProjectMemberInvite.getPendingAndReguestedInvitesForProject(projectId);
185+
} else if (util.hasPermissionByReq(PERMISSION.READ_PROJECT_INVITE_OWN, req)) {
186+
// include only own invites
187+
const currentUserId = req.authUser.userId;
188+
const email = req.authUser.email;
189+
return models.ProjectMemberInvite.getPendingOrRequestedProjectInvitesForUser(projectId, email, currentUserId);
190+
}
191+
// empty
192+
return Promise.resolve([]);
164193
})
165194
.then((invites) => {
166195
project.invites = invites;

‎src/routes/projects/get.spec.js‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,26 @@ describe('GET Project', () => {
274274
});
275275
});
276276

277+
it('should return the project with empty invites using M2M token without "read:project-invites" scope', (done) => {
278+
request(server)
279+
.get(`/v5/projects/${project1.id}`)
280+
.set({
281+
Authorization: `Bearer ${testUtil.m2m['read:projects']}`,
282+
})
283+
.expect('Content-Type', /json/)
284+
.expect(200)
285+
.end((err, res) => {
286+
if (err) {
287+
done(err);
288+
} else {
289+
const resJson = res.body;
290+
should.exist(resJson);
291+
resJson.invites.should.be.empty;
292+
done();
293+
}
294+
});
295+
});
296+
277297
it('should return project with "members", "invites", and "attachments" by default when data comes from ES', (done) => {
278298
request(server)
279299
.get(`/v5/projects/${data[0].id}`)

‎src/routes/projects/list.js‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -591,6 +591,25 @@ const retrieveProjects = (req, criteria, sort, ffields) => {
591591
es.search(searchCriteria).then((docs) => {
592592
const rows = _.map(docs.hits.hits, single => single._source); // eslint-disable-line no-underscore-dangle
593593
if (rows) {
594+
if (!util.hasPermissionByReq(PERMISSION.READ_PROJECT_INVITE_NOT_OWN, req)) {
595+
if (util.hasPermissionByReq(PERMISSION.READ_PROJECT_INVITE_OWN, req)) {
596+
// only include own invites
597+
const currentUserId = req.authUser.userId;
598+
const currentUserEmail = req.authUser.email;
599+
_.forEach(rows, (fp) => {
600+
const invites = _.filter(fp.invites, invite => (
601+
(invite.userId !== null && invite.userId === currentUserId) ||
602+
(invite.email && currentUserEmail && invite.email.toLowerCase() === currentUserEmail.toLowerCase())
603+
));
604+
_.set(fp, 'invites', invites);
605+
});
606+
} else {
607+
// return empty invites
608+
_.forEach(rows, (fp) => {
609+
_.set(fp, 'invites', []);
610+
});
611+
}
612+
}
594613
_.forEach(rows, (p) => {
595614
const fp = p;
596615
if (fp.members) {

0 commit comments

Comments
 (0)