Skip to content

Commit cef04da

Browse files
macroucheudoroolivares2016
macrouch
authored and
eudoroolivares2016
committed
GQL-124: Updates permissions for groups (#173)
* GQL-124: Updates permissions for groups * GQL-124: Adds missing tests, removes console logs * GQL-124: Adds comments, remove unnecessary test
1 parent 3eb64af commit cef04da

16 files changed

+448
-35
lines changed

‎magidoc-template/src/routes/+layout.svelte‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@ let innerWidth = -1
4747
let mobile = false
4848
4949
const favicon = get(templates.APP_FAVICON)
50-
console.log('🚀 ~ +layout.svelte:50 ~ favicon:', favicon)
5150
5251
const unsubscribe = page.subscribe(() => {
5352
// Mobile

‎magidoc-template/svelte.config.js‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import { loadVariables } from './magidoc.config.js'
77

88
const variables = loadVariables()
99
const base = templates.SITE_ROOT.getOrDefault(variables, '')
10-
console.log('🚀 ~ svelte.config.js:10 ~ base:', base)
1110

1211
/**
1312
* @type {import('@sveltejs/kit').Config}

‎src/permissions/__tests__/fallbackError.test.js‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,8 @@ const setupServer = () => (
4747
)
4848
const contextValue = {
4949
dataSources: {},
50-
requestId: 'mock-request-id',
51-
user: { ursId: 'testUser' }
50+
edlUsername: 'testUser',
51+
requestId: 'mock-request-id'
5252
}
5353

5454
describe('fallbackError', () => {
@@ -118,7 +118,9 @@ describe('fallbackError', () => {
118118
`
119119

120120
const variables = {
121-
params: {}
121+
params: {
122+
tags: ['CMR']
123+
}
122124
}
123125

124126
const result = await server.executeOperation({

‎src/permissions/__tests__/permissions.test.js‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ import permissions from '../index'
66

77
import { canCreateProviderGroups } from '../acls/canCreateProviderGroups'
88
import { canCreateSystemGroups } from '../acls/canCreateSystemGroups'
9+
import { canReadGroup } from '../acls/canReadGroup'
10+
import { canReadProviderGroups } from '../acls/canReadProviderGroups'
911
import { canReadSystemGroups } from '../acls/canReadSystemGroups'
1012

1113
import { isLocalMMT } from '../rules/isLocalMMT'
@@ -26,11 +28,12 @@ describe('permissions', () => {
2628
Query: {
2729
group: race(
2830
isLocalMMT,
29-
canReadSystemGroups
31+
canReadGroup
3032
),
3133
groups: race(
3234
isLocalMMT,
33-
canReadSystemGroups
35+
canReadSystemGroups,
36+
canReadProviderGroups
3437
)
3538
},
3639
Mutation: {

‎src/permissions/acls/__tests__/canCreateSystemGroups.test.js‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,27 +4,28 @@ import * as hasPermission from '../../../utils/hasPermission'
44
import { forbiddenError } from '../../../utils/forbiddenError'
55

66
describe('canCreateSystemGroups', () => {
7-
test('returns true if the user has permission', async () => {
7+
test('returns true if the tag is CMR and the user has system permission', async () => {
88
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(true)
99

1010
const result = await canCreateSystemGroups.resolve(
1111
null,
12-
{},
12+
{
13+
tag: 'CMR'
14+
},
1315
{
1416
edlUsername: 'test-user'
1517
}
1618
)
17-
1819
expect(result).toEqual(true)
1920
})
2021

21-
test('throws a ForbiddenError if the user does not have permission', async () => {
22-
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(false)
22+
test('throws a ForbiddenError if the tag is not CMR', async () => {
23+
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(true)
2324

2425
const result = await canCreateSystemGroups.resolve(
2526
null,
2627
{
27-
tag: 'CMR'
28+
tag: 'GQL'
2829
},
2930
{
3031
edlUsername: 'test-user'
@@ -34,8 +35,8 @@ describe('canCreateSystemGroups', () => {
3435
expect(result).toEqual(forbiddenError('Not authorized to perform [create] on system object [GROUP]'))
3536
})
3637

37-
test('returns true if the tag is CMR and the user has system permission', async () => {
38-
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(true)
38+
test('throws a ForbiddenError if the user does not have permission', async () => {
39+
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(false)
3940

4041
const result = await canCreateSystemGroups.resolve(
4142
null,
@@ -46,6 +47,7 @@ describe('canCreateSystemGroups', () => {
4647
edlUsername: 'test-user'
4748
}
4849
)
49-
expect(result).toEqual(true)
50+
51+
expect(result).toEqual(forbiddenError('Not authorized to perform [create] on system object [GROUP]'))
5052
})
5153
})

‎src/permissions/acls/__tests__/canReadGroup.test.js‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
import { canReadGroup } from '../canReadGroup'
2+
3+
import * as hasPermission from '../../../utils/hasPermission'
4+
import { forbiddenError } from '../../../utils/forbiddenError'
5+
6+
vi.mock('graphql-parse-resolve-info')
7+
vi.mock('../../../utils/parseRequestedFields')
8+
9+
describe('canReadGroup', () => {
10+
describe('when the group is a CMR group', () => {
11+
test('returns true if the user has permission', async () => {
12+
const hasPermissionMock = vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(true)
13+
14+
const result = await canReadGroup.resolve(
15+
null,
16+
{
17+
params: {
18+
id: '1234-abcd-5678'
19+
}
20+
},
21+
{
22+
dataSources: {
23+
groupSourceFetch: vi.fn().mockResolvedValue({ tag: 'CMR' })
24+
},
25+
edlUsername: 'test-user'
26+
},
27+
{}
28+
)
29+
30+
expect(result).toEqual(true)
31+
32+
expect(hasPermissionMock).toHaveBeenCalledTimes(1)
33+
expect(hasPermissionMock).toHaveBeenCalledWith(
34+
expect.any(Object),
35+
{
36+
permissions: 'read',
37+
permissionOptions: {
38+
user_id: 'test-user',
39+
system_object: 'GROUP'
40+
}
41+
}
42+
)
43+
})
44+
45+
test('throws a ForbiddenError if the user does not have permission', async () => {
46+
const hasPermissionMock = vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(false)
47+
48+
const result = await canReadGroup.resolve(
49+
null,
50+
{
51+
params: {
52+
id: '1234-abcd-5678'
53+
}
54+
},
55+
{
56+
dataSources: {
57+
groupSourceFetch: vi.fn().mockResolvedValue({ tag: 'CMR' })
58+
},
59+
edlUsername: 'test-user'
60+
}
61+
)
62+
63+
expect(result).toEqual(forbiddenError('Not authorized to perform [read] on system object [GROUP]'))
64+
65+
expect(hasPermissionMock).toHaveBeenCalledTimes(1)
66+
expect(hasPermissionMock).toHaveBeenCalledWith(
67+
expect.any(Object),
68+
{
69+
permissions: 'read',
70+
permissionOptions: {
71+
user_id: 'test-user',
72+
system_object: 'GROUP'
73+
}
74+
}
75+
)
76+
})
77+
})
78+
79+
describe('when the group is a provider group', () => {
80+
test('returns true if the user has permission', async () => {
81+
const hasPermissionMock = vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(true)
82+
83+
const result = await canReadGroup.resolve(
84+
null,
85+
{
86+
params: {
87+
id: '1234-abcd-5678'
88+
}
89+
},
90+
{
91+
dataSources: {
92+
groupSourceFetch: vi.fn().mockResolvedValue({ tag: 'GQL' })
93+
},
94+
edlUsername: 'test-user'
95+
},
96+
{}
97+
)
98+
99+
expect(result).toEqual(true)
100+
101+
expect(hasPermissionMock).toHaveBeenCalledTimes(1)
102+
expect(hasPermissionMock).toHaveBeenCalledWith(
103+
expect.any(Object),
104+
{
105+
permissions: 'read',
106+
permissionOptions: {
107+
provider: 'GQL',
108+
target: 'GROUP',
109+
user_id: 'test-user'
110+
}
111+
}
112+
)
113+
})
114+
115+
test('throws a ForbiddenError if the user does not have permission', async () => {
116+
const hasPermissionMock = vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(false)
117+
118+
const result = await canReadGroup.resolve(
119+
null,
120+
{
121+
params: {
122+
id: '1234-abcd-5678'
123+
}
124+
},
125+
{
126+
dataSources: {
127+
groupSourceFetch: vi.fn().mockResolvedValue({ tag: 'GQL' })
128+
},
129+
edlUsername: 'test-user'
130+
}
131+
)
132+
133+
expect(result).toEqual(forbiddenError('Not authorized to perform [read] on provider object [GROUP]'))
134+
135+
expect(hasPermissionMock).toHaveBeenCalledTimes(1)
136+
expect(hasPermissionMock).toHaveBeenCalledWith(
137+
expect.any(Object),
138+
{
139+
permissions: 'read',
140+
permissionOptions: {
141+
provider: 'GQL',
142+
target: 'GROUP',
143+
user_id: 'test-user'
144+
}
145+
}
146+
)
147+
})
148+
})
149+
150+
test('throws a ForbiddenError if the user does not exist', async () => {
151+
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(false)
152+
153+
const result = await canReadGroup.resolve(
154+
null,
155+
{
156+
params: {
157+
id: '1234-abcd-5678'
158+
}
159+
},
160+
{
161+
edlUsername: null
162+
}
163+
)
164+
165+
expect(result).toEqual(forbiddenError('Not authorized to perform [read] on system object [GROUP]'))
166+
})
167+
})

‎src/permissions/acls/__tests__/canReadProviderGroups.test.js‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
import { canReadProviderGroups } from '../canReadProviderGroups'
2+
3+
import * as hasPermission from '../../../utils/hasPermission'
4+
import { forbiddenError } from '../../../utils/forbiddenError'
5+
6+
describe('canReadProviderGroups', () => {
7+
test('returns true if the user has permission', async () => {
8+
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(true)
9+
10+
const result = await canReadProviderGroups.resolve(
11+
null,
12+
{
13+
params: {
14+
tags: ['GQL']
15+
}
16+
},
17+
{
18+
edlUsername: 'test-user'
19+
}
20+
)
21+
22+
expect(result).toEqual(true)
23+
})
24+
25+
test('returns true if the user has permission for all tags', async () => {
26+
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(true)
27+
28+
const result = await canReadProviderGroups.resolve(
29+
null,
30+
{
31+
params: {
32+
tags: ['GQL', 'TEST']
33+
}
34+
},
35+
{
36+
edlUsername: 'test-user'
37+
}
38+
)
39+
40+
expect(result).toEqual(true)
41+
})
42+
43+
test('throws a ForbiddenError if the user does not have permission', async () => {
44+
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(false)
45+
46+
const result = await canReadProviderGroups.resolve(
47+
null,
48+
{
49+
params: {
50+
tags: ['GQL']
51+
}
52+
},
53+
{
54+
edlUsername: 'test-user'
55+
}
56+
)
57+
58+
expect(result).toEqual(forbiddenError('Not authorized to perform [read] on provider object [GROUP]'))
59+
})
60+
61+
test('throws a ForbiddenError if the user does not have permission for all tags', async () => {
62+
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValueOnce(true)
63+
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValueOnce(false)
64+
65+
const result = await canReadProviderGroups.resolve(
66+
null,
67+
{
68+
params: {
69+
tags: ['GQL', 'TEST']
70+
}
71+
},
72+
{
73+
edlUsername: 'test-user'
74+
}
75+
)
76+
77+
expect(result).toEqual(forbiddenError('Not authorized to perform [read] on provider object [GROUP]'))
78+
})
79+
80+
test('throws a ForbiddenError if the user does not exist', async () => {
81+
vi.spyOn(hasPermission, 'hasPermission').mockResolvedValue(false)
82+
83+
const result = await canReadProviderGroups.resolve(
84+
null,
85+
{
86+
params: {
87+
tags: ['GQL']
88+
}
89+
},
90+
{
91+
edlUsername: null
92+
}
93+
)
94+
95+
expect(result).toEqual(forbiddenError('Not authorized to perform [read] on provider object [GROUP]'))
96+
})
97+
})

0 commit comments

Comments
 (0)