Skip to content

Commit

Permalink
Merge branch 'release-7.0.0' into chore/permissions-check-oauth-apps
Browse files Browse the repository at this point in the history
  • Loading branch information
@MarcosSpessatto
MarcosSpessatto committed May 9, 2024
2 parents dcc29fb + c68e1e8 commit e59ca2e
Show file tree
Hide file tree
Showing 5 changed files with 125 additions and 128 deletions.
31 changes: 13 additions & 18 deletions apps/meteor/app/api/server/v1/groups.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,7 @@ import { findUsersOfRoom } from '../../../../server/lib/findUsersOfRoom';
import { hideRoomMethod } from '../../../../server/methods/hideRoom';
import { removeUserFromRoomMethod } from '../../../../server/methods/removeUserFromRoom';
import { canAccessRoomAsync, roomAccessAttributes } from '../../../authorization/server';
import {
hasAllPermissionAsync,
hasAtLeastOnePermissionAsync,
hasPermissionAsync,
} from '../../../authorization/server/functions/hasPermission';
import { hasAllPermissionAsync, hasPermissionAsync } from '../../../authorization/server/functions/hasPermission';
import { saveRoomSettings } from '../../../channel-settings/server/methods/saveRoomSettings';
import { mountIntegrationQueryBasedOnPermissions } from '../../../integrations/server/lib/mountQueriesBasedOnPermission';
import { createPrivateGroupMethod } from '../../../lib/server/methods/createPrivateGroup';
Expand Down Expand Up @@ -412,20 +408,22 @@ API.v1.addRoute(

API.v1.addRoute(
'groups.getIntegrations',
{ authRequired: true },
{
async get() {
if (
!(await hasAtLeastOnePermissionAsync(this.userId, [
authRequired: true,
permissionsRequired: {
GET: {
permissions: [
'manage-outgoing-integrations',
'manage-own-outgoing-integrations',
'manage-incoming-integrations',
'manage-own-incoming-integrations',
]))
) {
return API.v1.unauthorized();
}

],
operation: 'hasAny',
},
},
},
{
async get() {
const findResult = await findPrivateGroupByIdOrName({
params: this.queryParams,
userId: this.userId,
Expand Down Expand Up @@ -670,12 +668,9 @@ API.v1.addRoute(

API.v1.addRoute(
'groups.listAll',
{ authRequired: true },
{ authRequired: true, permissionsRequired: ['view-room-administration'] },
{
async get() {
if (!(await hasPermissionAsync(this.userId, 'view-room-administration'))) {
return API.v1.unauthorized();
}
const { offset, count } = await getPaginationItems(this.queryParams);
const { sort, fields, query } = await this.parseJsonQuery();
const ourQuery = Object.assign({}, query, { t: 'p' as RoomType });
Expand Down
54 changes: 30 additions & 24 deletions apps/meteor/app/api/server/v1/integrations.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@ import { Match, check } from 'meteor/check';
import { Meteor } from 'meteor/meteor';
import type { Filter } from 'mongodb';

import { hasAtLeastOnePermissionAsync } from '../../../authorization/server/functions/hasPermission';
import {
mountIntegrationHistoryQueryBasedOnPermissions,
mountIntegrationQueryBasedOnPermissions,
Expand Down Expand Up @@ -43,15 +42,17 @@ API.v1.addRoute(

API.v1.addRoute(
'integrations.history',
{ authRequired: true, validateParams: isIntegrationsHistoryProps },
{
authRequired: true,
validateParams: isIntegrationsHistoryProps,
permissionsRequired: {
GET: { permissions: ['manage-outgoing-integrations', 'manage-own-outgoing-integrations'], operation: 'hasAny' },
},
},
{
async get() {
const { userId, queryParams } = this;

if (!(await hasAtLeastOnePermissionAsync(userId, ['manage-outgoing-integrations', 'manage-own-outgoing-integrations']))) {
return API.v1.unauthorized();
}

if (!queryParams.id || queryParams.id.trim() === '') {
return API.v1.failure('Invalid integration id.');
}
Expand Down Expand Up @@ -83,20 +84,22 @@ API.v1.addRoute(

API.v1.addRoute(
'integrations.list',
{ authRequired: true },
{
async get() {
if (
!(await hasAtLeastOnePermissionAsync(this.userId, [
authRequired: true,
permissionsRequired: {
GET: {
permissions: [
'manage-outgoing-integrations',
'manage-own-outgoing-integrations',
'manage-incoming-integrations',
'manage-own-incoming-integrations',
]))
) {
return API.v1.unauthorized();
}

],
operation: 'hasAny',
},
},
},
{
async get() {
const { offset, count } = await getPaginationItems(this.queryParams);
const { sort, fields: projection, query } = await this.parseJsonQuery();

Expand Down Expand Up @@ -124,20 +127,23 @@ API.v1.addRoute(

API.v1.addRoute(
'integrations.remove',
{ authRequired: true, validateParams: isIntegrationsRemoveProps },
{
async post() {
if (
!(await hasAtLeastOnePermissionAsync(this.userId, [
authRequired: true,
validateParams: isIntegrationsRemoveProps,
permissionsRequired: {
POST: {
permissions: [
'manage-outgoing-integrations',
'manage-own-outgoing-integrations',
'manage-incoming-integrations',
'manage-own-incoming-integrations',
]))
) {
return API.v1.unauthorized();
}

],
operation: 'hasAny',
},
},
},
{
async post() {
const { bodyParams } = this;

let integration: IIntegration | null = null;
Expand Down
58 changes: 31 additions & 27 deletions apps/meteor/tests/end-to-end/api/03-groups.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1070,33 +1070,37 @@ describe('[Groups]', function () {
});

describe('/groups.listAll', () => {
it('should fail if the user doesnt have view-room-administration permission', (done) => {
updatePermission('view-room-administration', []).then(() => {
request
.get(api('groups.listAll'))
.set(credentials)
.expect('Content-Type', 'application/json')
.expect(403)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error', 'unauthorized');
})
.end(done);
});
before(async () => {
return updatePermission('view-room-administration', ['admin']);
});
it('should succeed if user has view-room-administration permission', (done) => {
updatePermission('view-room-administration', ['admin']).then(() => {
request
.get(api('groups.listAll'))
.set(credentials)
.expect('Content-Type', 'application/json')
.expect(200)
.expect((res) => {
expect(res.body).to.have.property('success', true);
expect(res.body).to.have.property('groups').and.to.be.an('array');
})
.end(done);
});

after(async () => {
return updatePermission('view-room-administration', ['admin']);
});

it('should succeed if user has view-room-administration permission', async () => {
await request
.get(api('groups.listAll'))
.set(credentials)
.expect('Content-Type', 'application/json')
.expect(200)
.expect((res) => {
expect(res.body).to.have.property('success', true);
expect(res.body).to.have.property('groups').and.to.be.an('array');
});
});

it('should fail if the user doesnt have view-room-administration permission', async () => {
await updatePermission('view-room-administration', []);
await request
.get(api('groups.listAll'))
.set(credentials)
.expect('Content-Type', 'application/json')
.expect(403)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error', 'User does not have the permissions required for this action [error-unauthorized]');
});
});
});

Expand Down Expand Up @@ -1260,7 +1264,7 @@ describe('[Groups]', function () {
.expect(403)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error', 'unauthorized');
expect(res.body).to.have.property('error', 'User does not have the permissions required for this action [error-unauthorized]');
});
});
});
Expand Down
69 changes: 32 additions & 37 deletions apps/meteor/tests/end-to-end/api/06-outgoing-integrations.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -284,47 +284,42 @@ describe('[Outgoing Integrations]', function () {
});
});

it('should return unauthorized error when the user does not have any integrations permissions', (done) => {
updatePermission('manage-incoming-integrations', []).then(() => {
updatePermission('manage-own-incoming-integrations', []).then(() => {
updatePermission('manage-outgoing-integrations', []).then(() => {
updatePermission('manage-outgoing-integrations', []).then(() => {
request
.get(api('integrations.list'))
.set(credentials)
.expect('Content-Type', 'application/json')
.expect(403)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error', 'unauthorized');
})
.end(done);
});
});
it('should return unauthorized error when the user does not have any integrations permissions', async () => {
await Promise.all([
updatePermission('manage-incoming-integrations', []),
updatePermission('manage-own-incoming-integrations', []),
updatePermission('manage-outgoing-integrations', []),
updatePermission('manage-outgoing-integrations', []),
]);

await request
.get(api('integrations.list'))
.set(credentials)
.expect('Content-Type', 'application/json')
.expect(403)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error', 'User does not have the permissions required for this action [error-unauthorized]');
});
});
});
});

describe('[/integrations.history]', () => {
it('should return an error when the user DOES NOT the necessary permission', (done) => {
updatePermission('manage-outgoing-integrations', []).then(() => {
updatePermission('manage-own-outgoing-integrations', []).then(() => {
request
.get(api('integrations.history'))
.set(credentials)
.query({
id: integration._id,
})
.expect('Content-Type', 'application/json')
.expect(403)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error', 'unauthorized');
})
.end(done);
it('should return an error when the user DOES NOT the necessary permission', async () => {
await updatePermission('manage-outgoing-integrations', []);
await updatePermission('manage-own-outgoing-integrations', []);
await request
.get(api('integrations.history'))
.set(credentials)
.query({
id: integration._id,
})
.expect('Content-Type', 'application/json')
.expect(403)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error', 'User does not have the permissions required for this action [error-unauthorized]');
});
});
});

it('should return the history of outgoing integrations', (done) => {
Expand Down Expand Up @@ -457,7 +452,7 @@ describe('[Outgoing Integrations]', function () {
.expect(403)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error', 'unauthorized');
expect(res.body).to.have.property('error', 'User does not have the permissions required for this action [error-unauthorized]');
})
.end(done);
});
Expand All @@ -476,7 +471,7 @@ describe('[Outgoing Integrations]', function () {
.expect(403)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error', 'unauthorized');
expect(res.body).to.have.property('error', 'User does not have the permissions required for this action [error-unauthorized]');
})
.end(done);
});
Expand Down
Loading

0 comments on commit e59ca2e

Please sign in to comment.