sasjs/server
1
0
Fork 0
mirror of https://github.com/sasjs/server.git synced 2026-01-07 06:30:06 +00:00
Code Issues Projects Releases Wiki Activity

fix: update schema of Permission

Browse Source
This commit is contained in:
Sabir Hassan
2022-08-01 21:33:10 +05:00
parent b7dff341f0
commit 5d5a9d3788
14 changed files with 488 additions and 366 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
api/src/routes/api/spec/drive.spec.ts
View File

@@ -32,7 +32,8 @@ import appPromise from '../../../app'
import {
UserController,
PermissionController,
PermissionSetting,
PermissionType,
PermissionSettingForRoute,
PrincipalType
} from '../../../controllers/'
import { getTreeExample } from '../../../controllers/internal'
@@ -48,6 +49,12 @@ const user = {
isActive: true
}
const permission = {
type: PermissionType.route,
principalType: PrincipalType.user,
setting: PermissionSettingForRoute.grant
}
describe('drive', () => {
let app: Express
let con: Mongoose
@@ -66,34 +73,29 @@ describe('drive', () => {
const dbUser = await controller.createUser(user)
accessToken = await generateAndSaveToken(dbUser.id)
await permissionController.createPermission({
uri: '/SASjsApi/drive/deploy',
principalType: PrincipalType.user,
principalId: dbUser.id,
setting: PermissionSetting.grant
...permission,
path: '/SASjsApi/drive/deploy',
principalId: dbUser.id
})
await permissionController.createPermission({
uri: '/SASjsApi/drive/deploy/upload',
principalType: PrincipalType.user,
principalId: dbUser.id,
setting: PermissionSetting.grant
...permission,
path: '/SASjsApi/drive/deploy/upload',
principalId: dbUser.id
})
await permissionController.createPermission({
uri: '/SASjsApi/drive/file',
principalType: PrincipalType.user,
principalId: dbUser.id,
setting: PermissionSetting.grant
...permission,
path: '/SASjsApi/drive/file',
principalId: dbUser.id
})
await permissionController.createPermission({
uri: '/SASjsApi/drive/folder',
principalType: PrincipalType.user,
principalId: dbUser.id,
setting: PermissionSetting.grant
...permission,
path: '/SASjsApi/drive/folder',
principalId: dbUser.id
})
await permissionController.createPermission({
uri: '/SASjsApi/drive/rename',
principalType: PrincipalType.user,
principalId: dbUser.id,
setting: PermissionSetting.grant
...permission,
path: '/SASjsApi/drive/rename',
principalId: dbUser.id
})
})

129
api/src/routes/api/spec/permission.spec.ts
View File

@@ -9,7 +9,8 @@ import {
GroupController,
PermissionController,
PrincipalType,
PermissionSetting
PermissionType,
PermissionSettingForRoute
} from '../../../controllers/'
import {
UserDetailsResponse,
@@ -55,10 +56,10 @@ const user = {
}
const permission = {
uri: '/SASjsApi/code/execute',
setting: PermissionSetting.grant,
principalType: PrincipalType.user,
principalId: 123
path: '/SASjsApi/code/execute',
type: PermissionType.route,
setting: PermissionSettingForRoute.grant,
principalType: PrincipalType.user
}
const group = {
@@ -106,7 +107,8 @@ describe('permission', () => {
.expect(200)
expect(res.body.permissionId).toBeTruthy()
expect(res.body.uri).toEqual(permission.uri)
expect(res.body.path).toEqual(permission.path)
expect(res.body.type).toEqual(permission.type)
expect(res.body.setting).toEqual(permission.setting)
expect(res.body.user).toBeTruthy()
})
@@ -125,7 +127,8 @@ describe('permission', () => {
.expect(200)
expect(res.body.permissionId).toBeTruthy()
expect(res.body.uri).toEqual(permission.uri)
expect(res.body.path).toEqual(permission.path)
expect(res.body.type).toEqual(permission.type)
expect(res.body.setting).toEqual(permission.setting)
expect(res.body.group).toBeTruthy()
})
@@ -140,53 +143,74 @@ describe('permission', () => {
expect(res.body).toEqual({})
})
it('should respond with Unauthorized if access token is not of an admin account even if user has permission', async () => {
it('should respond with Unauthorized if access token is not of an admin account', async () => {
const accessToken = await generateAndSaveToken(dbUser.id)
await permissionController.createPermission({
uri: '/SASjsApi/permission',
principalType: PrincipalType.user,
principalId: dbUser.id,
setting: PermissionSetting.grant
})
const res = await request(app)
.post('/SASjsApi/permission')
.auth(accessToken, { type: 'bearer' })
.send()
.send(permission)
.expect(401)
expect(res.text).toEqual('Admin account required')
expect(res.body).toEqual({})
})
it('should respond with Bad Request if uri is missing', async () => {
it('should respond with Bad Request if path is missing', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
.auth(adminAccessToken, { type: 'bearer' })
.send({
...permission,
uri: undefined
path: undefined
})
.expect(400)
expect(res.text).toEqual(`"uri" is required`)
expect(res.text).toEqual(`"path" is required`)
expect(res.body).toEqual({})
})
it('should respond with Bad Request if uri is not valid', async () => {
it('should respond with Bad Request if path is not valid', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
.auth(adminAccessToken, { type: 'bearer' })
.send({
...permission,
uri: '/some/random/api/endpoint'
path: '/some/random/api/endpoint'
})
.expect(400)
expect(res.body).toEqual({})
})
it('should respond with Bad Request if type is not valid', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
.auth(adminAccessToken, { type: 'bearer' })
.send({
...permission,
type: 'invalid'
})
.expect(400)
expect(res.text).toEqual('"type" must be [Route]')
expect(res.body).toEqual({})
})
it('should respond with Bad Request if type is missing', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
.auth(adminAccessToken, { type: 'bearer' })
.send({
...permission,
type: undefined
})
.expect(400)
expect(res.text).toEqual(`"type" is required`)
expect(res.body).toEqual({})
})
it('should respond with Bad Request if setting is missing', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
@@ -201,6 +225,20 @@ describe('permission', () => {
expect(res.body).toEqual({})
})
it('should respond with Bad Request if setting is not valid', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
.auth(adminAccessToken, { type: 'bearer' })
.send({
...permission,
setting: 'invalid'
})
.expect(400)
expect(res.text).toEqual('"setting" must be one of [Grant, Deny]')
expect(res.body).toEqual({})
})
it('should respond with Bad Request if principalType is missing', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
@@ -215,20 +253,6 @@ describe('permission', () => {
expect(res.body).toEqual({})
})
it('should respond with Bad Request if principalId is missing', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
.auth(adminAccessToken, { type: 'bearer' })
.send({
...permission,
principalId: undefined
})
.expect(400)
expect(res.text).toEqual(`"principalId" is required`)
expect(res.body).toEqual({})
})
it('should respond with Bad Request if principal type is not valid', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
@@ -243,17 +267,17 @@ describe('permission', () => {
expect(res.body).toEqual({})
})
it('should respond with Bad Request if setting is not valid', async () => {
it('should respond with Bad Request if principalId is missing', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
.auth(adminAccessToken, { type: 'bearer' })
.send({
...permission,
setting: 'invalid'
principalId: undefined
})
.expect(400)
expect(res.text).toEqual('"setting" must be one of [Grant, Deny]')
expect(res.text).toEqual(`"principalId" is required`)
expect(res.body).toEqual({})
})
@@ -311,7 +335,8 @@ describe('permission', () => {
.auth(adminAccessToken, { type: 'bearer' })
.send({
...permission,
principalType: 'group'
principalType: 'group',
principalId: 123
})
.expect(404)
@@ -332,7 +357,7 @@ describe('permission', () => {
.expect(409)
expect(res.text).toEqual(
'Permission already exists with provided URI and User.'
'Permission already exists with provided Path, Type and User.'
)
expect(res.body).toEqual({})
})
@@ -355,7 +380,7 @@ describe('permission', () => {
const res = await request(app)
.patch(`/SASjsApi/permission/${dbPermission?.permissionId}`)
.auth(adminAccessToken, { type: 'bearer' })
.send({ setting: 'Deny' })
.send({ setting: PermissionSettingForRoute.deny })
.expect(200)
expect(res.body.setting).toEqual('Deny')
@@ -364,7 +389,7 @@ describe('permission', () => {
it('should respond with Unauthorized if access token is not present', async () => {
const res = await request(app)
.patch(`/SASjsApi/permission/${dbPermission?.permissionId}`)
.send(permission)
.send()
.expect(401)
expect(res.text).toEqual('Unauthorized')
@@ -398,12 +423,11 @@ describe('permission', () => {
expect(res.body).toEqual({})
})
it('should respond with Bad Request if setting is not valid', async () => {
it('should respond with Bad Request if setting is invalid', async () => {
const res = await request(app)
.post('/SASjsApi/permission')
.patch(`/SASjsApi/permission/${dbPermission?.permissionId}`)
.auth(adminAccessToken, { type: 'bearer' })
.send({
...permission,
setting: 'invalid'
})
.expect(400)
@@ -412,12 +436,12 @@ describe('permission', () => {
expect(res.body).toEqual({})
})
it('should respond with not found (404) if permission with provided id does not exists', async () => {
it('should respond with not found (404) if permission with provided id does not exist', async () => {
const res = await request(app)
.patch('/SASjsApi/permission/123')
.auth(adminAccessToken, { type: 'bearer' })
.send({
setting: PermissionSetting.deny
setting: PermissionSettingForRoute.deny
})
.expect(404)
@@ -456,12 +480,12 @@ describe('permission', () => {
beforeAll(async () => {
await permissionController.createPermission({
...permission,
uri: '/test-1',
path: '/test-1',
principalId: dbUser.id
})
await permissionController.createPermission({
...permission,
uri: '/test-2',
path: '/test-2',
principalId: dbUser.id
})
})
@@ -483,10 +507,11 @@ describe('permission', () => {
})
const accessToken = await generateAndSaveToken(nonAdminUser.id)
await permissionController.createPermission({
uri: '/test-1',
path: '/test-1',
type: PermissionType.route,
principalType: PrincipalType.user,
principalId: nonAdminUser.id,
setting: PermissionSetting.grant
setting: PermissionSettingForRoute.grant
})
const res = await request(app)
@@ -503,7 +528,7 @@ describe('permission', () => {
beforeAll(async () => {
await permissionController.createPermission({
...permission,
uri: '/SASjsApi/drive/deploy',
path: '/SASjsApi/drive/deploy',
principalId: dbUser.id
})
})

8
api/src/routes/api/spec/stp.spec.ts
View File

@@ -7,7 +7,8 @@ import appPromise from '../../../app'
import {
UserController,
PermissionController,
PermissionSetting,
PermissionType,
PermissionSettingForRoute,
PrincipalType
} from '../../../controllers/'
import {
@@ -56,10 +57,11 @@ describe('stp', () => {
const dbUser = await userController.createUser(user)
accessToken = await generateAndSaveToken(dbUser.id)
await permissionController.createPermission({
uri: '/SASjsApi/stp/execute',
path: '/SASjsApi/stp/execute',
type: PermissionType.route,
principalType: PrincipalType.user,
principalId: dbUser.id,
setting: PermissionSetting.grant
setting: PermissionSettingForRoute.grant
})
})