forest_liana 9.22.14 → 9.22.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ea33256d7cec4221e9c94bbe46f8bc4f7caaef29854b237cff1961aed4809dd
-  data.tar.gz: c80925513502ae243fabd0d0c6840483634940882226ccb1e6c686c0cbc52553
+  metadata.gz: dc9e247d2d65125925e14127a256acb70326504b4c1e2fc90daaf3b792736025
+  data.tar.gz: 7039ebbb67be595efd366b94d57a35881448f9747cba39cf2e8e35b1f88a083e
 SHA512:
-  metadata.gz: f21a026ae94a6061ba804462b9e681dc4e43fa57ace54b627ca06fcec199d1ddbeebdbc701c94e4820d3e00de8bab105dc6acd3614db4f855318592b6957ab81
-  data.tar.gz: 0f8579fab129cd9ba90747c9c37a22de38bf4aa0bf89a210e4cee5a806129a9aee1b1adb5da22c8ede9925047478cf18fbceb79b394f5d5323b27f13a2e1ce08
+  metadata.gz: 3bf2d66f16eaedc067bfca8422a0274255bc9bc6d86057e251bdb65dd41191859e02344f2712356511c437bf03a525c5ff11b2a7f4ebb972104420baafcd1fbc
+  data.tar.gz: 07b0b79be5105719f3cffbb590717731031d3e1cd0fc81eb6e5d2c72a60f7413e411661f4f301a97294fc08e4cadac9e1d547ceb9c9cec1b9b0bbeadae569b3b

data/app/controllers/forest_liana/devise_controller.rb

@@ -1,11 +1,15 @@
 module ForestLiana
-  class DeviseController < ForestLiana::ApplicationController
-    def change_password
-      resource = SchemaUtils.find_model_from_collection_name(
-        params['data']['attributes']['collection_name'])
+  class DeviseController < ForestLiana::SmartActionsController
+    rescue_from ActiveRecord::RecordNotFound, with: :render_target_not_found
 
-      user = resource.find(params['data']['attributes']['ids'].first)
-      user.password = params['data']['attributes']['values']['New password']
+    def change_password
+      attributes = @parameters[:data][:attributes]
+      # The inherited scope check skips composite primary keys.
+      scoped_records = ForestLiana::ScopeManager.apply_scopes_on_records(
+        @resource, forest_user, ForestLiana.name_for(@resource), @parameters[:timezone]
+      )
+      user = scoped_records.find(attributes[:ids].first)
+      user.password = attributes[:values]['New password']
       user.save
 
       if user.valid?
@@ -16,6 +20,11 @@ module ForestLiana
         }
       end
     end
+
+    private
+
+    def render_target_not_found
+      render serializer: nil, json: { error: 'Smart Action: target record not found' }, status: :bad_request
+    end
   end
 end
-

data/app/controllers/forest_liana/smart_actions_controller.rb

@@ -6,11 +6,13 @@ module ForestLiana
     rescue_from ForestLiana::Ability::Exceptions::ActionConditionError, with: :render_error
     include ForestLiana::Ability
     if Rails::VERSION::MAJOR < 4
+      before_filter :refuse_requester_id_outside_signed_request
       before_filter :get_smart_action_request
       before_filter :find_resource
       before_filter :check_permission_for_smart_route
       before_filter :ensure_record_ids_in_scope
     else
+      before_action :refuse_requester_id_outside_signed_request
       before_action :get_smart_action_request
       before_action :find_resource
       before_action :check_permission_for_smart_route
@@ -19,6 +21,10 @@ module ForestLiana
 
     private
 
+    def refuse_requester_id_outside_signed_request
+      raise ForestLiana::Errors::HTTP422Error.new if params.dig(:data, :attributes, :requester_id)
+    end
+
     def get_smart_action_request
       begin
         params[:data][:attributes]

data/app/services/forest_liana/schema_adapter.rb

@@ -32,6 +32,7 @@ module ForestLiana
         collection.actions << ForestLiana::Model::Action.new({
           id: "#{collection.name}.Change password",
           name: "Change password",
+          type: 'single',
           fields: [{
             field: 'New password',
             type: 'String'

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.14"
+  VERSION = "9.22.15"
 end

data/spec/requests/actions_controller_spec.rb

@@ -563,6 +563,17 @@ describe 'Requesting Actions routes', :type => :request  do
       end
     end
 
+    describe 'with a requester named outside a signed approval request' do
+      it 'should respond 422 and NOT perform the action' do
+        params[:data][:attributes][:requester_id] = 99
+        expect_any_instance_of(Forest::IslandsController).not_to receive(:test)
+
+        post '/forest/actions/test', params: JSON.dump(params), headers: headers
+
+        expect(response.status).to eq(422)
+      end
+    end
+
     describe 'with scopes' do
       before(:each) do
         allow_any_instance_of(ForestLiana::Ability).to receive(:forest_authorize!) { true }

data/spec/requests/devise_controller_spec.rb

@@ -0,0 +1,271 @@
+require 'rails_helper'
+
+describe 'Change password action', type: :request do
+  let(:rendering_id) { 13 }
+  let(:role_id) { 1 }
+  let(:trigger_roles) { [role_id] }
+  let(:approval_roles) { [] }
+  let(:approver_roles) { [] }
+  let(:scope_filters) { { 'scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' } } }
+  let(:cache) { ActiveSupport::Cache::MemoryStore.new }
+  let(:island_collection) { ForestLiana.apimap.find { |collection| collection.name.to_s == 'Island' } }
+  let(:change_password_action) do
+    ForestLiana::Model::Action.new(
+      id: 'Island.Change password',
+      name: 'Change password',
+      type: 'single',
+      fields: [{ field: 'New password', type: 'String' }]
+    )
+  end
+
+  let(:token) do
+    JWT.encode({
+      id: 38,
+      email: 'michael.kelso@that70.show',
+      first_name: 'Michael',
+      last_name: 'Kelso',
+      team: 'Operations',
+      rendering_id: rendering_id,
+      exp: Time.now.to_i + 2.weeks.to_i,
+      permission_level: 'user'
+    }, ForestLiana.auth_secret, 'HS256')
+  end
+
+  let(:headers) do
+    {
+      'Accept' => 'application/json',
+      'Content-Type' => 'application/json',
+      'Authorization' => "Bearer #{token}"
+    }
+  end
+
+  let(:attributes) do
+    {
+      collection_name: 'Island',
+      ids: ['1'],
+      all_records: false,
+      values: { 'New password' => 'n3w-p4ssw0rd' },
+      smart_action_id: 'Island-Change password'
+    }
+  end
+
+  let(:params) { { data: { attributes: attributes, type: 'custom-action-requests' }, timezone: 'Europe/Paris' } }
+
+  def environment_permissions
+    enabled = { 'roles' => [role_id] }
+    crud = %w[browseEnabled readEnabled editEnabled addEnabled deleteEnabled exportEnabled].to_h { |key| [key, enabled] }
+    change_password = {
+      'triggerEnabled' => { 'roles' => trigger_roles },
+      'triggerConditions' => [],
+      'approvalRequired' => { 'roles' => approval_roles },
+      'approvalRequiredConditions' => [],
+      'userApprovalEnabled' => { 'roles' => approver_roles },
+      'userApprovalConditions' => [],
+      'selfApprovalEnabled' => { 'roles' => [] }
+    }
+
+    { 'collections' => { 'Island' => { 'collection' => crud, 'actions' => { 'Change password' => change_password } } } }
+  end
+
+  before(:all) { Island.send(:attr_accessor, :password) }
+  after(:all) { Island.send(:remove_method, :password, :password=) }
+
+  before do
+    island_collection.actions << change_password_action
+    Island.create!(id: 1, name: 'Corsica')
+
+    allow(Rails).to receive(:cache).and_return(cache)
+    allow_any_instance_of(ForestLiana::Ability::Fetch).to receive(:get_permissions) do |_, path|
+      case path
+      when '/liana/v4/permissions/environment' then environment_permissions
+      when '/liana/v4/permissions/users' then [{ 'id' => 38, 'roleId' => role_id }]
+      end
+    end
+
+    ForestLiana::ScopeManager.invalidate_scope_cache(rendering_id)
+    allow(ForestLiana::ScopeManager).to receive(:fetch_scopes).and_return(scope_filters)
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+  end
+
+  after do
+    island_collection.actions.delete(change_password_action)
+    Island.destroy_all
+  end
+
+  def change_password
+    post '/forest/actions/change-password', params: JSON.dump(params), headers: headers
+  end
+
+  context 'when the user is allowed to trigger the action on the collection' do
+    it 'responds 204 and sets the new password on the targeted record' do
+      expect_any_instance_of(Island).to receive(:password=).with('n3w-p4ssw0rd').and_call_original
+
+      change_password
+
+      expect(response.status).to eq(204)
+    end
+  end
+
+  context 'when the user scope excludes the targeted record at lookup' do
+    it 'resolves the record within the user scope and leaves the password unchanged' do
+      expect(ForestLiana::ScopeManager).to receive(:apply_scopes_on_records)
+        .with(Island, hash_including('id' => 38, 'rendering_id' => rendering_id), 'Island', 'Europe/Paris')
+        .and_return(Island.none)
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(400)
+      expect(JSON.parse(response.body)).to eq('error' => 'Smart Action: target record not found')
+    end
+  end
+
+  context 'when the user is not allowed to trigger the action on the collection' do
+    let(:trigger_roles) { [] }
+
+    it 'responds 403 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first).to include(
+        'name' => 'CustomActionTriggerForbiddenError',
+        'detail' => "You don't have the permission to trigger this action"
+      )
+    end
+  end
+
+  context 'when the user role must have the action approved' do
+    let(:approval_roles) { [role_id] }
+
+    it 'responds 403 asking for approval and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first).to include(
+        'name' => 'CustomActionRequiresApprovalError',
+        'detail' => 'This action requires to be approved.'
+      )
+    end
+  end
+
+  context 'when the request carries no smart action id' do
+    let(:attributes) { super().except(:smart_action_id) }
+
+    it 'responds 400 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(400)
+    end
+  end
+
+  context 'when the targeted record is outside the user scope' do
+    let(:scope_filters) do
+      {
+        'scopes' => {
+          'Island' => {
+            'aggregator' => 'and',
+            'conditions' => [{ 'field' => 'name', 'operator' => 'equal', 'value' => 'Ré' }]
+          }
+        },
+        'team' => { 'id' => 43, 'name' => 'Operations' }
+      }
+    end
+
+    it 'responds 400 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(400)
+      expect(JSON.parse(response.body)).to eq('error' => 'Smart Action: target record not found')
+    end
+  end
+
+  context 'when the request selects all records' do
+    let(:attributes) { super().merge(all_records: true, all_records_ids_excluded: []) }
+
+    it 'responds 422 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(422)
+      expect(JSON.parse(response.body)['errors'].first).to include('detail' => ForestLiana::SingleRecordSelection::MESSAGE)
+    end
+  end
+
+  context 'when the request targets several records' do
+    let(:attributes) { super().merge(ids: %w[1 2]) }
+
+    it 'responds 422 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(422)
+      expect(JSON.parse(response.body)['errors'].first).to include('detail' => ForestLiana::SingleRecordSelection::MESSAGE)
+    end
+  end
+
+  context 'when the request names a requester outside a signed approval request' do
+    let(:attributes) { super().merge(requester_id: 99) }
+
+    it 'responds 422 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(422)
+    end
+  end
+
+  context 'when an approver executes a signed approval request' do
+    let(:approval_roles) { [role_id] }
+    let(:approver_roles) { [role_id] }
+    let(:approved_ids) { ['1'] }
+    let(:signed_approval_request) do
+      JWT.encode(
+        { data: { attributes: attributes.merge(ids: approved_ids, requester_id: 99) } },
+        ForestLiana.env_secret,
+        'HS256'
+      )
+    end
+    let(:params) do
+      {
+        data: {
+          attributes: attributes.except(:values).merge(signed_approval_request: signed_approval_request),
+          type: 'custom-action-requests'
+        },
+        timezone: 'Europe/Paris'
+      }
+    end
+
+    it 'responds 204 and sets the approved password on the targeted record' do
+      expect_any_instance_of(Island).to receive(:password=).with('n3w-p4ssw0rd').and_call_original
+
+      change_password
+
+      expect(response.status).to eq(204)
+    end
+
+    context 'and the approved request targets several records' do
+      let(:approved_ids) { %w[1 2] }
+
+      it 'responds 422 and leaves the password unchanged' do
+        expect_any_instance_of(Island).not_to receive(:password=)
+
+        change_password
+
+        expect(response.status).to eq(422)
+        expect(JSON.parse(response.body)['errors'].first).to include('detail' => ForestLiana::SingleRecordSelection::MESSAGE)
+      end
+    end
+  end
+end

data/spec/services/forest_liana/schema_adapter_spec.rb

@@ -122,6 +122,32 @@ module ForestLiana
           expect(uri_regex_validation[:value].match('\n')).to eq(nil)
         end
       end
+
+      context 'with a Devise model' do
+        let(:devise_model) do
+          stub_const('DeviseAccount', Class.new(ActiveRecord::Base) do
+            self.table_name = 'isle'
+
+            def self.devise_modules?
+              true
+            end
+          end)
+        end
+
+        after { ForestLiana.apimap.delete_if { |collection| collection.name.to_s == 'DeviseAccount' } }
+
+        it 'declares Change password as a single-record action' do
+          collection = described_class.new(devise_model).perform
+          action = collection.actions.find { |candidate| candidate.name == 'Change password' }
+
+          expect(action).to have_attributes(
+            id: 'DeviseAccount.Change password',
+            type: 'single',
+            endpoint: 'forest/actions/change-password',
+            http_method: 'POST'
+          )
+        end
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.14
+  version: 9.22.15
 platform: ruby
 authors:
 - Sandro Munda
@@ -486,6 +486,7 @@ files:
 - spec/requests/capabilities_spec.rb
 - spec/requests/cors_spec.rb
 - spec/requests/count_spec.rb
+- spec/requests/devise_controller_spec.rb
 - spec/requests/missing_attribute_valve_spec.rb
 - spec/requests/permissions_cache_footprint_spec.rb
 - spec/requests/projection_header_spec.rb
@@ -850,6 +851,7 @@ test_files:
 - spec/requests/capabilities_spec.rb
 - spec/requests/cors_spec.rb
 - spec/requests/count_spec.rb
+- spec/requests/devise_controller_spec.rb
 - spec/requests/missing_attribute_valve_spec.rb
 - spec/requests/permissions_cache_footprint_spec.rb
 - spec/requests/projection_header_spec.rb