mumuki-bibliotheca 7.1.0 → 7.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d5a9335601683b0046c9f9c35584d8040f863e0defec2151720c5e32090b583e
-  data.tar.gz: 64f610853cefb9bdf72df538e266e4a086294efda9fbdf94fb0858ca710671cc
+  metadata.gz: 2574adb06de636345516735567863bbf4d9c89ff5ed547a6ed03ded351333e78
+  data.tar.gz: 01adf381619381b9db20c9647c25f0e11024daf2e00e35f40a31945b23d2d76a
 SHA512:
-  metadata.gz: c06d0d1e8c664726c5dfa5bb69c2199bcb1b6a70a6d8e4320b06dc3424afd25d1c40155c74f869cda66a59edb6335ca997011bb80dcfd4656e1f5df552c9d1f3
-  data.tar.gz: 2f3d6cb49cef4b0c8b2bc89b3b43d67911b350640a2fd52fb2362d8299423211c5a1f319866bf0c02ae74fa82abab138215bd05bbf994a778b4800ecef3415f7
+  metadata.gz: 7a9c37af968b1d4c4f28dc6b75dcd345b3c7b25c217ee05ca87eb47458dc3d47461ad1c1675bc2b472eb687f11e53173e8d3d6f2f57bf78f7c5331e1571f9ebd
+  data.tar.gz: 973407c025088ce790eac84469f60242695d8a2f777dc5394dda2161865a02c3e0a4545dd6ac045782c3a1087b747d0e68681d58504f8eefaab3bcfbcbd48a12

data/lib/mumuki/bibliotheca/sinatra.rb

@@ -94,6 +94,10 @@ HTML
     halt 400
   end
 
+  error Mumuki::Domain::ForbiddenError do
+    halt 403
+  end
+
   options '*' do
     response.headers['Allow'] = settings.allow_methods.map { |it| it.to_s.upcase }.join(',')
     response.headers['Access-Control-Allow-Headers'] = 'X-Mumuki-Auth-Token, X-Requested-With, X-HTTP-Method-Override, Content-Type, Cache-Control, Accept, Authorization'
@@ -165,7 +169,7 @@ HTML
     end
 
     def permissions
-      current_user.permissions
+      current_user&.permissions
     end
 
     def organizations_for(item)
@@ -174,6 +178,10 @@ HTML
         .accessible_as(current_user, :student)
         .map { |it| it.as_json(only: [:name]) }
     end
+
+    def validate_accessible!(subject)
+      authorize! :writer if subject.private?
+    end
   end
 
   post '/markdown' do

data/lib/mumuki/bibliotheca/sinatra/books.rb

@@ -10,7 +10,7 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/books' do
-    list_books Book.all
+    list_books Book.visible(permissions)
   end
 
   get '/books/writable' do
@@ -18,10 +18,12 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/books/:organization/:repository' do
+    validate_accessible! book
     book.to_resource_h
   end
 
   get '/books/:organization/:repository/organizations' do
+    validate_accessible! book
     organizations_for book
   end
 

data/lib/mumuki/bibliotheca/sinatra/guides.rb

@@ -14,11 +14,11 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/guides' do
-    list_guides Guide.visible(current_user&.permissions)
+    list_guides Guide.visible(permissions)
   end
 
   get '/guides/writable' do
-    list_guides Guide.allowed(current_user&.permissions)
+    list_guides Guide.allowed(permissions)
   end
 
   delete '/guides/:organization/:repository' do
@@ -26,14 +26,17 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/guides/:organization/:repository/markdown' do
+    validate_accessible! guide
     slice_guide_resource_h_for_api guide.to_markdownified_resource_h
   end
 
   get '/guides/:organization/:repository' do
+    validate_accessible! guide
     slice_guide_resource_h_for_api guide.to_resource_h
   end
 
   get '/guides/:organization/:repository/organizations' do
+    validate_accessible! guide
     organizations_for guide
   end
 
@@ -50,6 +53,7 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   post '/guides/:organization/:repository/assets' do
+    authorize! :writer
     Mumuki::Bibliotheca.upload_asset! slug, json_body['filename'], json_body['content']
   end
 

data/lib/mumuki/bibliotheca/sinatra/topics.rb

@@ -10,7 +10,7 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/topics' do
-    list_topics Topic.all
+    list_topics Topic.visible(permissions)
   end
 
   get '/topics/writable' do
@@ -18,10 +18,12 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/topics/:organization/:repository' do
+    validate_accessible! topic
     topic.to_resource_h
   end
 
   get '/topics/:organization/:repository/organizations' do
+    validate_accessible! topic
     organizations_for topic
   end
 

data/lib/mumuki/bibliotheca/version.rb

@@ -1,5 +1,5 @@
 module Mumuki
   module Bibliotheca
-    VERSION = '7.1.0'
+    VERSION = '7.6.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mumuki-bibliotheca
 version: !ruby/object:Gem::Version
-  version: 7.1.0
+  version: 7.6.0
 platform: ruby
 authors:
 - Franco Bulgarelli
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-17 00:00:00.000000000 Z
+date: 2020-06-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 7.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 7.6.0
 - !ruby/object:Gem::Dependency
   name: mumukit-login
   requirement: !ruby/object:Gem::Requirement