mumuki-bibliotheca 7.1.0 → 7.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d5a9335601683b0046c9f9c35584d8040f863e0defec2151720c5e32090b583e
-  data.tar.gz: 64f610853cefb9bdf72df538e266e4a086294efda9fbdf94fb0858ca710671cc
+  metadata.gz: bddf299b537a1f2749a8f042746709c1e9033cb2af3b1b36063c6de358450770
+  data.tar.gz: 728a83c5686363f7398787d22bee777d4f0fd01137658578446269d4b0038dfe
 SHA512:
-  metadata.gz: c06d0d1e8c664726c5dfa5bb69c2199bcb1b6a70a6d8e4320b06dc3424afd25d1c40155c74f869cda66a59edb6335ca997011bb80dcfd4656e1f5df552c9d1f3
-  data.tar.gz: 2f3d6cb49cef4b0c8b2bc89b3b43d67911b350640a2fd52fb2362d8299423211c5a1f319866bf0c02ae74fa82abab138215bd05bbf994a778b4800ecef3415f7
+  metadata.gz: 5daeb1be795463f90c785087be78126839b8305988f1efbff8be92d2caa6874cb5e463a5083e23cbef585d99c03c04620026b34e43d18f2f1226ae5a45979a0c
+  data.tar.gz: e512a4e5d3fa31badd4a7d32eadc11387f96ff8f95dcf647dd72bfca89b2e17142db3964e3faef381d06a0ee7a6113a14540f09ff8b25839889d3327c77bfa82

data/lib/mumuki/bibliotheca/sinatra.rb

@@ -94,6 +94,10 @@ HTML
     halt 400
   end
 
+  error Mumuki::Domain::ForbiddenError do
+    halt 403
+  end
+
   options '*' do
     response.headers['Allow'] = settings.allow_methods.map { |it| it.to_s.upcase }.join(',')
     response.headers['Access-Control-Allow-Headers'] = 'X-Mumuki-Auth-Token, X-Requested-With, X-HTTP-Method-Override, Content-Type, Cache-Control, Accept, Authorization'
@@ -165,7 +169,7 @@ HTML
     end
 
     def permissions
-      current_user.permissions
+      current_user&.permissions
     end
 
     def organizations_for(item)
@@ -174,6 +178,10 @@ HTML
         .accessible_as(current_user, :student)
         .map { |it| it.as_json(only: [:name]) }
     end
+
+    def validate_accessible!(subject)
+      authorize! :writer if subject.private?
+    end
   end
 
   post '/markdown' do

data/lib/mumuki/bibliotheca/sinatra/books.rb

@@ -10,7 +10,7 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/books' do
-    list_books Book.all
+    list_books Book.visible(permissions)
   end
 
   get '/books/writable' do
@@ -18,10 +18,12 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/books/:organization/:repository' do
+    validate_accessible! book
     book.to_resource_h
   end
 
   get '/books/:organization/:repository/organizations' do
+    validate_accessible! book
     organizations_for book
   end
 

data/lib/mumuki/bibliotheca/sinatra/guides.rb

@@ -14,11 +14,11 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/guides' do
-    list_guides Guide.visible(current_user&.permissions)
+    list_guides Guide.visible(permissions)
   end
 
   get '/guides/writable' do
-    list_guides Guide.allowed(current_user&.permissions)
+    list_guides Guide.allowed(permissions)
   end
 
   delete '/guides/:organization/:repository' do
@@ -26,14 +26,17 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/guides/:organization/:repository/markdown' do
+    validate_accessible! guide
     slice_guide_resource_h_for_api guide.to_markdownified_resource_h
   end
 
   get '/guides/:organization/:repository' do
+    validate_accessible! guide
     slice_guide_resource_h_for_api guide.to_resource_h
   end
 
   get '/guides/:organization/:repository/organizations' do
+    validate_accessible! guide
     organizations_for guide
   end
 
@@ -50,6 +53,7 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   post '/guides/:organization/:repository/assets' do
+    authorize! :writer
     Mumuki::Bibliotheca.upload_asset! slug, json_body['filename'], json_body['content']
   end
 

data/lib/mumuki/bibliotheca/sinatra/topics.rb

@@ -10,7 +10,7 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/topics' do
-    list_topics Topic.all
+    list_topics Topic.visible(permissions)
   end
 
   get '/topics/writable' do
@@ -18,10 +18,12 @@ class Mumuki::Bibliotheca::App < Sinatra::Application
   end
 
   get '/topics/:organization/:repository' do
+    validate_accessible! topic
     topic.to_resource_h
   end
 
   get '/topics/:organization/:repository/organizations' do
+    validate_accessible! topic
     organizations_for topic
   end
 

data/lib/mumuki/bibliotheca/version.rb

@@ -1,5 +1,5 @@
 module Mumuki
   module Bibliotheca
-    VERSION = '7.1.0'
+    VERSION = '7.2.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mumuki-bibliotheca
 version: !ruby/object:Gem::Version
-  version: 7.1.0
+  version: 7.2.0
 platform: ruby
 authors:
 - Franco Bulgarelli
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-17 00:00:00.000000000 Z
+date: 2020-03-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 7.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 7.2.0
 - !ruby/object:Gem::Dependency
   name: mumukit-login
   requirement: !ruby/object:Gem::Requirement