mumuki-laboratory 5.11.0 → 5.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 18f020ea8f88054e994d5e652d5ba0da08c502c1e49042d7906293695e396a82
-  data.tar.gz: 49f403a38857fe24615f1c4429bc68927a621e9a714eabb5698815436f973466
+  metadata.gz: d1a14bc93fe037ed3d6ee6afa041dcd4c84d308011e819cffdd39b9c1fe5a7e2
+  data.tar.gz: 8f4fba71e09dab7bd831d8a2424a889b107e3e9b531c1b9d7a7ff3866d584c07
 SHA512:
-  metadata.gz: 5255c69d3d6ce5834f5c58db4d0b0cc451bb52262997673911e6ee54729bc543768ac07650a124874306a921df9b1b4081ff8e87482ef8594a9afb06660561c0
-  data.tar.gz: 16ba33bc9c99d07a865a17952aa5f7d4469d4532c5df5025677eaa926226c9aff94cdf3ef5817c007831356cdd124df417f629e2e366254f74d4150ab34e288d
+  metadata.gz: 0ee2606a772b5e0191e194f9c93cd1177247e1ba7d3407c40992a086d130059839b45ed5da6ea7ad89f1406fe48572bddd1190597f59ccf2718c17f897e56ed6
+  data.tar.gz: 496f224a3d84e678cefa614111eb8522b1e4d45539756db4708a9ca0a42b6c3d4ee73550e80fdcb9c71027ca5cadae6be043111980a600d43b0b6001016634b7

data/app/controllers/concerns/users_controller_template.rb

@@ -10,7 +10,7 @@ module UsersControllerTemplate
   private
 
   def protect_permissions_assignment!
-    current_user.protect_permissions_assignment! user_params[:permissions], @user.permissions
+    current_user.protect_permissions_assignment! user_params[:permissions], @user.permissions_was
   end
 
   def user_params

data/app/helpers/organization_list_helper.rb

@@ -2,8 +2,4 @@ module OrganizationListHelper
   def organizations_for(user)
     (user.accessible_organizations + [Organization.central]).uniq.compact
   end
-
-  def organization_switch_url(organization)
-    organization.url_for(controller_name == 'users' ? root_path : request.path)
-  end
 end

data/app/views/layouts/_organizations_listing.html.erb

@@ -7,7 +7,7 @@
           <%= image_tag(org.banner_url, height: 50, class: 'pull-left') %>
         </div>
         <div class="col-md-6 organization-row">
-          <%= link_to(t(:go_to, organization: org.name), organization_switch_url(org), class: 'btn btn-success pull-right') %>
+          <%= link_to(t(:go_to, organization: org.name), org.url, class: 'btn btn-success pull-right') %>
         </div>
       </div>
   <% end %>

data/db/migrate/20181014233438_remove_non_null_constraint_from_permissions.rb

@@ -0,0 +1,5 @@
+class RemoveNonNullConstraintFromPermissions < ActiveRecord::Migration[5.1]
+  def change
+    change_column :users, :permissions, :text, null: true, default: nil
+  end
+end

data/lib/mumuki/laboratory/controllers/dynamic_errors.rb

@@ -36,7 +36,7 @@ module Mumuki::Laboratory::Controllers::DynamicErrors
   end
 
   def forbidden
-    message = "Access to organization #{Organization.current} was forbidden to user #{current_user.uid} with permissions #{current_user.permissions.to_json}"
+    message = "The operation on organization #{Organization.current} was forbidden to user #{current_user.uid} with permissions #{current_user.permissions}"
     Rails.logger.info message
     render_error 'forbidden', 403, locals: { explanation: :forbidden_explanation }, error_message: message
   end
@@ -50,7 +50,7 @@ module Mumuki::Laboratory::Controllers::DynamicErrors
   end
 
   def render_error(template, status, options={})
-    if Mumukit::Platform.organization_mapping.path_under_namespace? request.path, 'api'
+    if Mumukit::Platform.organization_mapping.path_under_namespace? Mumukit::Platform.current_organization_name, request.path, 'api'
       render_api_errors [options[:error_message] || template.gsub('_', ' ')], status
     else
       render_app_errors template, options.merge(status: status).except(:error_message)

data/lib/mumuki/laboratory/mumukit/auth.rb

@@ -1,12 +1,5 @@
 require 'mumukit/auth'
 
-class Mumukit::Auth::Permissions
-  def protect_permissions_assignment!(other, previous)
-    other ||= {}
-    raise Mumukit::Auth::UnauthorizedAccessError unless assign_to?(Mumukit::Auth::Permissions.parse(other.to_h), previous)
-  end
-end
-
 Mumukit::Auth.configure do |c|
   # We are not using tokens, so implementing this strategy is meaningless
   c.persistence_strategy = nil

data/lib/mumuki/laboratory/mumukit/platform.rb

@@ -18,14 +18,6 @@ class Mumuki::Laboratory::Engine < ::Rails::Engine
   config.i18n.available_locales = Mumukit::Platform::Locale.supported
 end
 
-module Mumukit::Platform::OrganizationMapping::Subdomain
-  class << self
-    def path_under_namespace?(path, namespace)
-      path.start_with? "/#{namespace}/"
-    end
-  end
-end
-
 module Mumukit::Platform::OrganizationMapping::Path
   class << self
     alias __organization_name__ organization_name
@@ -38,9 +30,5 @@ module Mumukit::Platform::OrganizationMapping::Path
         name
       end
     end
-
-    def path_under_namespace?(path, namespace)
-      path.start_with? "/#{Mumukit::Platform.current_organization_name}/#{namespace}/"
-    end
   end
 end

data/lib/mumuki/laboratory/version.rb

@@ -1,5 +1,5 @@
 module Mumuki
   module Laboratory
-    VERSION = '5.11.0'
+    VERSION = '5.12.0'
   end
 end

data/spec/controllers/users_api_controller_spec.rb

@@ -38,10 +38,18 @@ describe Api::UsersController, type: :controller, organization_workspace: :base
   end
 
 
-  context 'post without permissions' do
+  context 'post that tries to escalate permissions' do
     before { post :create, params: {user: owner_json} }
 
     it { expect(response.status).to eq 403 }
+    it { expect(response.body).to json_eq errors: ['The operation on organization base was forbidden to user foo+1@bar.com with permissions !janitor:test/*;owner:'] }
+  end
+
+  context 'post on a user with high permissions that does not operate on them' do
+    let!(:user) { User.create! owner_json }
+    before { put :update, params: {id: 'foo@bar.com', user: owner_json} }
+
+    it { expect(response.status).to eq 200 }
   end
 
   context 'put' do

data/spec/dummy/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20181004173216) do
+ActiveRecord::Schema.define(version: 20181014233438) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -312,7 +312,7 @@ ActiveRecord::Schema.define(version: 20181004173216) do
     t.integer "last_exercise_id"
     t.integer "last_organization_id"
     t.string "uid", null: false
-    t.text "permissions", default: "{}", null: false
+    t.text "permissions"
     t.string "first_name"
     t.string "last_name"
     t.boolean "accepts_reminders", default: true

data/spec/features/not_found_private_flow_spec.rb

@@ -28,9 +28,9 @@ feature 'not found on app', organization_workspace: :base do
     visit '/api/nonexistentroute'
 
     expect(page.text).to json_eq errors: [
-      'Access to organization base' +
+      'The operation on organization base' +
       ' was forbidden to user foo+1@bar.com' +
-      ' with permissions {"student":"central/*","teacher":"","headmaster":"","janitor":"","owner":""}']
+      ' with permissions !student:central/*;teacher:;headmaster:;janitor:;owner:']
   end
 
   scenario 'api with authentication' do

data/spec/features/profile_flow_spec.rb

@@ -71,6 +71,8 @@ feature 'Standard Flow', organization_workspace: :test do
     end
 
     context 'with organizations and messages' do
+      before { allow_any_instance_of(Mumukit::Platform::Application::Organic).to receive(:organization_mapping).and_return(Mumukit::Platform::OrganizationMapping::Path) }
+
       scenario 'visit organizations tab' do
         user.make_student_of! organization.slug
         user.save!
@@ -78,6 +80,7 @@ feature 'Standard Flow', organization_workspace: :test do
 
         expect(page).to_not have_text('It seems you aren\'t in any organizations yet!')
         expect(page).to have_text('Go to test-organization')
+        expect(page).to have_link(nil, href: 'http://localmumuki.io/test-organization/')
       end
 
       scenario 'visit messages tab' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mumuki-laboratory
 version: !ruby/object:Gem::Version
-  version: 5.11.0
+  version: 5.12.0
 platform: ruby
 authors:
 - Franco Bulgarelli
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-10-18 00:00:00.000000000 Z
+date: 2018-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 7.3.0
+        version: '7.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 7.3.0
+        version: '7.4'
 - !ruby/object:Gem::Dependency
   name: mumukit-core
   requirement: !ruby/object:Gem::Requirement
@@ -114,14 +114,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.6'
+        version: '2.7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.6'
+        version: '2.7'
 - !ruby/object:Gem::Dependency
   name: mumukit-login
   requirement: !ruby/object:Gem::Requirement
@@ -802,6 +802,7 @@ files:
 - db/migrate/20180725145801_add_submissions_caps_to_exams.rb
 - db/migrate/20180802190437_add_approved_to_messages.rb
 - db/migrate/20181004173216_add_free_form_editor_to_exercises.rb
+- db/migrate/20181014233438_remove_non_null_constraint_from_permissions.rb
 - db/seeds/users.rb
 - lib/events.rb
 - lib/mumuki/laboratory.rb
@@ -973,7 +974,6 @@ files:
 - spec/helpers/email_helper_spec.rb
 - spec/helpers/exercise_input_helper_spec.rb
 - spec/helpers/icons_helper_spec.rb
-- spec/helpers/organization_list_helper_spec.rb
 - spec/helpers/test_results_rendering_spec.rb
 - spec/helpers/with_choices_spec.rb
 - spec/helpers/with_navigation_spec.rb
@@ -1161,7 +1161,6 @@ test_files:
 - spec/helpers/email_helper_spec.rb
 - spec/helpers/exercise_input_helper_spec.rb
 - spec/helpers/icons_helper_spec.rb
-- spec/helpers/organization_list_helper_spec.rb
 - spec/helpers/test_results_rendering_spec.rb
 - spec/helpers/with_choices_spec.rb
 - spec/helpers/with_navigation_spec.rb

data/spec/helpers/organization_list_helper_spec.rb

@@ -1,20 +0,0 @@
-require 'spec_helper'
-
-describe OrganizationListHelper, organization_workspace: :test do
-  helper OrganizationListHelper
-
-  context 'not not users path' do
-    let(:request) { struct path: '/guides/1' }
-
-    it { expect(organization_switch_url(Organization.current)).to eq 'http://test.localmumuki.io/guides/1' }
-  end
-
-  context 'on users path' do
-    let(:request) { struct path: '/users/' }
-    let(:controller_name) { 'users' }
-
-    it { expect(organization_switch_url(Organization.current)).to eq 'http://test.localmumuki.io/' }
-  end
-end
-
-