adapt-authoring-adaptframework 3.0.1 → 3.1.1

package/lib/AdaptFrameworkImport.js

@@ -169,6 +169,11 @@ class AdaptFrameworkImport {
      * @type {Array<String>}
      */
     this.newTagIds = []
+    /**
+     * Array of asset IDs newly created during import for rollback. Excludes assets de-duplicated to existing records.
+     * @type {Array<String>}
+     */
+    this.newAssetIds = []
     /**
      * Contains non-fatal infomation messages regarding import status which can be return as response data. Fatal errors are thrown in the usual way.
      * @type {Object}
@@ -595,7 +600,9 @@ class AdaptFrameworkImport {
         })
         // store the asset _id so we can map it to the old path later
         const resolved = path.relative(`${this.coursePath}/..`, filepath)
-        this.assetMap[resolved] = asset._id.toString()
+        const assetId = asset._id.toString()
+        this.assetMap[resolved] = assetId
+        this.newAssetIds.push(assetId)
       } catch (e) {
         if (e.code === 'DUPLICATE_ASSET') {
           const resolved = path.relative(`${this.coursePath}/..`, filepath)
@@ -902,9 +909,9 @@ class AdaptFrameworkImport {
     if (Object.keys(this.updatedContentPlugins).length) {
       tasks.push(this.restoreUpdatedPlugins())
     }
-    // Delete imported assets
-    if (this.assets) {
-      tasks.push(...Object.values(this.assetMap).map(id =>
+    // Delete newly created assets (skip de-duplicated assets which point to pre-existing records)
+    if (this.assets && this.newAssetIds.length) {
+      tasks.push(...this.newAssetIds.map(id =>
         this.assets.delete({ _id: id })
           .catch(e => log('warn', `failed to delete asset '${id}'`, e))
       ))

package/lib/AdaptFrameworkModule.js

@@ -4,7 +4,7 @@ import AdaptFrameworkImport from './AdaptFrameworkImport.js'
 import fs from 'node:fs/promises'
 import { getHandler, postHandler, importHandler, postUpdateHandler, getUpdateHandler } from './handlers.js'
 import { loadRouteConfig, registerRoutes } from 'adapt-authoring-server'
-import { runCliCommand, readFrameworkPluginVersions, migrateExistingCourses, computePluginHash, prebuildCache } from './utils.js'
+import { applyContentAccessFilter, runCliCommand, readFrameworkPluginVersions, migrateExistingCourses, computePluginHash, prebuildCache } from './utils.js'
 import BuildCache from './BuildCache.js'
 import path from 'node:path'
 import semver from 'semver'
@@ -79,6 +79,7 @@ class AdaptFrameworkModule extends AbstractModule {
     this._targetFrameworkVersion = meta.framework?.targetVersion
 
     this.app.waitForModule('content').then(content => {
+      content.accessQueryHook.tap(this.onContentAccessQueryHook.bind(this))
       content.accessCheckHook.tap(this.checkContentAccess.bind(this))
     })
 
@@ -319,6 +320,18 @@ class AdaptFrameworkModule extends AbstractModule {
     schemas.forEach(s => jsonschema.registerSchema(s))
   }
 
+  /**
+   * Merges ownership/sharing access clauses into the content query when listing courses,
+   * so the database returns only courses the user can see. Non-course queries fall through
+   * to the per-item `checkContentAccess` safety net (the parent course's `_id` is not in
+   * scope at this stage).
+   * @param {external:ExpressRequest} req
+   */
+  async onContentAccessQueryHook (req) {
+    if (req.apiData.query._type !== 'course') return
+    applyContentAccessFilter(req.apiData.query, req.auth.user._id.toString())
+  }
+
   /**
    * Checks whether the request user should be given access to the content they're requesting
    * @param {external:ExpressRequest} req

package/lib/utils/applyContentAccessFilter.js

@@ -0,0 +1,26 @@
+/**
+ * Mutates a mongo content query so it only matches courses the given user can access:
+ * owned by them, marked public via `_isShared`, or in `_shareWithUsers`. Combines safely
+ * with an existing `$or` (e.g. from search) by lifting both into `$and`.
+ * @param {object} query The mongo query object to mutate
+ * @param {string} userId The user's `_id` (already coerced to string)
+ * @memberof adaptframework
+ */
+export function applyContentAccessFilter (query, userId) {
+  if (!userId) return
+  const clauses = [
+    { createdBy: userId },
+    { _isShared: true },
+    { _shareWithUsers: userId }
+  ]
+  if (query.$or) {
+    query.$and = [
+      ...(query.$and ?? []),
+      { $or: query.$or },
+      { $or: clauses }
+    ]
+    delete query.$or
+  } else {
+    query.$or = clauses
+  }
+}

package/lib/utils.js

@@ -1,3 +1,4 @@
+export { applyContentAccessFilter } from './utils/applyContentAccessFilter.js'
 export { inferBuildAction } from './utils/inferBuildAction.js'
 export { getPluginUpdateStatus } from './utils/getPluginUpdateStatus.js'
 export { getImportContentCounts } from './utils/getImportContentCounts.js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adapt-authoring-adaptframework",
-  "version": "3.0.1",
+  "version": "3.1.1",
   "description": "Adapt framework integration for the Adapt authoring tool",
   "homepage": "https://github.com/adapt-security/adapt-authoring-adaptframework",
   "license": "GPL-3.0",

package/tests/AdaptFrameworkImport.spec.js

@@ -404,6 +404,7 @@ describe('AdaptFrameworkImport', () => {
         newContentPlugins: {},
         updatedContentPlugins: {},
         assetMap: {},
+        newAssetIds: [],
         newTagIds: [],
         contentJson: { course: {} },
         idMap: {},
@@ -438,12 +439,29 @@ describe('AdaptFrameworkImport', () => {
         assetMap: {
           'course/en/assets/logo.png': 'a1',
           'course/en/assets/bg.jpg': 'a2'
-        }
+        },
+        newAssetIds: ['a1', 'a2']
       })
       await rollback.call(ctx)
       assert.deepEqual(deleted.sort(), ['a1', 'a2'])
     })
 
+    it('should not delete de-duplicated assets that point to pre-existing records', async () => {
+      const deleted = []
+      const ctx = makeRollbackCtx({
+        assets: {
+          delete: async ({ _id }) => deleted.push(_id)
+        },
+        assetMap: {
+          'course/en/assets/new.png': 'a1',
+          'course/en/assets/existing.png': 'a2-existing'
+        },
+        newAssetIds: ['a1']
+      })
+      await rollback.call(ctx)
+      assert.deepEqual(deleted, ['a1'])
+    })
+
     it('should delete course content on rollback', async () => {
       const contentDeleted = []
       const ctx = makeRollbackCtx({
@@ -499,7 +517,8 @@ describe('AdaptFrameworkImport', () => {
           'path/a.png': 'a1',
           'path/b.png': 'a2',
           'path/c.png': 'a3'
-        }
+        },
+        newAssetIds: ['a1', 'a2', 'a3']
       })
       await rollback.call(ctx)
       assert.deepEqual(deleted.sort(), ['a2', 'a3'])

package/tests/utils-applyContentAccessFilter.spec.js

@@ -0,0 +1,52 @@
+import { describe, it } from 'node:test'
+import assert from 'node:assert/strict'
+import { applyContentAccessFilter } from '../lib/utils/applyContentAccessFilter.js'
+
+describe('applyContentAccessFilter()', () => {
+  it('should be a no-op when userId is falsy', () => {
+    const query = { _type: 'course' }
+    applyContentAccessFilter(query, undefined)
+    assert.deepEqual(query, { _type: 'course' })
+  })
+
+  it('should add a $or clause covering creator, public, and per-user sharing', () => {
+    const query = { _type: 'course' }
+    applyContentAccessFilter(query, 'user1')
+    assert.deepEqual(query.$or, [
+      { createdBy: 'user1' },
+      { _isShared: true },
+      { _shareWithUsers: 'user1' }
+    ])
+  })
+
+  it('should preserve an existing $or by lifting both into $and', () => {
+    const query = { $or: [{ title: 'foo' }] }
+    applyContentAccessFilter(query, 'user1')
+    assert.equal(query.$or, undefined)
+    assert.deepEqual(query.$and, [
+      { $or: [{ title: 'foo' }] },
+      {
+        $or: [
+          { createdBy: 'user1' },
+          { _isShared: true },
+          { _shareWithUsers: 'user1' }
+        ]
+      }
+    ])
+  })
+
+  it('should append to an existing $and rather than clobber it', () => {
+    const query = { $or: [{ title: 'foo' }], $and: [{ flag: true }] }
+    applyContentAccessFilter(query, 'user1')
+    assert.equal(query.$or, undefined)
+    assert.equal(query.$and.length, 3)
+    assert.deepEqual(query.$and[0], { flag: true })
+  })
+
+  it('should leave other top-level keys intact', () => {
+    const query = { _type: 'course', title: { $regex: 'foo' } }
+    applyContentAccessFilter(query, 'user1')
+    assert.equal(query._type, 'course')
+    assert.deepEqual(query.title, { $regex: 'foo' })
+  })
+})