adapt-authoring-roles 1.1.0 → 1.1.2

package/.github/workflows/releases.yml

@@ -3,10 +3,16 @@ on:
   push:
     branches:
       - master
+
 jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for trusted publishing and npm provenance
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -16,10 +22,11 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: 'lts/*'
+      - name: Update npm
+        run: npm install -g npm@latest
       - name: Install dependencies
         run: npm ci
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.AAT_NPM_TOKEN }}
-        run: npx semantic-release
+        run: npx semantic-release

package/lib/RolesModule.js

@@ -8,6 +8,7 @@ class RolesModule extends AbstractApiModule {
   /** @override */
   async init () {
     await super.init()
+    this.cache.isEnabled = true
     try {
       await this.initConfigRoles()
 
@@ -54,11 +55,7 @@ class RolesModule extends AbstractApiModule {
    */
   async shortNamesToIds (roles) {
     return Promise.all(roles.map(async r => {
-      let role = this.roleCache[r]
-      if (!role) {
-        [role] = await this.find({ shortName: r })
-        this.roleCache[r] = role
-      }
+      const [role] = await this.find({ shortName: r })
       return role._id.toString()
     }))
   }
@@ -84,12 +81,6 @@ class RolesModule extends AbstractApiModule {
    * @return {Promise}
    */
   async initDefaultRoles () {
-    /**
-     * Local store of roles
-     * @type {Object}
-     */
-    this.roleCache = {}
-
     const rolesforAll = await this.shortNamesToIds(this.getConfig('defaultRoles'))
     const rolesForAuth = Object.entries(this.getConfig('defaultRolesForAuthTypes')).reduce((m, [k, v]) => {
       return { [m[k]]: this.shortNamesToIds(v) }
@@ -116,12 +107,23 @@ class RolesModule extends AbstractApiModule {
    * @returns {Promise}
    */
   async onUpdateRoles (req) {
-    if (!req.body.roles || req.method === 'GET' || req.method === 'DELETE') {
+    if (req.apiData?.modifying !== false || (req.method !== 'DELETE' && !req.apiData?.data.roles)) {
       return
     }
-    if (!req.auth.isSuper && !req.auth.scopes.includes('assign:roles')) {
-      this.log('error', 'User does not have the correct permissions to assign user roles')
-      throw this.app.errors.UNAUTHORISED
+    if (!req.auth.isSuper) {
+      const reject = reason => {
+        this.log('error', 'UNAUTHORISED', req.auth.user._id.toString(), reason)
+        throw this.app.errors.UNAUTHORISED
+      }
+      if (!req.auth.scopes.includes('assign:roles')) {
+        reject('assign role')
+      }
+      if (req.apiData.data.roles.includes(await this.getSuperRoleId())) {
+        reject('assign superuser')
+      }
+      if (await this.isTargetSuper(req.apiData.query._id)) {
+        reject('modify superuser')
+      }
     }
     if (req.method !== 'POST') {
       const auth = await this.app.waitForModule('auth')
@@ -129,22 +131,22 @@ class RolesModule extends AbstractApiModule {
     }
   }
 
-  /**
-   * Blocks modification of super users by non-super users
-   * @param {external:ExpressRequest} req
-   * @param {Object} data Request data
-   */
-  async onCheckUserAccess (req, data) {
-    if (['GET', 'POST'].includes(req.method)) {
-      return true
-    }
-    const users = await this.app.waitForModule('users')
-    const [user] = await users.find({ _id: req.apiData.query._id })
-    const scopes = user.roles.length === 1 ? await this.getScopesForRole(user.roles[0]) : []
-    const isSuper = scopes.length === 1 && scopes[0] === '*:*'
-    if (isSuper && !req.auth.isSuper) {
+  async onCheckUserAccess (req) { // note access checks don't run for super users
+    if (req.apiData.modifying && await this.isTargetSuper(req.apiData.query._id)) {
       throw this.app.errors.UNAUTHORISED
     }
+    return true
+  }
+
+  async getSuperRoleId () {
+    const [superRole] = await this.find({ scopes: ['*:*'] })
+    return superRole._id.toString()
+  }
+
+  async isTargetSuper (_id) {
+    const users = await this.app.waitForModule('users')
+    const [user] = await users.find({ _id }, { projection: { roles: 1 } })
+    return user.roles.length === 1 && user.roles[0].toString() === await this.getSuperRoleId()
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adapt-authoring-roles",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Module for managing user roles",
   "homepage": "https://github.com/adapt-security/adapt-authoring-roles",
   "license": "GPL-3.0",
@@ -12,15 +12,15 @@
     "adapt-authoring-core": "github:adapt-security/adapt-authoring-core"
   },
   "devDependencies": {
-    "standard": "^17.1.0",
-    "@semantic-release/commit-analyzer": "^9.0.2",
+    "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",
-    "@semantic-release/github": "^8.0.5",
-    "@semantic-release/npm": "^9.0.1",
-    "@semantic-release/release-notes-generator": "^10.0.3",
-    "conventional-changelog-eslint": "^3.0.9",
-    "semantic-release": "^21.0.1",
-    "semantic-release-replace-plugin": "^1.2.7"
+    "@semantic-release/github": "^12.0.2",
+    "@semantic-release/npm": "^13.1.2",
+    "@semantic-release/release-notes-generator": "^14.1.0",
+    "conventional-changelog-eslint": "^6.0.0",
+    "semantic-release": "^25.0.2",
+    "semantic-release-replace-plugin": "^1.2.7",
+    "standard": "^17.1.0"
   },
   "release": {
     "plugins": [