expressa 1.4.7 → 2.0.1

package/test/testutils.js

@@ -1,6 +1,7 @@
 const fs = require('fs')
 
 const expressa = require('../')
+const request = require('supertest')
 const util = require('../util')
 
 // See https://stackoverflow.com/questions/18052762/remove-directory-which-is-not-empty
@@ -25,11 +26,62 @@ exports.api = expressa.api({
   file_storage_path: 'testdata'
 })
 const express = require('express')
+const randomstring = require('randomstring')
 exports.app = express()
 exports.app.use(exports.api)
 
-exports.getUserWithPermissions = util.getUserWithPermissions
+const tokens = {
+  admin: ''
+}
+
+exports.setAdminToken = function(token) {
+  tokens.admin = token
+}
+
+exports.getUserWithPermissions = async function(api, permissions) {
+  const service = request(exports.app)
+  if (typeof permissions === 'string') {
+    permissions = [permissions]
+  }
+  permissions = permissions || []
+  const permissionsMap = {}
+  permissions.forEach(function (permission) {
+    permissionsMap[permission] = true
+  })
+
+  const randId = randomstring.generate(12)
+  const roleName = 'role' + randId
+  const role = {
+    _id: roleName,
+    permissions: permissionsMap
+  }
+
+  const roleRes = await service.post('/role')
+    .set('x-access-token', tokens.admin)
+    .send(role)
+    .expect(200)
+
+  const user = {
+    email: 'test' + randId + '@example.com',
+    password: '123',
+  }
+  const registerRes = await service.post('/users/register')
+    .send(user)
+    .expect(200)
+
+  const updateRes = await service.post(`/users/${registerRes.body.id}/update`)
+    .send({ $push: { roles: roleName } })
+    .set('x-access-token', tokens.admin)
+    .expect(200)
+
+  const loginRes = await service.post('/users/login')
+    .send(user)
+    .expect(200)
+
+  user._id = loginRes.body.uid
+  return loginRes.body.token
+}
 exports.clone = util.clone
 exports.sleep = function sleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms))
-}
+}

package/test/users.js

@@ -189,4 +189,123 @@ describe('user functionality', function () {
       .expect(200)
     expect(res3.body.properties.roles.items.enum).to.not.include('testrole')
   })
+
+  it('cannot change owner by default', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    await request(app)
+      .post(`/users/${newUser._id}/update`)
+      .set('x-access-token', token)
+      .send({ $set: { 'meta.owner': user._id } }) // try change owner to another user
+      .expect(200) // will succeed but owner will not change
+
+    const res2 = await request(app)
+      .get(`/users/${newUser._id}`)
+      .set('x-access-token', token)
+    expect(res2.body.meta.owner).to.not.equal(user._id)
+    expect(res2.body.meta.owner).to.equal(newUser._id)
+
+  })
+
+  it('can change owner with correct permission', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'users: modify owner'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    await request(app)
+      .post(`/users/${newUser._id}/update`)
+      .set('x-access-token', token)
+      .send({ $set: { 'meta.owner': user._id } }) // try change owner to another user
+      .expect(200)
+
+    const res2 = await request(app)
+      .get(`/users/${newUser._id}`)
+      .set('x-access-token', token)
+    expect(res2.body.meta.owner).to.equal(user._id)
+  })
+
+  it('changing to bogus owner fails', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'users: modify owner'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    await request(app)
+      .post(`/users/${newUser._id}/update`)
+      .set('x-access-token', token)
+      .send({ $set: { 'meta.owner': 'owner-that-doesnt-exist' } }) // try change owner to another user
+      .expect(417)
+  })
+
+  it('cannot set owner on creation by default', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'testdoc: create', 'testdoc: view own'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    const doc = {
+      title: 'Test Title',
+      meta: {
+        owner: user._id,
+        owner_collection: 'users',
+      }
+    }
+
+    const res2 = await request(app)
+      .post(`/testdoc`)
+      .set('x-access-token', token)
+      .send(doc)
+      .expect(200) // will succeed but owner will not change
+    doc._id = res2.body.id
+
+    const res3 = await request(app)
+      .get(`/testdoc/${doc._id}`)
+      .set('x-access-token', token)
+      .expect(200)
+    expect(res3.body.meta.owner).to.not.equal(user._id)
+    expect(res3.body.meta.owner).to.equal(newUser._id)
+  })
+
+  it('can set owner on creation with correct permission', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'testdoc: create', 'testdoc: view', 'testdoc: modify owner'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    const doc = {
+      title: 'Test Title',
+      meta: {
+        owner: user._id,
+        owner_collection: 'users',
+      }
+    }
+
+    const res2 = await request(app)
+      .post(`/testdoc`)
+      .set('x-access-token', token)
+      .send(doc)
+      .expect(200) // will succeed but owner will not change
+    doc._id = res2.body.id
+
+    const res3 = await request(app)
+      .get(`/testdoc/${doc._id}`)
+      .set('x-access-token', token)
+      .expect(200)
+    expect(res3.body.meta.owner).to.not.equal(newUser._id)
+    expect(res3.body.meta.owner).to.equal(user._id)
+  })
 })