expressa 2.0.4 → 2.0.6

package/controllers/collections.js

@@ -14,13 +14,11 @@ async function validateDocumentOwner(req, doc) {
   if (!doc.meta.owner_collection) {
     throw new util.ApiError(417, 'no owner_collection for owner found')
   }
-  if (doc._id !== doc.meta.owner) {
+  if (!(doc._id === doc.meta.owner && req.params.collection === doc.meta.owner_collection)) {
     const count = await req.db[doc.meta.owner_collection].count({ _id: doc.meta.owner }, undefined, 1)
     if (!count) {
       throw new util.ApiError(417, 'invalid owner')
     }
-  } else if (req.params.collection !== doc.meta.owner_collection) {
-    throw new util.ApiError(417, 'invalid owner collection')
   }
 }
 
@@ -167,22 +165,37 @@ exports.getById = async function (req) {
 exports.replaceById = async function (req) {
   assertValidCollection(req)
   req.customResponseData = req.customResponseData || {}
+  const data = req.body
   let oldDoc = {}
   try {
     oldDoc = await req.db[req.params.collection].get(req.params.id)
   } catch (error) {
     // happens when new documents are created via a PUT
-    // todo: use setDocumentOwner
-    oldDoc = { meta: { owner: req.user._id } }
+    oldDoc = { meta: { owner: req.user._id, owner_collection: 'users' } }
+    data._id = req.params.id.trim()
+    await setDocumentOwner(req, data)
+  }
+  if (data._id) {
+    data._id = data._id.trim()
+  } else {
+    data._id = req.params.id.trim()
   }
-  const data = req.body
-  data._id = req.params.id
   data.meta = data.meta || {}
   data.meta.created = (oldDoc.meta || {}).created
-  data.meta.owner = (oldDoc.meta || {}).owner
+  if (data.meta.owner !== oldDoc.meta.owner || data.meta.owner_collection !== oldDoc.meta.owner_ollection) {
+    if (req.hasPermission(`${req.params.collection}: modify owner`)) {
+      if (oldDoc.meta.owner) {
+        await validateDocumentOwner(req, data)
+      }
+    } else {
+      debug('attempting to change document owner.')
+      data.meta.owner = oldDoc.meta.owner
+      data.meta.owner_collection = oldDoc.meta.owner_collection
+    }
+  }
   await util.notify('put', req, req.params.collection, data)
-  await req.db[req.params.collection].update(req.params.id, req.body)
-  await util.notify('changed', req, req.params.collection, req.body)
+  await req.db[req.params.collection].update(req.params.id, data)
+  await util.notify('changed', req, req.params.collection, data)
   return {
     status: 'OK',
     id: data._id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expressa",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "description": "API framework using JSON schemas",
   "main": "index.js",
   "repository": "https://github.com/thomas4019/expressa",

package/test/testutils.js

@@ -85,3 +85,4 @@ exports.clone = util.clone
 exports.sleep = function sleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms))
 }
+exports.generateDocumentId = util.generateDocumentId

package/test/users.js

@@ -232,6 +232,50 @@ describe('user functionality', function () {
     expect(res2.body.meta.owner).to.equal(user._id)
   })
 
+  it('cannot change owner with a PUT by default', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'users: view hashed passwords'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = JSON.parse(JSON.stringify(res.body))
+
+    res.body.meta.owner = user._id
+    await request(app)
+      .put(`/users/${newUser._id}`)
+      .set('x-access-token', token)
+      .send(res.body)
+      .expect(200)
+
+    const res2 = await request(app)
+      .get(`/users/${newUser._id}`)
+      .set('x-access-token', token)
+    expect(res2.body.meta.owner).to.not.equal(user._id)
+    expect(res2.body.meta.owner).to.equal(newUser._id)
+
+  })
+
+  it('can change owner with a PUT with correct permission', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'users: view hashed passwords', 'users: modify owner'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = JSON.parse(JSON.stringify(res.body))
+
+    res.body.meta.owner = user._id
+    await request(app)
+      .put(`/users/${newUser._id}`)
+      .set('x-access-token', token)
+      .send(res.body) // try change owner to another user
+      .expect(200)
+
+    const res2 = await request(app)
+      .get(`/users/${newUser._id}`)
+      .set('x-access-token', token)
+    expect(res2.body.meta.owner).to.equal(user._id)
+  })
+
   it('changing to bogus owner fails', async function () {
     const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'users: modify owner'])
 
@@ -308,4 +352,74 @@ describe('user functionality', function () {
     expect(res3.body.meta.owner).to.not.equal(newUser._id)
     expect(res3.body.meta.owner).to.equal(user._id)
   })
+
+  it('cannot set owner with a PUT on creation by default', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'testdoc: edit', 'testdoc: view own'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    const doc = {
+      title: 'Test Title',
+      meta: {
+        owner: user._id,
+        owner_collection: 'users',
+      }
+    }
+
+    const docId = testutils.generateDocumentId()
+
+    const res2 = await request(app)
+      .put(`/testdoc/${docId}`)
+      .set('x-access-token', token)
+      .send(doc)
+      .expect(200) // will succeed but owner will not change
+
+    expect(res2.body.id).to.equal(docId)
+    doc._id = docId
+
+    const res3 = await request(app)
+      .get(`/testdoc/${doc._id}`)
+      .set('x-access-token', token)
+      .expect(200)
+    expect(res3.body.meta.owner).to.not.equal(user._id)
+    expect(res3.body.meta.owner).to.equal(newUser._id)
+  })
+
+  it('can set owner with a PUT on creation with correct permission', async function () {
+    const token = await testutils.getUserWithPermissions(api, ['users: view', 'users: edit', 'testdoc: edit', 'testdoc: view', 'testdoc: modify owner'])
+
+    const res = await request(app)
+      .get(`/users/me`)
+      .set('x-access-token', token)
+    const newUser = res.body
+
+    const doc = {
+      title: 'Test Title',
+      meta: {
+        owner: user._id,
+        owner_collection: 'users',
+      }
+    }
+
+    const docId = testutils.generateDocumentId()
+
+    const res2 = await request(app)
+      .put(`/testdoc/${docId}`)
+      .set('x-access-token', token)
+      .send(doc)
+      .expect(200) // will succeed but owner will not change
+
+    expect(res2.body.id).to.equal(docId)
+    doc._id = docId
+
+    const res3 = await request(app)
+      .get(`/testdoc/${doc._id}`)
+      .set('x-access-token', token)
+      .expect(200)
+    expect(res3.body.meta.owner).to.not.equal(newUser._id)
+    expect(res3.body.meta.owner).to.equal(user._id)
+  })
 })