agw/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2026-11-15 06:33:55 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #30916 from overleaf/ar-allow-read-only-institution-access-for-admins-with-no-modify-capability

Browse Source 
[web] Add view-only version of institution managers page

GitOrigin-RevId: 65d19e42220932fe268d595ea13d0ba0b18c4398
This commit is contained in:
Andrew Rumble
2026-01-22 09:06:49 +00:00
committed by Copybot
parent dc179a29df
commit 2dfcfd1804
4 changed files with 82 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/web/test/acceptance/src/UserMembershipAuthorizationTests.mjs
+64 -1
View File
@@ -90,7 +90,7 @@ describe('UserMembershipAuthorization', function () {
})
describe('users management', function () {
it('should allow managers only', function (done) {
it('should allow managers', function (done) {
const url = `/manage/institutions/${this.institution.v1Id}/managers`
async.series(
[
@@ -102,6 +102,54 @@ describe('UserMembershipAuthorization', function () {
done
)
})
it('should allow admin users', function (done) {
const url = `/manage/institutions/${this.institution.v1Id}/managers`
async.series(
[
this.user.login.bind(this.user),
expectAccess(this.user, url, 403),
cb => this.user.ensureAdmin(cb),
cb => this.user.ensureAdminRole('sales', cb),
this.user.login.bind(this.user),
expectAccess(this.user, url, 200),
],
done
)
})
it('should not allow "sales" admin to add managers', function (done) {
const url = `/manage/institutions/${this.institution.v1Id}/managers`
async.series(
[
this.user.login.bind(this.user),
expectPost(this.user, url, { email: this.user.email }, 403),
cb => this.user.ensureAdmin(cb),
cb => this.user.ensureAdminRole('sales', cb),
this.user.login.bind(this.user),
expectPost(this.user, url, { email: this.user.email }, 403),
],
done
)
})
it('should allow "engineering" admin to add managers', function (done) {
const user = new User()
const url = `/manage/institutions/${this.institution.v1Id}/managers`
async.series(
[
user.ensureUserExists.bind(user),
this.user.login.bind(this.user),
expectPost(this.user, url, { email: user.email }, 403),
cb => this.user.ensureAdmin(cb),
cb => this.user.ensureAdminRole('engineering', cb),
this.user.login.bind(this.user),
expectPost(this.user, url, { email: user.email }, 200),
cb => this.institution.setManagerIds([], cb),
],
done
)
})
})
describe('creation', function () {
@@ -195,3 +243,18 @@ function expectAccess(user, url, status, pattern) {
})
}
}
function expectPost(user, url, body, status, pattern) {
return callback => {
user.request.post({ url, json: body }, (error, response, body) => {
if (error) {
return callback(error)
}
expect(response.statusCode).to.equal(status)
if (pattern) {
expect(body).to.match(pattern)
}
callback()
})
}
}