Merge pull request #16980 from overleaf/jpa-join-project-remove-sl-2

[misc] joinProject: pass userId and anonymous access token in body 2/2

GitOrigin-RevId: b1a11941a6d9c7cc779769d1e97d3a0f03bed610

services/web/app/src/Features/Editor/EditorHttpController.js

@@ -57,7 +57,7 @@ const unsupportedSpellcheckLanguages = [
 
 async function joinProject(req, res, next) {
   const projectId = req.params.Project_id
-  let userId = req.body.userId || req.query.user_id // keep schema in sync with router
+  let userId = req.body.userId // keep schema in sync with router
   if (userId === 'anonymous-user') {
     userId = null
   }
@@ -177,8 +177,7 @@ async function _buildJoinProjectView(req, projectId, userId) {
     await CollaboratorsGetter.promises.getInvitedMembersWithPrivilegeLevels(
       projectId
     )
-  const token =
-    req.body.anonymousAccessToken || req.headers['x-sl-anonymous-access-token']
+  const token = req.body.anonymousAccessToken
   const privilegeLevel =
     await AuthorizationManager.promises.getPrivilegeLevelForProject(
       userId,

services/web/app/src/Features/Editor/EditorRouter.js

@@ -3,6 +3,7 @@ const AuthenticationController = require('../Authentication/AuthenticationContro
 const AuthorizationMiddleware = require('../Authorization/AuthorizationMiddleware')
 const { RateLimiter } = require('../../infrastructure/RateLimiter')
 const RateLimiterMiddleware = require('../Security/RateLimiterMiddleware')
+const { validate, Joi } = require('../../infrastructure/Validation')
 
 const rateLimiters = {
   addDocToProject: new RateLimiter('add-doc-to-project', {
@@ -71,7 +72,13 @@ module.exports = {
       RateLimiterMiddleware.rateLimit(rateLimiters.joinProject, {
         params: ['Project_id'],
         // keep schema in sync with controller
-        getUserId: req => req.body.userId || req.query.user_id,
+        getUserId: req => req.body.userId,
+      }),
+      validate({
+        body: Joi.object({
+          userId: Joi.string().required(),
+          anonymousAccessToken: Joi.string().optional(),
+        }),
       }),
       EditorHttpController.joinProject
     )

services/web/test/acceptance/src/AuthorizationTests.js

@@ -166,13 +166,12 @@ function tryContentAccess(user, projectId, test, callback) {
   request.post(
     {
       url: `/project/${projectId}/join`,
-      qs: { user_id: userId },
       auth: {
         user: settings.apis.web.user,
         pass: settings.apis.web.pass,
         sendImmediately: true,
       },
-      json: true,
+      json: { userId },
       jar: false,
     },
     (error, response, body) => {

services/web/test/acceptance/src/ProjectFeaturesTests.js

@@ -20,13 +20,12 @@ const joinProject = (userId, projectId, callback) =>
   request.post(
     {
       url: `/project/${projectId}/join`,
-      qs: { user_id: userId },
       auth: {
         user: settings.apis.web.user,
         pass: settings.apis.web.pass,
         sendImmediately: true,
       },
-      json: true,
+      json: { userId },
       jar: false,
     },
     callback

services/web/test/acceptance/src/ProjectInviteTests.js

@@ -174,13 +174,12 @@ const tryJoinProject = (user, projectId, callback) => {
     user.request.post(
       {
         url: `/project/${projectId}/join`,
-        qs: { user_id: user._id },
         auth: {
           user: settings.apis.web.user,
           pass: settings.apis.web.pass,
           sendImmediately: true,
         },
-        json: true,
+        json: { userId: user._id },
         jar: false,
       },
       callback

services/web/test/acceptance/src/TokenAccessTests.js

@@ -160,46 +160,7 @@ const _doTryTokenAccept = (
   })
 }
 
-const tryContentAccess = (user, projectId, test, callback) => {
-  tryContentAccessQuery(user, projectId, test, err1 => {
-    tryContentAccessBody(user, projectId, test, err2 => {
-      callback(err1 || err2)
-    })
-  })
-}
-
-const tryContentAccessQuery = (user, projcetId, test, callback) => {
-  // The real-time service calls this end point to determine the user's
-  // permissions.
-  let userId
-  if (user.id != null) {
-    userId = user.id
-  } else {
-    userId = 'anonymous-user'
-  }
-  request.post(
-    {
-      url: `/project/${projcetId}/join`,
-      qs: { user_id: userId },
-      auth: {
-        user: settings.apis.web.user,
-        pass: settings.apis.web.pass,
-        sendImmediately: true,
-      },
-      json: true,
-      jar: false,
-    },
-    (error, response, body) => {
-      if (error != null) {
-        return callback(error)
-      }
-      test(response, body)
-      callback()
-    }
-  )
-}
-
-const tryContentAccessBody = (user, projcetId, test, callback) => {
+const tryContentAccess = (user, projcetId, test, callback) => {
   // The real-time service calls this end point to determine the user's
   // permissions.
   let userId
@@ -232,48 +193,6 @@ const tryContentAccessBody = (user, projcetId, test, callback) => {
 }
 
 const tryAnonContentAccess = (user, projectId, token, test, callback) => {
-  tryAnonContentAccessHeader(user, projectId, token, test, err1 => {
-    tryAnonContentAccessBody(user, projectId, token, test, err2 => {
-      callback(err1 || err2)
-    })
-  })
-}
-
-const tryAnonContentAccessHeader = (user, projectId, token, test, callback) => {
-  // The real-time service calls this end point to determine the user's
-  // permissions.
-  let userId
-  if (user.id != null) {
-    userId = user.id
-  } else {
-    userId = 'anonymous-user'
-  }
-  request.post(
-    {
-      url: `/project/${projectId}/join`,
-      qs: { user_id: userId },
-      auth: {
-        user: settings.apis.web.user,
-        pass: settings.apis.web.pass,
-        sendImmediately: true,
-      },
-      headers: {
-        'x-sl-anonymous-access-token': token,
-      },
-      json: true,
-      jar: false,
-    },
-    (error, response, body) => {
-      if (error != null) {
-        return callback(error)
-      }
-      test(response, body)
-      callback()
-    }
-  )
-}
-
-const tryAnonContentAccessBody = (user, projectId, token, test, callback) => {
   // The real-time service calls this end point to determine the user's
   // permissions.
   let userId

services/web/test/acceptance/src/helpers/User.js

@@ -680,13 +680,12 @@ class User {
     this.request.post(
       {
         url: `/project/${projectId}/join`,
-        qs: { user_id: this._id },
         auth: {
           user: settings.apis.web.user,
           pass: settings.apis.web.pass,
           sendImmediately: true,
         },
-        json: true,
+        json: { userId: this._id },
         jar: false,
       },
       (error, response, body) => {

services/web/test/unit/src/Editor/EditorHttpControllerTests.js

@@ -256,8 +256,6 @@ describe('EditorHttpController', function () {
           userId: 'anonymous-user',
           anonymousAccessToken: this.token,
         }
-        this.req.query = { user_id: 'anonymous-user' }
-        this.req.headers = { 'x-sl-anonymous-access-token': this.token }
         this.res.callback = done
         this.AuthorizationManager.isRestrictedUser
           .withArgs(null, 'readOnly', false, false)