agw/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2026-11-15 06:33:55 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add ensureUserCanSendComment authorization middleware (#22959)

Browse Source 
* Add ensureUserCanSendComment authorization middleware

* added tests

GitOrigin-RevId: d1f58bd6bc63275456e5280ccb8c99aaa02c4e5f
This commit is contained in:
Domagoj Kriskovic
2025-01-21 09:05:53 +00:00
committed by Copybot
parent e5a4a8606f
commit 741b65d0eb
4 changed files with 49 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/web/app/src/Features/Authorization/AuthorizationManager.js
+15
View File
@@ -280,11 +280,25 @@ async function canUserResolveThread(userId, projectId, docId, threadId, token) {
return comment.metadata.user_id === userId
}
async function canUserSendComment(userId, projectId, token) {
const privilegeLevel = await getPrivilegeLevelForProject(
userId,
projectId,
token
)
return (
privilegeLevel === PrivilegeLevels.OWNER ||
privilegeLevel === PrivilegeLevels.READ_AND_WRITE ||
privilegeLevel === PrivilegeLevels.REVIEW
)
}
module.exports = {
canUserReadProject: callbackify(canUserReadProject),
canUserWriteProjectContent: callbackify(canUserWriteProjectContent),
canUserReviewProjectContent: callbackify(canUserReviewProjectContent),
canUserResolveThread: callbackify(canUserResolveThread),
canUserSendComment: callbackify(canUserSendComment),
canUserWriteProjectSettings: callbackify(canUserWriteProjectSettings),
canUserRenameProject: callbackify(canUserRenameProject),
canUserAdminProject: callbackify(canUserAdminProject),
@@ -297,6 +311,7 @@ module.exports = {
canUserWriteProjectContent,
canUserReviewProjectContent,
canUserResolveThread,
canUserSendComment,
canUserWriteProjectSettings,
canUserRenameProject,
canUserAdminProject,
services/web/app/src/Features/Authorization/AuthorizationMiddleware.js
+20
View File
@@ -129,6 +129,25 @@ async function ensureUserCanResolveThread(req, res, next) {
return HttpErrorHandler.forbidden(req, res)
}
async function ensureUserCanSendComment(req, res, next) {
const projectId = _getProjectId(req)
const userId = _getUserId(req)
const token = TokenAccessHandler.getRequestToken(req, projectId)
const canSendComment = await AuthorizationManager.promises.canUserSendComment(
userId,
projectId,
token
)
if (canSendComment) {
logger.debug({ userId, projectId }, 'allowing user to send a comment')
return next()
}
logger.debug({ userId, projectId }, 'denying user to send a comment')
return HttpErrorHandler.forbidden(req, res)
}
async function ensureUserCanWriteProjectContent(req, res, next) {
const projectId = _getProjectId(req)
const userId = _getUserId(req)
@@ -249,6 +268,7 @@ module.exports = {
ensureUserCanWriteProjectSettings
),
ensureUserCanResolveThread: expressify(ensureUserCanResolveThread),
ensureUserCanSendComment: expressify(ensureUserCanSendComment),
ensureUserCanWriteProjectContent: expressify(
ensureUserCanWriteProjectContent
),