Merge pull request #8897 from overleaf/ta-token-access-anonymous-redirect

Redirect Early on Anonymous Write Token Access Attempts

GitOrigin-RevId: 55e1839c3171a0a6a677ecca2f6bec87aad802bd

services/web/test/acceptance/src/TokenAccessTests.js

@@ -993,6 +993,41 @@ describe('TokenAccess', function () {
           done
         )
       })
+
+      it('should require login if project does not exist', function (done) {
+        async.series(
+          [
+            // delete project
+            cb => {
+              this.owner.deleteProject(this.projectId, cb)
+            },
+            cb =>
+              tryReadAndWriteTokenAccess(
+                this.anon,
+                this.tokens.readAndWrite,
+                (response, body) => {
+                  expect(response.statusCode).to.equal(200)
+                },
+                (response, body) => {
+                  expect(response.statusCode).to.equal(200)
+                  expect(body).to.deep.equal({
+                    redirect: '/restricted',
+                    anonWriteAccessDenied: true,
+                  })
+                },
+                cb
+              ),
+            cb =>
+              this.anon.login((err, response, body) => {
+                expect(err).to.not.exist
+                expect(response.statusCode).to.equal(200)
+                expect(body.redir).to.equal(`/${this.tokens.readAndWrite}`)
+                cb()
+              }),
+          ],
+          done
+        )
+      })
     })
   } else {
     describe('anonymous read-and-write token, enabled', function () {
@@ -1118,6 +1153,35 @@ describe('TokenAccess', function () {
           )
         })
       })
+
+      it('should 404 if project does not exist', function (done) {
+        async.series(
+          [
+            // delete project
+            cb => {
+              this.owner.deleteProject(this.projectId, cb)
+            },
+            cb =>
+              tryReadAndWriteTokenAccess(
+                this.anon,
+                this.tokens.readAndWrite,
+                (response, body) => {
+                  expect(response.statusCode).to.equal(200)
+                },
+                (response, body) => {
+                  expect(response.statusCode).to.equal(200)
+                  expect(body).to.deep.equal({
+                    v1Import: {
+                      status: 'mustLogin',
+                    },
+                  })
+                },
+                cb
+              ),
+          ],
+          done
+        )
+      })
     })
   }