Skip to content

Commit

Permalink
require the current user to have the can_view >= content permission o…
Browse files Browse the repository at this point in the history 
…n an item in order to have the right to write to the thread linked to the item
  • Loading branch information
@zenovich
zenovich committed Jan 14, 2025
1 parent 49c67f8 commit 22192fe
Show file tree
Hide file tree
Showing 3 changed files with 78 additions and 2 deletions.
17 changes: 17 additions & 0 deletions app/api/threads/update_thread.feature
View file
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ Feature: Update thread
Given I am the user with id "3"
And there is no thread with "item_id=1000,participant_id=3"
And I am a member of the group with id "100"
And I can view content of the item 1000
And I can request help to the group with id "100" on the item with id "1000"
When I send a PUT request to "/items/1000/participant/3/thread" with the following body:
"""
Expand All @@ -94,6 +95,7 @@ Feature: Update thread
Scenario: Can write to thread condition (1) when status is not set
Given I am the user with id "1"
And there is a thread with "item_id=10,participant_id=1"
And I can view content of the item 10
When I send a PUT request to "/items/10/participant/1/thread" with the following body:
"""
{
Expand All @@ -109,6 +111,7 @@ Feature: Update thread
Scenario: Can write to thread condition (2) when status is not set
Given I am the user with id "2"
And there is a thread with "item_id=20,participant_id=3"
And I can view content of the item 20
And I have the watch permission set to "answer" on the item 20
And I am a manager of the group 3 and can watch for submissions from the group and its descendants
When I send a PUT request to "/items/20/participant/3/thread" with the following body:
Expand All @@ -127,6 +130,7 @@ Feature: Update thread
Given I am the user with id "2"
And there is a thread with "item_id=30,participant_id=3"
And I am part of the helper group of the thread
And I can view content of the item 30
And I have the watch permission set to "answer" on the item 30
When I send a PUT request to "/items/30/participant/3/thread" with the following body:
"""
Expand All @@ -145,6 +149,7 @@ Feature: Update thread
And there is a thread with "item_id=40,participant_id=3"
And I am part of the helper group of the thread
And I have a validated result on the item 40
And I can view content of the item 40
And I have the watch permission set to "result" on the item 40
When I send a PUT request to "/items/40/participant/3/thread" with the following body:
"""
Expand All @@ -161,6 +166,7 @@ Feature: Update thread
Scenario: Set message_count to 0
Given I am the user with id "1"
And there is a thread with "item_id=50,participant_id=1"
And I can view content of the item 50
When I send a PUT request to "/items/50/participant/1/thread" with the following body:
"""
{
Expand All @@ -176,6 +182,7 @@ Feature: Update thread
Scenario: Should set message_count to 0 if decrement to a negative value
Given I am the user with id "1"
And there is a thread with "item_id=60,participant_id=1,message_count=10"
And I can view content of the item 60
When I send a PUT request to "/items/60/participant/1/thread" with the following body:
"""
{
Expand All @@ -191,6 +198,7 @@ Feature: Update thread
Scenario Outline: Should increment message_count by message_count_increments
Given I am the user with id "1"
And there is a thread with "item_id=<item_id>,participant_id=1,message_count=10"
And I can view content of the item <item_id>
When I send a PUT request to "/items/<item_id>/participant/1/thread" with the following body:
"""
{
Expand All @@ -211,6 +219,7 @@ Feature: Update thread
Scenario Outline: Participant of a thread can always switch the thread from open to any other status
Given I am the user with id "3"
And there is a thread with "item_id=<item_id>,participant_id=3,status=<old_status>"
And I can view content of the item <item_id>
And I have the watch permission set to "none" on the item <item_id>
When I send a PUT request to "/items/<item_id>/participant/3/thread" with the following body:
"""
Expand All @@ -232,6 +241,7 @@ Feature: Update thread

Scenario Outline: A user who has can_watch>=answer on the item AND can_watch_members on the participant can always switch to an open status when thread exists
Given I am the user with id "2"
And I can view content of the item <item_id>
And I have the watch permission set to "answer" on the item <item_id>
And I am a manager of the group 3 and can watch for submissions from the group and its descendants
And there is a thread with "item_id=<item_id>,participant_id=3,status=closed"
Expand All @@ -256,6 +266,7 @@ Feature: Update thread

Scenario Outline: A user who has can_watch>=answer on the item AND can_watch_members on the participant can always switch to an open status when thread doesn't exists
Given I am the user with id "2"
And I can view content of the item <item_id>
And I have the watch permission set to "answer" on the item <item_id>
And I am a manager of the group 3 and can watch for submissions from the group and its descendants
And there is no thread with "item_id=<item_id>,participant_id=3"
Expand All @@ -278,6 +289,7 @@ Feature: Update thread

Scenario Outline: Can switch to open if part of the group the participant has requested help to AND can_watch>=answer on the item
Given I am the user with id "4"
And I can view content of the item <item_id>
And I have the watch permission set to "answer" on the item <item_id>
And there is a thread with "item_id=<item_id>,participant_id=3,status=<old_status>,helper_group_id=50"
When I send a PUT request to "/items/<item_id>/participant/3/thread" with the following body:
Expand All @@ -300,6 +312,7 @@ Feature: Update thread
Scenario Outline: Can switch to open if part of the group the participant has requested help to AND (have can_watch=result permission and a validated result on the item)
Given I am the user with id "4"
And I have a validated result on the item <item_id>
And I can view content of the item <item_id>
And I have the watch permission set to "result" on the item <item_id>
And there is a thread with "item_id=<item_id>,participant_id=3,status=<old_status>,helper_group_id=50"
When I send a PUT request to "/items/<item_id>/participant/3/thread" with the following body:
Expand All @@ -321,6 +334,7 @@ Feature: Update thread

Scenario: If status is open and not provided (no change): update helper_group_id
Given I am the user with id "2"
And I can view content of the item 260
And I have the watch permission set to "answer" on the item 260
And there is a thread with "item_id=260,participant_id=3,helper_group_id=10"
When I send a PUT request to "/items/260/participant/3/thread" with the following body:
Expand All @@ -336,6 +350,7 @@ Feature: Update thread

Scenario Outline: Participant of a thread can switch from non-open to open status when allowed to request help on the item
Given I am the user with id "3"
And I can view content of the item <item_id>
And I have the watch permission set to "none" on the item <item_id>
And there is a thread with "item_id=<item_id>,participant_id=3,status=closed,helper_group_id=<old_helper_group_id>"
When I send a PUT request to "/items/<item_id>/participant/3/thread" with the following body:
Expand All @@ -359,6 +374,7 @@ Feature: Update thread

Scenario Outline: Participant of a thread can switch from non-open to open status when allowed to request help on the item when thread doesn't exists
Given I am the user with id "3"
And I can view content of the item <item_id>
And I have the watch permission set to "none" on the item <item_id>
And there is no thread with "item_id=<item_id>,participant_id=3"
When I send a PUT request to "/items/<item_id>/participant/3/thread" with the following body:
Expand All @@ -383,6 +399,7 @@ Feature: Update thread
Scenario: Participant who can request help on region can request help on class
Given I am the user with id "3"
And there is no thread with "item_id=270,participant_id=3"
And I can view content of the item 270
And I can request help to the group with id "12" on the item with id "270"
When I send a PUT request to "/items/270/participant/3/thread" with the following body:
"""
Expand Down
15 changes: 13 additions & 2 deletions app/api/threads/update_thread.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ type updateThreadRequest struct {
//
//
// Validations and restrictions:
// * the current user should have `can_view` >= content permission on the item in order to have the right to write to the thread.
// * if `status` is given:
// - The participant of a thread can always switch the thread from open to any another other status.
// He can only switch it from non-open to an open status if he is allowed to request help on this item.
Expand Down Expand Up @@ -120,9 +121,19 @@ func (srv *Service) updateThread(w http.ResponseWriter, r *http.Request) service
rawRequestData, apiError := service.ResolveJSONBodyIntoMap(r)
service.MustBeNoError(apiError)

err = srv.GetStore(r).InTransaction(func(store *database.DataStore) error {
user := srv.GetUser(r)
user := srv.GetUser(r)
store := srv.GetStore(r)

userCanViewItemContent, err := store.Permissions().MatchingUserAncestors(user).
Where("permissions.item_id = ?", itemID).
WherePermissionIsAtLeast("view", "content").
HasRows()
service.MustNotBeError(err)
if !userCanViewItemContent {
return service.InsufficientAccessRightsError
}

err = store.InTransaction(func(store *database.DataStore) error {
var oldThreadInfo threadInfo
err = database.NewDataStore(constructThreadInfoQuery(store, user, itemID, participantID)).
WithCustomWriteLocks(golang.NewSet[string](), golang.NewSet[string]("threads")).
Expand Down
Loading

0 comments on commit 22192fe

Please sign in to comment.