Skip to content

Commit 9f5a536

Browse files
iamitprakashiamitprakash
authored
Merge pull request #2519 from Real-Dev-Squad/develop
Dev to Main Sync
2 parents b335ed9 + fe916f7 commit 9f5a536

File tree

5 files changed

+57
-28
lines changed

5 files changed

+57
-28
lines changed

‎controllers/progresses.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ const { PROGRESS_DOCUMENT_RETRIEVAL_SUCCEEDED, PROGRESS_DOCUMENT_CREATED_SUCCEED
4646
*/
4747

4848
const createProgress = async (req, res) => {
49-
if (req.userData.roles.archived) {
49+
if (req.userData.roles?.archived || req.userData.roles?.in_discord !== true) {
5050
return res.boom.forbidden(UNAUTHORIZED_WRITE);
5151
}
5252

‎routes/progresses.ts‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,8 @@ import {
1212
getProgressRangeData,
1313
getProgressBydDateController,
1414
} from "../controllers/progresses";
15-
import { disableRoute } from "../middlewares/shortCircuit";
1615
const router = express.Router();
17-
// DISABLE ROUTE FOR NOW as there is a security issue to be resolved
18-
router.post("/", authenticate, disableRoute, validateCreateProgressRecords, createProgress);
16+
router.post("/", authenticate, validateCreateProgressRecords, createProgress);
1917
router.get("/", validateGetProgressRecordsQuery, getProgress);
2018
router.get("/:type/:typeId/date/:date", validateGetDayProgressParams, getProgressBydDateController);
2119
router.get("/range", validateGetRangeProgressRecordsParams, getProgressRangeData);

‎test/integration/progressesTasks.test.js‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ const {
1515
} = require("../fixtures/progress/progresses");
1616

1717
const userData = require("../fixtures/user/user")();
18+
const withDiscordMembership = require("../utils/withDiscordMembership");
1819
const taskData = require("../fixtures/tasks/tasks")();
1920
const { INTERNAL_SERVER_ERROR_MESSAGE, UNAUTHORIZED_WRITE } = require("../../constants/progresses");
2021
const cookieName = config.get("userToken.cookieName");
@@ -25,8 +26,7 @@ describe("Test Progress Updates API for Tasks", function () {
2526
await cleanDb();
2627
});
2728

28-
// eslint-disable-next-line mocha/no-skipped-tests
29-
describe.skip("Verify POST Request Functionality", function () {
29+
describe("Verify POST Request Functionality", function () {
3030
let clock;
3131
let userId;
3232
let userToken;
@@ -42,7 +42,7 @@ describe("Test Progress Updates API for Tasks", function () {
4242
now: new Date(Date.UTC(2023, 4, 2, 0, 25)).getTime(), // UTC time equivalent to 5:55 AM IST
4343
toFake: ["Date"],
4444
});
45-
userId = await addUser(userData[1]);
45+
userId = await addUser(withDiscordMembership(userData[1]));
4646
archivedUserId = await addUser(userData[5]);
4747
archivedUserToken = authService.generateAuthToken({ userId: archivedUserId });
4848
userToken = authService.generateAuthToken({ userId: userId });
@@ -197,8 +197,8 @@ describe("Test Progress Updates API for Tasks", function () {
197197
let taskId3;
198198

199199
beforeEach(async function () {
200-
userId1 = await addUser(userData[1]);
201-
userId2 = await addUser(userData[2]);
200+
userId1 = await addUser(withDiscordMembership(userData[1]));
201+
userId2 = await addUser(withDiscordMembership(userData[2]));
202202
const taskObject1 = await tasks.updateTask(taskData[0]);
203203
taskId1 = taskObject1.taskId;
204204
const taskObject2 = await tasks.updateTask(taskData[1]);
@@ -394,7 +394,7 @@ describe("Test Progress Updates API for Tasks", function () {
394394
let taskId2;
395395

396396
beforeEach(async function () {
397-
userId = await addUser(userData[1]);
397+
userId = await addUser(withDiscordMembership(userData[1]));
398398
taskObject1 = await tasks.updateTask(taskData[0]);
399399
taskId1 = taskObject1.taskId;
400400
taskObject2 = await tasks.updateTask(taskData[1]);
@@ -470,7 +470,7 @@ describe("Test Progress Updates API for Tasks", function () {
470470
let anotherTaskId;
471471

472472
beforeEach(async function () {
473-
userId = await addUser(userData[0]);
473+
userId = await addUser(withDiscordMembership(userData[0]));
474474
const taskObject = await tasks.updateTask(taskData[0]);
475475
taskId = taskObject.taskId;
476476
const anotherTaskObject = await tasks.updateTask(taskData[0]);
@@ -557,7 +557,7 @@ describe("Test Progress Updates API for Tasks", function () {
557557

558558
describe("GET /progresses (getPaginatedProgressDocument)", function () {
559559
beforeEach(async function () {
560-
const userId = await addUser(userData[1]);
560+
const userId = await addUser(withDiscordMembership(userData[1]));
561561
const taskObject1 = await tasks.updateTask(taskData[0]);
562562
const taskId1 = taskObject1.taskId;
563563
const progressData1 = stubbedModelTaskProgressData(userId, taskId1, 1683626400000, 1683590400000); // 2023-05-09

‎test/integration/progressesUsers.test.js‎

Lines changed: 35 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -14,18 +14,17 @@ const {
1414
} = require("../fixtures/progress/progresses");
1515

1616
const userData = require("../fixtures/user/user")();
17-
const { INTERNAL_SERVER_ERROR_MESSAGE } = require("../../constants/progresses");
17+
const withDiscordMembership = require("../utils/withDiscordMembership");
18+
const { INTERNAL_SERVER_ERROR_MESSAGE, UNAUTHORIZED_WRITE } = require("../../constants/progresses");
1819
const cookieName = config.get("userToken.cookieName");
1920
const { expect } = chai;
2021

21-
// eslint-disable-next-line mocha/no-skipped-tests
22-
describe.skip("Test Progress Updates API for Users", function () {
22+
describe("Test Progress Updates API for Users", function () {
2323
afterEach(async function () {
2424
await cleanDb();
2525
});
2626

27-
// eslint-disable-next-line mocha/no-skipped-tests
28-
describe.skip("Verify the POST progress records", function () {
27+
describe("Verify the POST progress records", function () {
2928
let clock;
3029
let userId;
3130
let userToken;
@@ -39,9 +38,9 @@ describe.skip("Test Progress Updates API for Users", function () {
3938
now: new Date(Date.UTC(2023, 4, 2, 0, 25)).getTime(), // UTC time equivalent to 5:55 AM IST
4039
toFake: ["Date"],
4140
});
42-
userId = await addUser(userData[1]);
41+
userId = await addUser(withDiscordMembership(userData[1]));
4342
userToken = authService.generateAuthToken({ userId: userId });
44-
anotherUserId = await addUser(userData[8]);
43+
anotherUserId = await addUser(withDiscordMembership(userData[8]));
4544
anotherUserToken = authService.generateAuthToken({ userId: anotherUserId });
4645
const progressData = stubbedModelProgressData(anotherUserId, 1682935200000, 1682899200000);
4746
await firestore.collection("progresses").doc("anotherUserProgressDocument").set(progressData);
@@ -159,6 +158,26 @@ describe.skip("Test Progress Updates API for Users", function () {
159158
return done();
160159
});
161160
});
161+
162+
it("Returns forbidden error when user is not in discord", async function () {
163+
const nonDiscordFixture = {
164+
...userData[1],
165+
username: `${(userData[1].username || "user").split("-")[0]}-non-discord`,
166+
github_id: `${userData[1].github_id || "github"}-non-discord-${Date.now()}`,
167+
roles: { ...(userData[1].roles || {}), archived: false, in_discord: false },
168+
};
169+
const nonDiscordUserId = await addUser(nonDiscordFixture);
170+
const nonDiscordToken = authService.generateAuthToken({ userId: nonDiscordUserId });
171+
172+
const res = await chai
173+
.request(app)
174+
.post("/progresses")
175+
.set("Cookie", `${cookieName}=${nonDiscordToken}`)
176+
.send(standupProgressDay1);
177+
178+
expect(res).to.have.status(403);
179+
expect(res.body.message).to.equal(UNAUTHORIZED_WRITE);
180+
});
162181
});
163182

164183
describe("Verify the GET progress records", function () {
@@ -167,9 +186,9 @@ describe.skip("Test Progress Updates API for Users", function () {
167186
let userId3;
168187

169188
beforeEach(async function () {
170-
userId1 = await addUser(userData[0]);
171-
userId2 = await addUser(userData[1]);
172-
userId3 = await addUser(userData[2]);
189+
userId1 = await addUser(withDiscordMembership(userData[0]));
190+
userId2 = await addUser(withDiscordMembership(userData[1]));
191+
userId3 = await addUser(withDiscordMembership(userData[2]));
173192
const progressData1 = stubbedModelProgressData(userId1, 1683957764140, 1683936000000);
174193
const progressData2 = stubbedModelProgressData(userId2, 1683957764140, 1683936000000);
175194
await firestore.collection("progresses").doc("progressDoc1").set(progressData1);
@@ -272,8 +291,8 @@ describe.skip("Test Progress Updates API for Users", function () {
272291
let userId2;
273292

274293
beforeEach(async function () {
275-
userId = await addUser(userData[1]);
276-
userId2 = await addUser(userData[2]);
294+
userId = await addUser(withDiscordMembership(userData[1]));
295+
userId2 = await addUser(withDiscordMembership(userData[2]));
277296
const progressData1 = stubbedModelProgressData(userId, 1683626400000, 1683590400000); // 2023-05-09
278297
const progressData2 = stubbedModelProgressData(userId, 1683885600000, 1683849600000); // 2023-05-12
279298
await firestore.collection("progresses").doc("progressDoc1").set(progressData1);
@@ -344,8 +363,8 @@ describe.skip("Test Progress Updates API for Users", function () {
344363
let anotherUserId;
345364

346365
beforeEach(async function () {
347-
userId = await addUser(userData[0]);
348-
anotherUserId = await addUser(userData[1]);
366+
userId = await addUser(withDiscordMembership(userData[0]));
367+
anotherUserId = await addUser(withDiscordMembership(userData[1]));
349368
const progressData = stubbedModelProgressData(userId, 1683072000000, 1682985600000);
350369
await firestore.collection("progresses").doc("progressDoc").set(progressData);
351370
});
@@ -427,8 +446,8 @@ describe.skip("Test Progress Updates API for Users", function () {
427446

428447
describe("GET /progresses (getPaginatedProgressDocument)", function () {
429448
beforeEach(async function () {
430-
const userId1 = await addUser(userData[0]);
431-
const userId2 = await addUser(userData[1]);
449+
const userId1 = await addUser(withDiscordMembership(userData[0]));
450+
const userId2 = await addUser(withDiscordMembership(userData[1]));
432451
const progressData1 = stubbedModelProgressData(userId1, 1683957764140, 1683936000000);
433452
const progressData2 = stubbedModelProgressData(userId2, 1683957764140, 1683936000000);
434453
await firestore.collection("progresses").doc("progressDoc1").set(progressData1);

‎test/utils/withDiscordMembership.js‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
/**
2+
* Ensures the provided user fixture represents an active Discord member.
3+
*
4+
* @param {object} user - Original user fixture.
5+
* @returns {object} Updated fixture with archived: false and in_discord: true.
6+
*/
7+
const withDiscordMembership = (user = {}) => ({
8+
...user,
9+
roles: { ...(user.roles || {}), archived: false, in_discord: true },
10+
});
11+
12+
module.exports = withDiscordMembership;

0 commit comments

Comments
 (0)