chore(#10551): add user role constants beyond ONLINE constant (#10747)

Signed-off-by: Aravind <gmarav005@gmail.com>
Co-authored-by: Sugat Bajracharya <30311933+sugat009@users.noreply.github.com>

Author: gmarav05

admin/src/js/controllers/edit-user.js

@@ -2,12 +2,14 @@ const moment = require('moment');
 const passwordTester = require('simple-password-tester');
 const phoneNumber = require('@medic/phone-number');
 const CHT = require('@medic/cht-datasource');
+const constants = require('@medic/constants');
+const USER_ROLES = constants.USER_ROLES;
 const PASSWORD_MINIMUM_LENGTH = 8;
 const PASSWORD_MINIMUM_SCORE = 50;
 const SHOW_PASSWORD_ICON = '/login/images/show-password.svg';
 const HIDE_PASSWORD_ICON = '/login/images/hide-password.svg';
 const USERNAME_ALLOWED_CHARS = /^[a-z0-9_-]+$/;
-const ADMIN_ROLE = '_admin';
+const ADMIN_ROLE = USER_ROLES.COUCHDB_ADMIN;
 const FIELDS_TO_IGNORE = [
   'currentPassword',
   'passwordConfirm',

admin/src/js/services/session.js

@@ -1,7 +1,8 @@
 const _ = require('lodash/core');
 const constants = require('@medic/constants');
+const USER_ROLES = constants.USER_ROLES;
 const COOKIE_NAME = 'userCtx';
-const ONLINE_ROLE = constants.USER_ROLES.ONLINE;
+const ONLINE_ROLE = USER_ROLES.ONLINE;
 
 (function () {
 
@@ -96,7 +97,7 @@ const ONLINE_ROLE = constants.USER_ROLES.ONLINE;
 
       const isAdmin = function(userCtx) {
         userCtx = userCtx || getUserCtx();
-        return hasRole(userCtx, '_admin');
+        return hasRole(userCtx, USER_ROLES.COUCHDB_ADMIN);
       };
 
       return {

admin/tests/unit/services/auth.spec.js

@@ -1,3 +1,5 @@
+const { USER_ROLES: { COUCHDB_ADMIN } } = require('@medic/constants');
+
 describe('Auth service', function() {
 
   'use strict';
@@ -58,7 +60,7 @@ describe('Auth service', function() {
     });
 
     it('true when user is db admin', async () => {
-      userCtx.returns({ roles: ['_admin'] });
+      userCtx.returns({ roles: [COUCHDB_ADMIN] });
       Settings.resolves({ permissions: { can_edit: [ 'chw' ] } });
       const result = await service.has(['can_backup_facilities']);
       chai.expect(result).to.be.true;
@@ -176,7 +178,7 @@ describe('Auth service', function() {
     });
 
     it('false when admin and !permission', async () => {
-      userCtx.returns({ roles: ['_admin'] });
+      userCtx.returns({ roles: [COUCHDB_ADMIN] });
       Settings.resolves({ permissions: {} });
       const result = await service.has(['!can_backup_facilities']);
       chai.expect(result).to.be.false;
@@ -246,21 +248,21 @@ describe('Auth service', function() {
     });
 
     it('true when admin and no disallowed permissions', async () => {
-      userCtx.returns({ roles: ['_admin'] });
+      userCtx.returns({ roles: [COUCHDB_ADMIN] });
       Settings.resolves({ permissions: { can_edit: [ 'chw' ] } });
       const result = await service.any([['can_backup_facilities'], ['can_export_messages'], ['somepermission']]);
       chai.expect(result).to.be.true;
     });
 
     it('true when admin and some disallowed permissions', async () => {
-      userCtx.returns({ roles: ['_admin'] });
+      userCtx.returns({ roles: [COUCHDB_ADMIN] });
       Settings.resolves({ permissions: { can_edit: [ 'chw' ] } });
       const result = await service.any([['!can_backup_facilities'], ['!can_export_messages'], ['somepermission']]);
       chai.expect(result).to.be.true;
     });
 
     it('false when admin and all disallowed permissions', async () => {
-      userCtx.returns({ roles: ['_admin'] });
+      userCtx.returns({ roles: [COUCHDB_ADMIN] });
       Settings.resolves({ permissions: {} });
       const result = await service.any([['!can_backup_facilities'], ['!can_export_messages'], ['!somepermission']]);
       chai.expect(result).to.be.false;

admin/tests/unit/services/session.spec.js

@@ -1,6 +1,7 @@
 describe('Session service', function() {
 
   'use strict';
+  const { USER_ROLES: { COUCHDB_ADMIN } } = require('@medic/constants');
 
   let service;
   let ipCookie;
@@ -149,7 +150,7 @@ describe('Session service', function() {
     });
 
     it('returns true for _admin', function(done) {
-      ipCookie.returns({ roles: [ '_admin' ] });
+      ipCookie.returns({ roles: [COUCHDB_ADMIN] });
       const actual = service.isAdmin();
       chai.expect(actual).to.equal(true);
       done();

api/src/migrations/restrict-access-to-vault-db.js

@@ -1,9 +1,10 @@
 const request = require('@medic/couch-request');
 const url = require('url');
 const environment = require('@medic/environment');
+const { USER_ROLES } = require('@medic/constants');
 
 const addSecurityToDb = () => {
-  const dbAdminRole = '_admin';
+  const dbAdminRole = USER_ROLES.COUCHDB_ADMIN;
   const securityObject = {
     admins: { names: [], roles: [ dbAdminRole ] },
     members: { names: [], roles: [ dbAdminRole ] }

api/tests/mocha/auth.spec.js

@@ -6,6 +6,7 @@ const auth = require('../../src/auth');
 const config = require('../../src/config');
 const environment = require('@medic/environment');
 const { PermissionError } = require('../../src/errors');
+const { USER_ROLES: { COUCHDB_ADMIN } } = require('@medic/constants');
 
 let req;
 
@@ -79,7 +80,7 @@ describe('Auth', () => {
     });
 
     it('returns username for admin', () => {
-      const userCtx = { userCtx: { name: 'steve', roles: [ '_admin' ] } };
+      const userCtx = { userCtx: { name: 'steve', roles: [COUCHDB_ADMIN] } };
       const get = sinon.stub(request, 'get').resolves(userCtx);
       return auth.check({headers: []}, 'can_edit').then(ctx => {
         chai.expect(get.callCount).to.equal(1);
@@ -272,7 +273,7 @@ describe('Auth', () => {
     });
 
     it('succeeds for admin user regardless of permissions', async () => {
-      userCtx.roles.push('_admin');
+      userCtx.roles.push(COUCHDB_ADMIN);
       config.get.returns({
         can_edit: ['other_role'],
       });

api/tests/mocha/controllers/login.spec.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const chai = require('chai');
 const sinon = require('sinon');
 const request = require('@medic/couch-request');
+const { USER_ROLES: { COUCHDB_ADMIN } } = require('@medic/constants');
 
 const environment = require('@medic/environment');
 const auth = require('../../../src/auth');
@@ -1013,7 +1014,7 @@ describe('login controller', () => {
       sinon.stub(res, 'send');
       sinon.stub(res, 'status').returns(res);
       sinon.stub(users, 'createAdmin').resolves();
-      const userCtx = { name: 'shazza', roles: [ '_admin' ] };
+      const userCtx = { name: 'shazza', roles: [COUCHDB_ADMIN] };
       sinon.stub(users, 'getUserDoc').resolves({});
       sinon.stub(auth, 'getUserCtx').resolves(userCtx);
       roles.isOnlineOnly.returns(true);
@@ -1046,7 +1047,7 @@ describe('login controller', () => {
       sinon.stub(res, 'status').returns(res);
       sinon.stub(res, 'json').returns(res);
       sinon.stub(users, 'createAdmin').resolves();
-      const userCtx = { name: 'shazza', roles: [ '_admin' ] };
+      const userCtx = { name: 'shazza', roles: [COUCHDB_ADMIN] };
       sinon.stub(users, 'getUserDoc').resolves({ oidc_username: 'true' });
       sinon.stub(auth, 'getUserCtx').resolves(userCtx);
       roles.isOnlineOnly.returns(true);

api/tests/mocha/controllers/replication-limit-log.spec.js

@@ -4,6 +4,7 @@ const auth = require('../../../src/auth');
 const serverUtils = require('../../../src/server-utils');
 const replicationLimitLogController = require('../../../src/controllers/replication-limit-log');
 const replicationLimitLogService = require('../../../src/services/replication-limit-log');
+const { USER_ROLES: { COUCHDB_ADMIN } } = require('@medic/constants');
 
 describe('Replication Limit Log Controller', () => {
   let req;
@@ -59,7 +60,7 @@ describe('Replication Limit Log Controller', () => {
     });
 
     it('should respond with a log document', () => {
-      auth.getUserCtx.resolves({ roles: ['_admin'] });
+      auth.getUserCtx.resolves({ roles: [COUCHDB_ADMIN] });
       replicationLimitLogService.get.resolves({ some: 'logs' });
 
       return replicationLimitLogController

api/tests/mocha/controllers/users.spec.js

@@ -10,6 +10,7 @@ const db = require('../../../src/db');
 const dataContext = require('../../../src/services/data-context');
 const { roles, users } = require('@medic/user-management')(config, db, dataContext);
 const replicationLimitLog = require('../../../src/services/replication-limit-log');
+const { USER_ROLES: { COUCHDB_ADMIN, ADMIN } } = require('@medic/constants');
 
 let req;
 let userCtx;
@@ -194,7 +195,7 @@ describe('Users Controller', () => {
 
     beforeEach(() => {
       userList = [
-        { id: 'org.couchdb.user:admin', roles: ['_admin'] },
+        { id: 'org.couchdb.user:admin', roles: [COUCHDB_ADMIN] },
         {
           id: 'org.couchdb.user:chw',
           roles: ['chw', 'district-admin'],
@@ -250,7 +251,7 @@ describe('Users Controller', () => {
         const result = res.json.args[0][0];
         chai.expect(result[0].id).to.equal('org.couchdb.user:admin');
         chai.expect(result[0].type).to.be.undefined;
-        chai.expect(result[0].roles).to.deep.equal([ '_admin' ]);
+        chai.expect(result[0].roles).to.deep.equal([COUCHDB_ADMIN]);
         chai.expect(result[1].id).to.equal('org.couchdb.user:chw');
         chai.expect(result[1].type).to.be.undefined;
         chai.expect(result[1].roles).to.deep.equal([ 'chw', 'district-admin' ]);
@@ -318,7 +319,7 @@ describe('Users Controller', () => {
 
   describe('info', () => {
     beforeEach(() => {
-      userCtx = { name: 'user', roles: ['admin'] };
+      userCtx = { name: 'user', roles: [ADMIN] };
       req = { query: {}, userCtx };
       res = { json: sinon.stub() };
     });

shared-libs/cht-datasource/package.json

@@ -17,6 +17,7 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@medic/contact-types-utils": "file:../contact-types-utils",
-    "@medic/logger": "file:../logger"
+    "@medic/logger": "file:../logger",
+    "@medic/constants": "file:../constants"
   }
 }