Verified Commit cce09ca1 authored by Luc Didry's avatar Luc Didry

Fix #133 Setting to allow users (non admins) of folder to create pads in it

parent b5536f4b
Pipeline #48686 passed with stage
in 39 seconds
......@@ -1261,7 +1261,32 @@ module.exports = (function () {
if (!isAdmin && !u) {
return fn.denied(res, 'BACKEND.ERROR.AUTHENTICATION.NOT_AUTH');
}
_set(req, res);
if (isAdmin) {
_set(req, res);
} else {
if (req.body.group) {
group.get(req.body.group, function (err, g) {
if (err) {
if (ld.isEqual(err, new Error('BACKEND.ERROR.CONFIGURATION.KEY_NOT_FOUND'))) {
err = 'BACKEND.ERROR.PAD.ITEMS_NOT_FOUND';
}
return res.status(400).send({ success: false, error: err });
}
if (typeof(g) === 'undefined') {
return res.status(400).send({ success: false, error: 'BACKEND.ERROR.PAD.ITEMS_NOT_FOUND'});
} else {
if (ld.indexOf(g.admins, u._id) !== -1 ||
(g.allowUsersToCreatePads && ld.indexOf(g.users, u._id) !== -1)) {
_set(req, res);
} else {
return fn.denied(res, 'BACKEND.ERROR.AUTHENTICATION.DENIED');
}
}
});
} else {
return res.status(400).send({ success: false, error: 'BACKEND.ERROR.TYPE.PARAM_STR'});
}
}
});
/**
......
......@@ -62,7 +62,7 @@ module.exports = (function () {
document.title = (c.addView() ? conf.LANG.GROUP.ADD :
conf.LANG.GROUP.EDIT_GROUP);
document.title += ' - ' + conf.SERVER.title;
c.fields = ['name', 'description', 'visibility', 'password', 'readonly'];
c.fields = ['name', 'description', 'visibility', 'password', 'readonly', 'allowUsersToCreatePads'];
form.initFields(c, c.fields);
c.data.visibility('restricted');
var tagsCurrent;
......@@ -160,6 +160,9 @@ module.exports = (function () {
view.icon.readonly = function () {
return view.icon.common(conf.LANG.GROUP.INFO.READONLY);
};
view.icon.allowUsersToCreatePads = function () {
return view.icon.common(conf.LANG.GROUP.INFO.ALLOW_USERS_TO_CREATE_PADS);
};
/**
* ### Fields
......@@ -252,6 +255,20 @@ module.exports = (function () {
return { label: label, icon: icon };
};
view.field.allowUsersToCreatePads = function (c) {
var icon = view.icon.allowUsersToCreatePads();
var label = m('label', [
m('input', {
name: 'allowUsersToCreatePads',
type: 'checkbox',
checked: c.data.allowUsersToCreatePads(),
onchange: m.withAttr('checked', c.data.allowUsersToCreatePads)
}),
[ conf.LANG.GROUP.FIELD.ALLOW_USERS_TO_CREATE_PADS, icon ]
]);
return { label: label, icon: icon };
};
view.field.tag = function (c) { return tag.view(c.tag); };
/**
......@@ -288,15 +305,22 @@ module.exports = (function () {
);
}
if (!c.addView()) {
fields.push(
fields.push([
m('.form-group',
m('.col-sm-7 .col-sm-offset-4',
m('.checkbox', [
_f.readonly.label,
])
)
),
m('.form-group',
m('.col-sm-7 .col-sm-offset-4',
m('.checkbox', [
_f.allowUsersToCreatePads.label,
])
)
)
);
]);
}
fields.push(view.field.tag(c));
return m('form.form-horizontal', {
......
......@@ -359,7 +359,7 @@ module.exports = (function () {
}
})();
var padBlocks = [];
if (c.isAdmin) { padBlocks.push(addView);}
if (c.isAdmin || (c.group.allowUsersToCreatePads && !c.isGuest)) { padBlocks.push(addView);}
padBlocks.push(filterView, sortView, padView);
if (c.isAdmin) { padBlocks.push(moveView);}
return m('section.panel-body', padBlocks);
......
......@@ -54,7 +54,8 @@ module.exports = (function () {
* visibility: 'restricted' || 'public' || 'private',
* password: 'secret',
* readonly: false,
* tags: ['important', 'domain1']
* tags: ['important', 'domain1'],
* allowUsersToCreatePads: false
* };
*
*/
......@@ -480,6 +481,7 @@ module.exports = (function () {
g.visibility = (ld.isString(v) && ld.includes(vVal, v)) ? v : 'restricted';
g.password = ld.isString(p.password) ? p.password : null;
g.readonly = ld.isBoolean(p.readonly) ? p.readonly : false;
g.allowUsersToCreatePads = ld.isBoolean(p.allowUsersToCreatePads) ? p.allowUsersToCreatePads : false;
g.tags = ld.isArray(p.tags) ? p.tags : [];
return g;
};
......
......@@ -2145,6 +2145,8 @@
var uotherid;
var gid;
var gotherid;
var gsharedid;
var gsharedallowcreationid;
var pid;
var potherid;
var ppublicid;
......@@ -2188,7 +2190,21 @@
function (err, resp, b) {
if (!err && resp.statusCode === 200) {
token = b.token;
done();
group.set({ name: 'sharedgroup', admin: uotherid, users: [uid] }, function (err, g) {
if (err) { console.log(err); }
gsharedid = g._id;
group.set(
{
name: 'sharedgroup',
admin: uotherid, users: [uid],
allowUsersToCreatePads: true
}, function (err, g) {
if (err) { console.log(err); }
gsharedallowcreationid = g._id;
done();
}
);
});
}
}
);
......@@ -2275,12 +2291,34 @@
describe('pad.set/add POST and value as params', function () {
it('should return error when arguments are not as expected',
it('should return an error if no user is given',
function (done) {
var b = { body: { } };
rq.post(padRoute, b, function (err, resp, body) {
expect(resp.statusCode).toBe(401);
expect(body.error).toMatch('AUTHENTICATION.NOT_AUTH');
done();
});
}
);
it('should return an error if no group is given',
function (done) {
var b = { body: { auth_token: token } };
rq.post(padRoute, b, function (err, resp, body) {
expect(resp.statusCode).toBe(400);
expect(body.error).toMatch('PARAM_STR');
done();
});
}
);
it('should return error when arguments are not as expected',
function (done) {
var b = { body: { auth_token: token, group: gid } };
rq.post(padRoute, b, function (err, resp, body) {
expect(resp.statusCode).toBe(400);
expect(body.error).toMatch('PARAM_STR');
var b = { body: { name: 'pad1' } };
b.body.auth_token = token;
rq.post(padRoute, b, function (err, resp, body) {
......@@ -2335,7 +2373,25 @@
}
);
it('should create a new pad otherwise', function (done) {
it('should return an error if creator is not in group admins',
function (done) {
var b = { body:
{
name: 'pad1',
group: gsharedid,
visibility: 'restricted',
auth_token: token
}
};
rq.post(padRoute, b, function (err, resp, body) {
expect(resp.statusCode).toBe(401);
expect(body.error).toMatch('AUTHENTICATION.DENIED');
done();
});
}
);
it('should create a new pad if creator is in group admins', function (done) {
var b = {
body: {
name: 'padOk',
......@@ -2369,6 +2425,42 @@
});
});
it('should create a new pad if creator is in group users and allowUsersToCreatePads is true',
function (done) {
var b = { body:
{
name: 'padOk2',
group: gsharedallowcreationid,
visibility: 'restricted',
auth_token: token
}
};
rq.post(padRoute, b, function (err, resp, body) {
expect(err).toBeNull();
expect(resp.statusCode).toBe(200);
expect(body.success).toBeTruthy();
expect(body.key).toBeDefined();
var key = body.key;
expect(body.value.name).toBe('padOk2');
b = { body: { auth_token: token } };
rq.get(padRoute + '/' + key, b,
function (err, resp, body) {
expect(err).toBeNull();
expect(resp.statusCode).toBe(200);
expect(body.key).toBe(key);
expect(body.value._id).toBe(key);
expect(body.value.name).toBe('padOk2');
expect(body.value.visibility).toBe('restricted');
expect(ld.isArray(body.value.users)).toBeTruthy();
expect(body.value.password).toBeNull();
expect(body.value.readonly).toBeNull();
done();
}
);
});
}
);
});
describe('pad.set PUT key in URL and value as params', function () {
......
......@@ -2141,6 +2141,8 @@
var uotherid;
var gid;
var gotherid;
var gsharedid;
var gsharedallowcreationid;
var pid;
var potherid;
var ppublicid;
......@@ -2186,7 +2188,21 @@
function (err, resp, b) {
if (!err && resp.statusCode === 200) {
token = b.token;
done();
group.set({ name: 'sharedgroup', admin: uotherid, users: [uid] }, function (err, g) {
if (err) { console.log(err); }
gsharedid = g._id;
group.set(
{
name: 'sharedgroup',
admin: uotherid,
users: [uid], allowUsersToCreatePads: true
}, function (err, g) {
if (err) { console.log(err); }
gsharedallowcreationid = g._id;
done();
}
);
});
}
}
);
......@@ -2273,12 +2289,34 @@
describe('pad.set/add POST and value as params', function () {
it('should return error when arguments are not as expected',
it('should return an error if no user is given',
function (done) {
var b = { body: { } };
rq.post(padRoute, b, function (err, resp, body) {
expect(resp.statusCode).toBe(401);
expect(body.error).toMatch('AUTHENTICATION.NOT_AUTH');
done();
});
}
);
it('should return an error if no group is given',
function (done) {
var b = { body: { auth_token: token } };
rq.post(padRoute, b, function (err, resp, body) {
expect(resp.statusCode).toBe(400);
expect(body.error).toMatch('PARAM_STR');
done();
});
}
);
it('should return error when arguments are not as expected',
function (done) {
var b = { body: { auth_token: token, group: gid } };
rq.post(padRoute, b, function (err, resp, body) {
expect(resp.statusCode).toBe(400);
expect(body.error).toMatch('PARAM_STR');
var b = { body: { name: 'pad1' } };
b.body.auth_token = token;
rq.post(padRoute, b, function (err, resp, body) {
......@@ -2333,7 +2371,25 @@
}
);
it('should create a new pad otherwise', function (done) {
it('should return an error if creator is not in group admins',
function (done) {
var b = { body:
{
name: 'pad1',
group: gsharedid,
visibility: 'restricted',
auth_token: token
}
};
rq.post(padRoute, b, function (err, resp, body) {
expect(resp.statusCode).toBe(401);
expect(body.error).toMatch('AUTHENTICATION.DENIED');
done();
});
}
);
it('should create a new pad if creator is in group admins', function (done) {
var b = {
body: {
name: 'padOk',
......@@ -2367,6 +2423,42 @@
});
});
it('should create a new pad if creator is in group users and allowUsersToCreatePads is true',
function (done) {
var b = { body:
{
name: 'padOk2',
group: gsharedallowcreationid,
visibility: 'restricted',
auth_token: token
}
};
rq.post(padRoute, b, function (err, resp, body) {
expect(err).toBeNull();
expect(resp.statusCode).toBe(200);
expect(body.success).toBeTruthy();
expect(body.key).toBeDefined();
var key = body.key;
expect(body.value.name).toBe('padOk2');
b = { body: { auth_token: token } };
rq.get(padRoute + '/' + key, b,
function (err, resp, body) {
expect(err).toBeNull();
expect(resp.statusCode).toBe(200);
expect(body.key).toBe(key);
expect(body.value._id).toBe(key);
expect(body.value.name).toBe('padOk2');
expect(body.value.visibility).toBe('restricted');
expect(ld.isArray(body.value.users)).toBeTruthy();
expect(body.value.password).toBeNull();
expect(body.value.readonly).toBeNull();
done();
}
);
});
}
);
});
describe('pad.set PUT key in URL and value as params', function () {
......
This diff is collapsed.
This source diff could not be displayed because it is too large. You can view the blob instead.
......@@ -191,6 +191,7 @@
"NAME": "The name of the folder is required"
},
"FIELD": {
"ALLOW_USERS_TO_CREATE_PADS": "Allow simple users of the folder to create pads?",
"DESCRIPTION": "Description",
"GROUP_PARAMS": "Folder parameters ?",
"NAME": "Name",
......@@ -211,6 +212,7 @@
"HELP": "Folders can contain pads. Here are your folders : those you have created, those you have been explicitly invited",
"INFO": {
"ADD_SUCCESS": "Folder has been successfully created",
"ALLOW_USERS_TO_CREATE_PADS": "This allows users of the folder that don't have administrator rights to create pads in the folder",
"CHAT_HISTORY_REMOVE_SUCCESS": "The chat history of the pad has been successfully removed",
"CHAT_HISTORY_REMOVE_SURE": "Are you sure you want to remove the chat history of this pad?",
"DESCRIPTION": "An optional long text to describe your folder",
......
......@@ -191,6 +191,7 @@
"NAME": "The name of the folder is required"
},
"FIELD": {
"ALLOW_USERS_TO_CREATE_PADS": "Allow simple users of the folder to create pads?",
"DESCRIPTION": "Description",
"GROUP_PARAMS": "Folder parameters ?",
"NAME": "Name",
......@@ -211,6 +212,7 @@
"HELP": "Folders can contain pads. Here are your folders : those you have created, those you have been explicitly invited",
"INFO": {
"ADD_SUCCESS": "Folder has been successfully created",
"ALLOW_USERS_TO_CREATE_PADS": "This allows users of the folder that don't have administrator rights to create pads in the folder",
"CHAT_HISTORY_REMOVE_SUCCESS": "The chat history of the pad has been successfully removed",
"CHAT_HISTORY_REMOVE_SURE": "Are you sure you want to remove the chat history of this pad?",
"DESCRIPTION": "An optional long text to describe your folder",
......
......@@ -191,6 +191,7 @@
"NAME": "Se necesita un nombre para la carpeta"
},
"FIELD": {
"ALLOW_USERS_TO_CREATE_PADS": "Allow simple users of the folder to create pads?",
"DESCRIPTION": "Descripción ",
"GROUP_PARAMS": "Opciones de carpetas?",
"NAME": "Nombre",
......@@ -211,6 +212,7 @@
"HELP": "Las carpetas pueden contener pads. Aquí tienes tus carpetas : las que has creado, las que has sido invitadas explícitamente",
"INFO": {
"ADD_SUCCESS": "La carpeta ha sido creada con éxito",
"ALLOW_USERS_TO_CREATE_PADS": "This allows users of the folder that don't have administrator rights to create pads in the folder",
"CHAT_HISTORY_REMOVE_SUCCESS": "El historial de chat del pad ha sido eliminado con éxito",
"CHAT_HISTORY_REMOVE_SURE": "¿Estás segura de que quieres eliminar el historial de chat de este pad?",
"DESCRIPTION": "Un largo texto explicativo opcional para describir su carpeta",
......
This diff is collapsed.
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment