yellowadmin/pp-tcms
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: inplement auth for cases

Browse Source
This commit is contained in:
Takeshi Kimata
2024-06-06 11:29:33 +09:00
parent d9cc30c839
commit 145f9fed68
10 changed files with 168 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
backend/middleware/auth.js
View File

@@ -51,67 +51,6 @@ function authMiddleware(sequelize) {
next();
}
/**
* Verify user can access project
* (have to be called after verifySignedIn() middleware)
*/
async function verifyProjectVisible(req, res, next) {
const Project = defineProject(sequelize, DataTypes);
const Folder = defineFolder(sequelize, DataTypes);
const Member = defineMember(sequelize, DataTypes);
Project.hasMany(Member, { foreignKey: 'projectId' });
let projectId = req.params.projectId || req.query.projectId;
const folderId = req.params.folderId || req.query.folderId;
if (!projectId && !folderId) {
return res.status(400).json({ error: 'projectId or folderId is required' });
}
if (!projectId) {
// find project id from folderId
const folder = await Folder.findByPk(folderId);
if (folder && folder.projectId) {
projectId = folder.projectId;
} else {
return res.status(404).send('failed to find project from folderId');
}
}
const project = await Project.findOne({
where: { id: projectId },
include: [
{
model: Member,
where: { userId: req.userId },
required: false,
},
],
});
if (!project) {
return res.status(404).send('Project not found');
}
// if project is public, everyone can see
if (project.isPublic) {
next();
return;
}
// if project is private, owner and project member can see
if (project.userId === req.userId) {
next();
return;
}
const member = project.Members && project.Members[0];
if (member) {
next();
return;
}
return res.status(403).json({ error: 'Forbidden' });
}
/**
* Verify user has project
* (have to be called after verifySignedIn() middleware)
@@ -188,8 +127,9 @@ function authMiddleware(sequelize) {
const Folder = defineFolder(sequelize, DataTypes);
const Case = defineCase(sequelize, DataTypes);
const Member = defineMember(sequelize, DataTypes);
Project.hasMany(Member, { foreignKey: 'projectId' });
Project.hasMany(Folder, { foreignKey: 'projectId' });
Folder.hasMany(Case, { foreignKey: 'folderId' });
Project.hasMany(Member, { foreignKey: 'projectId' });
let projectId = req.params.projectId || req.query.projectId;
const folderId = req.params.folderId || req.query.folderId;
@@ -258,7 +198,6 @@ function authMiddleware(sequelize) {
return {
verifySignedIn,
verifyAdmin,
verifyProjectVisible,
verifyProjectOwner,
verifyProjectManager,
verifyProjectDeveloper,

134
backend/middleware/verifyVisible.js Normal file
View File

@@ -0,0 +1,134 @@
const { DataTypes } = require('sequelize');
const defineMember = require('../models/members');
const defineProject = require('../models/projects');
const defineFolder = require('../models/folders');
const defineCase = require('../models/cases');
function verifyVisibleMiddleware(sequelize) {
/**
* Verify user can read project by projectId
* (have to be called after verifySignedIn() middleware)
*/
async function verifyProjectVisibleFromProjectId(req, res, next) {
let projectId = req.params.projectId || req.query.projectId;
if (!projectId) {
return res.status(400).json({ error: 'projectId is required' });
}
const isVisble = await isVisible(projectId, req.userId);
if (isVisble) {
next();
return;
}
return res.status(403).json({ error: 'Forbidden' });
}
/**
* Verify user can read project by folderId
* (have to be called after verifySignedIn() middleware)
*/
async function verifyProjectVisibleFromFolderId(req, res, next) {
const Folder = defineFolder(sequelize, DataTypes);
const folderId = req.params.folderId || req.query.folderId;
if (!folderId) {
return res.status(400).json({ error: 'folderId is required' });
}
// find project id from folderId
const folder = await Folder.findByPk(folderId);
const projectId = folder && folder.id;
if (!projectId) {
return res.status(404).send('failed to find projectId');
}
const isVisble = await isVisible(projectId, req.userId);
if (isVisble) {
next();
return;
}
return res.status(403).json({ error: 'Forbidden' });
}
async function verifyProjectVisibleFromCaseId(req, res, next) {
const Project = defineProject(sequelize, DataTypes);
const Folder = defineFolder(sequelize, DataTypes);
const Case = defineCase(sequelize, DataTypes);
Project.hasMany(Folder, { foreignKey: 'projectId' });
Folder.hasMany(Case, { foreignKey: 'folderId' });
Folder.belongsTo(Project, { foreignKey: 'projectId' });
Case.belongsTo(Folder, { foreignKey: 'folderId' });
const caseId = req.params.caseId || req.query.caseId;
if (!caseId) {
return res.status(400).json({ error: 'caseId is required' });
}
// find project id from caseId
const testCase = await Case.findByPk(caseId, {
include: {
model: Folder,
include: Project,
},
});
const projectId = testCase && testCase.Folder && testCase.Folder.Project && testCase.Folder.Project.id;
if (!projectId) {
return res.status(404).send('failed to find projectId');
}
const isVisble = await isVisible(projectId, req.userId);
if (isVisble) {
next();
return;
}
return res.status(403).json({ error: 'Forbidden' });
}
async function isVisible(projectId, userId) {
const Project = defineProject(sequelize, DataTypes);
const Member = defineMember(sequelize, DataTypes);
Project.hasMany(Member, { foreignKey: 'projectId' });
const project = await Project.findOne({
where: { id: projectId },
include: [
{
model: Member,
where: { userId: userId },
required: false,
},
],
});
if (!project) {
return res.status(404).send('Project not found');
}
// if project is public, everyone can see
if (project.isPublic) {
return true;
}
// if project is private, owner and project member can see
if (project.userId === userId) {
return true;
}
const member = project.Members && project.Members[0];
if (member) {
return true;
}
return false;
}
return {
verifyProjectVisibleFromProjectId,
verifyProjectVisibleFromFolderId,
verifyProjectVisibleFromCaseId,
};
}
module.exports = verifyVisibleMiddleware;

5
backend/routes/cases/index.js
View File

@@ -5,9 +5,10 @@ const { DataTypes } = require('sequelize');
module.exports = function (sequelize) {
const Case = defineCase(sequelize, DataTypes);
const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
const { verifySignedIn } = require('../../middleware/auth')(sequelize);
const { verifyProjectVisibleFromFolderId } = require('../../middleware/verifyVisible')(sequelize);
router.get('/', verifySignedIn, verifyProjectVisible, async (req, res) => {
router.get('/', verifySignedIn, verifyProjectVisibleFromFolderId, async (req, res) => {
const { folderId } = req.query;
if (!folderId) {

5
backend/routes/cases/show.js
View File

@@ -13,9 +13,10 @@ module.exports = function (sequelize) {
Step.belongsToMany(Case, { through: 'caseSteps' });
Case.belongsToMany(Attachment, { through: 'caseAttachments' });
Attachment.belongsToMany(Case, { through: 'caseAttachments' });
const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
const { verifySignedIn } = require('../../middleware/auth')(sequelize);
const { verifyProjectVisibleFromCaseId } = require('../../middleware/verifyVisible')(sequelize);
router.get('/:caseId', verifySignedIn, verifyProjectVisible, async (req, res) => {
router.get('/:caseId', verifySignedIn, verifyProjectVisibleFromCaseId, async (req, res) => {
const caseId = req.params.caseId;
if (!caseId) {

5
backend/routes/folders/index.js
View File

@@ -4,10 +4,11 @@ const defineFolder = require('../../models/folders');
const { DataTypes } = require('sequelize');
module.exports = function (sequelize) {
const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
const { verifySignedIn } = require('../../middleware/auth')(sequelize);
const { verifyProjectVisibleFromProjectId } = require('../../middleware/verifyVisible')(sequelize);
const Folder = defineFolder(sequelize, DataTypes);
router.get('/', verifySignedIn, verifyProjectVisible, async (req, res) => {
router.get('/', verifySignedIn, verifyProjectVisibleFromProjectId, async (req, res) => {
const { projectId } = req.query;
if (!projectId) {

5
backend/routes/home/index.js
View File

@@ -8,7 +8,8 @@ const defineRunCase = require('../../models/runCases');
const { DataTypes } = require('sequelize');
module.exports = function (sequelize) {
const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
const { verifySignedIn } = require('../../middleware/auth')(sequelize);
const { verifyProjectVisibleFromProjectId } = require('../../middleware/verifyVisible')(sequelize);
const Project = defineProject(sequelize, DataTypes);
const Folder = defineFolder(sequelize, DataTypes);
@@ -20,7 +21,7 @@ module.exports = function (sequelize) {
Project.hasMany(Run, { foreignKey: 'projectId' });
Run.hasMany(RunCase, { foreignKey: 'runId' });
router.get('/:projectId', verifySignedIn, verifyProjectVisible, async (req, res) => {
router.get('/:projectId', verifySignedIn, verifyProjectVisibleFromProjectId, async (req, res) => {
const projectId = req.params.projectId;
if (!projectId) {

5
backend/routes/members/index.js
View File

@@ -5,12 +5,13 @@ const defineMember = require('../../models/members');
const { DataTypes } = require('sequelize');
module.exports = function (sequelize) {
const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
const { verifySignedIn } = require('../../middleware/auth')(sequelize);
const { verifyProjectVisibleFromProjectId } = require('../../middleware/verifyVisible')(sequelize);
const User = defineUser(sequelize, DataTypes);
const Member = defineMember(sequelize, DataTypes);
Member.belongsTo(User, { foreignKey: 'userId' });
router.get('/', verifySignedIn, verifyProjectVisible, async (req, res) => {
router.get('/', verifySignedIn, verifyProjectVisibleFromProjectId, async (req, res) => {
const { projectId } = req.query;
if (!projectId) {

5
backend/routes/projects/show.js
View File

@@ -5,12 +5,13 @@ const defineFolder = require('../../models/folders');
const { DataTypes } = require('sequelize');
module.exports = function (sequelize) {
const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
const { verifySignedIn } = require('../../middleware/auth')(sequelize);
const { verifyProjectVisibleFromProjectId } = require('../../middleware/verifyVisible')(sequelize);
const Project = defineProject(sequelize, DataTypes);
const Folder = defineFolder(sequelize, DataTypes);
Project.hasMany(Folder, { foreignKey: 'projectId' });
router.get('/:projectId', verifySignedIn, verifyProjectVisible, async (req, res) => {
router.get('/:projectId', verifySignedIn, verifyProjectVisibleFromProjectId, async (req, res) => {
const projectId = req.params.projectId;
if (!projectId) {
return res.status(400).json({ error: 'projectId is required' });