Removes blacklisting, *-but test case
This commit is contained in:
@@ -1408,10 +1408,7 @@ describe('schemas', () => {
|
||||
role.relation('users').add(admin);
|
||||
return role.save(null, {useMasterKey: true}).then(() => {
|
||||
let perm = {
|
||||
'find': {
|
||||
// Admins can't read
|
||||
'role:admin': false
|
||||
}
|
||||
find: {}
|
||||
};
|
||||
// let the user find
|
||||
perm['find'][user.id] = true;
|
||||
@@ -1455,76 +1452,5 @@ describe('schemas', () => {
|
||||
}).then(() => {
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('validate CLP 6', done => {
|
||||
let user = new Parse.User();
|
||||
user.setUsername('user');
|
||||
user.setPassword('user');
|
||||
|
||||
let user2 = new Parse.User();
|
||||
user2.setUsername('user2');
|
||||
user2.setPassword('user2');
|
||||
let admin = new Parse.User();
|
||||
admin.setUsername('admin');
|
||||
admin.setPassword('admin');
|
||||
|
||||
let role = new Parse.Role('admin', new Parse.ACL());
|
||||
|
||||
Promise.resolve().then(() => {
|
||||
return Parse.Object.saveAll([user, user2, admin, role], {useMasterKey: true});
|
||||
}).then(()=> {
|
||||
role.relation('users').add(admin);
|
||||
return role.save(null, {useMasterKey: true}).then(() => {
|
||||
let perm = {
|
||||
'find': {
|
||||
// Anyone can find
|
||||
'*': true
|
||||
}
|
||||
};
|
||||
// but the user can't
|
||||
perm['find'][user.id] = false;
|
||||
return setPermissionsOnClass('AClass', perm);
|
||||
})
|
||||
}).then(() => {
|
||||
return Parse.User.logIn('user', 'user').then(() => {
|
||||
let obj = new Parse.Object('AClass');
|
||||
return obj.save();
|
||||
})
|
||||
}).then(() => {
|
||||
let query = new Parse.Query('AClass');
|
||||
return query.find().then((res) => {
|
||||
fail('User should not be able to find!')
|
||||
return Promise.resolve();
|
||||
}, (err) => {
|
||||
expect(err.message).toEqual('Permission denied for this action.');
|
||||
return Promise.resolve();
|
||||
})
|
||||
}).then(() => {
|
||||
return Parse.User.logIn('admin', 'admin');
|
||||
}).then( () => {
|
||||
let query = new Parse.Query('AClass');
|
||||
return query.find();
|
||||
}).then((results) => {
|
||||
expect(results.length).toEqual(1);
|
||||
return Promise.resolve();
|
||||
}, (err) => {
|
||||
fail('Should find the object as admin');
|
||||
return Promise.resolve();
|
||||
}).then(() => {
|
||||
return Parse.User.logIn('user2', 'user2');
|
||||
}).then( () => {
|
||||
let query = new Parse.Query('AClass');
|
||||
return query.find();
|
||||
}).then((results) => {
|
||||
expect(results.length).toEqual(1);
|
||||
return Promise.resolve();
|
||||
}, (err) => {
|
||||
fail('Should find the object as user2');
|
||||
return Promise.resolve();
|
||||
}).then(() => {
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user