Adds class level permission requiring authenticated user (#893)
* Adds class level permission requiring authenticated user * Updates to latest schema permissions syntax * fix flaky test * Exclude PG * Rebased and nitted * lints
This commit is contained in:
Florent Vilmart
GitHub
@@ -881,3 +881,230 @@ describe('SchemaController', () => {
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('Class Level Permissions for requiredAuth', () => {
|
||||
|
||||
beforeEach(() => {
|
||||
config = new Config('test');
|
||||
});
|
||||
|
||||
function createUser() {
|
||||
let user = new Parse.User();
|
||||
user.set("username", "hello");
|
||||
user.set("password", "world");
|
||||
return user.signUp(null);
|
||||
}
|
||||
|
||||
it('required auth test find', (done) => {
|
||||
config.database.loadSchema().then((schema) => {
|
||||
// Just to create a valid class
|
||||
return schema.validateObject('Stuff', {foo: 'bar'});
|
||||
}).then((schema) => {
|
||||
return schema.setPermissions('Stuff', {
|
||||
'find': {
|
||||
'requiresAuthentication': true
|
||||
}
|
||||
});
|
||||
}).then(() => {
|
||||
var query = new Parse.Query('Stuff');
|
||||
return query.find();
|
||||
}).then(() => {
|
||||
fail('Class permissions should have rejected this query.');
|
||||
done();
|
||||
}, (e) => {
|
||||
expect(e.message).toEqual('Permission denied, user needs to be authenticated.');
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('required auth test find authenticated', (done) => {
|
||||
config.database.loadSchema().then((schema) => {
|
||||
// Just to create a valid class
|
||||
return schema.validateObject('Stuff', {foo: 'bar'});
|
||||
}).then((schema) => {
|
||||
return schema.setPermissions('Stuff', {
|
||||
'find': {
|
||||
'requiresAuthentication': true
|
||||
}
|
||||
});
|
||||
}).then(() => {
|
||||
return createUser();
|
||||
}).then(() => {
|
||||
var query = new Parse.Query('Stuff');
|
||||
return query.find();
|
||||
}).then((results) => {
|
||||
expect(results.length).toEqual(0);
|
||||
done();
|
||||
}, (e) => {
|
||||
console.error(e);
|
||||
fail("Should not have failed");
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('required auth should allow create authenticated', (done) => {
|
||||
config.database.loadSchema().then((schema) => {
|
||||
// Just to create a valid class
|
||||
return schema.validateObject('Stuff', {foo: 'bar'});
|
||||
}).then((schema) => {
|
||||
return schema.setPermissions('Stuff', {
|
||||
'create': {
|
||||
'requiresAuthentication': true
|
||||
}
|
||||
});
|
||||
}).then(() => {
|
||||
return createUser();
|
||||
}).then(() => {
|
||||
let stuff = new Parse.Object('Stuff');
|
||||
stuff.set('foo', 'bar');
|
||||
return stuff.save();
|
||||
}).then(() => {
|
||||
done();
|
||||
}, (e) => {
|
||||
console.error(e);
|
||||
fail("Should not have failed");
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('required auth should reject create when not authenticated', (done) => {
|
||||
config.database.loadSchema().then((schema) => {
|
||||
// Just to create a valid class
|
||||
return schema.validateObject('Stuff', {foo: 'bar'});
|
||||
}).then((schema) => {
|
||||
return schema.setPermissions('Stuff', {
|
||||
'create': {
|
||||
'requiresAuthentication': true
|
||||
}
|
||||
});
|
||||
}).then(() => {
|
||||
let stuff = new Parse.Object('Stuff');
|
||||
stuff.set('foo', 'bar');
|
||||
return stuff.save();
|
||||
}).then(() => {
|
||||
fail('Class permissions should have rejected this query.');
|
||||
done();
|
||||
}, (e) => {
|
||||
expect(e.message).toEqual('Permission denied, user needs to be authenticated.');
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('required auth test create/get/update/delete authenticated', (done) => {
|
||||
config.database.loadSchema().then((schema) => {
|
||||
// Just to create a valid class
|
||||
return schema.validateObject('Stuff', {foo: 'bar'});
|
||||
}).then((schema) => {
|
||||
return schema.setPermissions('Stuff', {
|
||||
'create': {
|
||||
'requiresAuthentication': true
|
||||
},
|
||||
'get': {
|
||||
'requiresAuthentication': true
|
||||
},
|
||||
'delete': {
|
||||
'requiresAuthentication': true
|
||||
},
|
||||
'update': {
|
||||
'requiresAuthentication': true
|
||||
}
|
||||
});
|
||||
}).then(() => {
|
||||
return createUser();
|
||||
}).then(() => {
|
||||
let stuff = new Parse.Object('Stuff');
|
||||
stuff.set('foo', 'bar');
|
||||
return stuff.save().then(() => {
|
||||
let query = new Parse.Query('Stuff');
|
||||
return query.get(stuff.id);
|
||||
});
|
||||
}).then((gotStuff) => {
|
||||
return gotStuff.save({'foo': 'baz'}).then(() => {
|
||||
return gotStuff.destroy();
|
||||
})
|
||||
}).then(() => {
|
||||
done();
|
||||
}, (e) => {
|
||||
console.error(e);
|
||||
fail("Should not have failed");
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('required auth test create/get/update/delete not authenitcated', (done) => {
|
||||
config.database.loadSchema().then((schema) => {
|
||||
// Just to create a valid class
|
||||
return schema.validateObject('Stuff', {foo: 'bar'});
|
||||
}).then((schema) => {
|
||||
return schema.setPermissions('Stuff', {
|
||||
'get': {
|
||||
'requiresAuthentication': true
|
||||
},
|
||||
'delete': {
|
||||
'requiresAuthentication': true
|
||||
},
|
||||
'update': {
|
||||
'requiresAuthentication': true
|
||||
},
|
||||
'create': {
|
||||
'*': true
|
||||
}
|
||||
});
|
||||
}).then(() => {
|
||||
let stuff = new Parse.Object('Stuff');
|
||||
stuff.set('foo', 'bar');
|
||||
return stuff.save().then(() => {
|
||||
let query = new Parse.Query('Stuff');
|
||||
return query.get(stuff.id);
|
||||
});
|
||||
}).then(() => {
|
||||
fail("Should not succeed!");
|
||||
done();
|
||||
}, (e) => {
|
||||
expect(e.message).toEqual('Permission denied, user needs to be authenticated.');
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('required auth test create/get/update/delete not authenitcated', (done) => {
|
||||
config.database.loadSchema().then((schema) => {
|
||||
// Just to create a valid class
|
||||
return schema.validateObject('Stuff', {foo: 'bar'});
|
||||
}).then((schema) => {
|
||||
return schema.setPermissions('Stuff', {
|
||||
'find': {
|
||||
'requiresAuthentication': true
|
||||
},
|
||||
'delete': {
|
||||
'requiresAuthentication': true
|
||||
},
|
||||
'update': {
|
||||
'requiresAuthentication': true
|
||||
},
|
||||
'create': {
|
||||
'*': true
|
||||
},
|
||||
'get': {
|
||||
'*': true
|
||||
}
|
||||
});
|
||||
}).then(() => {
|
||||
let stuff = new Parse.Object('Stuff');
|
||||
stuff.set('foo', 'bar');
|
||||
return stuff.save().then(() => {
|
||||
let query = new Parse.Query('Stuff');
|
||||
return query.get(stuff.id);
|
||||
})
|
||||
}).then((result) => {
|
||||
expect(result.get('foo')).toEqual('bar');
|
||||
let query = new Parse.Query('Stuff');
|
||||
return query.find();
|
||||
}).then(() => {
|
||||
fail("Should not succeed!");
|
||||
done();
|
||||
}, (e) => {
|
||||
expect(e.message).toEqual('Permission denied, user needs to be authenticated.');
|
||||
done();
|
||||
});
|
||||
});
|
||||
})
|
||||
|
||||
Reference in New Issue
Block a user