Skip to content

Commit f95ca33

Browse files
imcaizhengimcaizheng
committed
fix: permission rules for connect manager
1 parent 28e0b38 commit f95ca33

File tree

4 files changed

+33
-101
lines changed

4 files changed

+33
-101
lines changed

‎docs/Topcoder-bookings-api.postman_collection.json

Lines changed: 25 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -8237,7 +8237,7 @@
82378237
"id": "f25317af-4933-4c93-b02b-cae7feddac50",
82388238
"exec": [
82398239
"var data = JSON.parse(responseBody);\r",
8240-
"postman.setEnvironmentVariable(\"job_candidate_id_created_for_member\",data.id);"
8240+
"postman.setEnvironmentVariable(\"job_candidate_id_created_by_member\",data.id);"
82418241
],
82428242
"type": "text/javascript"
82438243
}
@@ -8523,7 +8523,7 @@
85238523
"id": "9754578e-91dd-437d-b5a2-cdb5668e14e4",
85248524
"exec": [
85258525
"var data = JSON.parse(responseBody);\r",
8526-
"postman.setEnvironmentVariable(\"resource_booking_id_created_for_member\",data.id);"
8526+
"postman.setEnvironmentVariable(\"resource_booking_id_created_by_member\",data.id);"
85278527
],
85288528
"type": "text/javascript"
85298529
}
@@ -8789,67 +8789,15 @@
87898789
"name": "Jobs",
87908790
"item": [
87918791
{
8792-
"name": "Before Test",
8793-
"item": [
8794-
{
8795-
"name": "create job",
8796-
"event": [
8797-
{
8798-
"listen": "test",
8799-
"script": {
8800-
"id": "faaf5dc1-9869-4615-992c-3cace41f65e8",
8801-
"exec": [
8802-
"var data = JSON.parse(responseBody);\r",
8803-
"postman.setEnvironmentVariable(\"job_id_created_for_connect_manager\",data.id);"
8804-
],
8805-
"type": "text/javascript"
8806-
}
8807-
}
8808-
],
8809-
"request": {
8810-
"method": "POST",
8811-
"header": [
8812-
{
8813-
"key": "Authorization",
8814-
"value": "Bearer {{token_administrator}}",
8815-
"type": "text"
8816-
}
8817-
],
8818-
"body": {
8819-
"mode": "raw",
8820-
"raw": "{\r\n \"projectId\": {{project_id_16718}},\r\n \"externalId\": \"1212\",\r\n \"description\": \"Dummy Description\",\r\n \"startDate\": \"2020-09-27T04:17:23.131Z\",\r\n \"endDate\": \"2020-09-27T04:17:23.131Z\",\r\n \"numPositions\": 13,\r\n \"resourceType\": \"Dummy Resource Type\",\r\n \"rateType\": \"hourly\",\r\n \"workload\": \"full-time\",\r\n \"skills\": [\r\n \"23e00d92-207a-4b5b-b3c9-4c5662644941\",\r\n \"7d076384-ccf6-4e43-a45d-1b24b1e624aa\",\r\n \"cbac57a3-7180-4316-8769-73af64893158\",\r\n \"a2b4bc11-c641-4a19-9eb7-33980378f82e\"\r\n ]\r\n}\r\n",
8821-
"options": {
8822-
"raw": {
8823-
"language": "json"
8824-
}
8825-
}
8826-
},
8827-
"url": {
8828-
"raw": "{{URL}}/jobs",
8829-
"host": [
8830-
"{{URL}}"
8831-
],
8832-
"path": [
8833-
"jobs"
8834-
]
8835-
}
8836-
},
8837-
"response": []
8838-
}
8839-
],
8840-
"protocolProfileBehavior": {},
8841-
"_postman_isSubFolder": true
8842-
},
8843-
{
8844-
"name": "✘ create job with connect manager",
8792+
"name": "✔ create job with connect manager",
88458793
"event": [
88468794
{
88478795
"listen": "test",
88488796
"script": {
8849-
"id": "ab2fa9b2-71fc-4cda-b72d-60cf2d99525d",
8797+
"id": "0a6a3140-f1fb-434f-8dbf-37ed64b7573d",
88508798
"exec": [
88518799
"var data = JSON.parse(responseBody);\r",
8852-
"postman.setEnvironmentVariable(\"job_id_created_for_connect_manager\",data.id);"
8800+
"postman.setEnvironmentVariable(\"job_id_created_by_connect_manager\",data.id);"
88538801
],
88548802
"type": "text/javascript"
88558803
}
@@ -8897,13 +8845,13 @@
88978845
}
88988846
],
88998847
"url": {
8900-
"raw": "{{URL}}/jobs/{{job_id_created_for_connect_manager}}",
8848+
"raw": "{{URL}}/jobs/{{job_id_created_by_connect_manager}}",
89018849
"host": [
89028850
"{{URL}}"
89038851
],
89048852
"path": [
89058853
"jobs",
8906-
"{{job_id_created_for_connect_manager}}"
8854+
"{{job_id_created_by_connect_manager}}"
89078855
]
89088856
}
89098857
},
@@ -9005,7 +8953,7 @@
90058953
"response": []
90068954
},
90078955
{
9008-
"name": "✘ put job with connect manager",
8956+
"name": "✔ put job with connect manager",
90098957
"request": {
90108958
"method": "PUT",
90118959
"header": [
@@ -9025,20 +8973,20 @@
90258973
}
90268974
},
90278975
"url": {
9028-
"raw": "{{URL}}/jobs/{{job_id_created_for_connect_manager}}",
8976+
"raw": "{{URL}}/jobs/{{job_id_created_by_connect_manager}}",
90298977
"host": [
90308978
"{{URL}}"
90318979
],
90328980
"path": [
90338981
"jobs",
9034-
"{{job_id_created_for_connect_manager}}"
8982+
"{{job_id_created_by_connect_manager}}"
90358983
]
90368984
}
90378985
},
90388986
"response": []
90398987
},
90408988
{
9041-
"name": "✘ patch job with connect manager",
8989+
"name": "✔ patch job with connect manager",
90428990
"request": {
90438991
"method": "PATCH",
90448992
"header": [
@@ -9058,13 +9006,13 @@
90589006
}
90599007
},
90609008
"url": {
9061-
"raw": "{{URL}}/jobs/{{job_id_created_for_connect_manager}}",
9009+
"raw": "{{URL}}/jobs/{{job_id_created_by_connect_manager}}",
90629010
"host": [
90639011
"{{URL}}"
90649012
],
90659013
"path": [
90669014
"jobs",
9067-
"{{job_id_created_for_connect_manager}}"
9015+
"{{job_id_created_by_connect_manager}}"
90689016
]
90699017
}
90709018
},
@@ -9091,13 +9039,13 @@
90919039
}
90929040
},
90939041
"url": {
9094-
"raw": "{{URL}}/jobs/{{job_id_created_for_connect_manager}}",
9042+
"raw": "{{URL}}/jobs/{{job_id_created_by_connect_manager}}",
90959043
"host": [
90969044
"{{URL}}"
90979045
],
90989046
"path": [
90999047
"jobs",
9100-
"{{job_id_created_for_connect_manager}}"
9048+
"{{job_id_created_by_connect_manager}}"
91019049
]
91029050
}
91039051
},
@@ -9119,7 +9067,7 @@
91199067
{
91209068
"listen": "test",
91219069
"script": {
9122-
"id": "5ce6dd7a-39aa-4910-aba1-37f02559d293",
9070+
"id": "8bb2aa84-0052-42f1-b4c6-2cac7a87e54b",
91239071
"exec": [
91249072
"var data = JSON.parse(responseBody);\r",
91259073
"postman.setEnvironmentVariable(\"job_candidate_id_created_for_connect_manager\",data.id);"
@@ -9139,7 +9087,7 @@
91399087
],
91409088
"body": {
91419089
"mode": "raw",
9142-
"raw": "{\r\n \"jobId\": \"{{job_id_created_by_member}}\",\r\n \"userId\": \"fe38eed1-af73-41fd-85a2-ac4da1ff09a3\"\r\n}",
9090+
"raw": "{\r\n \"jobId\": \"{{job_id_created_by_connect_manager}}\",\r\n \"userId\": \"fe38eed1-af73-41fd-85a2-ac4da1ff09a3\"\r\n}",
91439091
"options": {
91449092
"raw": {
91459093
"language": "json"
@@ -9168,10 +9116,10 @@
91689116
{
91699117
"listen": "test",
91709118
"script": {
9171-
"id": "74e63fe5-8d71-4791-a722-5d7347e28f83",
9119+
"id": "62dadb99-c6cb-418f-9a17-347d3d92edb0",
91729120
"exec": [
91739121
"var data = JSON.parse(responseBody);\r",
9174-
"postman.setEnvironmentVariable(\"job_candidate_id_created_for_connect_manager\",data.id);"
9122+
"postman.setEnvironmentVariable(\"job_candidate_id_created_by_connect_manager\",data.id);"
91759123
],
91769124
"type": "text/javascript"
91779125
}
@@ -9292,7 +9240,7 @@
92929240
"response": []
92939241
},
92949242
{
9295-
"name": "✘ put job candidate with connect manager",
9243+
"name": "✔ put job candidate with connect manager",
92969244
"request": {
92979245
"method": "PUT",
92989246
"header": [
@@ -9325,7 +9273,7 @@
93259273
"response": []
93269274
},
93279275
{
9328-
"name": "✘ patch job candidate with connect manager",
9276+
"name": "✔ patch job candidate with connect manager",
93299277
"request": {
93309278
"method": "PATCH",
93319279
"header": [
@@ -9406,7 +9354,7 @@
94069354
{
94079355
"listen": "test",
94089356
"script": {
9409-
"id": "513617f1-b4ba-4041-9aaf-fd99f883939b",
9357+
"id": "65b3ece2-3411-4ff7-9432-3ba49e9143bd",
94109358
"exec": [
94119359
"var data = JSON.parse(responseBody);\r",
94129360
"postman.setEnvironmentVariable(\"resource_booking_id_created_for_connect_manager\",data.id);"
@@ -9426,7 +9374,7 @@
94269374
],
94279375
"body": {
94289376
"mode": "raw",
9429-
"raw": "{\r\n \"projectId\": {{project_id_16718}},\r\n \"userId\": \"fe38eed1-af73-41fd-85a2-ac4da1ff09a3\",\r\n \"jobId\": \"{{job_id_created_by_member}}\",\r\n \"startDate\": \"2020-09-27T04:17:23.131Z\",\r\n \"endDate\": \"2020-09-27T04:17:23.131Z\",\r\n \"memberRate\": 13.23,\r\n \"customerRate\": 13,\r\n \"rateType\": \"hourly\"\r\n}",
9377+
"raw": "{\r\n \"projectId\": {{project_id_16718}},\r\n \"userId\": \"fe38eed1-af73-41fd-85a2-ac4da1ff09a3\",\r\n \"jobId\": \"{{job_id_created_by_connect_manager}}\",\r\n \"startDate\": \"2020-09-27T04:17:23.131Z\",\r\n \"endDate\": \"2020-09-27T04:17:23.131Z\",\r\n \"memberRate\": 13.23,\r\n \"customerRate\": 13,\r\n \"rateType\": \"hourly\"\r\n}",
94309378
"options": {
94319379
"raw": {
94329380
"language": "json"
@@ -9455,10 +9403,10 @@
94559403
{
94569404
"listen": "test",
94579405
"script": {
9458-
"id": "be4bde84-1e50-4bb4-a99c-4d03ce055023",
9406+
"id": "bc33d0bb-8e0b-46e5-ac74-f1016881c156",
94599407
"exec": [
94609408
"var data = JSON.parse(responseBody);\r",
9461-
"postman.setEnvironmentVariable(\"resource_booking_id_created_for_connect_manager\",data.id);"
9409+
"postman.setEnvironmentVariable(\"resource_booking_id_created_by_connect_manager\",data.id);"
94629410
],
94639411
"type": "text/javascript"
94649412
}

‎src/services/JobCandidateService.js

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ const esClient = helper.getESClient()
2525
* @returns {undefined}
2626
*/
2727
async function _checkUserAccessAssociatedJob (currentUser, jobId) {
28-
if (!currentUser.hasManagePermission && !currentUser.isMachine && !currentUser.isConnectManager) {
28+
if (!currentUser.hasManagePermission && !currentUser.isMachine) {
2929
await JobService.getJob(currentUser, jobId)
3030
}
3131
}
@@ -118,17 +118,9 @@ async function updateJobCandidate (currentUser, id, data) {
118118
const jobCandidate = await JobCandidate.findById(id)
119119

120120
const userId = await helper.getUserId(currentUser.userId)
121-
if (!currentUser.hasManagePermission && !currentUser.isMachine) {
122-
if (currentUser.isConnectManager) {
123-
throw new errors.ForbiddenError('You are not allowed to perform this action!')
124-
}
125-
// check whether user can access the job associated with the jobCandidate
126-
await JobService.getJob(currentUser, jobCandidate.dataValues.jobId)
127-
// check whether user are allowed to update the candidate
128-
if (jobCandidate.dataValues.userId !== userId) {
129-
throw new errors.ForbiddenError('You are not allowed to perform this action!')
130-
}
131-
}
121+
// check whether user can access the job associated with the jobCandidate
122+
await _checkUserAccessAssociatedJob(currentUser, jobCandidate.dataValues.jobId)
123+
132124
data.updatedAt = new Date()
133125
data.updatedBy = userId
134126

‎src/services/JobService.js

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ async function _validateSkills (skills) {
8282
* @returns {undefined}
8383
*/
8484
async function _checkUserAccessAssociatedProject (currentUser, projectId) {
85-
if (!currentUser.hasManagePermission && !currentUser.isMachine && !currentUser.isConnectManager) {
85+
if (!currentUser.hasManagePermission && !currentUser.isMachine) {
8686
await helper.getProjectById(currentUser, projectId)
8787
}
8888
}
@@ -145,13 +145,8 @@ getJob.schema = Joi.object().keys({
145145
* @returns {Object} the created job
146146
*/
147147
async function createJob (currentUser, job) {
148-
// check if user can access the project
149-
if (!currentUser.hasManagePermission && !currentUser.isMachine) {
150-
if (currentUser.isConnectManager) {
151-
throw new errors.ForbiddenError('You are not allowed to perform this action!')
152-
}
153-
await helper.getProjectById(currentUser, job.projectId)
154-
}
148+
// check whether user can access the project associated with the job
149+
await _checkUserAccessAssociatedProject(currentUser, job.projectId)
155150

156151
await _validateSkills(job.skills)
157152
job.id = uuid()
@@ -194,9 +189,6 @@ async function updateJob (currentUser, id, data) {
194189
let job = await Job.findById(id)
195190
const ubhanUserId = await helper.getUserId(currentUser.userId)
196191
if (!currentUser.hasManagePermission && !currentUser.isMachine) {
197-
if (currentUser.isConnectManager) {
198-
throw new errors.ForbiddenError('You are not allowed to perform this action!')
199-
}
200192
// Check whether user can update the job.
201193
// Note that there is no need to check if user is member of the project associated with the job here
202194
// because user who created the job must be the member of the project associated with the job

‎src/services/ResourceBookingService.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ async function _getResourceBookingFilteringFields (currentUser, resourceBooking)
3838
* @returns {undefined}
3939
*/
4040
async function _checkUserAccessAssociatedProject (currentUser, projectId) {
41-
if (!currentUser.hasManagePermission && !currentUser.isMachine && !currentUser.isConnectManager) {
41+
if (!currentUser.hasManagePermission && !currentUser.isMachine) {
4242
await helper.getProjectById(currentUser, projectId)
4343
}
4444
}

0 commit comments

Comments
 (0)