[$150] 403 Forbidden error returned for some users of CREATE/PUT/PATCH/DELETE calls to jobs, jobCandidates and resourceBookings endpoints

[SathyaJayabal]

user: TCConManager
Roles: “Topcoder User”, “Connect Manager”

403 Forbidden error returned for the following :

endpoints

jobs: CREATE/DELETE
jobCandidates : CREATE/PUT/PATCH
resourceBookings: CREATE/PUT/PATCH

500 Internal server error for the following:

endpoints
jobs: PUT/PATCH

[SathyaJayabal]

TCConmanager is not part of v5/users.

This was fixed in #14, but not working now

cc @maxceem

[maxceem]

@nkumar-topcoder as I understand regular users should not be able to do any operations with jobs, jobCandidates, resourceBookings.
Only Bookingmanager users and M2M should be able to perform all these operations.

[nkumar-topcoder]

@maxceem Regular tc user can create the job and view the job (they create). Same applies for job candidates.
My understanding is that imcaizheng has implemented this.
And, you understanding on Bookingmanager is right

[SathyaJayabal]

@nkumar-topcoder @maxceem , at present, regular users are able to create jobs even on projects they dont have access to.
#35

[maxceem]

We have to fix permissions for Job, JobCandidates and ResourceBookings as per the next table #72 (comment).

Note, that technically Connect Manager users already have access to all the projects. So we don't have to write for them a separate logic, we can use for them the same logic as for Topcoder User when checking if such users can access the project or no.

We already have a method isConnectMember https://github.com/topcoder-platform/taas-apis/blob/dev/src/common/helper.js#L184-L196 which by fact is not checking if the user is a Manager it checks if user has access to the project or no. So this method might be renamed to something likecanAccessProject and used to check permissions for both Connect Manager and Topcoder User.

For the next cases when requested by Topcoder User:

• if filter param is not defined, return 403: Not allowed without filtering by "projectId". (or "jobId")

  

• If filter param is defined, but no access to the project, then return 403 as we do in Teams endpoints

We also have to allow Admins to perform all the actions same like BookingManagers. To do so we can update the logic here https://github.com/topcoder-platform/taas-apis/blob/dev/app-routes.js#L52-L54:

• also allow administrator role
• rename isBookingManager to hasManagePermission (or maybe you know a better name) to show that it can be not only manager but also admin - just someone who has all the permissions

[maxceem]

Contest https://www.topcoder.com/challenges/30159302 has been created for this ticket.

This is an automated message for maxceem via Topcoder X

[maxceem]

@imcaizheng this is open for pick up now. This has a higher priority for us in comparison with enhancement issues.

[maxceem]

Contest https://www.topcoder.com/challenges/30159302 has been updated - it has been assigned to aaron2017.

This is an automated message for maxceem via Topcoder X

[imcaizheng]

PR created #77