Skip to content

Commit 9a97eec

Browse files
author
Maksym Mykhailenko
committed
feat: permissions for attachments
- refactored code to use unified permission - support standard M2M tokens for attachments - don't return attachments if user doesn't has permissions to read them
1 parent 9161843 commit 9a97eec

16 files changed

+729
-172
lines changed

‎docs/permissions.html

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -939,6 +939,221 @@ <h2 class="anchor-container">
939939
</div>
940940
</div>
941941
</div>
942+
<div class="row">
943+
<div class="col pt-5 pb-2">
944+
<h2 class="anchor-container">
945+
<a href="#section-project-attachment" name="section-project-attachment" class="anchor"></a>Project Attachment
946+
</h2>
947+
</div>
948+
</div>
949+
<div class="row border-top">
950+
<div class="col py-2">
951+
<div class="permission-title anchor-container">
952+
<a href="#CREATE_PROJECT_ATTACHMENT" name="CREATE_PROJECT_ATTACHMENT" class="anchor"></a>Create Project Attachment
953+
</div>
954+
<div class="permission-variable"><small><code>CREATE_PROJECT_ATTACHMENT</code></small></div>
955+
<div class="text-black-50 small-text"></div>
956+
</div>
957+
<div class="col-9 py-2">
958+
<div>
959+
<span class="badge badge-primary" title="Allowed">Any Project Member</span>
960+
</div>
961+
962+
<div>
963+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Admin</span>
964+
<span class="badge badge-success" title="Allowed Topcoder Role">administrator</span>
965+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Manager</span>
966+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Account Manager</span>
967+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Copilot Manager</span>
968+
<span class="badge badge-success" title="Allowed Topcoder Role">Business Development Representative</span>
969+
<span class="badge badge-success" title="Allowed Topcoder Role">Presales</span>
970+
<span class="badge badge-success" title="Allowed Topcoder Role">Account Executive</span>
971+
<span class="badge badge-success" title="Allowed Topcoder Role">Program Manager</span>
972+
<span class="badge badge-success" title="Allowed Topcoder Role">Solution Architect</span>
973+
<span class="badge badge-success" title="Allowed Topcoder Role">Project Manager</span>
974+
</div>
975+
976+
<div>
977+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
978+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:projects</span>
979+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:projects</span>
980+
</div>
981+
</div>
982+
</div>
983+
<div class="row border-top">
984+
<div class="col py-2">
985+
<div class="permission-title anchor-container">
986+
<a href="#READ_PROJECT_ATTACHMENT_OWN_OR_ALLOWED" name="READ_PROJECT_ATTACHMENT_OWN_OR_ALLOWED" class="anchor"></a>Read Project Attachment (own or allowed)
987+
</div>
988+
<div class="permission-variable"><small><code>READ_PROJECT_ATTACHMENT_OWN_OR_ALLOWED</code></small></div>
989+
<div class="text-black-50 small-text">Who can view own attachment or an attachment of another user when they are in the &quot;allowed&quot; list.</div>
990+
</div>
991+
<div class="col-9 py-2">
992+
<div>
993+
<span class="badge badge-primary" title="Allowed">Any Project Member</span>
994+
</div>
995+
996+
<div>
997+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Admin</span>
998+
<span class="badge badge-success" title="Allowed Topcoder Role">administrator</span>
999+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Manager</span>
1000+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Account Manager</span>
1001+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Copilot Manager</span>
1002+
<span class="badge badge-success" title="Allowed Topcoder Role">Business Development Representative</span>
1003+
<span class="badge badge-success" title="Allowed Topcoder Role">Presales</span>
1004+
<span class="badge badge-success" title="Allowed Topcoder Role">Account Executive</span>
1005+
<span class="badge badge-success" title="Allowed Topcoder Role">Program Manager</span>
1006+
<span class="badge badge-success" title="Allowed Topcoder Role">Solution Architect</span>
1007+
<span class="badge badge-success" title="Allowed Topcoder Role">Project Manager</span>
1008+
</div>
1009+
1010+
<div>
1011+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
1012+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:projects</span>
1013+
<span class="badge badge-dark" title="Allowed Topcoder Role">read:projects</span>
1014+
</div>
1015+
</div>
1016+
</div>
1017+
<div class="row border-top">
1018+
<div class="col py-2">
1019+
<div class="permission-title anchor-container">
1020+
<a href="#READ_PROJECT_ATTACHMENT_NOT_OWN_AND_NOT_ALLOWED" name="READ_PROJECT_ATTACHMENT_NOT_OWN_AND_NOT_ALLOWED" class="anchor"></a>Read Project Attachment (not own and not allowed)
1021+
</div>
1022+
<div class="permission-variable"><small><code>READ_PROJECT_ATTACHMENT_NOT_OWN_AND_NOT_ALLOWED</code></small></div>
1023+
<div class="text-black-50 small-text">Who can view attachment of another user when they are not in &quot;allowed&quot; users list.</div>
1024+
</div>
1025+
<div class="col-9 py-2">
1026+
<div>
1027+
</div>
1028+
1029+
<div>
1030+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Admin</span>
1031+
<span class="badge badge-success" title="Allowed Topcoder Role">administrator</span>
1032+
</div>
1033+
1034+
<div>
1035+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
1036+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:projects</span>
1037+
<span class="badge badge-dark" title="Allowed Topcoder Role">read:projects</span>
1038+
</div>
1039+
</div>
1040+
</div>
1041+
<div class="row border-top">
1042+
<div class="col py-2">
1043+
<div class="permission-title anchor-container">
1044+
<a href="#UPDATE_PROJECT_ATTACHMENT_OWN" name="UPDATE_PROJECT_ATTACHMENT_OWN" class="anchor"></a>Update Project Attachment (own)
1045+
</div>
1046+
<div class="permission-variable"><small><code>UPDATE_PROJECT_ATTACHMENT_OWN</code></small></div>
1047+
<div class="text-black-50 small-text">Who can edit attachment they created.</div>
1048+
</div>
1049+
<div class="col-9 py-2">
1050+
<div>
1051+
<span class="badge badge-primary" title="Allowed">Any Project Member</span>
1052+
</div>
1053+
1054+
<div>
1055+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Admin</span>
1056+
<span class="badge badge-success" title="Allowed Topcoder Role">administrator</span>
1057+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Manager</span>
1058+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Account Manager</span>
1059+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Copilot Manager</span>
1060+
<span class="badge badge-success" title="Allowed Topcoder Role">Business Development Representative</span>
1061+
<span class="badge badge-success" title="Allowed Topcoder Role">Presales</span>
1062+
<span class="badge badge-success" title="Allowed Topcoder Role">Account Executive</span>
1063+
<span class="badge badge-success" title="Allowed Topcoder Role">Program Manager</span>
1064+
<span class="badge badge-success" title="Allowed Topcoder Role">Solution Architect</span>
1065+
<span class="badge badge-success" title="Allowed Topcoder Role">Project Manager</span>
1066+
</div>
1067+
1068+
<div>
1069+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
1070+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:projects</span>
1071+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:projects</span>
1072+
</div>
1073+
</div>
1074+
</div>
1075+
<div class="row border-top">
1076+
<div class="col py-2">
1077+
<div class="permission-title anchor-container">
1078+
<a href="#UPDATE_PROJECT_ATTACHMENT_NOT_OWN" name="UPDATE_PROJECT_ATTACHMENT_NOT_OWN" class="anchor"></a>Update Project Attachment (not own)
1079+
</div>
1080+
<div class="permission-variable"><small><code>UPDATE_PROJECT_ATTACHMENT_NOT_OWN</code></small></div>
1081+
<div class="text-black-50 small-text">Who can edit attachment created by another user.</div>
1082+
</div>
1083+
<div class="col-9 py-2">
1084+
<div>
1085+
</div>
1086+
1087+
<div>
1088+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Admin</span>
1089+
<span class="badge badge-success" title="Allowed Topcoder Role">administrator</span>
1090+
</div>
1091+
1092+
<div>
1093+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
1094+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:projects</span>
1095+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:projects</span>
1096+
</div>
1097+
</div>
1098+
</div>
1099+
<div class="row border-top">
1100+
<div class="col py-2">
1101+
<div class="permission-title anchor-container">
1102+
<a href="#DELETE_PROJECT_ATTACHMENT_OWN" name="DELETE_PROJECT_ATTACHMENT_OWN" class="anchor"></a>Delete Project Attachment (own)
1103+
</div>
1104+
<div class="permission-variable"><small><code>DELETE_PROJECT_ATTACHMENT_OWN</code></small></div>
1105+
<div class="text-black-50 small-text">Who can delete attachment they created.</div>
1106+
</div>
1107+
<div class="col-9 py-2">
1108+
<div>
1109+
<span class="badge badge-primary" title="Allowed">Any Project Member</span>
1110+
</div>
1111+
1112+
<div>
1113+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Admin</span>
1114+
<span class="badge badge-success" title="Allowed Topcoder Role">administrator</span>
1115+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Manager</span>
1116+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Account Manager</span>
1117+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Copilot Manager</span>
1118+
<span class="badge badge-success" title="Allowed Topcoder Role">Business Development Representative</span>
1119+
<span class="badge badge-success" title="Allowed Topcoder Role">Presales</span>
1120+
<span class="badge badge-success" title="Allowed Topcoder Role">Account Executive</span>
1121+
<span class="badge badge-success" title="Allowed Topcoder Role">Program Manager</span>
1122+
<span class="badge badge-success" title="Allowed Topcoder Role">Solution Architect</span>
1123+
<span class="badge badge-success" title="Allowed Topcoder Role">Project Manager</span>
1124+
</div>
1125+
1126+
<div>
1127+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
1128+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:projects</span>
1129+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:projects</span>
1130+
</div>
1131+
</div>
1132+
</div>
1133+
<div class="row border-top">
1134+
<div class="col py-2">
1135+
<div class="permission-title anchor-container">
1136+
<a href="#DELETE_PROJECT_ATTACHMENT_NOT_OWN" name="DELETE_PROJECT_ATTACHMENT_NOT_OWN" class="anchor"></a>Delete Project Attachment (not own)
1137+
</div>
1138+
<div class="permission-variable"><small><code>DELETE_PROJECT_ATTACHMENT_NOT_OWN</code></small></div>
1139+
<div class="text-black-50 small-text">Who can delete attachment created by another user.</div>
1140+
</div>
1141+
<div class="col-9 py-2">
1142+
<div>
1143+
</div>
1144+
1145+
<div>
1146+
<span class="badge badge-success" title="Allowed Topcoder Role">Connect Admin</span>
1147+
<span class="badge badge-success" title="Allowed Topcoder Role">administrator</span>
1148+
</div>
1149+
1150+
<div>
1151+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:connect_project</span>
1152+
<span class="badge badge-dark" title="Allowed Topcoder Role">all:projects</span>
1153+
<span class="badge badge-dark" title="Allowed Topcoder Role">write:projects</span>
1154+
</div>
1155+
</div>
1156+
</div>
9421157
<div class="row">
9431158
<div class="col pt-5 pb-2">
9441159
<h2 class="anchor-container">

‎src/permissions/constants.js

Lines changed: 112 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,44 +53,73 @@ import {
5353
M2M_SCOPES,
5454
} from '../constants';
5555

56+
/**
57+
* All Project Roles
58+
*/
5659
const PROJECT_ROLES_ALL = _.values(PROJECT_MEMBER_ROLE);
60+
61+
/**
62+
* "Management Level" Project Roles
63+
*/
5764
const PROJECT_ROLES_MANAGEMENT = _.difference(PROJECT_ROLES_ALL, [
5865
PROJECT_MEMBER_ROLE.COPILOT,
5966
PROJECT_MEMBER_ROLE.CUSTOMER,
6067
PROJECT_MEMBER_ROLE.OBSERVER,
6168
]);
6269

70+
/**
71+
* This is a special constant to indicate that all project members or any logged-in user
72+
* has permission.
73+
*/
6374
const ALL = true;
6475

76+
/**
77+
* M2M scopes to "read" projects
78+
*/
6579
const SCOPES_PROJECTS_READ = [
6680
M2M_SCOPES.CONNECT_PROJECT_ADMIN,
6781
M2M_SCOPES.PROJECTS.ALL,
6882
M2M_SCOPES.PROJECTS.READ,
6983
];
7084

85+
/**
86+
* M2M scopes to "write" projects
87+
*/
7188
const SCOPES_PROJECTS_WRITE = [
7289
M2M_SCOPES.CONNECT_PROJECT_ADMIN,
7390
M2M_SCOPES.PROJECTS.ALL,
7491
M2M_SCOPES.PROJECTS.WRITE,
7592
];
7693

94+
/**
95+
* M2M scopes to "write" billingAccountId property
96+
*/
7797
const SCOPES_PROJECTS_WRITE_BILLING_ACCOUNTS = [
7898
M2M_SCOPES.CONNECT_PROJECT_ADMIN,
7999
M2M_SCOPES.PROJECTS.WRITE_BILLING_ACCOUNTS,
80100
];
81101

102+
/**
103+
* M2M scopes to "read" projects members
104+
*/
82105
const SCOPES_PROJECT_MEMBERS_READ = [
83106
M2M_SCOPES.CONNECT_PROJECT_ADMIN,
84107
M2M_SCOPES.PROJECT_MEMBERS.ALL,
85108
M2M_SCOPES.PROJECT_MEMBERS.READ,
86109
];
87110

111+
/**
112+
* M2M scopes to "write" projects members
113+
*/
88114
const SCOPES_PROJECT_MEMBERS_WRITE = [
89115
M2M_SCOPES.CONNECT_PROJECT_ADMIN,
90116
M2M_SCOPES.PROJECT_MEMBERS.ALL,
91117
M2M_SCOPES.PROJECT_MEMBERS.WRITE,
92118
];
93119

120+
/**
121+
* The full list of possible permission rules in Project Service
122+
*/
94123
export const PERMISSION = { // eslint-disable-line import/prefer-default-export
95124
/*
96125
* Project
@@ -430,7 +459,85 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
430459
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
431460
},
432461

433-
/**
462+
/*
463+
* Project Attachments
464+
*/
465+
CREATE_PROJECT_ATTACHMENT: {
466+
meta: {
467+
title: 'Create Project Attachment',
468+
group: 'Project Attachment',
469+
},
470+
topcoderRoles: TOPCODER_ROLES_MANAGERS_AND_ADMINS,
471+
projectRoles: ALL,
472+
scopes: SCOPES_PROJECTS_WRITE,
473+
},
474+
475+
READ_PROJECT_ATTACHMENT_OWN_OR_ALLOWED: {
476+
meta: {
477+
title: 'Read Project Attachment (own or allowed)',
478+
group: 'Project Attachment',
479+
description: 'Who can view own attachment or an attachment of another user when they are in the "allowed" list.',
480+
},
481+
topcoderRoles: TOPCODER_ROLES_MANAGERS_AND_ADMINS,
482+
projectRoles: ALL,
483+
scopes: SCOPES_PROJECTS_READ,
484+
},
485+
486+
READ_PROJECT_ATTACHMENT_NOT_OWN_AND_NOT_ALLOWED: {
487+
meta: {
488+
title: 'Read Project Attachment (not own and not allowed)',
489+
group: 'Project Attachment',
490+
description: 'Who can view attachment of another user when they are not in "allowed" users list.',
491+
},
492+
topcoderRoles: TOPCODER_ROLES_ADMINS,
493+
scopes: SCOPES_PROJECTS_READ,
494+
},
495+
496+
UPDATE_PROJECT_ATTACHMENT_OWN: {
497+
meta: {
498+
title: 'Update Project Attachment (own)',
499+
group: 'Project Attachment',
500+
description: 'Who can edit attachment they created.',
501+
},
502+
topcoderRoles: TOPCODER_ROLES_MANAGERS_AND_ADMINS,
503+
projectRoles: ALL,
504+
scopes: SCOPES_PROJECTS_WRITE,
505+
},
506+
507+
UPDATE_PROJECT_ATTACHMENT_NOT_OWN: {
508+
meta: {
509+
title: 'Update Project Attachment (not own)',
510+
group: 'Project Attachment',
511+
description: 'Who can edit attachment created by another user.',
512+
},
513+
topcoderRoles: TOPCODER_ROLES_ADMINS,
514+
scopes: SCOPES_PROJECTS_WRITE,
515+
},
516+
517+
DELETE_PROJECT_ATTACHMENT_OWN: {
518+
meta: {
519+
title: 'Delete Project Attachment (own)',
520+
group: 'Project Attachment',
521+
description: 'Who can delete attachment they created.',
522+
},
523+
topcoderRoles: TOPCODER_ROLES_MANAGERS_AND_ADMINS,
524+
projectRoles: ALL,
525+
scopes: SCOPES_PROJECTS_WRITE,
526+
},
527+
528+
DELETE_PROJECT_ATTACHMENT_NOT_OWN: {
529+
meta: {
530+
title: 'Delete Project Attachment (not own)',
531+
group: 'Project Attachment',
532+
description: 'Who can delete attachment created by another user.',
533+
},
534+
topcoderRoles: TOPCODER_ROLES_ADMINS,
535+
scopes: SCOPES_PROJECTS_WRITE,
536+
},
537+
538+
/*
539+
* DEPRECATED - THIS PERMISSION RULE HAS TO BE REMOVED
540+
*
434541
* Permissions defined by logic: **WHO** can do actions with such a permission.
435542
*/
436543
ROLES_COPILOT_AND_ABOVE: {
@@ -448,6 +555,10 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
448555
},
449556
};
450557

558+
/**
559+
* Matrix which define Project Roles and corresponding Topcoder Roles of users
560+
* who may join with such Project Roles.
561+
*/
451562
export const PROJECT_TO_TOPCODER_ROLES_MATRIX = {
452563
[PROJECT_MEMBER_ROLE.CUSTOMER]: _.values(USER_ROLE),
453564
[PROJECT_MEMBER_ROLE.MANAGER]: [

0 commit comments

Comments
 (0)