Connect Admin
administrator
+ Connect Copilot Manager
diff --git a/src/permissions/constants.js b/src/permissions/constants.js
index c69cf36f..874ea45a 100644
--- a/src/permissions/constants.js
+++ b/src/permissions/constants.js
@@ -306,19 +306,6 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
},
- UPDATE_PROJECT_MEMBER_TO_COPILOT: {
- meta: {
- title: 'Update Project Member (to copilot)',
- group: 'Project Member',
- description: 'Who can update project member role to "copilot".',
- },
- topcoderRoles: [
- ...TOPCODER_ROLES_ADMINS,
- USER_ROLE.COPILOT_MANAGER,
- ],
- scopes: SCOPES_PROJECT_MEMBERS_WRITE,
- },
-
DELETE_PROJECT_MEMBER_CUSTOMER: {
meta: {
title: 'Delete Project Member (customer)',
@@ -330,17 +317,31 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
},
- DELETE_PROJECT_MEMBER_NON_CUSTOMER: {
+ DELETE_PROJECT_MEMBER_TOPCODER: {
meta: {
- title: 'Delete Project Member (non-customer)',
+ title: 'Delete Project Member (topcoder)',
group: 'Project Member',
- description: 'Who can delete project members with non "customer" role.',
+ description: 'Who can delete project members with some topcoder role like "manager" etc.',
},
topcoderRoles: TOPCODER_ROLES_ADMINS,
projectRoles: PROJECT_ROLES_MANAGEMENT,
scopes: SCOPES_PROJECT_MEMBERS_WRITE,
},
+ DELETE_PROJECT_MEMBER_COPILOT: {
+ meta: {
+ title: 'Delete Project Member (copilot)',
+ group: 'Project Member',
+ description: 'Who can delete project members with "copilot" role.',
+ },
+ topcoderRoles: [
+ ...TOPCODER_ROLES_ADMINS,
+ USER_ROLE.COPILOT_MANAGER,
+ ],
+ projectRoles: ALL,
+ scopes: SCOPES_PROJECT_MEMBERS_WRITE,
+ },
+
/*
* Project Invite
*/
@@ -371,23 +372,23 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
group: 'Project Invite',
description: 'Who can invite project members with "customer" role.',
},
- topcoderRoles: TOPCODER_ROLES_MANAGERS_AND_ADMINS,
+ topcoderRoles: TOPCODER_ROLES_ADMINS,
projectRoles: ALL,
scopes: SCOPES_PROJECT_INVITES_WRITE,
},
- CREATE_PROJECT_INVITE_NON_CUSTOMER: {
+ CREATE_PROJECT_INVITE_TOPCODER: {
meta: {
- title: 'Create Project Invite (non-customer)',
+ title: 'Create Project Invite (topcoder)',
group: 'Project Invite',
- description: 'Who can invite project members with non "customer" role.',
+ description: 'Who can invite project members with topcoder role like "manager" etc.',
},
topcoderRoles: TOPCODER_ROLES_ADMINS,
projectRoles: PROJECT_ROLES_MANAGEMENT,
scopes: SCOPES_PROJECT_INVITES_WRITE,
},
- CREATE_PROJECT_INVITE_COPILOT_DIRECTLY: {
+ CREATE_PROJECT_INVITE_COPILOT: {
meta: {
title: 'Create Project Invite (copilot)',
group: 'Project Invite',
@@ -454,17 +455,31 @@ export const PERMISSION = { // eslint-disable-line import/prefer-default-export
scopes: SCOPES_PROJECT_INVITES_WRITE,
},
- DELETE_PROJECT_INVITE_NOT_OWN_NON_CUSTOMER: {
+ DELETE_PROJECT_INVITE_NOT_OWN_TOPCODER: {
meta: {
- title: 'Delete Project Invite (not own, non-customer)',
+ title: 'Delete Project Invite (not own, topcoder)',
group: 'Project Invite',
- description: 'Who can delete project invites for other members with non "customer" role.',
+ description: 'Who can delete project invites for other members with some topcoder role like "manager" etc.',
},
topcoderRoles: TOPCODER_ROLES_ADMINS,
projectRoles: PROJECT_ROLES_MANAGEMENT,
scopes: SCOPES_PROJECT_INVITES_WRITE,
},
+ DELETE_PROJECT_INVITE_NOT_OWN_COPILOT: {
+ meta: {
+ title: 'Delete Project Invite (not own, copilot)',
+ group: 'Project Invite',
+ description: 'Who can delete invites for other members with "copilot" role.',
+ },
+ topcoderRoles: [
+ ...TOPCODER_ROLES_ADMINS,
+ USER_ROLE.COPILOT_MANAGER,
+ ],
+ projectRoles: PROJECT_ROLES_MANAGEMENT,
+ scopes: SCOPES_PROJECT_INVITES_WRITE,
+ },
+
DELETE_PROJECT_INVITE_REQUESTED: {
meta: {
title: 'Delete Project Invite (requested)',
diff --git a/src/permissions/index.js b/src/permissions/index.js
index 9344c0b1..a37fdb04 100644
--- a/src/permissions/index.js
+++ b/src/permissions/index.js
@@ -31,12 +31,14 @@ module.exports = () => {
]));
Authorizer.setPolicy('projectMember.delete', generalPermission([
PERMISSION.DELETE_PROJECT_MEMBER_CUSTOMER,
- PERMISSION.DELETE_PROJECT_MEMBER_NON_CUSTOMER,
+ PERMISSION.DELETE_PROJECT_MEMBER_TOPCODER,
+ PERMISSION.DELETE_PROJECT_MEMBER_COPILOT,
]));
Authorizer.setPolicy('projectMemberInvite.create', generalPermission([
PERMISSION.CREATE_PROJECT_INVITE_CUSTOMER,
- PERMISSION.CREATE_PROJECT_INVITE_NON_CUSTOMER,
+ PERMISSION.CREATE_PROJECT_INVITE_TOPCODER,
+ PERMISSION.CREATE_PROJECT_INVITE_COPILOT,
]));
Authorizer.setPolicy('projectMemberInvite.view', generalPermission([
PERMISSION.READ_PROJECT_INVITE_OWN,
@@ -49,7 +51,8 @@ module.exports = () => {
Authorizer.setPolicy('projectMemberInvite.delete', generalPermission([
PERMISSION.DELETE_PROJECT_INVITE_OWN,
PERMISSION.DELETE_PROJECT_INVITE_NOT_OWN_CUSTOMER,
- PERMISSION.DELETE_PROJECT_INVITE_NOT_OWN_NON_CUSTOMER,
+ PERMISSION.DELETE_PROJECT_INVITE_NOT_OWN_COPILOT,
+ PERMISSION.DELETE_PROJECT_INVITE_NOT_OWN_TOPCODER,
]));
Authorizer.setPolicy('projectAttachment.create', generalPermission(PERMISSION.CREATE_PROJECT_ATTACHMENT));
diff --git a/src/routes/projectMemberInvites/create.js b/src/routes/projectMemberInvites/create.js
index 97e0cd25..1f113739 100644
--- a/src/routes/projectMemberInvites/create.js
+++ b/src/routes/projectMemberInvites/create.js
@@ -274,8 +274,14 @@ module.exports = [
}
if (
- invite.role !== PROJECT_MEMBER_ROLE.CUSTOMER &&
- !util.hasPermissionByReq(PERMISSION.CREATE_PROJECT_INVITE_NON_CUSTOMER, req)
+ ( // if cannot invite non-customer user
+ invite.role !== PROJECT_MEMBER_ROLE.CUSTOMER &&
+ !util.hasPermissionByReq(PERMISSION.CREATE_PROJECT_INVITE_TOPCODER, req)
+ ) && !(
+ // and if cannot invite copilot directly
+ invite.role === PROJECT_MEMBER_ROLE.COPILOT &&
+ util.hasPermissionByReq(PERMISSION.CREATE_PROJECT_INVITE_COPILOT, req)
+ )
) {
const err = new Error(`You are not allowed to invite user as ${invite.role}.`);
err.status = 403;
@@ -373,7 +379,7 @@ module.exports = [
role: invite.role,
// invite copilots directly if user has permissions
status: (invite.role !== PROJECT_MEMBER_ROLE.COPILOT ||
- util.hasPermissionByReq(PERMISSION.CREATE_PROJECT_INVITE_COPILOT_DIRECTLY, req))
+ util.hasPermissionByReq(PERMISSION.CREATE_PROJECT_INVITE_COPILOT, req))
? INVITE_STATUS.PENDING
: INVITE_STATUS.REQUESTED,
createdBy: req.authUser.userId,
diff --git a/src/routes/projectMemberInvites/create.spec.js b/src/routes/projectMemberInvites/create.spec.js
index 2ed2f15c..49376e0c 100644
--- a/src/routes/projectMemberInvites/create.spec.js
+++ b/src/routes/projectMemberInvites/create.spec.js
@@ -736,7 +736,7 @@ describe('Project Member Invite create', () => {
});
});
- it('should return 201 if try to create customer with COPILOT', (done) => {
+ it('should return 201 if try to create copilot invite with COPILOT role', (done) => {
util.getUserRoles.restore();
sandbox.stub(util, 'getUserRoles', () => Promise.resolve(['Connect Copilot']));
request(server)
@@ -764,6 +764,34 @@ describe('Project Member Invite create', () => {
});
});
+ it('should return 201 if try to create copilot invite by "Connect Copilot Manager"', (done) => {
+ util.getUserRoles.restore();
+ sandbox.stub(util, 'getUserRoles', () => Promise.resolve([USER_ROLE.COPILOT]));
+ request(server)
+ .post(`/v5/projects/${project2.id}/invites`)
+ .set({
+ Authorization: `Bearer ${testUtil.jwts.copilotManager}`,
+ })
+ .send({
+ handles: ['test_customer1'],
+ role: 'copilot',
+ })
+ .expect('Content-Type', /json/)
+ .expect(201)
+ .end((err, res) => {
+ if (err) {
+ done(err);
+ } else {
+ const resJson = res.body.success[0];
+ should.exist(resJson);
+ resJson.role.should.equal('copilot');
+ resJson.projectId.should.equal(project2.id);
+ resJson.userId.should.equal(40051331);
+ done();
+ }
+ });
+ });
+
it('should return 403 and failed list when trying add already invited member by lowercase email', (done) => {
request(server)
.post(`/v5/projects/${project1.id}/invites`)
diff --git a/src/routes/projectMemberInvites/delete.js b/src/routes/projectMemberInvites/delete.js
index 2ec3536f..d8c8be91 100644
--- a/src/routes/projectMemberInvites/delete.js
+++ b/src/routes/projectMemberInvites/delete.js
@@ -44,8 +44,9 @@ module.exports = [
error = 'You don\'t have permissions to cancel requested invites.';
} else if (
invite.role !== PROJECT_MEMBER_ROLE.CUSTOMER
+ && invite.role !== PROJECT_MEMBER_ROLE.COPILOT
&& !ownInvite
- && !util.hasPermissionByReq(PERMISSION.DELETE_PROJECT_INVITE_NOT_OWN_NON_CUSTOMER, req)
+ && !util.hasPermissionByReq(PERMISSION.DELETE_PROJECT_INVITE_NOT_OWN_TOPCODER, req)
) {
error = 'You don\'t have permissions to cancel invites to Topcoder Team for other users.';
} else if (
@@ -54,6 +55,12 @@ module.exports = [
&& !util.hasPermissionByReq(PERMISSION.DELETE_PROJECT_INVITE_NOT_OWN_CUSTOMER, req)
) {
error = 'You don\'t have permissions to cancel invites to Customer Team for other users.';
+ } else if (
+ invite.role === PROJECT_MEMBER_ROLE.COPILOT
+ && !ownInvite
+ && !util.hasPermissionByReq(PERMISSION.DELETE_PROJECT_INVITE_NOT_OWN_COPILOT, req)
+ ) {
+ error = 'You don\'t have permissions to cancel invites to Copilot Team for other users.';
}
if (error) {
diff --git a/src/routes/projectMemberInvites/delete.spec.js b/src/routes/projectMemberInvites/delete.spec.js
index fbb601ec..d6bddd46 100644
--- a/src/routes/projectMemberInvites/delete.spec.js
+++ b/src/routes/projectMemberInvites/delete.spec.js
@@ -157,7 +157,20 @@ describe('Project member invite delete', () => {
updatedAt: '2016-06-30 00:33:07+00',
});
- return Promise.all([pm, invite4, invite5, invite6]);
+ const invite7 = models.ProjectMemberInvite.create({
+ id: 7,
+ projectId: project2.id,
+ userId: testUtil.userIds.copilot,
+ email: null,
+ role: PROJECT_MEMBER_ROLE.COPILOT,
+ status: INVITE_STATUS.ACCEPTED,
+ createdBy: 1,
+ updatedBy: 1,
+ createdAt: '2016-06-30 00:33:07+00',
+ updatedAt: '2016-06-30 00:33:07+00',
+ });
+
+ return Promise.all([pm, invite4, invite5, invite6, invite7]);
});
Promise.all([p1, p2]).then(() => done());
@@ -335,6 +348,16 @@ describe('Project member invite delete', () => {
.end(() => done());
});
+ it('should return 204 if "Connect Copilot Manager" cancels invitation for copilot', (done) => {
+ request(server)
+ .delete(`/v5/projects/${project1.id}/invites/7`)
+ .set({
+ Authorization: `Bearer ${testUtil.jwts.copilotManager}`,
+ })
+ .expect(204)
+ .end(() => done());
+ });
+
it('should return 204 if user cancels invitation', (done) => {
request(server)
.delete(`/v5/projects/${project1.id}/invites/5`)
diff --git a/src/routes/projectMembers/delete.js b/src/routes/projectMembers/delete.js
index 8c8e4d55..c654ecf6 100644
--- a/src/routes/projectMembers/delete.js
+++ b/src/routes/projectMembers/delete.js
@@ -31,12 +31,31 @@ module.exports = [
return Promise.reject(err);
}
+ const isOwnMember = member.userId === req.authUser.userId;
+
if (
- member.userId !== req.authUser.userId &&
- member.role !== PROJECT_MEMBER_ROLE.CUSTOMER &&
- !util.hasPermissionByReq(PERMISSION.DELETE_PROJECT_MEMBER_NON_CUSTOMER, req)
+ !isOwnMember &&
+ member.role !== PROJECT_MEMBER_ROLE.CUSTOMER &&
+ member.role !== PROJECT_MEMBER_ROLE.COPILOT &&
+ !util.hasPermissionByReq(PERMISSION.DELETE_PROJECT_MEMBER_TOPCODER, req)
+ ) {
+ const err = new Error('You don\'t have permissions to delete other members from Topcoder Team.');
+ err.status = 403;
+ return Promise.reject(err);
+ } else if (
+ !isOwnMember &&
+ member.role === PROJECT_MEMBER_ROLE.CUSTOMER &&
+ !util.hasPermissionByReq(PERMISSION.DELETE_PROJECT_MEMBER_CUSTOMER, req)
+ ) {
+ const err = new Error('You don\'t have permissions to delete other members with "customer" role.');
+ err.status = 403;
+ return Promise.reject(err);
+ } else if (
+ !isOwnMember &&
+ member.role === PROJECT_MEMBER_ROLE.COPILOT &&
+ !util.hasPermissionByReq(PERMISSION.DELETE_PROJECT_MEMBER_COPILOT, req)
) {
- const err = new Error('You don\'t have permissions to delete other members with non-customer role.');
+ const err = new Error('You don\'t have permissions to delete other members with "copilot" role.');
err.status = 403;
return Promise.reject(err);
}
diff --git a/src/tests/util.js b/src/tests/util.js
index e9a64bbb..a98e7b5c 100644
--- a/src/tests/util.js
+++ b/src/tests/util.js
@@ -28,6 +28,8 @@ export default {
admin: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIiwiYWRtaW5pc3RyYXRvciJdLCJpc3MiOiJodHRwczovL2FwaS50b3Bjb2Rlci1kZXYuY29tIiwiaGFuZGxlIjoidGVzdDEiLCJleHAiOjI1NjMwNzY2ODksInVzZXJJZCI6IjQwMDUxMzMzIiwiaWF0IjoxNDYzMDc2MDg5LCJlbWFpbCI6InRlc3RAdG9wY29kZXIuY29tIiwianRpIjoiYjMzYjc3Y2QtYjUyZS00MGZlLTgzN2UtYmViOGUwYWU2YTRhIn0.wKWUe0-SaiFVN-VR_-GwgFlvWaDkSbc8H55ktb9LAVw',
// userId = 40051334, roles: [ 'Manager', 'Topcoder User' ],handle: 'test1',email: 'test@topcoder.com'
manager: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIiwiQ29ubmVjdCBNYW5hZ2VyIl0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJ0ZXN0MSIsImV4cCI6MjU2MzA3NjY4OSwidXNlcklkIjoiNDAwNTEzMzQiLCJpYXQiOjE0NjMwNzYwODksImVtYWlsIjoidGVzdEB0b3Bjb2Rlci5jb20iLCJqdGkiOiJiMzNiNzdjZC1iNTJlLTQwZmUtODM3ZS1iZWI4ZTBhZTZhNGEifQ.J5VtOEQVph5jfe2Ji-NH7txEDcx_5gthhFeD-MzX9ck',
+ // userId = 40051337, roles: [ 'Connect Copilot Manager', 'Connect Manager', 'Topcoder User' ], handle: 'connect_copilot_manger', email: 'connect_copilot_manger@topcoder.com'
+ copilotManager: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIiwiQ29ubmVjdCBNYW5hZ2VyIiwiQ29ubmVjdCBDb3BpbG90IE1hbmFnZXIiXSwiaXNzIjoiaHR0cHM6Ly9hcGkudG9wY29kZXItZGV2LmNvbSIsImhhbmRsZSI6ImNvbm5lY3RfY29waWxvdF9tYW5nZXIiLCJleHAiOjI1NjMwNzY2ODksInVzZXJJZCI6IjQwMDUxMzM3IiwiaWF0IjoxNDYzMDc2MDg5LCJlbWFpbCI6ImNvbm5lY3RfY29waWxvdF9tYW5nZXJAdG9wY29kZXIuY29tIiwianRpIjoiYjMzYjc3Y2QtYjUyZS00MGZlLTgzN2UtYmViOGUwYWU2YTRhIn0.j9nTufEslU5CLXqkwHixC-nNdysJSCYQC9MhacOca64',
// userId = 40051335, [ 'Topcoder User' ],handle: 'member2',email: 'test@topcoder.com'
member2: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIl0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJtZW1iZXIyIiwiZXhwIjoyNTYzMDc2Njg5LCJ1c2VySWQiOiI0MDA1MTMzNSIsImlhdCI6MTQ2MzA3NjA4OSwiZW1haWwiOiJ0ZXN0QHRvcGNvZGVyLmNvbSIsImp0aSI6ImIzM2I3N2NkLWI1MmUtNDBmZS04MzdlLWJlYjhlMGFlNmE0YSJ9.Mh4bw3wm-cn5Kcf96gLFVlD0kySOqqk4xN3qnreAKL4',
// userId = 40051336, [ 'Connect Admin' ], handle: 'connect_admin1', email: 'connect_admin1@topcoder.com'
@@ -54,6 +56,7 @@ export default {
manager: 40051334,
member2: 40051335,
connectAdmin: 40051336,
+ copilotManager: 40051337,
romit: 40158431,
},
getDecodedToken: token => jwt.decode(token),
diff --git a/src/util.js b/src/util.js
index 2ad0aa4a..1cdd8cfd 100644
--- a/src/util.js
+++ b/src/util.js
@@ -1277,14 +1277,14 @@ const projectServiceUtils = {
return false;
}
- // console.log('hasPermission', permission, user);
-
const allowRule = permission.allowRule ? permission.allowRule : permission;
const denyRule = permission.denyRule ? permission.denyRule : null;
const allow = util.matchPermissionRule(allowRule, user, projectMembers);
const deny = util.matchPermissionRule(denyRule, user, projectMembers);
+ // console.log('hasPermission', JSON.stringify({ permission, user, projectMembers, allow, deny }, null, 2));
+
return allow && !deny;
},