add new group - create project access

Author: sshugsc

app/middleware/acl.js

@@ -34,6 +34,10 @@ const SPECIAL_CASES = [
     PUT: [{name: 'admin'}, {name: 'manager'}, {name: 'variant-text edit access'}],
     DELETE: [{name: 'admin'}, {name: 'manager'}, {name: 'variant-text edit access'}],
   },
+  {
+    path: pathToRegexp('/api/user/search'),
+    GET: [{name: 'admin'}, {name: 'manager'}, {name: 'create project access'}],
+  },
   {
     path: pathToRegexp('/api/user/:user'),
     GET: [{name: 'admin'}, {name: 'manager'}, {name: 'report assignment access'}],
@@ -50,7 +54,7 @@ const SPECIAL_CASES = [
     POST: [{name: 'admin'}, {name: 'manager'}, {name: 'create report access'}],
   },
   { // TODO double check these permissions
-    path: pathToRegexp('/api/reports/:report/observed-variant-annotation'),
+    path: pathToRegexp('/api/reports/:report/observed-variant-annotations'),
     POST: [{name: 'admin'}, {name: 'manager'}, {name: 'create report access'}],
     PUT: [{name: 'admin'}, {name: 'manager'}, {name: 'create report access'}],
   },
@@ -92,11 +96,11 @@ const SPECIAL_CASES = [
   },
   {
     path: pathToRegexp('/api/project'),
-    POST: [{name: 'admin'}],
+    POST: [{name: 'admin'}, {name: 'manager'}, {name: 'create project access'}],
   },
   {
     path: pathToRegexp('/api/project/:project'),
-    PUT: [{name: 'admin'}],
+    PUT: [{name: 'admin'}, {name: 'manager'}, {name: 'create project access'}],
     DELETE: [{name: 'admin'}],
   },
   {

app/routes/project/project.js

@@ -7,7 +7,9 @@ const db = require('../../models');
 const logger = require('../../log');
 
 const projectMiddleware = require('../../middleware/project');
-const {hasMasterAccess} = require('../../libs/helperFunctions');
+const {hasMasterAccess, hasAccess} = require('../../libs/helperFunctions');
+
+const CREATE_PROJECT_ACCESS = ['admin', 'manager', 'create project access'];
 
 const schemaGenerator = require('../../schemas/schemaGenerator');
 const validateAgainstSchema = require('../../libs/validateAgainstSchema');
@@ -115,6 +117,12 @@ router.route('/')
     }
   })
   .post(async (req, res) => {
+    if (!hasAccess(req.user, CREATE_PROJECT_ACCESS)) {
+      return res.status(HTTP_STATUS.FORBIDDEN).json({
+        error: {message: 'You do not have the correct permissions to create a project'},
+      });
+    }
+
     try {
       // validate request against the model
       validateAgainstSchema(createSchema, req.body);
@@ -135,6 +143,11 @@ router.route('/')
         return res.status(HTTP_STATUS.CONFLICT).json({error: {message: 'Project already exists'}});
       }
 
+      await db.models.userProject.findOrCreate({
+        where: {project_id: result.id, user_id: req.user.id},
+        defaults: {project_id: result.id, user_id: req.user.id},
+      });
+
       return res.status(HTTP_STATUS.CREATED).json(result.view('public'));
     } catch (error) {
       logger.error(`Error while trying to find/create project ${error}`);

migrations/latest/20260601170434-DEVSU-2932-add-create-project-permission.js

@@ -0,0 +1,22 @@
+const {v4: uuidv4} = require('uuid');
+
+const createProjectGroup = 'create project access';
+
+module.exports = {
+  up: async (queryInterface) => {
+    await queryInterface.sequelize.query(
+      // eslint-disable-next-line no-multi-str
+      `INSERT INTO user_groups (name, created_at, updated_at, ident)\
+          VALUES('${createProjectGroup}',\
+          '${new Date().toLocaleString()}',\
+          '${new Date().toLocaleString()}',\
+          '${uuidv4()}');`,
+    );
+  },
+
+  down: async (queryInterface) => {
+    await queryInterface.sequelize.query(`
+      DELETE FROM user_groups WHERE name = '${createProjectGroup}'
+    `);
+  },
+};

seeders/constants/user_groups.json

@@ -64,5 +64,11 @@
         "ident": "2841d7dd-80a4-47e1-abcf-f22fa9fbe187",
         "name": "create report access",
         "description": null
+    },
+    {
+        "id": 53,
+        "ident": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
+        "name": "create project access",
+        "description": null
     }
 ]

test/middleware/acl.test.js

@@ -213,6 +213,36 @@ describe('Testing ACL methods', () => {
       expect(res.status).not.toHaveBeenCalledWith(FORBIDDEN);
     });
 
+    test('Special case for create project with create project access', async () => {
+      req.user.groups = [{name: 'create project access'}];
+      req.originalUrl = '/api/project';
+      req.method = 'POST';
+
+      await Acl(req, res, () => {});
+
+      expect(res.status).not.toHaveBeenCalledWith(FORBIDDEN);
+    });
+
+    test('Create project is forbidden without create project access', async () => {
+      req.user.groups = [{name: 'hello'}];
+      req.originalUrl = '/api/project';
+      req.method = 'POST';
+
+      await Acl(req, res, () => {});
+
+      expect(res.status).toHaveBeenCalledWith(FORBIDDEN);
+    });
+
+    test('User search allows create project access', async () => {
+      req.user.groups = [{name: 'create project access'}];
+      req.originalUrl = '/api/user/search';
+      req.method = 'GET';
+
+      await Acl(req, res, () => {});
+
+      expect(res.status).not.toHaveBeenCalledWith(FORBIDDEN);
+    });
+
     test('Special case (matching route and method) where the user is not allowed to edit', async () => {
       req.originalUrl = '/api/template/fsddfds';
       req.method = 'PUT';

test/routes/project/project.test.js

@@ -8,7 +8,7 @@ const CONFIG = require('../../../app/config');
 const {listen} = require('../../../app');
 
 CONFIG.set('env', 'test');
-const {username, managerUsername, password} = CONFIG.get('testing');
+const {username, managerUsername, bioinformaticianUsername, password} = CONFIG.get('testing');
 
 const LONGER_TIMEOUT = 100000;
 
@@ -112,14 +112,26 @@ describe('/project', () => {
         .send({name: 'new-project-test-project01'})
         .expect(HTTP_STATUS.CREATED);
 
+      const createdProject = await db.models.project.findOne({
+        where: {ident: res.body.ident},
+      });
+      const requestUser = await db.models.user.findOne({
+        where: {username},
+      });
+      const userProjectBinding = await db.models.userProject.findOne({
+        where: {project_id: createdProject.id, user_id: requestUser.id},
+      });
+
+      expect(userProjectBinding).not.toBeNull();
+
       // Remove test project from db
       await db.models.project.destroy({where: {ident: res.body.ident}, force: true});
     });
 
     test('/ - 403 forbidden to non-admin', async () => {
       await request
         .post('/api/project')
-        .auth(managerUsername, password)
+        .auth(bioinformaticianUsername, password)
         .type('json')
         .send({name: 'new-project-test-project02'})
         .expect(HTTP_STATUS.FORBIDDEN);