72b4b26e2c
Closes https://github.com/twentyhq/core-team-issues/issues/526 (for reminder: 1. Make defaultRoleId non-nullable for an active workspace 2. Remove permissions V1 feature flag 3. Set member role as default role for new workspaces About 1.: An active workspace's defaultRoleId should never be null. We can't rely on a simple postgres NOT NULL constraint as defaultRoleId will always be initially null when the workspace is first created since the roles do not exist at that time. Let's add a more complex rule to ensure that About 3.: In the first phase of our deploy of permissions, we chose to assign admin role to all existing users, not to break any existing behavior with the introduction of the feature (= existing users have less rights than before). As we deploy permissions to all existing and future workspaces, let's set the member role as default role for future workspaces. )
112 lines
3.4 KiB
TypeScript
112 lines
3.4 KiB
TypeScript
import request from 'supertest';
|
|
|
|
import { ErrorCode } from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
|
|
import { PermissionsExceptionMessage } from 'src/engine/metadata-modules/permissions/permissions.exception';
|
|
|
|
const client = request(`http://localhost:${APP_PORT}`);
|
|
|
|
describe('workspace invitation permissions', () => {
|
|
it('should throw a permission error when user does not have permission to send invitation', async () => {
|
|
const queryData = {
|
|
query: `
|
|
mutation sendWorkspaceInvitation {
|
|
sendInvitations(emails: ["test@example.com"]) {
|
|
success
|
|
}
|
|
}
|
|
`,
|
|
};
|
|
|
|
await client
|
|
.post('/graphql')
|
|
.set('Authorization', `Bearer ${MEMBER_ACCESS_TOKEN}`)
|
|
.send(queryData)
|
|
.expect(200)
|
|
.expect((res) => {
|
|
expect(res.body.data).toBeNull();
|
|
expect(res.body.errors).toBeDefined();
|
|
expect(res.body.errors[0].message).toBe(
|
|
PermissionsExceptionMessage.PERMISSION_DENIED,
|
|
);
|
|
expect(res.body.errors[0].extensions.code).toBe(ErrorCode.FORBIDDEN);
|
|
});
|
|
});
|
|
|
|
it('should throw a permission error when user does not have permission to resend invitation', async () => {
|
|
const queryData = {
|
|
query: `
|
|
mutation resendWorkspaceInvitation {
|
|
resendWorkspaceInvitation(appTokenId: "test-invitation-id") {
|
|
success
|
|
}
|
|
}
|
|
`,
|
|
};
|
|
|
|
await client
|
|
.post('/graphql')
|
|
.set('Authorization', `Bearer ${MEMBER_ACCESS_TOKEN}`)
|
|
.send(queryData)
|
|
.expect(200)
|
|
.expect((res) => {
|
|
expect(res.body.data).toBeNull();
|
|
expect(res.body.errors).toBeDefined();
|
|
expect(res.body.errors[0].message).toBe(
|
|
PermissionsExceptionMessage.PERMISSION_DENIED,
|
|
);
|
|
expect(res.body.errors[0].extensions.code).toBe(ErrorCode.FORBIDDEN);
|
|
});
|
|
});
|
|
|
|
it('should throw a permission error when user does not have permission to find invitations', async () => {
|
|
const queryData = {
|
|
query: `
|
|
query findWorkspaceInvitations {
|
|
findWorkspaceInvitations {
|
|
id
|
|
email
|
|
}
|
|
}
|
|
`,
|
|
};
|
|
|
|
await client
|
|
.post('/graphql')
|
|
.set('Authorization', `Bearer ${MEMBER_ACCESS_TOKEN}`)
|
|
.send(queryData)
|
|
.expect(200)
|
|
.expect((res) => {
|
|
expect(res.body.data).toBeNull();
|
|
expect(res.body.errors).toBeDefined();
|
|
expect(res.body.errors[0].message).toBe(
|
|
PermissionsExceptionMessage.PERMISSION_DENIED,
|
|
);
|
|
expect(res.body.errors[0].extensions.code).toBe(ErrorCode.FORBIDDEN);
|
|
});
|
|
});
|
|
|
|
it('should throw a permission error when user does not have permission to delete invitation', async () => {
|
|
const queryData = {
|
|
query: `
|
|
mutation deleteWorkspaceInvitation {
|
|
deleteWorkspaceInvitation(appTokenId: "test-invitation-id")
|
|
}
|
|
`,
|
|
};
|
|
|
|
await client
|
|
.post('/graphql')
|
|
.set('Authorization', `Bearer ${MEMBER_ACCESS_TOKEN}`)
|
|
.send(queryData)
|
|
.expect(200)
|
|
.expect((res) => {
|
|
expect(res.body.data).toBeNull();
|
|
expect(res.body.errors).toBeDefined();
|
|
expect(res.body.errors[0].message).toBe(
|
|
PermissionsExceptionMessage.PERMISSION_DENIED,
|
|
);
|
|
expect(res.body.errors[0].extensions.code).toBe(ErrorCode.FORBIDDEN);
|
|
});
|
|
});
|
|
});
|