Merge pull request #1234 from sharelatex/ta-teamplate-without-brand-metrics

Handle Access for Template Without Brands

GitOrigin-RevId: f1127298fcede8075b31f6b1bc7161f474817a7e

services/web/app/coffee/Features/UserMembership/UserMembershipAuthorization.coffee

@@ -50,7 +50,10 @@ module.exports = UserMembershipAuthorization =
 			req.template =
 				id: body.id
 				title: body.title
-			requireAccessToEntity('publisher', body.brand.slug, req, res, next)
+			if body?.brand?.slug
+				requireAccessToEntity('publisher', body.brand.slug, req, res, next)
+			else
+				AuthorizationMiddlewear.ensureUserIsSiteAdmin(req, res, next)
 
 	requireGraphAccess: (req, res, next) ->
 		if req.query.resource_type == 'template'

services/web/test/unit/coffee/UserMembership/UserMembershipAuthorizationTests.coffee

@@ -21,6 +21,7 @@ describe "UserMembershipAuthorization", ->
 			getEntityWithoutAuthorizationCheck: sinon.stub().yields(null, @subscription)
 		@AuthorizationMiddlewear =
 			redirectToRestricted: sinon.stub().yields()
+			ensureUserIsSiteAdmin: sinon.stub().yields()
 		@UserMembershipAuthorization = SandboxedModule.require modulePath, requires:
 			'../Authentication/AuthenticationController': @AuthenticationController
 			'../Authorization/AuthorizationMiddlewear': @AuthorizationMiddlewear
@@ -132,7 +133,7 @@ describe "UserMembershipAuthorization", ->
 				)
 				done()
 
-		it 'handle template access', (done) ->
+		it 'handle template with brand access', (done) ->
 			templateData =
 				id: 123
 				title: 'Template Title'
@@ -147,6 +148,18 @@ describe "UserMembershipAuthorization", ->
 				)
 				done()
 
+		it 'handle template without brand access', (done) ->
+			templateData =
+				id: 123
+				title: 'Template Title'
+				brand: null
+			@request.yields(null, { statusCode: 200 }, JSON.stringify(templateData))
+			@UserMembershipAuthorization.requireTemplateAccess @req, null, (error) =>
+				expect(error).to.not.extist
+				sinon.assert.notCalled(@UserMembershipHandler.getEntity)
+				sinon.assert.calledOnce(@AuthorizationMiddlewear.ensureUserIsSiteAdmin)
+				done()
+
 		it 'handle graph access', (done) ->
 			@req.query.resource_id = 'mock-resource-id'
 			@req.query.resource_type = 'institution'