Bläddra i källkod

Fix failing tests for token access

If project was changed from token access to private, then we want to
404 on v2 (not redirect to v1). So the logic was changed to check if the
project exists and if it does then a 404 is returned. If it does not
then it redirects to v1.
Alasdair Smith 8 år sedan
förälder
incheckning
9d600afdf8

+ 8 - 0
services/web/app/coffee/Features/Errors/Errors.coffee

@@ -82,6 +82,13 @@ EmailExistsError = (message) ->
 	return error
 	return error
 EmailExistsError.prototype.__proto__ = Error.prototype
 EmailExistsError.prototype.__proto__ = Error.prototype
 
 
+ProjectNotTokenAccessError = (message) ->
+	error = new Error(message)
+	error.name = "ProjectNotTokenAccessError"
+	error.__proto__ = ProjectNotTokenAccessError.prototype
+	return error
+ProjectNotTokenAccessError.prototype.__proto__ = Error.prototype
+
 module.exports = Errors =
 module.exports = Errors =
 	NotFoundError: NotFoundError
 	NotFoundError: NotFoundError
 	ServiceNotConfiguredError: ServiceNotConfiguredError
 	ServiceNotConfiguredError: ServiceNotConfiguredError
@@ -95,3 +102,4 @@ module.exports = Errors =
 	V1ConnectionError: V1ConnectionError
 	V1ConnectionError: V1ConnectionError
 	UnconfirmedEmailError: UnconfirmedEmailError
 	UnconfirmedEmailError: UnconfirmedEmailError
 	EmailExistsError: EmailExistsError
 	EmailExistsError: EmailExistsError
+	ProjectNotTokenAccessError: ProjectNotTokenAccessError

+ 6 - 2
services/web/app/coffee/Features/TokenAccess/TokenAccessController.coffee

@@ -8,7 +8,7 @@ settings = require 'settings-sharelatex'
 module.exports = TokenAccessController =
 module.exports = TokenAccessController =
 
 
 	redirectNotFoundErrorToV1: (err, req, res, next) ->
 	redirectNotFoundErrorToV1: (err, req, res, next) ->
-		if err instanceof Errors.NotFoundError and settings.overleaf
+		if err instanceof Errors.ProjectNotTokenAccessError and settings.overleaf
 			logger.log {
 			logger.log {
 				token: req.params['read_and_write_token']
 				token: req.params['read_and_write_token']
 			}, "[TokenAccess] No project found for token, redirecting to v1"
 			}, "[TokenAccess] No project found for token, redirecting to v1"
@@ -21,11 +21,15 @@ module.exports = TokenAccessController =
 		return ProjectController.loadEditor(req, res, next)
 		return ProjectController.loadEditor(req, res, next)
 
 
 	_tryHigherAccess: (token, userId, req, res, next) ->
 	_tryHigherAccess: (token, userId, req, res, next) ->
-		TokenAccessHandler.findProjectWithHigherAccess token, userId, (err, project) ->
+		TokenAccessHandler.findProjectWithHigherAccess token, userId, (err, project, projectExists) ->
 			if err?
 			if err?
 				logger.err {err, token, userId},
 				logger.err {err, token, userId},
 					"[TokenAccess] error finding project with higher access"
 					"[TokenAccess] error finding project with higher access"
 				return next(err)
 				return next(err)
+			if !projectExists
+				logger.log {token, userId},
+					"[TokenAccess] no project found for this token"
+				return next(new Errors.ProjectNotTokenAccessError())
 			if !project?
 			if !project?
 				logger.log {token, userId},
 				logger.log {token, userId},
 					"[TokenAccess] no project with higher access found for this user and token"
 					"[TokenAccess] no project with higher access found for this user and token"

+ 7 - 3
services/web/app/coffee/Features/TokenAccess/TokenAccessHandler.coffee

@@ -22,7 +22,7 @@ module.exports = TokenAccessHandler =
 			'publicAccesLevel': PublicAccessLevels.TOKEN_BASED
 			'publicAccesLevel': PublicAccessLevels.TOKEN_BASED
 		}, {_id: 1, publicAccesLevel: 1, owner_ref: 1}, callback
 		}, {_id: 1, publicAccesLevel: 1, owner_ref: 1}, callback
 
 
-	findProjectWithHigherAccess: (token, userId, callback=(err, project)->) ->
+	findProjectWithHigherAccess: (token, userId, callback=(err, project, projectExists)->) ->
 		Project.findOne {
 		Project.findOne {
 			$or: [
 			$or: [
 				{'tokens.readAndWrite': token},
 				{'tokens.readAndWrite': token},
@@ -32,12 +32,16 @@ module.exports = TokenAccessHandler =
 			if err?
 			if err?
 				return callback(err)
 				return callback(err)
 			if !project?
 			if !project?
-				return callback(null, null)
+				return callback(null, null, false) # Project doesn't exist, so we handle differently
 			projectId = project._id
 			projectId = project._id
 			CollaboratorsHandler.isUserInvitedMemberOfProject userId, projectId, (err, isMember) ->
 			CollaboratorsHandler.isUserInvitedMemberOfProject userId, projectId, (err, isMember) ->
 				if err?
 				if err?
 					return callback(err)
 					return callback(err)
-				callback(null, if isMember == true then project else null)
+				callback(
+					null,
+					if isMember == true then project else null,
+					true # Project does exist, but user doesn't have access
+				)
 
 
 	addReadOnlyUserToProject: (userId, projectId, callback=(err)->) ->
 	addReadOnlyUserToProject: (userId, projectId, callback=(err)->) ->
 		userId = ObjectId(userId.toString())
 		userId = ObjectId(userId.toString())