From de0e83f7032591ec3e163ad2a2ed7cebf83d0435 Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Fri, 16 Feb 2024 17:58:51 +0000 Subject: [PATCH] fix: move user and project logic from general to api hook --- app/config/errors.php | 5 - app/controllers/general.php | 8 -- app/controllers/shared/api.php | 8 +- src/Appwrite/Extend/Exception.php | 1 - tests/e2e/General/HooksTest.php | 158 ++++++++++++++++++++++++++++++ 5 files changed, 162 insertions(+), 18 deletions(-) create mode 100644 tests/e2e/General/HooksTest.php diff --git a/app/config/errors.php b/app/config/errors.php index d3f84dc353..3f12b5953a 100644 --- a/app/config/errors.php +++ b/app/config/errors.php @@ -647,11 +647,6 @@ return [ 'description' => 'Project with the requested ID already exists. Try again with a different ID or use ID.unique() to generate a unique ID.', 'code' => 409, ], - Exception::PROJECT_UNKNOWN => [ - 'name' => Exception::PROJECT_UNKNOWN, - 'description' => 'The project ID is either missing or not valid. Please check the value of the X-Appwrite-Project header to ensure the correct project ID is being used.', - 'code' => 400, - ], Exception::PROJECT_PROVIDER_DISABLED => [ 'name' => Exception::PROJECT_PROVIDER_DISABLED, 'description' => 'The chosen OAuth provider is disabled. You can enable the OAuth provider using the Appwrite console.', diff --git a/app/controllers/general.php b/app/controllers/general.php index 78cb70de02..99ed12b668 100644 --- a/app/controllers/general.php +++ b/app/controllers/general.php @@ -316,14 +316,6 @@ App::init() $locale->setDefault($localeParam); } - if ($project->isEmpty()) { - throw new AppwriteException(AppwriteException::PROJECT_NOT_FOUND); - } - - if (!empty($route->getLabel('sdk.auth', [])) && $project->isEmpty() && ($route->getLabel('scope', '') !== 'public')) { - throw new AppwriteException(AppwriteException::PROJECT_UNKNOWN); - } - $referrer = $request->getReferer(); $origin = \parse_url($request->getOrigin($referrer), PHP_URL_HOST); $protocol = \parse_url($request->getOrigin($referrer), PHP_URL_SCHEME); diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php index 5758a20eb1..02ab0914b2 100644 --- a/app/controllers/shared/api.php +++ b/app/controllers/shared/api.php @@ -157,6 +157,10 @@ App::init() ->action(function (App $utopia, Request $request, Database $dbForConsole, Document $project, Document $user, ?Document $session, array $servers, string $mode) { $route = $utopia->getRoute(); + if ($project->isEmpty()) { + throw new Exception(Exception::PROJECT_NOT_FOUND); + } + /** * ACL Check */ @@ -308,10 +312,6 @@ App::init() $route = $utopia->getRoute(); - if ($project->isEmpty() && $route->getLabel('abuse-limit', 0) > 0) { // Abuse limit requires an active project scope - throw new Exception(Exception::PROJECT_UNKNOWN); - } - /* * Abuse Check */ diff --git a/src/Appwrite/Extend/Exception.php b/src/Appwrite/Extend/Exception.php index 348fdacc0b..eba88480c4 100644 --- a/src/Appwrite/Extend/Exception.php +++ b/src/Appwrite/Extend/Exception.php @@ -192,7 +192,6 @@ class Exception extends \Exception /** Projects */ public const PROJECT_NOT_FOUND = 'project_not_found'; - public const PROJECT_UNKNOWN = 'project_unknown'; public const PROJECT_PROVIDER_DISABLED = 'project_provider_disabled'; public const PROJECT_PROVIDER_UNSUPPORTED = 'project_provider_unsupported'; public const PROJECT_ALREADY_EXISTS = 'project_already_exists'; diff --git a/tests/e2e/General/HooksTest.php b/tests/e2e/General/HooksTest.php new file mode 100644 index 0000000000..f4933428d1 --- /dev/null +++ b/tests/e2e/General/HooksTest.php @@ -0,0 +1,158 @@ +client->setEndpoint('http://localhost'); + } + + public function testProjectHooks() + { + /** + * Test for api controllers + */ + $response = $this->client->call(Client::METHOD_GET, '/v1/locale', \array_merge([ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + ]), [ + 'project' => 'console' + ]); + + $this->assertEquals(200, $response['headers']['status-code']); + + $response = $this->client->call(Client::METHOD_GET, '/v1/locale', \array_merge([ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + ]), [ + 'project' => '$this_project_doesnt_exist' + ]); + + $this->assertEquals(404, $response['headers']['status-code']); + + /** + * Test for web controllers + */ + $response = $this->client->call(Client::METHOD_GET, headers: [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + ], params: [ + 'project' => 'console' + ]); + + $this->assertEquals(200, $response['headers']['status-code']); + + $response = $this->client->call(Client::METHOD_GET, headers: [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + ], params: [ + 'project' => '$this_project_doesnt_exist' + ]); + + $this->assertEquals(200, $response['headers']['status-code']); + } + + public function testUserHooks() + { + /** + * Setup blocked user + */ + $email = uniqid() . 'user@localhost.test'; + $password = 'password'; + + $response = $this->client->call(Client::METHOD_POST, '/v1/account', [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], [ + 'userId' => ID::unique(), + 'email' => $email, + 'password' => $password, + ]); + + $id = $response['body']['$id']; + + $this->assertEquals(201, $response['headers']['status-code']); + + $response = $this->client->call(Client::METHOD_POST, '/v1/account/sessions/email', [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], [ + 'email' => $email, + 'password' => $password, + ]); + + $this->assertEquals(201, $response['headers']['status-code']); + + $session = $response['cookies']['a_session_' . $this->getProject()['$id']]; + $cookie = 'a_session_' . $this->getProject()['$id'] . '=' . $session; + + $response = $this->client->call(Client::METHOD_GET, '/v1/account', [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'cookie' => $cookie, + ]); + + $this->assertEquals(200, $response['headers']['status-code']); + + $response = $this->client->call(Client::METHOD_PATCH, '/v1/account/status', [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'cookie' => $cookie, + ], [ + 'status' => false, + ]); + + $this->assertEquals(200, $response['headers']['status-code']); + + $response = $this->client->call(Client::METHOD_GET, '/v1/account', [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'cookie' => $cookie, + ]); + + $this->assertEquals(401, $response['headers']['status-code']); + + /** + * Test for api controllers + */ + $response = $this->client->call(Client::METHOD_GET, '/v1/locale', [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'cookie' => $cookie, + ]); + + $this->assertEquals(401, $response['headers']['status-code']); + $this->assertEquals(Exception::USER_BLOCKED, $response['body']['type']); + + /** + * Test for web controllers + */ + $response = $this->client->call(Client::METHOD_GET, headers: [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'cookie' => $cookie, + ]); + + $this->assertEquals(200, $response['headers']['status-code']); + } +}