Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1580 from TorstenDittmann/fix-priviledged-user

Browse Source 
fix(auth): add role for privileged users
This commit is contained in:
Torsten Dittmann
2021-09-06 15:16:40 +02:00
committed by GitHub
parent df832ca0a1 978f15c1c1
commit f5cf111383
3 changed files with 85 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/general.php
+2
View File
@@ -245,6 +245,8 @@ App::init(function ($utopia, $request, $response, $console, $project, $consoleDB
}
}
Authorization::setRole('role:'.$role);
foreach (Auth::getRoles($user) as $authRole) {
Authorization::setRole($authRole);
}
src/Appwrite/Auth/Auth.php
+10 -5
View File
@@ -3,6 +3,7 @@
namespace Appwrite\Auth;
use Appwrite\Database\Document;
use Appwrite\Database\Validator\Authorization;
class Auth
{
@@ -282,11 +283,15 @@ class Auth
*/
public static function getRoles(Document $user): array
{
if ($user->getId()) {
$roles[] = 'user:'.$user->getId();
$roles[] = 'role:'.Auth::USER_ROLE_MEMBER;
} else {
return ['role:'.Auth::USER_ROLE_GUEST];
$roles = [];
if (!self::isPrivilegedUser(Authorization::$roles) && !self::isAppUser(Authorization::$roles)) {
if ($user->getId()) {
$roles[] = 'user:'.$user->getId();
$roles[] = 'role:'.Auth::USER_ROLE_MEMBER;
} else {
return ['role:'.Auth::USER_ROLE_GUEST];
}
}
foreach ($user->getAttribute('memberships', []) as $node) {
tests/unit/Auth/AuthTest.php
+73
View File
@@ -4,6 +4,7 @@ namespace Appwrite\Tests;
use Appwrite\Auth\Auth;
use Appwrite\Database\Document;
use Appwrite\Database\Validator\Authorization;
use PHPUnit\Framework\TestCase;
class AuthTest extends TestCase
@@ -240,4 +241,76 @@ class AuthTest extends TestCase
$this->assertContains('team:def', $roles);
$this->assertContains('team:def/guest', $roles);
}
public function testPrivilegedUserRoles()
{
Authorization::setRole('role:'.Auth::USER_ROLE_OWNER);
$user = new Document([
'$id' => '123',
'memberships' => [
[
'teamId' => 'abc',
'roles' => [
'administrator',
'moderator'
]
],
[
'teamId' => 'def',
'roles' => [
'guest'
]
]
]
]);
$roles = Auth::getRoles($user);
$this->assertCount(5, $roles);
$this->assertNotContains('role:member', $roles);
$this->assertNotContains('user:123', $roles);
$this->assertContains('team:abc', $roles);
$this->assertContains('team:abc/administrator', $roles);
$this->assertContains('team:abc/moderator', $roles);
$this->assertContains('team:def', $roles);
$this->assertContains('team:def/guest', $roles);
Authorization::reset();
}
public function testAppUserRoles()
{
Authorization::setRole('role:'.Auth::USER_ROLE_APP);
$user = new Document([
'$id' => '123',
'memberships' => [
[
'teamId' => 'abc',
'roles' => [
'administrator',
'moderator'
]
],
[
'teamId' => 'def',
'roles' => [
'guest'
]
]
]
]);
$roles = Auth::getRoles($user);
$this->assertCount(5, $roles);
$this->assertNotContains('role:member', $roles);
$this->assertNotContains('user:123', $roles);
$this->assertContains('team:abc', $roles);
$this->assertContains('team:abc/administrator', $roles);
$this->assertContains('team:abc/moderator', $roles);
$this->assertContains('team:def', $roles);
$this->assertContains('team:def/guest', $roles);
Authorization::reset();
}
}