From dc4cf2b35f72f66154cde5df230a3011a43c625a Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Fri, 3 Sep 2021 16:30:16 +0200 Subject: [PATCH 1/7] fix(auth): add role for privileged users --- app/controllers/general.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/app/controllers/general.php b/app/controllers/general.php index 8e63131e65..4bafd220df 100644 --- a/app/controllers/general.php +++ b/app/controllers/general.php @@ -245,6 +245,8 @@ App::init(function ($utopia, $request, $response, $console, $project, $consoleDB } } + Authorization::setRole('role:'.Auth::USER_ROLE_APP); + foreach (Auth::getRoles($user) as $authRole) { Authorization::setRole($authRole); } From b617afb17c22398abb6d9e37aac4cb7bea81f961 Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Fri, 3 Sep 2021 16:42:31 +0200 Subject: [PATCH 2/7] fix huge mistake --- app/controllers/general.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/general.php b/app/controllers/general.php index 4bafd220df..557da7a254 100644 --- a/app/controllers/general.php +++ b/app/controllers/general.php @@ -245,7 +245,7 @@ App::init(function ($utopia, $request, $response, $console, $project, $consoleDB } } - Authorization::setRole('role:'.Auth::USER_ROLE_APP); + Authorization::setRole('role:'.$role); foreach (Auth::getRoles($user) as $authRole) { Authorization::setRole($authRole); From 0b344e182c02e4adda687d8ce683091f16aca88d Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Fri, 3 Sep 2021 17:07:09 +0200 Subject: [PATCH 3/7] feat(Auth): improve getRoles method --- src/Appwrite/Auth/Auth.php | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/src/Appwrite/Auth/Auth.php b/src/Appwrite/Auth/Auth.php index 7fd402f5bd..1f75a55204 100644 --- a/src/Appwrite/Auth/Auth.php +++ b/src/Appwrite/Auth/Auth.php @@ -3,6 +3,7 @@ namespace Appwrite\Auth; use Appwrite\Database\Document; +use Appwrite\Database\Validator\Authorization; class Auth { @@ -282,11 +283,13 @@ class Auth */ public static function getRoles(Document $user): array { - if ($user->getId()) { - $roles[] = 'user:'.$user->getId(); - $roles[] = 'role:'.Auth::USER_ROLE_MEMBER; - } else { - return ['role:'.Auth::USER_ROLE_GUEST]; + if (self::isPrivilegedUser(Authorization::$roles) || self::isAppUser(Authorization::$roles)) { + if ($user->getId()) { + $roles[] = 'user:'.$user->getId(); + $roles[] = 'role:'.Auth::USER_ROLE_MEMBER; + } else { + return ['role:'.Auth::USER_ROLE_GUEST]; + } } foreach ($user->getAttribute('memberships', []) as $node) { From 55a5a0c7fdfbaff6628c752a6c277aa07296e77f Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Fri, 3 Sep 2021 17:15:42 +0200 Subject: [PATCH 4/7] fix roles variable --- src/Appwrite/Auth/Auth.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/Appwrite/Auth/Auth.php b/src/Appwrite/Auth/Auth.php index 1f75a55204..ea7787e857 100644 --- a/src/Appwrite/Auth/Auth.php +++ b/src/Appwrite/Auth/Auth.php @@ -283,6 +283,8 @@ class Auth */ public static function getRoles(Document $user): array { + $roles = []; + if (self::isPrivilegedUser(Authorization::$roles) || self::isAppUser(Authorization::$roles)) { if ($user->getId()) { $roles[] = 'user:'.$user->getId(); From 0ac4b031eb6293620a20bb8c65beb007fe348e6d Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Fri, 3 Sep 2021 17:18:42 +0200 Subject: [PATCH 5/7] fix condition --- src/Appwrite/Auth/Auth.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Appwrite/Auth/Auth.php b/src/Appwrite/Auth/Auth.php index ea7787e857..4ea9751854 100644 --- a/src/Appwrite/Auth/Auth.php +++ b/src/Appwrite/Auth/Auth.php @@ -285,7 +285,7 @@ class Auth { $roles = []; - if (self::isPrivilegedUser(Authorization::$roles) || self::isAppUser(Authorization::$roles)) { + if (!self::isPrivilegedUser(Authorization::$roles) && !self::isAppUser(Authorization::$roles)) { if ($user->getId()) { $roles[] = 'user:'.$user->getId(); $roles[] = 'role:'.Auth::USER_ROLE_MEMBER; From 1f7bad15606e85eb4d8772958496dfda64bf5ee8 Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Fri, 3 Sep 2021 17:59:02 +0200 Subject: [PATCH 6/7] add test --- tests/unit/Auth/AuthTest.php | 37 ++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/tests/unit/Auth/AuthTest.php b/tests/unit/Auth/AuthTest.php index de3013f96b..0b1fb5cf71 100644 --- a/tests/unit/Auth/AuthTest.php +++ b/tests/unit/Auth/AuthTest.php @@ -4,6 +4,7 @@ namespace Appwrite\Tests; use Appwrite\Auth\Auth; use Appwrite\Database\Document; +use Appwrite\Database\Validator\Authorization; use PHPUnit\Framework\TestCase; class AuthTest extends TestCase @@ -240,4 +241,40 @@ class AuthTest extends TestCase $this->assertContains('team:def', $roles); $this->assertContains('team:def/guest', $roles); } + + public function testPrivilegedUserRoles() + { + Authorization::setRole('role:'.Auth::USER_ROLE_APP); + $user = new Document([ + '$id' => '123', + 'memberships' => [ + [ + 'teamId' => 'abc', + 'roles' => [ + 'administrator', + 'moderator' + ] + ], + [ + 'teamId' => 'def', + 'roles' => [ + 'guest' + ] + ] + ] + ]); + + $roles = Auth::getRoles($user); + + $this->assertCount(5, $roles); + $this->assertNotContains('role:member', $roles); + $this->assertNotContains('user:123', $roles); + $this->assertContains('team:abc', $roles); + $this->assertContains('team:abc/administrator', $roles); + $this->assertContains('team:abc/moderator', $roles); + $this->assertContains('team:def', $roles); + $this->assertContains('team:def/guest', $roles); + + Authorization::reset(); + } } From 978f15c1c1d72ff60ca793fcbb76295b8a05d8fb Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Fri, 3 Sep 2021 18:05:50 +0200 Subject: [PATCH 7/7] extend tests --- tests/unit/Auth/AuthTest.php | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/tests/unit/Auth/AuthTest.php b/tests/unit/Auth/AuthTest.php index 0b1fb5cf71..443f244d45 100644 --- a/tests/unit/Auth/AuthTest.php +++ b/tests/unit/Auth/AuthTest.php @@ -243,6 +243,42 @@ class AuthTest extends TestCase } public function testPrivilegedUserRoles() + { + Authorization::setRole('role:'.Auth::USER_ROLE_OWNER); + $user = new Document([ + '$id' => '123', + 'memberships' => [ + [ + 'teamId' => 'abc', + 'roles' => [ + 'administrator', + 'moderator' + ] + ], + [ + 'teamId' => 'def', + 'roles' => [ + 'guest' + ] + ] + ] + ]); + + $roles = Auth::getRoles($user); + + $this->assertCount(5, $roles); + $this->assertNotContains('role:member', $roles); + $this->assertNotContains('user:123', $roles); + $this->assertContains('team:abc', $roles); + $this->assertContains('team:abc/administrator', $roles); + $this->assertContains('team:abc/moderator', $roles); + $this->assertContains('team:def', $roles); + $this->assertContains('team:def/guest', $roles); + + Authorization::reset(); + } + + public function testAppUserRoles() { Authorization::setRole('role:'.Auth::USER_ROLE_APP); $user = new Document([