Update logic according to Excel. Simplify some code.
MODIFY
src/authorization/AuthorizationsDefinition.ts
src/authorization/AuthorizationsDefinition.ts
@@ -277,8 +277,8 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
{ resource: Entity.USERS, action: Action.LIST, attributes: ['*'] },
{ resource: Entity.USER, action: [Action.READ], attributes: ['*'] },
{ resource: Entity.USERS_SITES, action: Action.LIST, attributes: ['*'] },
- { resource: Entity.USERS_SITES, action: [Action.ASSIGN, Action.UNASSIGN], attributes: ['*'] },
- { resource: Entity.SITE, action: [Action.UPDATE, Action.DELETE], attributes: ['*'] },
+ { resource: Entity.USERS_SITES, action: [Action.UNASSIGN], attributes: ['*'] },
+ { resource: Entity.SITE, action: [Action.UPDATE], attributes: ['*'] },
{
resource: Entity.SITE_AREA, action: [Action.CREATE, Action.UPDATE, Action.DELETE], attributes: ['*'],
condition: { Fn: 'LIST_CONTAINS', args: { 'sites': '$.site' } }
@@ -322,9 +322,6 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
grants: [
{ resource: Entity.USERS, action: Action.LIST, attributes: ['*'] },
{ resource: Entity.USER, action: [Action.READ], attributes: ['*'] },
- { resource: Entity.USERS_SITES, action: Action.LIST, attributes: ['*'] },
- { resource: Entity.USERS_SITES, action: [Action.ASSIGN, Action.UNASSIGN], attributes: ['*'] },
- { resource: Entity.SITE, action: [Action.UPDATE], attributes: ['*'] },
{
resource: Entity.TRANSACTION, action: [Action.READ, Action.REFUND_TRANSACTION], attributes: ['*'],
condition: { Fn: 'LIST_CONTAINS', args: { 'sitesOwner': '$.site' } }

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -36,13 +36,11 @@ export default class AuthorizationService {
if (!Utils.isEmptyArray(filteredRequest.ProjectFields)) {
authorizationFilters.projectFields = authorizationFilters.projectFields.filter((projectField) => filteredRequest.ProjectFields.includes(projectField));
}
- // Not an Admin?
+ // Not an Admin user?
if (userToken.role !== UserRole.ADMIN) {
- if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
- // Get Site IDs from Site Admin flag
+ // Get assigned Site IDs from DB
const siteIDs = await AuthorizationService.getAssignedSiteIDs(tenant.id, userToken, filteredRequest.ID);
- if (!Utils.isEmptyArray(siteIDs)) {
- if (!siteIDs.includes(filteredRequest.ID)) {
+ if (Utils.isEmptyArray(siteIDs) || !siteIDs.includes(filteredRequest.ID)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: userToken,
@@ -52,14 +50,34 @@ export default class AuthorizationService {
} else {
authorizationFilters.authorized = true;
}
- } else {
+ }
+ return authorizationFilters;
+ }
+
+ public static async checkAndGetUpdateSiteAuthorizationFilters(
+ tenant: Tenant, userToken: UserToken, filteredRequest: HttpSiteRequest): Promise<AuthorizationFilter> {
+ const authorizationFilters: AuthorizationFilter = {
+ filters: {},
+ projectFields: [
+ 'id', 'name', 'issuer', 'image', 'address', 'companyID', 'company.name', 'autoUserSiteAssignment', 'public'
+ ],
+ authorized: userToken.role === UserRole.ADMIN,
+ };
+ // Check Projection
+ if (!Utils.isEmptyArray(filteredRequest.ProjectFields)) {
+ authorizationFilters.projectFields = authorizationFilters.projectFields.filter((projectField) => filteredRequest.ProjectFields.includes(projectField));
+ }
+ // Not an Admin user?
+ if (userToken.role !== UserRole.ADMIN) {
+ // Get SiteIDs for which user is Site Admin
+ const { siteAdminIDs, siteOwnerIDs } = await AuthorizationService.getSiteAdminOwnerIDs(tenant, userToken);
+ if (Utils.isEmptyArray(siteAdminIDs) || !siteAdminIDs.includes(filteredRequest.ID)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: userToken,
action: Action.READ, entity: Entity.SITE,
module: MODULE_NAME, method: 'checkAndGetSiteAuthorizationFilters',
});
- }
} else {
authorizationFilters.authorized = true;
}
@@ -72,14 +90,14 @@ export default class AuthorizationService {
const { siteAdminIDs, siteOwnerIDs } = await AuthorizationService.getSiteAdminOwnerIDs(tenant, userToken);
// Enrich
for (const site of sites) {
- site.canRead = true; // all users can read sites
+ site.canRead = Authorizations.canReadSite(userToken);
+ site.canDelete = Authorizations.canDeleteSite(userToken);
+ // update can be performed by admin or site admin
if (userToken.role === UserRole.ADMIN) {
site.canUpdate = true;
- site.canDelete = true;
} else {
- site.canUpdate = Authorizations.canUpdateSite(userToken) && (siteAdminIDs.includes(site.id) || siteOwnerIDs.includes(site.id));
- site.canDelete = Authorizations.canDeleteSite(userToken) && (siteAdminIDs.includes(site.id) || siteOwnerIDs.includes(site.id));
+ site.canUpdate = Authorizations.canUpdateSite(userToken) && siteAdminIDs.includes(site.id);
}
}
}
@@ -105,7 +123,7 @@ export default class AuthorizationService {
}
// Not an Admin?
if (userToken.role !== UserRole.ADMIN) {
- // Get Site IDs from Site Admin flag
+ // Get assigned Site IDs assigned to user from DB
const siteIDs = await AuthorizationService.getAssignedSiteIDs(tenant.id, userToken);
if (!Utils.isEmptyArray(siteIDs)) {
// Force the filter
@@ -172,46 +190,26 @@ export default class AuthorizationService {
};
// Not an Admin?
if (userToken.role !== UserRole.ADMIN) {
- if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
- // Get Site IDs from Site Admin & Site Owner flag
+ // Get Site IDs for which user is admin from db
const siteAdminSiteIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
- const siteOwnerSiteIDs: Array<string> = await AuthorizationService.getSiteOwnerSiteIDs(tenant.id, userToken);
- const allSites: Array<string> = _.uniq([...siteAdminSiteIDs, ...siteOwnerSiteIDs]);
- // Get User IDs from Site Admin flag
- if (!Utils.isEmptyArray(allSites)) {
- // Check Site ID
- if (allSites.includes(filteredRequest.siteID)) {
+ // Check Site
+ if (!Utils.isEmptyArray(siteAdminSiteIDs) && siteAdminSiteIDs.includes(filteredRequest.siteID)) {
// Site Authorized, now check users
if (!Utils.isEmptyArray(filteredRequest.userIDs)) {
let foundInvalidUserID = false;
- // Get authorized User IDs
+ // Get User IDs already assigned to the site
const userIDs = await AuthorizationService.getAssignedUsersIDs(tenant.id, filteredRequest.siteID);
- switch (action) {
- // Check if any of the users we want to assign are already assigned
- case ServerAction.ADD_USERS_TO_SITE:
- for (const userID of filteredRequest.userIDs) {
- if (userIDs.includes(userID)) {
- foundInvalidUserID = true;
- break;
- }
- }
- break;
- default:
- // Check if any of the users we want to unassign are already unassigned
+ // Check if any of the users we want to unassign are missing
for (const userID of filteredRequest.userIDs) {
if (!userIDs.includes(userID)) {
foundInvalidUserID = true;
- break;
}
}
- break;
- }
if (!foundInvalidUserID) {
authorizationFilters.authorized = true;
}
}
}
- }
if (!authorizationFilters.authorized) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
@@ -221,9 +219,6 @@ export default class AuthorizationService {
module: MODULE_NAME, method: 'checkAndAssignSiteUsersAuthorizationFilters'
});
}
- } else {
- authorizationFilters.authorized = true;
- }
}
return authorizationFilters;
}
@@ -529,7 +524,7 @@ export default class AuthorizationService {
}
private static async getAssignedSiteIDs(tenantID: string, userToken: UserToken, siteID?: string): Promise<string[]> {
- // Get the Sites where the user is Site Admin
+ // Get the Sites assigned to user
const sites = await SiteStorage.getSites(tenantID,
{
siteIDs: siteID ? [siteID] : null,
@@ -542,7 +537,7 @@ export default class AuthorizationService {
}
private static async getAssignedUsersIDs(tenantID: string, siteID: string): Promise<string[]> {
- // Get the Sites where the user is Site Admin
+ // Get the Users assigned to the site
const users = await UserStorage.getUsers(tenantID,
{
siteIDs: [siteID],
@@ -553,7 +548,7 @@ export default class AuthorizationService {
return users.result.map((user) => user.id);
}
- private static async getSiteAdminOwnerIDs(tenant: Tenant, userToken: UserToken): Promise<{ siteAdminIDs: string[]; siteOwnerIDs: string[]; }> {
+ public static async getSiteAdminOwnerIDs(tenant: Tenant, userToken: UserToken): Promise<{ siteAdminIDs: string[]; siteOwnerIDs: string[]; }> {
const siteAdminIDs: string[] = [];
const siteOwnerIDs: string[] = [];
const userSites = await UserStorage.getUserSites(tenant.id, { userID: userToken.id }, Constants.DB_PARAMS_MAX_LIMIT);

MODIFY
src/server/rest/v1/service/SiteService.ts
src/server/rest/v1/service/SiteService.ts
@@ -26,9 +26,9 @@ export default class SiteService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.UPDATE, Entity.SITE, MODULE_NAME, 'handleUpdateSiteUserAdmin');
- // Filter
+ // Filter request
const filteredRequest = SiteSecurity.filterUpdateSiteUserAdminRequest(req.body);
- // Check
+ // Check mandatory fields
if (!filteredRequest.userID) {
throw new AppError({
source: Constants.CENTRAL_SERVER,
@@ -66,6 +66,7 @@ export default class SiteService {
actionOnUser: filteredRequest.userID
});
}
+ // Check static auth
if (!Authorizations.canUpdateSite(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
@@ -75,23 +76,23 @@ export default class SiteService {
value: filteredRequest.siteID
});
}
- // Check auth
+ // Check dynamic auth for reading site
const authorizationSiteFilters = await AuthorizationService.checkAndGetSiteAuthorizationFilters(
req.tenant, req.user, { ID: filteredRequest.siteID });
- // Get the Site
+ // Get the Site and check it exists
const site = await SiteStorage.getSite(
req.user.tenantID, filteredRequest.siteID, authorizationSiteFilters.filters);
UtilsService.assertObjectExists(action, site, `Site with ID '${filteredRequest.siteID}' does not exist`,
MODULE_NAME, 'handleUpdateSiteUserAdmin', req.user);
- // Get authorization filters
+ // Get dynamic auth filters for reading user
const authorizationUserFilters = await AuthorizationService.checkAndGetUserAuthorizationFilters(
req.tenant, req.user, { ID: filteredRequest.userID });
- // Get the User
+ // Get the User and check it exists
const user = await UserStorage.getUser(
req.user.tenantID, filteredRequest.userID, authorizationUserFilters.filters);
UtilsService.assertObjectExists(action, user, `User with ID '${filteredRequest.userID}' does not exist`,
MODULE_NAME, 'handleUpdateSiteUserAdmin', req.user);
- // Check user
+ // Check user role
if (!Authorizations.isBasic(user)) {
throw new AppError({
source: Constants.CENTRAL_SERVER,
@@ -118,6 +119,7 @@ export default class SiteService {
}
public static async handleUpdateSiteOwner(action: ServerAction, req: Request, res: Response, next: NextFunction): Promise<void> {
+ // check static auth
if (!Authorizations.canCreateSite(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
@@ -129,9 +131,9 @@ export default class SiteService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.UPDATE, Entity.SITE, MODULE_NAME, 'handleUpdateSiteOwner');
- // Filter
+ // Filter request
const filteredRequest = SiteSecurity.filterUpdateSiteOwnerRequest(req.body);
- // Check
+ // Check mandatory fields
if (!filteredRequest.userID) {
throw new AppError({
source: Constants.CENTRAL_SERVER,
@@ -159,18 +161,18 @@ export default class SiteService {
user: req.user
});
}
- // Check auth
+ // Check dynamic auth for reading site
const authorizationSiteFilters = await AuthorizationService.checkAndGetSiteAuthorizationFilters(
req.tenant, req.user, { ID: filteredRequest.siteID });
- // Get the Site
+ // Get the Site and check it exists
const site = await SiteStorage.getSite(
req.user.tenantID, filteredRequest.siteID, authorizationSiteFilters.filters);
UtilsService.assertObjectExists(action, site, `Site with ID '${filteredRequest.siteID}' does not exist`,
MODULE_NAME, 'handleUpdateSiteUserOwner', req.user);
- // Get authorization filters
+ // Get dynamic auth filters for reading user
const authorizationUserFilters = await AuthorizationService.checkAndGetUserAuthorizationFilters(
req.tenant, req.user, { ID: filteredRequest.userID });
- // Get the User
+ // Get the User and check it exists
const user = await UserStorage.getUser(
req.user.tenantID, filteredRequest.userID, authorizationUserFilters.filters);
UtilsService.assertObjectExists(action, user, `User with ID '${filteredRequest.userID}' does not exist`,
@@ -194,7 +196,7 @@ export default class SiteService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.UPDATE, Entity.SITE, MODULE_NAME, 'handleAssignUsersToSite');
- // Check auth
+ // Check static auth
if (action === ServerAction.ADD_USERS_TO_SITE) {
if (!Authorizations.canAssignUsersSites(req.user)) {
throw new AppAuthError({
@@ -212,9 +214,9 @@ export default class SiteService {
module: MODULE_NAME, method: 'checkAndAssignSiteUsersAuthorizationFilters'
});
}
- // Filter
+ // Filter request
const filteredRequest = SiteSecurity.filterAssignSiteUsers(req.body);
- // Check
+ // Check mandatory fields
UtilsService.assertIdIsProvided(action, filteredRequest.siteID, MODULE_NAME, 'handleAssignUsersToSite', req.user);
if (!filteredRequest.userIDs || Utils.isEmptyArray(filteredRequest.userIDs)) {
throw new AppError({
@@ -225,7 +227,7 @@ export default class SiteService {
user: req.user
});
}
- // Check auth
+ // Check static auth for read
if (!Authorizations.canReadSite(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
@@ -235,10 +237,10 @@ export default class SiteService {
value: filteredRequest.siteID
});
}
- // Check auth
+ // Check dynamic auth for reading
const authorizationSiteFilters = await AuthorizationService.checkAndGetSiteAuthorizationFilters(
req.tenant, req.user, { ID: filteredRequest.siteID });
- // Get the Site
+ // Get the Site & check that it exists
const site = await SiteStorage.getSite(
req.user.tenantID, filteredRequest.siteID, authorizationSiteFilters.filters);
UtilsService.assertObjectExists(action, site, `Site '${filteredRequest.siteID}' does not exist`,
@@ -254,7 +256,7 @@ export default class SiteService {
action: action
});
}
- // Check auth
+ // Check dynamic auth for assignment
await AuthorizationService.checkAndAssignSiteUsersAuthorizationFilters(
req.tenant, action, req.user, filteredRequest);
// Save
@@ -344,11 +346,11 @@ export default class SiteService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.DELETE, Entity.SITE, MODULE_NAME, 'handleDeleteSite');
- // Filter
+ // Filter request
const siteID = SiteSecurity.filterSiteRequestByID(req.query);
// Check Mandatory fields
UtilsService.assertIdIsProvided(action, siteID, MODULE_NAME, 'handleDeleteSite', req.user);
- // Check
+ // Check static auth
if (!Authorizations.canDeleteSite(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
@@ -358,12 +360,12 @@ export default class SiteService {
value: siteID
});
}
- // Check auth
+ // Check dynamic auth
const authorizationSiteFilters = await AuthorizationService.checkAndGetSiteAuthorizationFilters(
req.tenant, req.user, { ID: siteID });
- // Get
- const site = await SiteStorage.getSite(
- req.user.tenantID, siteID, authorizationSiteFilters.filters);
+ // Get the site
+ const site = await SiteStorage.getSite(req.user.tenantID, siteID, authorizationSiteFilters.filters);
+ // Check that the site exists
UtilsService.assertObjectExists(action, site, `Site with ID '${siteID}' does not exist`,
MODULE_NAME, 'handleDeleteSite', req.user);
// OCPI Site
@@ -396,7 +398,7 @@ export default class SiteService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.READ, Entity.SITE, MODULE_NAME, 'handleGetSite');
- // Check auth
+ // Check static auth
if (!Authorizations.canReadSite(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
@@ -405,10 +407,11 @@ export default class SiteService {
module: MODULE_NAME, method: 'checkAndGetSiteAuthorizationFilters',
});
}
- // Filter
+ // Filter request
const filteredRequest = SiteSecurity.filterSiteRequest(req.query);
+ // Check Mandatory fields
UtilsService.assertIdIsProvided(action, filteredRequest.ID, MODULE_NAME, 'handleGetSite', req.user);
- // Check auth
+ // Check dynamic auth
const authorizationSiteFilters = await AuthorizationService.checkAndGetSiteAuthorizationFilters(
req.tenant, req.user, filteredRequest);
// Get it
@@ -431,7 +434,7 @@ export default class SiteService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.LIST, Entity.SITES, MODULE_NAME, 'handleGetSites');
- // Check auth
+ // Check static auth
if (!Authorizations.canListSites(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
@@ -440,9 +443,9 @@ export default class SiteService {
module: MODULE_NAME, method: 'handleGetSites'
});
}
- // Filter
+ // Filter request
const filteredRequest = SiteSecurity.filterSitesRequest(req.query);
- // Check auth
+ // Check dynamic auth
const authorizationSiteFilters = await AuthorizationService.checkAndGetSitesAuthorizationFilters(
req.tenant, req.user, filteredRequest);
if (!authorizationSiteFilters.authorized) {
@@ -521,7 +524,7 @@ export default class SiteService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.CREATE, Entity.SITE, MODULE_NAME, 'handleCreateSite');
- // Check auth
+ // Check static auth
if (!Authorizations.canCreateSite(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
@@ -530,11 +533,11 @@ export default class SiteService {
module: MODULE_NAME, method: 'handleCreateSite'
});
}
- // Filter
+ // Filter request
const filteredRequest = SiteSecurity.filterSiteCreateRequest(req.body);
- // Check
+ // Check data is valid
UtilsService.checkIfSiteValid(filteredRequest, req);
- // Check Company
+ // Check Company exists
const company = await CompanyStorage.getCompany(req.user.tenantID, filteredRequest.companyID);
UtilsService.assertObjectExists(action, company, `Company ID '${filteredRequest.companyID}' does not exist`,
MODULE_NAME, 'handleCreateSite', req.user);
@@ -575,8 +578,9 @@ export default class SiteService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.UPDATE, Entity.SITE, MODULE_NAME, 'handleUpdateSite');
- // Filter
+ // Filter request
const filteredRequest = SiteSecurity.filterSiteUpdateRequest(req.body);
+ // Check mandatory fields
UtilsService.assertIdIsProvided(action, filteredRequest.id, MODULE_NAME, 'handleUpdateSite', req.user);
// Check auth
if (!Authorizations.canUpdateSite(req.user)) {
@@ -588,22 +592,22 @@ export default class SiteService {
value: filteredRequest.id
});
}
- // Check Company
- const company = await CompanyStorage.getCompany(req.user.tenantID, filteredRequest.companyID);
- UtilsService.assertObjectExists(action, company, `Company ID '${filteredRequest.companyID}' does not exist`,
- MODULE_NAME, 'handleUpdateSite', req.user);
- // Check auth
+ // Check data is valid
+ UtilsService.checkIfSiteValid(filteredRequest, req);
+ // Check static auth for reading company
if (!Authorizations.canReadCompany(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
action: Action.READ, entity: Entity.COMPANY,
module: MODULE_NAME, method: 'handleUpdateSite',
- value: company.id
+ value: filteredRequest.companyID
});
}
- // Check
- UtilsService.checkIfSiteValid(filteredRequest, req);
+ // Get Company & check it exists
+ const company = await CompanyStorage.getCompany(req.user.tenantID, filteredRequest.companyID);
+ UtilsService.assertObjectExists(action, company, `Company ID '${filteredRequest.companyID}' does not exist`,
+ MODULE_NAME, 'handleUpdateSite', req.user);
// OCPI Company
if (!company.issuer) {
throw new AppError({
@@ -615,16 +619,16 @@ export default class SiteService {
action: action
});
}
- // Check auth
- const authorizationSiteFilters = await AuthorizationService.checkAndGetSiteAuthorizationFilters(
+ // Check dynamic auth
+ const authorizationSiteFilters = await AuthorizationService.checkAndGetUpdateSiteAuthorizationFilters(
req.tenant, req.user, { ID: filteredRequest.id });
- // Get Site
+ // Get Site & check it exists
const site = await SiteStorage.getSite(
req.user.tenantID, filteredRequest.id, authorizationSiteFilters.filters);
UtilsService.assertObjectExists(action, site, `Site with ID '${filteredRequest.id}' does not exist`,
MODULE_NAME, 'handleUpdateSite', req.user);
// OCPI Site
- if (!company.issuer) {
+ if (!site.issuer) {
throw new AppError({
source: Constants.CENTRAL_SERVER,
errorCode: HTTPError.GENERAL_ERROR,

MODIFY
test/api/SiteOrgTest.ts
test/api/SiteOrgTest.ts
@@ -303,64 +303,82 @@ describe('Site tests', function() {
}
});
- it('Should not be able to update a site', async () => {
- try {
+ it('Should not be able to update a site he is assigned to', async () => {
// Change entity
testData.createdSites[0].name = 'New Name';
- // Update
- await testData.userService.updateEntity(
+ // Try to update
+ try {
+ const updateResult = await testData.userService.updateEntity(
testData.userService.siteApi,
testData.createdSites[0]
);
+ expect(updateResult.status).to.not.eq(200);
} catch (error) {
expect(error.actual).to.eq(403);
}
});
- it('Should be able to update the site for which he is site admin', async () => {
+ it('Should not be able to update a site he is not assigned to', async () => {
+ // Change entity
+ testData.createdSites[1].name = 'New Name';
+ // Try to update
+ try {
+ const updateResult = await testData.userService.updateEntity(
+ testData.userService.siteApi,
+ testData.createdSites[1]
+ );
+ expect(updateResult.status).to.not.eq(200);
+ } catch (error) {
+ expect(error.actual).to.eq(403);
+ }
+ });
+
+ it('Should be able to update a site for which he is site admin', async () => {
// Change entity
testData.createdSites[2].name = 'New Name';
// Update
- await testData.userService.updateEntity(
+ const updateResult = await testData.userService.updateEntity(
testData.userService.siteApi,
testData.createdSites[2]
);
+ expect(updateResult.status).to.eq(200);
});
- it('Should be able to update the site for which he is site owner', async () => {
+ it('Should not be able to update a site for which he is site owner', async () => {
// Change entity
testData.createdSites[3].name = 'New Name';
- // Update
- await testData.userService.updateEntity(
+ // Try to update
+ try {
+ const updateResult = await testData.userService.updateEntity(
testData.userService.siteApi,
testData.createdSites[3]
);
+ expect(updateResult.status).to.not.eq(200);
+ } catch (error) {
+ expect(error.actual).to.eq(403);
+ }
+ });
+ it('Should not be able to assign a user to a site he is assigned to', async () => {
+ const assignmentResult = await assignUserToSite(ContextDefinition.USER_CONTEXTS.DEFAULT_ADMIN, testData.createdSites[0]);
+ expect(assignmentResult.status).to.eq(403);
});
- it('Should not be able to assign a user to a site if he is not site admin or site owner', async () => {
+ it('Should not be able to assign a user to a site he is not assigned to', async () => {
const assignmentResult = await assignUserToSite(ContextDefinition.USER_CONTEXTS.DEFAULT_ADMIN, testData.createdSites[1]);
expect(assignmentResult.status).to.eq(403);
});
- it('Should be able to assign a user to a site if he is site admin', async () => {
+ it('Should not be able to assign a user to a site for which he is site admin', async () => {
const assignmentResult = await assignUserToSite(ContextDefinition.USER_CONTEXTS.DEFAULT_ADMIN, testData.createdSites[2]);
- expect(assignmentResult.status).to.eq(200);
- const res = await testData.userService.siteApi.readUsersForSite(testData.createdSites[2].id);
- expect(res.data.count).to.eq(2); // the site admin & the assigned user
- const userContext = await testData.tenantContext.getUserContext(ContextDefinition.USER_CONTEXTS.BASIC_USER);
- expect(res.data.result.map((site) => site.user.id)).to.contain(userContext.id);
+ expect(assignmentResult.status).to.eq(403);
});
- it('Should be able to assign a user to a site if he is site owner', async () => {
+ it('Should not be able to assign a user to a site for which he is site owner', async () => {
const assignmentResult = await assignUserToSite(ContextDefinition.USER_CONTEXTS.DEFAULT_ADMIN, testData.createdSites[3]);
- expect(assignmentResult.status).to.eq(200);
- const res = await testData.userService.siteApi.readUsersForSite(testData.createdSites[3].id);
- expect(res.data.count).to.eq(2); // the site owner & the assigned user
- const userContext = await testData.tenantContext.getUserContext(ContextDefinition.USER_CONTEXTS.BASIC_USER);
- expect(res.data.result.map((site) => site.user.id)).to.contain(userContext.id);
+ expect(assignmentResult.status).to.eq(403);
});
- it('Should not be able to delete a site he is assigned to if he is not site admin or site owner', async () => {
+ it('Should not be able to delete a site he is assigned to', async () => {
try {
await testData.userService.deleteEntity(
testData.userService.siteApi,
@@ -382,18 +400,26 @@ describe('Site tests', function() {
}
});
- it('Should be able to delete the site for which he is site admin', async () => {
+ it('Should not be able to delete a site for which he is site admin', async () => {
+ try {
await testData.userService.deleteEntity(
testData.userService.siteApi,
testData.createdSites[2]
);
+ } catch (error) {
+ expect(error.actual).to.eq(403);
+ }
});
- it('Should be able to delete the site for which he is site owner', async () => {
+ it('Should not be able to delete a site for which he is site owner', async () => {
+ try {
await testData.userService.deleteEntity(
testData.userService.siteApi,
testData.createdSites[3]
);
+ } catch (error) {
+ expect(error.actual).to.eq(403);
+ }
});
});

Update logic according to Excel. Simplify some code.