realm-object-server/dist/integration-tests/permissions/server-apply-permissions-tests.spec.js

Realm Object Server

"use strict";
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : new P(function (resolve) { resolve(result.value); }).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
Object.defineProperty(exports, "__esModule", { value: true });
const TestServer_1 = require("../../TestServer");
const auth = require("../../auth");
const chai_1 = require("chai");
const chai = require("chai");
chai.use(require("chai-as-promised"));
const superagent = require("superagent");
const realmUtil_1 = require("../../shared/realmUtil");
const uuid = require("uuid");
const URI = require("urijs");
const assert_1 = require("assert");
const ProductSchema = {
    name: "Product",
    primaryKey: "productId",
    properties: {
        productId: { type: "int", optional: false },
        name: { type: "string", optional: false },
        price: { type: "float", optional: false }
    }
};
describe("Server applyPermissions Tests", function () {
    let server;
    let authAccessTokenUrl;
    const createRealm = (path) => __awaiter(this, void 0, void 0, function* () {
        const adminCredentials = realmUtil_1.Realm.Sync.Credentials.adminToken(server.adminToken);
        const user = realmUtil_1.Realm.Sync.User.login(server.url, adminCredentials);
        const realm = new realmUtil_1.Realm({
            sync: {
                user: user,
                url: `realm://${server.address}${path}`
            },
            schema: [ProductSchema]
        });
        yield realm.syncSession.uploadAllLocalChanges();
    });
    const verifyPermissions = (path, token, permissions) => __awaiter(this, void 0, void 0, function* () {
        const expectedStatus = permissions.length === 0 ? 403 : 200;
        const response = yield superagent
            .post(authAccessTokenUrl)
            .send({
            path,
            data: token,
            provider: "realm"
        })
            .ok(res => res.status === expectedStatus);
        if (permissions.length > 0) {
            chai_1.expect(response.body["access_token"]).to.be.not.undefined;
            chai_1.expect(response.body["access_token"]["token_data"]).to.be.not.undefined;
            chai_1.expect(response.body["access_token"]["token_data"]["access"]).to.exist;
            const access = response.body["access_token"]["token_data"]["access"];
            chai_1.expect(access).deep.equal(permissions);
        }
        else {
            chai_1.expect(response.body.code).to.equal(614);
            chai_1.expect(response.body.status).to.equal(403);
            chai_1.expect(response.status).to.equal(403);
        }
    });
    before(() => __awaiter(this, void 0, void 0, function* () {
        server = new TestServer_1.TestServer();
        yield server.start({
            authProviders: [new auth.PasswordAuthProvider({ iterations: 1 }), new auth.AnonymousAuthProvider()]
        });
        authAccessTokenUrl = new URI(server.url).segment("auth").toString();
    }));
    after(() => __awaiter(this, void 0, void 0, function* () {
        yield server.shutdown();
    }));
    describe("apply wildcard permissions", () => {
        describe("on a global Realm", () => {
            it("should grant and revoke permissions", () => __awaiter(this, void 0, void 0, function* () {
                const path = `/${uuid.v4()}`;
                yield createRealm(path);
                const userA = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const userB = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const result = yield server.applyPermissions({ userId: "*" }, path, "read");
                chai_1.expect(result.affectedUsers).to.equal(-1);
                yield verifyPermissions(path, userA.token, ["download"]);
                yield verifyPermissions(path, userB.token, ["download"]);
                yield server.applyPermissions({ userId: "*" }, path, "write");
                yield verifyPermissions(path, userA.token, ["download", "upload"]);
                yield verifyPermissions(path, userB.token, ["download", "upload"]);
                yield server.applyPermissions({ userId: "*" }, path, "admin");
                yield verifyPermissions(path, userA.token, ["download", "upload", "manage"]);
                yield verifyPermissions(path, userB.token, ["download", "upload", "manage"]);
                yield server.applyPermissions({ userId: "*" }, path, "write");
                yield verifyPermissions(path, userA.token, ["download", "upload"]);
                yield verifyPermissions(path, userB.token, ["download", "upload"]);
                yield server.applyPermissions({ userId: "*" }, path, "read");
                yield verifyPermissions(path, userA.token, ["download"]);
                yield verifyPermissions(path, userB.token, ["download"]);
                yield server.applyPermissions({ userId: "*" }, path, "none");
                yield verifyPermissions(path, userA.token, []);
                yield verifyPermissions(path, userB.token, []);
            }));
        });
        describe("on a user Realm", () => {
            it("should grant and revoke permissions", () => __awaiter(this, void 0, void 0, function* () {
                const userA = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const path = `/${userA.identity}/${uuid.v4()}`;
                yield createRealm(path);
                const userB = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const result = yield server.applyPermissions({ userId: "*" }, path, "read");
                chai_1.expect(result.affectedUsers).to.equal(-1);
                yield verifyPermissions(path, userA.token, ["download"]);
                yield verifyPermissions(path, userB.token, ["download"]);
                yield server.applyPermissions({ userId: "*" }, path, "write");
                yield verifyPermissions(path, userA.token, ["download", "upload"]);
                yield verifyPermissions(path, userB.token, ["download", "upload"]);
                yield server.applyPermissions({ userId: "*" }, path, "admin");
                yield verifyPermissions(path, userA.token, ["download", "upload", "manage"]);
                yield verifyPermissions(path, userB.token, ["download", "upload", "manage"]);
                yield server.applyPermissions({ userId: "*" }, path, "write");
                yield verifyPermissions(path, userA.token, ["download", "upload"]);
                yield verifyPermissions(path, userB.token, ["download", "upload"]);
                yield server.applyPermissions({ userId: "*" }, path, "read");
                yield verifyPermissions(path, userA.token, ["download"]);
                yield verifyPermissions(path, userB.token, ["download"]);
                yield server.applyPermissions({ userId: "*" }, path, "none");
                yield verifyPermissions(path, userA.token, []);
                yield verifyPermissions(path, userB.token, []);
            }));
        });
    });
    describe("apply userId permissions", () => {
        describe("on a global Realm", () => {
            it("should grant and revoke user permissions", () => __awaiter(this, void 0, void 0, function* () {
                const path = `/${uuid.v4()}`;
                yield createRealm(path);
                const grantee = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const randomUser = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const result = yield server.applyPermissions({ userId: grantee.identity }, path, "read");
                chai_1.expect(result.affectedUsers).to.equal(1);
                yield verifyPermissions(path, grantee.token, ["download"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions({ userId: grantee.identity }, path, "write");
                yield verifyPermissions(path, grantee.token, ["download", "upload"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions({ userId: grantee.identity }, path, "admin");
                yield verifyPermissions(path, grantee.token, ["download", "upload", "manage"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions({ userId: grantee.identity }, path, "write");
                yield verifyPermissions(path, grantee.token, ["download", "upload"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions({ userId: grantee.identity }, path, "read");
                yield verifyPermissions(path, grantee.token, ["download"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions({ userId: grantee.identity }, path, "none");
                yield verifyPermissions(path, grantee.token, []);
                yield verifyPermissions(path, randomUser.token, []);
            }));
        });
        describe("on a user Realm", () => {
            it("should grant and revoke permissions", () => __awaiter(this, void 0, void 0, function* () {
                const userA = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const path = `/${userA.identity}/${uuid.v4()}`;
                yield createRealm(path);
                const grantee = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const randomUser = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const result = yield server.applyPermissions({ userId: grantee.identity }, path, "read");
                chai_1.expect(result.affectedUsers).to.equal(1);
                yield verifyPermissions(path, grantee.token, ["download"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions({ userId: grantee.identity }, path, "write");
                yield verifyPermissions(path, grantee.token, ["download", "upload"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions({ userId: grantee.identity }, path, "admin");
                yield verifyPermissions(path, grantee.token, ["download", "upload", "manage"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions({ userId: grantee.identity }, path, "write");
                yield verifyPermissions(path, grantee.token, ["download", "upload"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions({ userId: grantee.identity }, path, "read");
                yield verifyPermissions(path, grantee.token, ["download"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions({ userId: grantee.identity }, path, "none");
                yield verifyPermissions(path, grantee.token, []);
                yield verifyPermissions(path, randomUser.token, []);
            }));
        });
    });
    describe("apply metadata permissions", () => {
        const applyMetadata = (user, value) => __awaiter(this, void 0, void 0, function* () {
            const adminRealm = yield server.openRealm("/__admin");
            const realmUser = adminRealm.objectForPrimaryKey("User", user.identity);
            adminRealm.write(() => {
                realmUser.metadata.push({
                    key: "foo",
                    value: value
                });
            });
            adminRealm.close();
        });
        describe("on a global Realm", () => {
            it("should grant and revoke user permissions", () => __awaiter(this, void 0, void 0, function* () {
                const path = `/${uuid.v4()}`;
                yield createRealm(path);
                const granteeA = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const granteeB = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const randomUser = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const metadataValue = uuid.v4();
                yield applyMetadata(granteeA, metadataValue);
                yield applyMetadata(granteeB, metadataValue);
                const condition = { metadataKey: "foo", metadataValue: metadataValue };
                const result = yield server.applyPermissions(condition, path, "read");
                chai_1.expect(result.affectedUsers).to.equal(2);
                yield verifyPermissions(path, granteeA.token, ["download"]);
                yield verifyPermissions(path, granteeB.token, ["download"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions(condition, path, "write");
                yield verifyPermissions(path, granteeA.token, ["download", "upload"]);
                yield verifyPermissions(path, granteeB.token, ["download", "upload"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions(condition, path, "admin");
                yield verifyPermissions(path, granteeA.token, ["download", "upload", "manage"]);
                yield verifyPermissions(path, granteeB.token, ["download", "upload", "manage"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions(condition, path, "write");
                yield verifyPermissions(path, granteeA.token, ["download", "upload"]);
                yield verifyPermissions(path, granteeB.token, ["download", "upload"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions(condition, path, "read");
                yield verifyPermissions(path, granteeA.token, ["download"]);
                yield verifyPermissions(path, granteeB.token, ["download"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions(condition, path, "none");
                yield verifyPermissions(path, granteeA.token, []);
                yield verifyPermissions(path, granteeB.token, []);
                yield verifyPermissions(path, randomUser.token, []);
            }));
        });
        describe("on a user Realm", () => {
            it("should grant and revoke permissions", () => __awaiter(this, void 0, void 0, function* () {
                const userA = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const path = `/${userA.identity}/${uuid.v4()}`;
                yield createRealm(path);
                const granteeA = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const granteeB = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const randomUser = yield realmUtil_1.Realm.Sync.User.login(server.url, realmUtil_1.Realm.Sync.Credentials.anonymous());
                const metadataValue = uuid.v4();
                yield applyMetadata(granteeA, metadataValue);
                yield applyMetadata(granteeB, metadataValue);
                const condition = { metadataKey: "foo", metadataValue: metadataValue };
                const result = yield server.applyPermissions(condition, path, "read");
                chai_1.expect(result.affectedUsers).to.equal(2);
                yield verifyPermissions(path, granteeA.token, ["download"]);
                yield verifyPermissions(path, granteeB.token, ["download"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions(condition, path, "write");
                yield verifyPermissions(path, granteeA.token, ["download", "upload"]);
                yield verifyPermissions(path, granteeB.token, ["download", "upload"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions(condition, path, "admin");
                yield verifyPermissions(path, granteeA.token, ["download", "upload", "manage"]);
                yield verifyPermissions(path, granteeB.token, ["download", "upload", "manage"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions(condition, path, "write");
                yield verifyPermissions(path, granteeA.token, ["download", "upload"]);
                yield verifyPermissions(path, granteeB.token, ["download", "upload"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions(condition, path, "read");
                yield verifyPermissions(path, granteeA.token, ["download"]);
                yield verifyPermissions(path, granteeB.token, ["download"]);
                yield verifyPermissions(path, randomUser.token, []);
                yield server.applyPermissions(condition, path, "none");
                yield verifyPermissions(path, granteeA.token, []);
                yield verifyPermissions(path, granteeB.token, []);
                yield verifyPermissions(path, randomUser.token, []);
            }));
        });
    });
    describe("invalid parameters", () => {
        it("non-existent Realm", () => __awaiter(this, void 0, void 0, function* () {
            const path = `/${uuid.v4()}`;
            try {
                yield server.applyPermissions({ userId: "*" }, path, "read");
                assert_1.fail("Expected to throw an error");
            }
            catch (e) {
                chai_1.expect(e.code).to.equal(601);
                chai_1.expect(e.invalidParams.length).to.equal(1);
                chai_1.expect(e.invalidParams[0].name).to.equal("realmPath");
                chai_1.expect(e.invalidParams[0].reason).to.contain(path).and.to.contain("does not exist");
            }
        }));
        it("no path", () => __awaiter(this, void 0, void 0, function* () {
            try {
                yield server.applyPermissions({ userId: "*" }, undefined, "read");
                assert_1.fail("Expected to throw an error");
            }
            catch (e) {
                chai_1.expect(e.code).to.equal(602);
                chai_1.expect(e.invalidParams.length).to.equal(1);
                chai_1.expect(e.invalidParams[0].name).to.equal("realmPath");
            }
        }));
        it("no condition", () => __awaiter(this, void 0, void 0, function* () {
            try {
                yield server.applyPermissions(undefined, "some-path", "read");
                assert_1.fail("Expected to throw an error");
            }
            catch (e) {
                chai_1.expect(e.code).to.equal(602);
                chai_1.expect(e.invalidParams.length).to.equal(1);
                chai_1.expect(e.invalidParams[0].name).to.equal("condition");
            }
        }));
        it("invalid condition", () => __awaiter(this, void 0, void 0, function* () {
            try {
                yield server.applyPermissions({ foo: "bar" }, "/__admin", "read");
                assert_1.fail("Expected to throw an error");
            }
            catch (e) {
                chai_1.expect(e.code).to.equal(601);
                chai_1.expect(e.invalidParams.length).to.equal(1);
                chai_1.expect(e.invalidParams[0].name).to.equal("condition");
            }
        }));
        it("no access level", () => __awaiter(this, void 0, void 0, function* () {
            try {
                yield server.applyPermissions({ userId: "*" }, "some-path", undefined);
                assert_1.fail("Expected to throw an error");
            }
            catch (e) {
                chai_1.expect(e.code).to.equal(601);
                chai_1.expect(e.invalidParams.length).to.equal(1);
                chai_1.expect(e.invalidParams[0].name).to.equal("accessLevel");
            }
        }));
        it("invalid access level", () => __awaiter(this, void 0, void 0, function* () {
            try {
                yield server.applyPermissions({ userId: "*" }, "some-path", "foo");
                assert_1.fail("Expected to throw an error");
            }
            catch (e) {
                chai_1.expect(e.code).to.equal(601);
                chai_1.expect(e.invalidParams.length).to.equal(1);
                chai_1.expect(e.invalidParams[0].name).to.equal("accessLevel");
            }
        }));
    });
});
//# sourceMappingURL=server-apply-permissions-tests.spec.js.map