From 1428b4f3926ebbb2d068e434fb93a1cd234ef9df Mon Sep 17 00:00:00 2001 From: juhanikat Date: Mon, 28 Oct 2024 11:02:46 +0200 Subject: [PATCH 1/2] updated userRights tests and documentation and added id value for delete button --- cypress/e2e/userRights.cy.js | 42 +++++++++++++++++-- documentation/user_rights.md | 4 +- .../src/components/DetailView/DetailView.tsx | 8 +++- 3 files changed, 48 insertions(+), 6 deletions(-) diff --git a/cypress/e2e/userRights.cy.js b/cypress/e2e/userRights.cy.js index a4c5f19b..886dfe44 100644 --- a/cypress/e2e/userRights.cy.js +++ b/cypress/e2e/userRights.cy.js @@ -5,7 +5,7 @@ before('Reset database', () => { describe('Broadly test what different user rights see', () => { describe('Admin visibility', () => { beforeEach('Login as admin', () => { - cy.session('admin-session', () => {}) + cy.session('admin-session', () => { }) cy.login('testSu') }) it('Sees new button in tableviews', () => { @@ -14,28 +14,34 @@ describe('Broadly test what different user rights see', () => { cy.contains('Time Unit') cy.contains('Creating new locality') }) - it('Region works', () => { + it('Regions view shows correctly', () => { cy.get('div[id="/admin-menu-button"]').click() cy.contains('Regions').click() cy.contains('region 4452477e') cy.get('[data-cy="detailview-button-1"]').first().click() cy.contains('Regional Coordinators') cy.contains('prs') + cy.get('[id="edit-button"]').should('exist') + cy.get('[id="delete-button"]').should('exist') }) - it('Project works', () => { + it('Projects view shows correctly', () => { cy.get('div[id="/admin-menu-button"]').click() cy.get('a[id="/project-menu-link"]').click() cy.contains('Workgroup on Insectivores') cy.get('[data-cy="detailview-button-3"]').first().click() cy.contains('Coordinator') cy.contains('NOW Database') + cy.get('[id="edit-button"]').should('exist') + cy.get('[id="delete-button"]').should('exist') }) - it('Time Bound works', () => { + it('Time Bound view shows correctly', () => { cy.contains('Time Bounds').click() cy.contains('C2N-y') cy.get('[data-cy="detailview-button-11"]').first().click() cy.contains('Bound') cy.contains('1.778') + cy.get('[id="edit-button"]').should('exist') + cy.get('[id="delete-button"]').should('exist') }) it('Email page opens', () => { cy.get('div[id="/admin-menu-button"]').click() @@ -63,5 +69,33 @@ describe('Broadly test what different user rights see', () => { it('Does not see email page', () => { cy.pageForbidden('/email') }) + it('Does not see the New button in table view', () => { + cy.visit('/locality') + cy.contains('New').should('not.exist') + cy.visit('/species') + cy.contains('New').should('not.exist') + cy.visit('/reference') + cy.contains('New').should('not.exist') + cy.visit('/time-unit') + cy.contains('New').should('not.exist') + }) + it('Does not see edit or delete buttons in detailview', () => { + cy.visit('locality/20920') + cy.contains('Lantian-Shuijiazui') + cy.get('[id="edit-button"]').should('not.exist') + cy.get('[id="delete-button"]').should('not.exist') + cy.visit('species/21052') + cy.contains('Simplomys simplicidens') + cy.get('[id="edit-button"]').should('not.exist') + cy.get('[id="delete-button"]').should('not.exist') + cy.visit('reference/10039') + cy.contains('A new geomagnetic polarity time scale') + cy.get('[id="edit-button"]').should('not.exist') + cy.get('[id="delete-button"]').should('not.exist') + cy.visit('time-unit/bahean') + cy.contains('Bahean') + cy.get('[id="edit-button"]').should('not.exist') + cy.get('[id="delete-button"]').should('not.exist') + }) }) }) diff --git a/documentation/user_rights.md b/documentation/user_rights.md index 01d51fa8..e460494d 100644 --- a/documentation/user_rights.md +++ b/documentation/user_rights.md @@ -48,7 +48,9 @@ Any user can get a list of reference types. Any user can view the details of a reference. -References cannot be created, updated or deleted by anyone at the moment. +Creating or updating a reference requires the **Admin** or **EditUnrestricted** roles. + +Deleting a reference requires the **Admin** role. ## Time Unit diff --git a/frontend/src/components/DetailView/DetailView.tsx b/frontend/src/components/DetailView/DetailView.tsx index c77cd8d4..17888400 100644 --- a/frontend/src/components/DetailView/DetailView.tsx +++ b/frontend/src/components/DetailView/DetailView.tsx @@ -177,7 +177,13 @@ export const DetailView = ({ )} {editRights.delete && !isNew && ( - )} From e743c83948363332a40a7b32c999210031bae3cb Mon Sep 17 00:00:00 2001 From: juhanikat Date: Mon, 28 Oct 2024 11:21:03 +0200 Subject: [PATCH 2/2] add tests for permissions when creating reference --- backend/src/api-tests/reference/create.test.ts | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/backend/src/api-tests/reference/create.test.ts b/backend/src/api-tests/reference/create.test.ts index 96b0a742..d2727898 100644 --- a/backend/src/api-tests/reference/create.test.ts +++ b/backend/src/api-tests/reference/create.test.ts @@ -2,7 +2,7 @@ import { beforeEach, beforeAll, afterAll, describe, it, expect } from '@jest/glo import { ReferenceDetailsType } from '../../../../frontend/src/backendTypes' //import { LogRow } from '../../services/write/writeOperations/types' import { newReferenceBasis } from './data' -import { login, resetDatabase, send, /*testLogRows,*/ resetDatabaseTimeout } from '../utils' +import { login, logout, resetDatabase, send, /*testLogRows,*/ resetDatabaseTimeout } from '../utils' import { pool } from '../../utils/db' //let createdRef: ReferenceDetailsType | null = null @@ -29,8 +29,22 @@ describe('Creating new reference works', () => { const { status: getReqStat } = await send(`reference/${createdId}`, 'GET') expect(getReqStat).toEqual(200) + }) - //console.log(createdRef) + it('Creation fails without permissions', async () => { + logout() + const { body: resultBody1, status: getReqStatus1 } = await send('reference/', 'PUT', { + reference: { ...newReferenceBasis }, + }) + expect(resultBody1).toEqual({}) + expect(getReqStatus1).toEqual(403) + + await login('testEr') + const { body: resultBody2, status: getReqStatus2 } = await send('reference/', 'PUT', { + reference: { ...newReferenceBasis }, + }) + expect(resultBody2).toEqual({}) + expect(getReqStatus2).toEqual(403) }) /* it('Contains correct data', () => {