Skip to content
Snippets Groups Projects
Commit b118eeae authored by joel.vonderwe's avatar joel.vonderwe
Browse files

Change getAssignment to accept both a secret or a logged user

parent 5adda6d7
No related branches found
No related tags found
No related merge requests found
Pipeline #32770 passed
...@@ -2,6 +2,7 @@ ...@@ -2,6 +2,7 @@
<project version="4"> <project version="4">
<component name="VcsDirectoryMappings"> <component name="VcsDirectoryMappings">
<mapping directory="$PROJECT_DIR$/.." vcs="Git" /> <mapping directory="$PROJECT_DIR$/.." vcs="Git" />
<mapping directory="$PROJECT_DIR$/.idea/jetbrainsConfiguration" vcs="Git" />
<mapping directory="$PROJECT_DIR$/src/shared" vcs="Git" /> <mapping directory="$PROJECT_DIR$/src/shared" vcs="Git" />
</component> </component>
</project> </project>
\ No newline at end of file
...@@ -5,6 +5,9 @@ import db from '../helpers/DatabaseHelper'; ...@@ -5,6 +5,9 @@ import db from '../helpers/DatabaseHelper';
class AssignmentManager { class AssignmentManager {
async isUserAllowedToAccessAssignment(assignment: Assignment, user: User): Promise<boolean> { async isUserAllowedToAccessAssignment(assignment: Assignment, user: User): Promise<boolean> {
if (user === null || user === undefined) {
return false;
}
if ( !assignment.staff ) { if ( !assignment.staff ) {
assignment.staff = await db.assignment.findUnique({ assignment.staff = await db.assignment.findUnique({
where: { where: {
......
...@@ -21,6 +21,9 @@ class SecurityMiddleware { ...@@ -21,6 +21,9 @@ class SecurityMiddleware {
for ( const checkType of checkTypes ) { for ( const checkType of checkTypes ) {
try { try {
switch ( String(checkType) ) { switch ( String(checkType) ) {
case SecurityCheckType.USER:
isAllowed = isAllowed || (req.session.profile !== null && req.session.profile !== undefined);
break;
case SecurityCheckType.TEACHING_STAFF: case SecurityCheckType.TEACHING_STAFF:
isAllowed = isAllowed || req.session.profile.isTeachingStaff; isAllowed = isAllowed || req.session.profile.isTeachingStaff;
break; break;
......
...@@ -71,7 +71,7 @@ class AssignmentRoutes implements RoutesManager { ...@@ -71,7 +71,7 @@ class AssignmentRoutes implements RoutesManager {
registerOnBackend(backend: Express) { registerOnBackend(backend: Express) {
backend.get('/assignments/languages', this.getLanguages.bind(this)); backend.get('/assignments/languages', this.getLanguages.bind(this));
backend.get('/assignments/:assignmentNameOrUrl', SecurityMiddleware.check(true), this.getAssignment.bind(this)); backend.get('/assignments/:assignmentNameOrUrl', SecurityMiddleware.check(false, SecurityCheckType.ASSIGNMENT_SECRET, SecurityCheckType.USER), this.getAssignment.bind(this));
backend.post('/assignments', SecurityMiddleware.check(true, SecurityCheckType.TEACHING_STAFF), ParamsValidatorMiddleware.validate(this.assignmentValidator), this.createAssignment.bind(this)); backend.post('/assignments', SecurityMiddleware.check(true, SecurityCheckType.TEACHING_STAFF), ParamsValidatorMiddleware.validate(this.assignmentValidator), this.createAssignment.bind(this));
backend.patch('/assignments/:assignmentNameOrUrl/publish', SecurityMiddleware.check(true, SecurityCheckType.ASSIGNMENT_STAFF), this.changeAssignmentPublishedStatus(true).bind(this)); backend.patch('/assignments/:assignmentNameOrUrl/publish', SecurityMiddleware.check(true, SecurityCheckType.ASSIGNMENT_STAFF), this.changeAssignmentPublishedStatus(true).bind(this));
...@@ -91,7 +91,6 @@ class AssignmentRoutes implements RoutesManager { ...@@ -91,7 +91,6 @@ class AssignmentRoutes implements RoutesManager {
delete assignment.gitlabCreationInfo; delete assignment.gitlabCreationInfo;
delete assignment.gitlabLastInfo; delete assignment.gitlabLastInfo;
delete assignment.gitlabLastInfoDate; delete assignment.gitlabLastInfoDate;
delete assignment.useSonar;
delete assignment.staff; delete assignment.staff;
delete assignment.exercises; delete assignment.exercises;
} }
......
Subproject commit 4d1e63ebbbe7e6fec1de74d79a2919047eea5775 Subproject commit bf8d6180e6d86bf97bd8e8b16ee00826172ed287
...@@ -4,6 +4,7 @@ enum SecurityCheckType { ...@@ -4,6 +4,7 @@ enum SecurityCheckType {
ASSIGNMENT_IS_PUBLISHED = 'assignmentIsPublished', ASSIGNMENT_IS_PUBLISHED = 'assignmentIsPublished',
EXERCISE_SECRET = 'exerciseSecret', EXERCISE_SECRET = 'exerciseSecret',
ASSIGNMENT_SECRET = 'assignmentSecret', ASSIGNMENT_SECRET = 'assignmentSecret',
USER = 'user',
} }
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment