Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-02-03 23:00:14 -05:00
Code Issues Activity

Added the newsletter API permissions

Browse source 
refs https://github.com/TryGhost/Team/issues/1463

- Allow admins to perform all newsletter operations
- We can adjust and be more permissive in the future if needed
- Added the tests back as permissions are configured correctly now
This commit is contained in:
Thibaut Patel 2022-03-31 10:52:04 +02:00 • committed by Thibaut Patel
parent ae54352a29
commit fdb0e3d44d
5 changed files with 123 additions and 75 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
core/server/data/migrations/versions/4.42/2022-03-30-15-44-add-newsletter-permissions.js Normal file
View file

@ -0,0 +1,28 @@
const {
addPermissionWithRoles,
combineTransactionalMigrations
} = require('../../utils');
module.exports = combineTransactionalMigrations(
addPermissionWithRoles({
name: 'Browse newsletters',
action: 'browse',
object: 'newsletter'
}, [
'Administrator'
]),
addPermissionWithRoles({
name: 'Add newsletters',
action: 'add',
object: 'newsletter'
}, [
'Administrator'
]),
addPermissionWithRoles({
name: 'Edit newsletters',
action: 'edit',
object: 'newsletter'
}, [
'Administrator'
])
);

132
test/e2e-api/admin/newsletters.test.js
View file

@ -21,76 +21,76 @@ describe('Newsletters API', function () {
mockManager.restore(); mockManager.restore();
}); });
// it('Can add a newsletter', async function () { it('Can add a newsletter', async function () {
// const newsletter = { const newsletter = {
// name: 'My test newsletter', name: 'My test newsletter',
// sender_name: 'Test', sender_name: 'Test',
// sender_email: 'test@example.com', sender_email: 'test@example.com',
// sender_reply_to: 'test@example.com', sender_reply_to: 'test@example.com',
// default: false, default: false,
// status: 'active', status: 'active',
// recipient_filter: '', recipient_filter: '',
// subscribe_on_signup: true, subscribe_on_signup: true,
// sort_order: 0 sort_order: 0
// }; };
// await agent await agent
// .post(`newsletters/`) .post(`newsletters/`)
// .body({newsletters: [newsletter]}) .body({newsletters: [newsletter]})
// .expectStatus(201) .expectStatus(201)
// .matchBodySnapshot({ .matchBodySnapshot({
// newsletters: [newsletterSnapshot] newsletters: [newsletterSnapshot]
// }) })
// .matchHeaderSnapshot({ .matchHeaderSnapshot({
// etag: anyEtag, etag: anyEtag,
// location: anyString location: anyString
// }); });
// await agent.get('newsletters/') await agent.get('newsletters/')
// .expectStatus(200) .expectStatus(200)
// .matchBodySnapshot({ .matchBodySnapshot({
// newsletters: [newsletterSnapshot] newsletters: [newsletterSnapshot]
// }) })
// .matchHeaderSnapshot({ .matchHeaderSnapshot({
// etag: anyEtag etag: anyEtag
// }); });
// }); });
// it('Can browse newsletters', async function () { it('Can browse newsletters', async function () {
// await agent.get('newsletters/') await agent.get('newsletters/')
// .expectStatus(200) .expectStatus(200)
// .matchBodySnapshot({ .matchBodySnapshot({
// newsletters: [newsletterSnapshot] newsletters: [newsletterSnapshot]
// }) })
// .matchHeaderSnapshot({ .matchHeaderSnapshot({
// etag: anyEtag etag: anyEtag
// }); });
// }); });
// it('Can edit newsletters', async function () { it('Can edit newsletters', async function () {
// const res = await agent.get('newsletters?limit=1') const res = await agent.get('newsletters?limit=1')
// .expectStatus(200) .expectStatus(200)
// .matchBodySnapshot({ .matchBodySnapshot({
// newsletters: [newsletterSnapshot] newsletters: [newsletterSnapshot]
// }) })
// .matchHeaderSnapshot({ .matchHeaderSnapshot({
// etag: anyEtag etag: anyEtag
// }); });
// const id = res.body.newsletters[0].id; const id = res.body.newsletters[0].id;
// await agent.put(`newsletters/${id}`) await agent.put(`newsletters/${id}`)
// .body({ .body({
// newsletters: [{ newsletters: [{
// name: 'Updated newsletter name' name: 'Updated newsletter name'
// }] }]
// }) })
// .expectStatus(200) .expectStatus(200)
// .matchBodySnapshot({ .matchBodySnapshot({
// newsletters: [newsletterSnapshot] newsletters: [newsletterSnapshot]
// }) })
// .matchHeaderSnapshot({ .matchHeaderSnapshot({
// etag: anyEtag etag: anyEtag
// }); });
// }); });
}); });

8
test/integration/migrations/migration.test.js
View file

@ -45,7 +45,7 @@ describe('Database Migration (special functions)', function () {
const permissions = this.obj; const permissions = this.obj;
// If you have to change this number, please add the relevant `havePermission` checks below // If you have to change this number, please add the relevant `havePermission` checks below
permissions.length.should.eql(92); permissions.length.should.eql(95);
permissions.should.havePermission('Export database', ['Administrator', 'DB Backup Integration']); permissions.should.havePermission('Export database', ['Administrator', 'DB Backup Integration']);
permissions.should.havePermission('Import database', ['Administrator', 'DB Backup Integration']); permissions.should.havePermission('Import database', ['Administrator', 'DB Backup Integration']);
@ -162,6 +162,10 @@ describe('Database Migration (special functions)', function () {
permissions.should.havePermission('Browse custom theme settings', ['Administrator']); permissions.should.havePermission('Browse custom theme settings', ['Administrator']);
permissions.should.havePermission('Edit custom theme settings', ['Administrator']); permissions.should.havePermission('Edit custom theme settings', ['Administrator']);
permissions.should.havePermission('Browse newsletters', ['Administrator']);
permissions.should.havePermission('Edit newsletters', ['Administrator']);
permissions.should.havePermission('Add newsletters', ['Administrator']);
}); });
describe('Populate', function () { describe('Populate', function () {
@ -219,7 +223,7 @@ describe('Database Migration (special functions)', function () {
result.roles.at(7).get('name').should.eql('Scheduler Integration'); result.roles.at(7).get('name').should.eql('Scheduler Integration');
// Permissions // Permissions
result.permissions.length.should.eql(92); result.permissions.length.should.eql(95);
result.permissions.toJSON().should.be.CompletePermissions(); result.permissions.toJSON().should.be.CompletePermissions();
}); });
}); });

12
test/unit/server/data/schema/fixtures/fixture-manager.test.js
View file

@ -162,18 +162,18 @@ describe('Migration Fixture Utils', function () {
fixtureManager.addFixturesForRelation(fixtures.relations[0]).then(function (result) { fixtureManager.addFixturesForRelation(fixtures.relations[0]).then(function (result) {
should.exist(result); should.exist(result);
result.should.be.an.Object(); result.should.be.an.Object();
result.should.have.property('expected', 82); result.should.have.property('expected', 83);
result.should.have.property('done', 82); result.should.have.property('done', 83);
// Permissions & Roles // Permissions & Roles
permsAllStub.calledOnce.should.be.true(); permsAllStub.calledOnce.should.be.true();
rolesAllStub.calledOnce.should.be.true(); rolesAllStub.calledOnce.should.be.true();
dataMethodStub.filter.callCount.should.eql(82); dataMethodStub.filter.callCount.should.eql(83);
dataMethodStub.find.callCount.should.eql(7); dataMethodStub.find.callCount.should.eql(7);
baseUtilAttachStub.callCount.should.eql(82); baseUtilAttachStub.callCount.should.eql(83);
fromItem.related.callCount.should.eql(82); fromItem.related.callCount.should.eql(83);
fromItem.find.callCount.should.eql(82); fromItem.find.callCount.should.eql(83);
done(); done();
}).catch(done); }).catch(done);

18
test/utils/fixtures/fixtures.json
View file

@ -532,6 +532,21 @@
"name": "Edit custom theme settings", "name": "Edit custom theme settings",
"action_type": "edit", "action_type": "edit",
"object_type": "custom_theme_setting" "object_type": "custom_theme_setting"
},
{
"name": "Browse newsletters",
"action_type": "browse",
"object_type": "newsletter"
},
{
"name": "Add newsletters",
"action_type": "add",
"object_type": "newsletter"
},
{
"name": "Edit newsletters",
"action_type": "edit",
"object_type": "newsletter"
} }
] ]
}, },
@ -792,7 +807,8 @@
"custom_theme_setting": "all", "custom_theme_setting": "all",
"offer": "all", "offer": "all",
"authentication": "resetAllPasswords", "authentication": "resetAllPasswords",
"members_stripe_connect": "auth" "members_stripe_connect": "auth",
"newsletter": "all"
}, },
"DB Backup Integration": { "DB Backup Integration": {
"db": "all" "db": "all"