Skip to content

Commit 0b23610

Browse files
awgeorgeawgeorge
committed
Upload spec for parse-community#3588 
1 parent db8594d commit 0b23610

File tree

3 files changed

+186
-10
lines changed

3 files changed

+186
-10
lines changed

‎spec/ParseUser.spec.js

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3537,4 +3537,68 @@ describe('Parse.User testing', () => {
35373537
expect(results.length).toBe(1);
35383538
}).then(done, done.fail);
35393539
});
3540+
3541+
describe('with privilaged user', () => {
3542+
let adminUser;
3543+
let normalUser;
3544+
3545+
beforeEach((done) => {
3546+
let adminRole;
3547+
return new Parse.Role("Administrator", new Parse.ACL()).save(null, { useMasterKey: true })
3548+
.then(role => adminRole = role)
3549+
.then(() => Parse.User.signUp('normal_user', 'secure'))
3550+
.then(loggedInUser => {
3551+
normalUser = loggedInUser
3552+
const managementRole = new Parse.Role("managementOf_user" + normalUser.id, new Parse.ACL(normalUser));
3553+
managementRole.getRoles().add(adminRole);
3554+
3555+
return managementRole.save(null, { useMasterKey: true }).then(() => {
3556+
const userACL = new Parse.ACL();
3557+
userACL.setPublicReadAccess(true);
3558+
userACL.setPublicWriteAccess(true); // Shouldn't be enforced
3559+
userACL.setReadAccess(managementRole, true);
3560+
userACL.setWriteAccess(managementRole, true);
3561+
3562+
return normalUser.setACL(userACL).save(null, { useMasterKey: true });
3563+
});
3564+
})
3565+
.then(() => Parse.User.signUp('administrator', 'secure'))
3566+
.then(loggedInUser => adminUser = loggedInUser)
3567+
.then(() => Parse.User.logIn(adminUser.get('username'), 'secure'))
3568+
.then(() => adminRole.getUsers().add(adminUser).save(null, {useMasterKey: true}))
3569+
.then(() => done());
3570+
});
3571+
3572+
it('admin should be able to update user', (done) => {
3573+
normalUser.set("username", "test");
3574+
normalUser.save().then(done, done.fail);
3575+
});
3576+
3577+
it('public should not be able to update user', (done) => {
3578+
Parse.User.logOut()
3579+
.then(() => {
3580+
normalUser.set("username", "test");
3581+
return normalUser.save().then(done.fail, done)
3582+
})
3583+
});
3584+
3585+
it('admin should be able to update user via REST with admin credentials', (done) => {
3586+
request.post({
3587+
url: 'http://localhost:8378/1/classes/_User',
3588+
json: true,
3589+
headers: {
3590+
'X-Parse-Application-Id': 'test',
3591+
'X-Parse-Javascript-Key': 'test',
3592+
'X-Parse-Session-Token': adminUser.getSessionToken()
3593+
},
3594+
body: {
3595+
username: "test"
3596+
}
3597+
}, function(err, res, body) {
3598+
expect(body.status).toBe(200);
3599+
done();
3600+
});
3601+
});
3602+
3603+
});
35403604
});

‎spec/UserPII.spec.js

Lines changed: 121 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,20 +8,37 @@ const request = require('request-promise');
88
const EMAIL = '[email protected]';
99
const ZIP = '10001';
1010
const SSN = '999-99-9999';
11+
const NICKNAME = 'PublicNickname';
1112

1213
describe('Personally Identifiable Information', () => {
1314
let user;
15+
let adminUser;
16+
let adminRole;
1417

1518
beforeEach(done => {
16-
return Parse.User.signUp('tester', 'abc')
19+
return new Parse.Role("Administrator", new Parse.ACL()).save(null, { useMasterKey: true })
20+
.then(role => adminRole = role)
21+
.then(() => Parse.User.signUp('tester', 'abc'))
1722
.then(loggedInUser => user = loggedInUser)
1823
.then(() => Parse.User.logIn(user.get('username'), 'abc'))
19-
.then(() => user
20-
.set('email', EMAIL)
21-
.set('zip', ZIP)
22-
.set('ssn', SSN)
23-
.save())
24-
.then(() => done());
24+
.then(() => {
25+
const managementRole = new Parse.Role("managementOf_user" + user.id, new Parse.ACL(user));
26+
managementRole.getRoles().add(adminRole);
27+
28+
return managementRole.save(null, { useMasterKey: true });
29+
}).then((managementRole) => {
30+
const userACL = new Parse.ACL();
31+
userACL.setPublicReadAccess(true);
32+
userACL.setReadAccess(managementRole, true);
33+
userACL.setWriteAccess(managementRole, true);
34+
35+
return user.set('email', EMAIL)
36+
.set('zip', ZIP)
37+
.set('ssn', SSN)
38+
.set('nickname', NICKNAME)
39+
.setACL(userACL)
40+
.save()})
41+
.then(() => done(), (e) => console.log(e));
2542
});
2643

2744
it('should be able to get own PII via API with object', (done) => {
@@ -50,6 +67,22 @@ describe('Personally Identifiable Information', () => {
5067
});
5168
});
5269

70+
it('should be able to get non PII via API with object', (done) => {
71+
Parse.User.logOut()
72+
.then(() => {
73+
const userObj = new (Parse.Object.extend(Parse.User));
74+
userObj.id = user.id;
75+
userObj.fetch().then(
76+
fetchedUser => {
77+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
78+
})
79+
.fail(e => {
80+
done.fail(JSON.stringify(e));
81+
})
82+
.done(() => done());
83+
});
84+
});
85+
5386
it('should be able to get PII via API with object using master key', (done) => {
5487
Parse.User.logOut()
5588
.then(() => {
@@ -63,7 +96,6 @@ describe('Personally Identifiable Information', () => {
6396
});
6497
});
6598

66-
6799
it('should be able to get own PII via API with Find', (done) => {
68100
new Parse.Query(Parse.User)
69101
.first()
@@ -236,7 +268,7 @@ describe('Personally Identifiable Information', () => {
236268
).done(() => done());
237269
});
238270

239-
it('should get PII via REST by ID with master key', (done) => {
271+
it('should get PII via REST by ID with master key', (done) => {
240272
request.get({
241273
url: `http://localhost:8378/1/classes/_User/${user.id}`,
242274
json: true,
@@ -270,6 +302,7 @@ describe('Personally Identifiable Information', () => {
270302
expect(fetchedUser.get('email')).toBe(EMAIL);
271303
expect(fetchedUser.get('zip')).toBe(ZIP);
272304
expect(fetchedUser.get('ssn')).toBe(SSN);
305+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
273306
done();
274307
}, e => done.fail(e));
275308
});
@@ -284,6 +317,7 @@ describe('Personally Identifiable Information', () => {
284317
expect(fetchedUser.get('email')).toBe(undefined);
285318
expect(fetchedUser.get('zip')).toBe(undefined);
286319
expect(fetchedUser.get('ssn')).toBe(undefined);
320+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
287321
}, e => console.error('error', e))
288322
.done(() => done());
289323
});
@@ -299,6 +333,7 @@ describe('Personally Identifiable Information', () => {
299333
expect(fetchedUser.get('email')).toBe(EMAIL);
300334
expect(fetchedUser.get('zip')).toBe(ZIP);
301335
expect(fetchedUser.get('ssn')).toBe(SSN);
336+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
302337
}, e => console.error('error', e))
303338
.done(() => done());
304339
});
@@ -312,6 +347,7 @@ describe('Personally Identifiable Information', () => {
312347
expect(fetchedUser.get('email')).toBe(EMAIL);
313348
expect(fetchedUser.get('zip')).toBe(ZIP);
314349
expect(fetchedUser.get('ssn')).toBe(SSN);
350+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
315351
done();
316352
});
317353
});
@@ -324,6 +360,7 @@ describe('Personally Identifiable Information', () => {
324360
expect(fetchedUser.get('email')).toBe(undefined);
325361
expect(fetchedUser.get('zip')).toBe(undefined);
326362
expect(fetchedUser.get('ssn')).toBe(undefined);
363+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
327364
done();
328365
})
329366
);
@@ -337,6 +374,7 @@ describe('Personally Identifiable Information', () => {
337374
expect(fetchedUser.get('email')).toBe(EMAIL);
338375
expect(fetchedUser.get('zip')).toBe(ZIP);
339376
expect(fetchedUser.get('ssn')).toBe(SSN);
377+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
340378
done();
341379
})
342380
);
@@ -350,6 +388,7 @@ describe('Personally Identifiable Information', () => {
350388
expect(fetchedUser.get('email')).toBe(EMAIL);
351389
expect(fetchedUser.get('zip')).toBe(ZIP);
352390
expect(fetchedUser.get('ssn')).toBe(SSN);
391+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
353392
done();
354393
});
355394
});
@@ -362,6 +401,7 @@ describe('Personally Identifiable Information', () => {
362401
expect(fetchedUser.get('email')).toBe(undefined);
363402
expect(fetchedUser.get('zip')).toBe(undefined);
364403
expect(fetchedUser.get('ssn')).toBe(undefined);
404+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
365405
done();
366406
})
367407
);
@@ -375,6 +415,7 @@ describe('Personally Identifiable Information', () => {
375415
expect(fetchedUser.get('email')).toBe(EMAIL);
376416
expect(fetchedUser.get('zip')).toBe(ZIP);
377417
expect(fetchedUser.get('ssn')).toBe(SSN);
418+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
378419
done();
379420
})
380421
);
@@ -395,6 +436,7 @@ describe('Personally Identifiable Information', () => {
395436
expect(fetchedUser.zip).toBe(undefined);
396437
expect(fetchedUser.ssn).toBe(undefined);
397438
expect(fetchedUser.email).toBe(undefined);
439+
expect(fetchedUser.nickname).toBe(NICKNAME);
398440
},
399441
e => console.error('error', e.message)
400442
).done(() => done());
@@ -416,6 +458,7 @@ describe('Personally Identifiable Information', () => {
416458
expect(fetchedUser.zip).toBe(ZIP);
417459
expect(fetchedUser.email).toBe(EMAIL);
418460
expect(fetchedUser.ssn).toBe(SSN);
461+
expect(fetchedUser.nickname).toBe(NICKNAME);
419462
},
420463
e => console.error('error', e.message)
421464
).done(() => done());
@@ -436,6 +479,7 @@ describe('Personally Identifiable Information', () => {
436479
expect(fetchedUser.zip).toBe(ZIP);
437480
expect(fetchedUser.email).toBe(EMAIL);
438481
expect(fetchedUser.ssn).toBe(SSN);
482+
expect(fetchedUser.nickname).toBe(NICKNAME);
439483
},
440484
e => console.error('error', e.message)
441485
).done(() => done());
@@ -455,6 +499,7 @@ describe('Personally Identifiable Information', () => {
455499
const fetchedUser = result;
456500
expect(fetchedUser.zip).toBe(undefined);
457501
expect(fetchedUser.email).toBe(undefined);
502+
expect(fetchedUser.nickname).toBe(NICKNAME);
458503
},
459504
e => console.error('error', e.message)
460505
).done(() => done());
@@ -475,6 +520,7 @@ describe('Personally Identifiable Information', () => {
475520
const fetchedUser = result;
476521
expect(fetchedUser.zip).toBe(ZIP);
477522
expect(fetchedUser.email).toBe(EMAIL);
523+
expect(fetchedUser.nickname).toBe(NICKNAME);
478524
},
479525
e => console.error('error', e.message)
480526
).done(() => done());
@@ -495,9 +541,75 @@ describe('Personally Identifiable Information', () => {
495541
const fetchedUser = result;
496542
expect(fetchedUser.zip).toBe(ZIP);
497543
expect(fetchedUser.email).toBe(EMAIL);
544+
expect(fetchedUser.nickname).toBe(NICKNAME);
498545
},
499546
e => console.error('error', e.message)
500547
).done(() => done());
501548
});
502549
});
550+
551+
describe('with privilaged user', () => {
552+
beforeEach((done) => {
553+
return Parse.User.logOut()
554+
.then(() => Parse.User.signUp('administrator', 'secure'))
555+
.then(loggedInUser => adminUser = loggedInUser)
556+
.then(() => Parse.User.logIn(adminUser.get('username'), 'secure'))
557+
.then(() => adminRole.getUsers().add(adminUser).save(null, {useMasterKey: true}))
558+
.then(() => done());
559+
});
560+
561+
it('admin should be able to get user PII via API with object', (done) => {
562+
const userObj = new (Parse.Object.extend(Parse.User));
563+
userObj.id = user.id;
564+
userObj.fetch().then(
565+
fetchedUser => {
566+
expect(fetchedUser.get('email')).toBe(EMAIL);
567+
}, e => console.error('error', e))
568+
.done(() => done());
569+
});
570+
571+
it('admin should be able to get user PII via API with Find', (done) => {
572+
new Parse.Query(Parse.User)
573+
.first()
574+
.then(fetchedUser => {
575+
expect(fetchedUser.get('email')).toBe(EMAIL);
576+
expect(fetchedUser.get('zip')).toBe(ZIP);
577+
expect(fetchedUser.get('ssn')).toBe(SSN);
578+
done();
579+
});
580+
});
581+
582+
it('admin should be able to get user PII via API with Get', (done) => {
583+
new Parse.Query(Parse.User)
584+
.get(user.id)
585+
.then(fetchedUser => {
586+
expect(fetchedUser.get('email')).toBe(EMAIL);
587+
expect(fetchedUser.get('zip')).toBe(ZIP);
588+
expect(fetchedUser.get('ssn')).toBe(SSN);
589+
expect(fetchedUser.get('nickname')).toBe(NICKNAME);
590+
done();
591+
});
592+
});
593+
594+
it('admin should get PII via REST with admin credentials', (done) => {
595+
request.get({
596+
url: 'http://localhost:8378/1/classes/_User',
597+
json: true,
598+
headers: {
599+
'X-Parse-Application-Id': 'test',
600+
'X-Parse-Javascript-Key': 'test',
601+
'X-Parse-Session-Token': adminUser.getSessionToken()
602+
}
603+
})
604+
.then(
605+
result => {
606+
const fetchedUser = result.results[0];
607+
expect(fetchedUser.zip).toBe(ZIP);
608+
expect(fetchedUser.email).toBe(EMAIL);
609+
},
610+
e => console.error('error', e.message)
611+
).done(() => done());
612+
});
613+
614+
});
503615
});

‎src/Routers/UsersRouter.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -268,7 +268,7 @@ export class UsersRouter extends ClassesRouter {
268268
throw new Parse.Error(Parse.Error.EMAIL_NOT_FOUND, `No user found with email ${email}`);
269269
}
270270
const user = results[0];
271-
271+
272272
// remove password field, messes with saving on postgres
273273
delete user.password;
274274

0 commit comments

Comments
 (0)