Skip to content

Commit

Permalink
Extend scenario auth to table and charts
Browse files Browse the repository at this point in the history
  • Loading branch information
@alexeh
alexeh committed Apr 3, 2023
1 parent 614b26d commit 83016ad
Show file tree
Hide file tree
Showing 2 changed files with 214 additions and 1 deletion.
8 changes: 8 additions & 0 deletions api/src/modules/impact/impact.controller.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,10 @@ export class ImpactController {
bypassIfScenarioIsPublic: true,
isComparisonMode: true,
})
@CheckUserOwnsScenario({
bypassIfScenarioIsPublic: true,
isComparisonMode: true,
})
@UseInterceptors(SetScenarioIdsInterceptor)
@Get('compare/scenario/vs/scenario')
async getTwoScenariosImpactTable(
Expand Down Expand Up @@ -122,6 +126,10 @@ export class ImpactController {
bypassIfScenarioIsPublic: true,
isComparisonMode: true,
})
@CheckUserOwnsScenario({
bypassIfScenarioIsPublic: true,
isComparisonMode: true,
})
@UseInterceptors(SetScenarioIdsInterceptor)
@Get('compare/scenario/vs/actual')
async getActualVsScenarioImpactTable(
Expand Down
207 changes: 206 additions & 1 deletion api/test/e2e/authorization/comparison-authorization.spec.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,14 +14,17 @@ import ApplicationManager, {
import { DataSource } from 'typeorm';
import { setupTestUser } from '../../utils/userAuth';
import { HttpStatus } from '@nestjs/common';
import { v4 } from 'uuid';
import { v4 as uuidv4, v4 } from 'uuid';
import { H3MapResponse } from '../../../src/modules/h3-data/dto/h3-map-response.dto';
import { Test } from '@nestjs/testing';
import { AppModule } from '../../../src/app.module';
import { IndicatorsService } from '../../../src/modules/indicators/indicators.service';
import { MaterialsService } from '../../../src/modules/materials/materials.service';
import { H3DataMapService } from '../../../src/modules/h3-data/h3-data-map.service';
import { Scenario } from '../../../src/modules/scenarios/scenario.entity';
import { ActualVsScenarioImpactService } from '../../../src/modules/impact/comparison/actual-vs-scenario.service';
import { PaginatedImpactTable } from '../../../src/modules/impact/dto/response-impact-table.dto';
import { ScenarioVsScenarioImpactService } from '../../../src/modules/impact/comparison/scenario-vs-scenario.service';

describe('Authorization Test (E2E)', () => {
let testApplication: TestApplication;
Expand All @@ -41,6 +44,16 @@ describe('Authorization Test (E2E)', () => {
.overrideProvider(H3DataMapService)
.useValue({
getImpactMapByResolution: async (dto: any) => ({} as H3MapResponse),
})
.overrideProvider(ActualVsScenarioImpactService)
.useValue({
getActualVsScenarioImpactTable: async (dto: any) =>
({} as PaginatedImpactTable),
})
.overrideProvider(ScenarioVsScenarioImpactService)
.useValue({
getScenarioVsScenarioImpactTable: async (dto: any) =>
({} as PaginatedImpactTable),
}),
);

Expand Down Expand Up @@ -254,5 +267,197 @@ describe('Authorization Test (E2E)', () => {
.expect(HttpStatus.OK);
});
});
describe('Impact Table and Charts Comparisons', () => {
test('When I request a comparison table between actual data and scenario, But that scenario is neither mine or public, Then I should not be authorised', async () => {
const { jwtToken } = await setupTestUser(testApplication, ROLES.USER);
const comparedScenario = await createScenario({ isPublic: false });

await request(testApplication.getHttpServer())
.get(`/api/v1/impact/compare/scenario/vs/actual`)
.query({
'indicatorIds[]': [uuidv4()],
startYear: 2023,
endYear: 2024,
groupBy: 'material',
comparedScenarioId: comparedScenario.id,
})
.set('Authorization', `Bearer ${jwtToken}`)
.send()
.expect(HttpStatus.FORBIDDEN);
});

test('When I request a comparison table between actual data and scenario, And that scenario is neither mine or public, But I am an Admin, Then I should get the data', async () => {
const { jwtToken } = await setupTestUser(testApplication, ROLES.ADMIN);
const { user: someFakeUser } = await setupTestUser(
testApplication,
ROLES.USER,
{ email: '[email protected]' },
);
const comparedScenario = await createScenario({
isPublic: false,
userId: someFakeUser.id,
});

await request(testApplication.getHttpServer())
.get(`/api/v1/impact/compare/scenario/vs/actual`)
.query({
'indicatorIds[]': [uuidv4()],
startYear: 2023,
endYear: 2024,
groupBy: 'material',
comparedScenarioId: comparedScenario.id,
})
.set('Authorization', `Bearer ${jwtToken}`)
.send()
.expect(HttpStatus.OK);
});

test('When I request a comparison table between actual data and scenario, But that scenario is mine, Then I should be authorised', async () => {
const { jwtToken, user } = await setupTestUser(
testApplication,
ROLES.USER,
);
const comparedScenario = await createScenario({
isPublic: false,
userId: user.id,
});

await request(testApplication.getHttpServer())
.get(`/api/v1/impact/compare/scenario/vs/actual`)
.query({
'indicatorIds[]': [uuidv4()],
startYear: 2023,
endYear: 2024,
groupBy: 'material',
comparedScenarioId: comparedScenario.id,
})
.set('Authorization', `Bearer ${jwtToken}`)
.send()
.expect(HttpStatus.OK);
});
test('When I request a comparison table between two scenarios, And none of them is mine, Then I should not be authorised', async () => {
const { jwtToken } = await setupTestUser(testApplication, ROLES.USER);
const comparedScenario = await createScenario({
isPublic: false,
});
const baseScenario = await createScenario({ isPublic: false });

await request(testApplication.getHttpServer())
.get(`/api/v1/impact/compare/scenario/vs/scenario`)
.query({
'indicatorIds[]': [uuidv4()],
startYear: 2023,
endYear: 2024,
groupBy: 'material',
comparedScenarioId: comparedScenario.id,
baseScenarioId: baseScenario.id,
})
.set('Authorization', `Bearer ${jwtToken}`)
.send()
.expect(HttpStatus.FORBIDDEN);
});
test('When I request a comparison table between two scenarios, And one is public but the other one is not either public or mine, Then I should not be authorised', async () => {
const { jwtToken } = await setupTestUser(testApplication, ROLES.USER);
const comparedScenario = await createScenario({
isPublic: true,
});
const baseScenario = await createScenario({ isPublic: false });

await request(testApplication.getHttpServer())
.get(`/api/v1/impact/compare/scenario/vs/scenario`)
.query({
'indicatorIds[]': [uuidv4()],
startYear: 2023,
endYear: 2024,
groupBy: 'material',
comparedScenarioId: comparedScenario.id,
baseScenarioId: baseScenario.id,
})
.set('Authorization', `Bearer ${jwtToken}`)
.send()
.expect(HttpStatus.FORBIDDEN);
});

test('When I request a comparison table between two scenarios, And both of them are public, Then I should get the data', async () => {
const { jwtToken } = await setupTestUser(testApplication, ROLES.USER);
const comparedScenario = await createScenario({
isPublic: true,
});
const baseScenario = await createScenario({ isPublic: true });

await request(testApplication.getHttpServer())
.get(`/api/v1/impact/compare/scenario/vs/scenario`)
.query({
'indicatorIds[]': [uuidv4()],
startYear: 2023,
endYear: 2024,
groupBy: 'material',
comparedScenarioId: comparedScenario.id,
baseScenarioId: baseScenario.id,
})
.set('Authorization', `Bearer ${jwtToken}`)
.send()
.expect(HttpStatus.OK);
});
test('When I request a comparison table between two scenarios, And both are mine, Then I should be authorised', async () => {
const { jwtToken, user } = await setupTestUser(
testApplication,
ROLES.USER,
);
const comparedScenario = await createScenario({
isPublic: false,
userId: user.id,
});
const baseScenario = await createScenario({
isPublic: false,
userId: user.id,
});

await request(testApplication.getHttpServer())
.get(`/api/v1/impact/compare/scenario/vs/scenario`)
.query({
'indicatorIds[]': [uuidv4()],
startYear: 2023,
endYear: 2024,
groupBy: 'material',
comparedScenarioId: comparedScenario.id,
baseScenarioId: baseScenario.id,
})
.set('Authorization', `Bearer ${jwtToken}`)
.send()
.expect(HttpStatus.OK);
});

test('When I request a comparison table between two scenarios, And any of them is public or mine, But I am an admin, Then I should get the data', async () => {
const { jwtToken } = await setupTestUser(testApplication, ROLES.ADMIN);
const { user: someFakeUser } = await setupTestUser(
testApplication,
ROLES.USER,
{ email: '[email protected]' },
);
const comparedScenario = await createScenario({
isPublic: false,
userId: someFakeUser.id,
});
const baseScenario = await createScenario({
isPublic: false,
userId: someFakeUser.id,
});

await request(testApplication.getHttpServer())
.get(`/api/v1/impact/compare/scenario/vs/scenario`)
.query({
'indicatorIds[]': [uuidv4()],
startYear: 2023,
endYear: 2024,
groupBy: 'material',
comparedScenarioId: comparedScenario.id,
baseScenarioId: baseScenario.id,
})
.set('Authorization', `Bearer ${jwtToken}`)
.send()
.expect(HttpStatus.OK);
});
});
});
});

0 comments on commit 83016ad

Please sign in to comment.