feat(e2e): `teamAdmin` permission tests #2230

DafyddLlyr · 2023-09-21T15:57:45Z

Add test cases for the teamAdmin role for all tables not covered by introspection tests
Fix permissions on operations table (ShareDB does the writing to this as admin currently, but I thought it worthwhile to correctly model Hasura)
Resolves CVE-2023-26144 for e2e/api tests, API & Editor by bumping planx-core
- e2e/ui to follow - aiming to use planx-core here for teardown instead of the more manual graphql-request approach

✅ Regression test run against this branch - https://github.com/theopensystemslab/planx-new/actions/runs/6338450886

github-actions · 2023-09-21T16:27:57Z

Removed vultr server and associated DNS entries

github-actions · 2023-09-22T08:37:15Z

🤖 Hasura Change Summary compared a subset of table metadata including permissions:

Updated Tables (1)

public.operations permissions:

	insert	select	update	delete
platformAdmin			^➕/_➖
teamEditor	^➕/_➖		^➕/_➖

14 added column permissions

	insert	select	update
platformAdmin			➕ actor_id ➕ created_at ➕ data ➕ flow_id ➕ id ➕ updated_at ➕ version
teamEditor

- Update planx-core - Move shared helpers - Scope test lifecycle hooks - Add JWT helper methods

…matching

- Will look into why husky wasn't picking these up in another PR

- Resolves CVE-2023-26144 - e2e/ui still to do in a follow on PR

jessicamcinchak

Looks good to me, thanks for figuring this one out!

Left a few minor questions, but no blockers.

jessicamcinchak · 2023-09-28T14:19:53Z

e2e/tests/api-driven/src/permissions/steps.ts


  error?: Error = undefined;
-  activeUser!: TestUser;
+  result: any[] | Record<"returning", any[]> | null = null;


Personally, would love to turn off the type warnings for unexpected any to make PRs a bit less noisy - I think we can trust each other to catch actually-unnecessary ones in code reviews ?

jessicamcinchak · 2023-09-28T14:24:29Z

e2e/tests/api-driven/src/permissions/helpers.ts

+    slug: "team-1-flow",
+  });
+
+  const user2Id = await createUser({ email: "[email protected]" });
  const teamId2 = await createTeam({ name: "E2E Team 2", slug: "e2e-team2" });


double checking i understand this: in overall setup, we create two users who are by default not a platform admin and they also do not have roles on either teamId1 or teamId2? then later in individual test suites, you're creating & cleaning up team memberships and toggling permissions?

i'm wondering a bit if it'd be clearer to setup more explicitly with something like e2e-platform-admin@.. etc rather than vague user-1, user-2 etc? definitely not a showstopper though.

Yeah I appreciate this is an unclear point - team1 and team2 are quite vague/meaningless names but I needed something to differentiate (I was also considering red/blue or something to make it slightly more distinct).

The intention is that there are -

Two teams

One TeamEditor of each team

We test that teamEditor1 can access team1 resources

We test that teamEditor2 cannot access team1 resources

I'll add comments to explicitly explain the setup here 👍

jessicamcinchak · 2023-09-28T14:28:36Z

e2e/tests/api-driven/src/permissions/helpers.ts

@@ -24,26 +28,27 @@ export const cleanup = async () => {
 };

 export const setup = async () => {
+  const user1Id = await createUser({ email: "[email protected]" });


nit: I think helen & mel previously reported an annoying issue where e2e test emails using the @opensystemslab.io domain were causing bounced errors in the enquiries inbox? can we use a harmless @example.com or something instead?

DafyddLlyr requested a review from a team September 22, 2023 09:25

DafyddLlyr marked this pull request as ready for review September 22, 2023 09:25

DafyddLlyr force-pushed the dp/teamAdmin-e2e-queries branch from 65422b3 to cae9bcd Compare September 26, 2023 10:35

DafyddLlyr force-pushed the dp/cucumber-permissions-test branch from f456bcb to 794d305 Compare September 27, 2023 10:43

Base automatically changed from dp/cucumber-permissions-test to main September 27, 2023 11:38

DafyddLlyr added 14 commits September 27, 2023 12:40

chore: Setup new test suites

c28fdcb

- Update planx-core - Move shared helpers - Scope test lifecycle hooks - Add JWT helper methods

feat: Initial test setup

d6a62b6

chore: Update ITP tests to follow new format

d0e0a8c

feat: Flows queries

37dc489

refactor: Flatten CustomWorld structure to simplify GraphQL variable …

b7d9043

…matching

feat: Users table

a0e0ff6

feat: Published flows

af3f0ec

refactor: Update syntax to be more explicit

14f12f1

fix: Harden tests

f5b5fbb

feat: Tests for teamAdmin selecting users

3e120bc

fix: Operations permissions

5af1451

feat: Operations E2E permission tests

31413e5

fix: Linting

367744f

- Will look into why husky wasn't picking these up in another PR

chore: Bump planx-core

2df8311

- Resolves CVE-2023-26144 - e2e/ui still to do in a follow on PR

DafyddLlyr force-pushed the dp/teamAdmin-e2e-queries branch 2 times, most recently from f4e0330 to 2df8311 Compare September 27, 2023 15:26

fix: Add back postinstall step...

6a562fc

DafyddLlyr force-pushed the dp/teamAdmin-e2e-queries branch from b6d2314 to 6a562fc Compare September 28, 2023 06:47

DafyddLlyr mentioned this pull request Sep 28, 2023

chore(e2e): Resolve CVE-2023-26144 in /e2e/ui-driven #2245

Merged

jessicamcinchak approved these changes Sep 28, 2023

View reviewed changes

DafyddLlyr added 3 commits September 29, 2023 12:01

fix: Use safe throwaway emails

d15795d

fix: any -> unknown

6ae654d

fix: PR comments - clarify setup

1833a13

DafyddLlyr mentioned this pull request Sep 29, 2023

chore(deps): bump graphql from 16.8.0 to 16.8.1 in /e2e/tests/api-driven #2248

Closed

DafyddLlyr merged commit 3f6e2b4 into main Sep 29, 2023
12 checks passed

DafyddLlyr deleted the dp/teamAdmin-e2e-queries branch September 29, 2023 12:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(e2e): `teamAdmin` permission tests #2230

feat(e2e): `teamAdmin` permission tests #2230

DafyddLlyr commented Sep 21, 2023 •

edited

Loading

github-actions bot commented Sep 21, 2023 •

edited

Loading

github-actions bot commented Sep 22, 2023 •

edited

Loading

jessicamcinchak left a comment

jessicamcinchak Sep 28, 2023

jessicamcinchak Sep 28, 2023 •

edited

Loading

DafyddLlyr Sep 29, 2023

jessicamcinchak Sep 28, 2023

feat(e2e): teamAdmin permission tests #2230

feat(e2e): teamAdmin permission tests #2230

Conversation

DafyddLlyr commented Sep 21, 2023 • edited Loading

github-actions bot commented Sep 21, 2023 • edited Loading

github-actions bot commented Sep 22, 2023 • edited Loading

Updated Tables (1)

jessicamcinchak left a comment

Choose a reason for hiding this comment

jessicamcinchak Sep 28, 2023

Choose a reason for hiding this comment

jessicamcinchak Sep 28, 2023 • edited Loading

Choose a reason for hiding this comment

DafyddLlyr Sep 29, 2023

Choose a reason for hiding this comment

jessicamcinchak Sep 28, 2023

Choose a reason for hiding this comment

feat(e2e): `teamAdmin` permission tests #2230

feat(e2e): `teamAdmin` permission tests #2230

DafyddLlyr commented Sep 21, 2023 •

edited

Loading

github-actions bot commented Sep 21, 2023 •

edited

Loading

github-actions bot commented Sep 22, 2023 •

edited

Loading

jessicamcinchak Sep 28, 2023 •

edited

Loading