From dafd385144fd5c6ea41de52ef8839a84a0b51c70 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:21:48 +0300 Subject: [PATCH 01/21] Header tag check, show quick tour for all --- apis/client/view/header/header.html | 5 ++++- apis/client/view/header/header.less | 7 ++++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/apis/client/view/header/header.html b/apis/client/view/header/header.html index a86c981a87..25f5fec02e 100644 --- a/apis/client/view/header/header.html +++ b/apis/client/view/header/header.html @@ -8,6 +8,9 @@

{{ api.name }} {{> viewApiStatus api=api width="0.4" }}

+ {{#unless api.isPublic }} + private + {{/ unless }} - {{# if api.currentUserCanEdit }} + {{# if api.currentUserCanView }} {{> apiIntro }} {{/ if }} diff --git a/apis/client/view/header/header.less b/apis/client/view/header/header.less index d5f46fb2ff..bcee3b22af 100644 --- a/apis/client/view/header/header.less +++ b/apis/client/view/header/header.less @@ -12,14 +12,19 @@ border-bottom: 1px solid #eee; #api-header { + display: inline; font-size: 1.7em; font-weight: 600; padding-left: 0.5em; - margin-left: 2em; + margin-left: 0em; margin-bottom: 0; margin-top: 0.1em; } + .label-align { + vertical-align: text-top; + } + .view-api-meta-details { padding-left: 0.5em; margin-left: 3.4em; From 1a6c496d1d91ec62be7d76412678ddb935c30ebd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:22:38 +0300 Subject: [PATCH 02/21] Show forbidden if no permissions --- apis/client/lib/router.js | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/apis/client/lib/router.js b/apis/client/lib/router.js index e820e5b987..f0cb4639aa 100644 --- a/apis/client/lib/router.js +++ b/apis/client/lib/router.js @@ -1,3 +1,6 @@ +import { Meteor } from 'meteor/meteor'; +import { Router } from 'meteor/iron:router'; + Router.route('/api/new', function () { this.render('addApi'); this.layout('masterLayout'); @@ -19,13 +22,13 @@ Router.route('/api/:_id/', function () { // Get current API Backend ID const apiBackendId = Router.current().params._id; - // Ensure current user is authorized to view backend - Meteor.call('currentUserCanViewApi', apiBackendId, function (error, userIsAuthorized) { - if (userIsAuthorized) { + // Ensure current user has permissions to view backend + Meteor.call('currentUserCanViewApi', apiBackendId, (error, userIsAllowedToViewApi) => { + if (userIsAllowedToViewApi) { route.render('viewApi'); route.layout('masterLayout'); } else { - Router.go('notAuthorized'); + Router.go('forbidden'); } }); }, { From c5d7e19c1a9ea241ff1aaed859f227bfe755a0f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:23:06 +0300 Subject: [PATCH 03/21] Add forbidden template --- core/client/error_templates/forbidden.html | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 core/client/error_templates/forbidden.html diff --git a/core/client/error_templates/forbidden.html b/core/client/error_templates/forbidden.html new file mode 100644 index 0000000000..1d225e1fd0 --- /dev/null +++ b/core/client/error_templates/forbidden.html @@ -0,0 +1,16 @@ + From 615d004a23591949ca490f0f5af066bc3c037e71 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:23:24 +0300 Subject: [PATCH 04/21] Update collection helpers --- apis/collection/helpers.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/apis/collection/helpers.js b/apis/collection/helpers.js index 93726c76ce..ab889e90b9 100644 --- a/apis/collection/helpers.js +++ b/apis/collection/helpers.js @@ -20,11 +20,14 @@ Apis.helpers({ // Check if user is manager of this API const userIsManager = _.includes(this.managerIds, userId); + // Check if user has external access + const userIsAuthorized = _.includes(this.authorizedUserIds, userId); + // Check if user is administrator const userIsAdmin = Roles.userIsInRole(userId, ['admin']); // if user is manager or administrator, they can edit - if (userIsManager || userIsAdmin) { + if (userIsManager || userIsAuthorized || userIsAdmin) { return true; } } @@ -34,7 +37,7 @@ Apis.helpers({ currentUserCanView () { // Check if API is public // Only user who can edit, can view private APIs - return (this.isPublic || this.currentUserCanEdit()); + return (this.visibility === 'public' || this.currentUserCanEdit()); }, currentUserIsManager () { // Get current User ID From c4fa3d6e1f8c2bafcd7b5bff5952f86eb2b5b1c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:23:52 +0300 Subject: [PATCH 05/21] Tag for grid --- catalogue/client/grid/grid.html | 7 +++++-- catalogue/client/grid/grid.less | 9 ++++++--- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/catalogue/client/grid/grid.html b/catalogue/client/grid/grid.html index 8293658498..f50ed465a9 100644 --- a/catalogue/client/grid/grid.html +++ b/catalogue/client/grid/grid.html @@ -17,11 +17,14 @@ {{_ "catalogueGrid_addedBy" }} {{ api.getApiManagersByName }} -

+ {{#unless api.isPublic }} + private + {{/ unless }} {{# if api.description }} +

{{ api.description }} +

{{/ if }} -

  • diff --git a/catalogue/client/grid/grid.less b/catalogue/client/grid/grid.less index 74603a2ec0..5a92f7cd27 100644 --- a/catalogue/client/grid/grid.less +++ b/catalogue/client/grid/grid.less @@ -16,7 +16,7 @@ height: 10.7em; margin-bottom: 1.87em; - .icon-indicator { + .api-status-color { float: right; } } @@ -67,11 +67,12 @@ .api-card-created { color: #777; font-size: 0.85em; + margin-right: 5em; } .api-card-info { margin-left: 4.8em; - margin-top: 0.3em; + margin-top: -1em; margin-right: 0.3em; } @@ -80,6 +81,8 @@ } .api-card-stats { - margin-bottom: 0; + position: absolute; + bottom: 2em; + width: 100%; margin-left: 0.5em; } From 8e2e0088c99672780d2fd39c6c9e5b16ec89ef71 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:24:09 +0300 Subject: [PATCH 06/21] Tag for table --- catalogue/client/table/table.html | 23 ++++++++++++++--------- catalogue/client/table/table.less | 4 ++++ 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/catalogue/client/table/table.html b/catalogue/client/table/table.html index bf14559ce0..4c9943ca27 100644 --- a/catalogue/client/table/table.html +++ b/catalogue/client/table/table.html @@ -17,15 +17,20 @@

    {{ api.name }}

    - - {{_ "catalogueTable_addedBy" }} - {{ api.getApiManagersByName }} - -
    - - {{_ "catalogueTable_added" }} - {{ api.relativeCreatedAt }} - + {{#unless api.isPublic }} + private + {{/ unless }} +
    + + {{_ "catalogueTable_addedBy" }} + {{ api.getApiManagersByName }} + +
    + + {{_ "catalogueTable_added" }} + {{ api.relativeCreatedAt }} + +
    {{> apiBackendRating api }} diff --git a/catalogue/client/table/table.less b/catalogue/client/table/table.less index 4e7f5e056f..f1572386d6 100644 --- a/catalogue/client/table/table.less +++ b/catalogue/client/table/table.less @@ -14,5 +14,9 @@ } .api-catalogue-table-title { margin-top: 0; + display: inline; + } + .label-align { + vertical-align: text-top; } } From adddb64d1c7ff24c96b2a5633fd7556ca4eb7a0c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:24:56 +0300 Subject: [PATCH 07/21] Checks for catalogue publication, lint lint --- catalogue/server/publications.js | 86 ++++++++++++++++++++------------ 1 file changed, 55 insertions(+), 31 deletions(-) diff --git a/catalogue/server/publications.js b/catalogue/server/publications.js index 36a25db073..33d63b1ef2 100644 --- a/catalogue/server/publications.js +++ b/catalogue/server/publications.js @@ -1,3 +1,6 @@ +import { Meteor } from 'meteor/meteor'; +import { Roles } from 'meteor/alanning:roles'; + // Collection imports import { Apis } from '/apis/collection'; import { ApiBackendRatings } from '/ratings/collection'; @@ -11,16 +14,24 @@ Meteor.publish('catalogue', function ({ filterBy, sortBy, sortDirection }) { // Get user ID const userId = this.userId; + const userIsAdmin = Roles.userIsInRole(userId, ['admin']); + if (userId) { - // If user logged in - // Select public and managed APIs - selector = { - $or: - [ - { isPublic: true }, - { managerIds: userId }, - ], - }; + if (userIsAdmin) { + // Select all APIs + selector = {}; + } else { + // If user logged in + // Select public, managed APIs & APIs user is authorized to see + selector = { + $or: + [ + { isPublic: true }, + { managerIds: userId }, + { authorizedUserIds: userId }, + ], + }; + } } // Set up query options with empty sort settings @@ -34,29 +45,42 @@ Meteor.publish('catalogue', function ({ filterBy, sortBy, sortDirection }) { // Get user bookmarks const userBookmarks = ApiBookmarks.findOne({ userId }); - // Get bookmarked API IDs + // Check userBookmarks exist if (userBookmarks) { + // Get bookmarkedApiIds const bookmarkedApiIds = userBookmarks.apiIds; - - // Set up query object to contain bookmarked API IDs which are public - selector = { - $or: [ - { - $and: - [// User has bookmarked and API is public + // Check if userIsAdmin + if (userIsAdmin) { + // Show bookmarked APIs (regardless of visibility status) + selector = { _id: { $in: bookmarkedApiIds } }; + } else { + // Set up query object to contain bookmarked API IDs which are public + selector = { + $or: [ + { + $and: + [// User has bookmarked and API is public + { _id: { $in: bookmarkedApiIds } }, + { isPublic: true }, + ], + }, + { + $and: + [// User has bookmarked and is manager (regardless of public status) { _id: { $in: bookmarkedApiIds } }, - { isPublic: true }, - ], - }, - { - $and: - [// User has bookmarked and is manager (regardless of public status) - { _id: { $in: bookmarkedApiIds } }, - { managerIds: userId }, - ], - }, - ], - }; + { managerIds: userId }, + ], + }, + { + $and: + [// User has bookmarked and has view rights to API + { _id: { $in: bookmarkedApiIds } }, + { authorizedUserIds: userId }, + ], + }, + ], + }; + } } else { // If user has no bookmarks, don't return any results return []; @@ -79,12 +103,12 @@ Meteor.publish('catalogue', function ({ filterBy, sortBy, sortDirection }) { return Apis.find(selector, queryOptions); }); -Meteor.publish('catalogueRatings', function () { +Meteor.publish('catalogueRatings', () => { // Find all API Backends return ApiBackendRatings.find(); }); -Meteor.publish('catalogueBookmarks', function () { +Meteor.publish('catalogueBookmarks', () => { // Find all API Backends return ApiBookmarks.find(); }); From 9575c84fce4639aa6789f02b9520e1b403a3a145 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:25:13 +0300 Subject: [PATCH 08/21] Add route for forbidden --- core/client/lib/router.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/core/client/lib/router.js b/core/client/lib/router.js index 817bd5bb48..dbafdc7fda 100755 --- a/core/client/lib/router.js +++ b/core/client/lib/router.js @@ -45,4 +45,9 @@ Router.map(function() { layoutTemplate: "masterLayout", render: "notAuthorized" }); + this.route("forbidden", { + path: "/forbidden", + layoutTemplate: "masterLayout", + render: "forbidden" + }); }); From 9fb703195473ebf8fbecda721dcd49c7459751d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:25:25 +0300 Subject: [PATCH 09/21] Move to error_templates --- .../{not_authorized => error_templates}/not_authorized.html | 0 core/client/{not_authorized => error_templates}/not_found.html | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename core/client/{not_authorized => error_templates}/not_authorized.html (100%) rename core/client/{not_authorized => error_templates}/not_found.html (100%) diff --git a/core/client/not_authorized/not_authorized.html b/core/client/error_templates/not_authorized.html similarity index 100% rename from core/client/not_authorized/not_authorized.html rename to core/client/error_templates/not_authorized.html diff --git a/core/client/not_authorized/not_found.html b/core/client/error_templates/not_found.html similarity index 100% rename from core/client/not_authorized/not_found.html rename to core/client/error_templates/not_found.html From d7200096ca80b64a1d1f006170043927a6015761 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:26:03 +0300 Subject: [PATCH 10/21] ProxyBackend info required for all users --- .../collection/server/publications.js | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/proxy_backends/collection/server/publications.js b/proxy_backends/collection/server/publications.js index 4877dc0bec..f9b40fd65d 100644 --- a/proxy_backends/collection/server/publications.js +++ b/proxy_backends/collection/server/publications.js @@ -10,27 +10,13 @@ import { ProxyBackends } from '/proxy_backends/collection'; import _ from 'lodash'; Meteor.publish('apiProxySettings', function (apiId) { - // TODO: determine how to use 'api.userCanEdit()' helper - // which uses 'Meteor.userId()' instead of 'this.userId' - // Get current userId const userId = this.userId; // Check that user is logged in if (userId) { - // Get API document - const api = Apis.findOne(apiId); - - // Check if user is API manager - const userIsManager = _.includes(api.managerIds, userId); - - // Check if user is administrator - const userIsAdmin = Roles.userIsInRole(userId, ['admin']); - - // Check if user is authorized to access API proxy settings - if (userIsManager || userIsAdmin) { - return ProxyBackends.find({ apiId }); - } + // Return APIs proxy settings + return ProxyBackends.find({ apiId }); } // Complete publication execution @@ -38,7 +24,6 @@ Meteor.publish('apiProxySettings', function (apiId) { }); Meteor.publish('proxyApis', function () { - // TODO: pass proxy Id to this publication ? // Placeholder for proxy backends From 3d312f09ee33ebf8695b885f64a3f3b85469a873 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Fri, 7 Oct 2016 16:37:23 +0300 Subject: [PATCH 11/21] Adjust monitoring status dot --- catalogue/client/grid/grid.html | 2 +- catalogue/client/grid/grid.less | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/catalogue/client/grid/grid.html b/catalogue/client/grid/grid.html index f50ed465a9..221aaa6f05 100644 --- a/catalogue/client/grid/grid.html +++ b/catalogue/client/grid/grid.html @@ -7,11 +7,11 @@ - {{> viewApiStatus api=api width="0.6" }}
    {{ api.name }} + {{> viewApiStatus api=api width="0.6" }} {{_ "catalogueGrid_addedBy" }} diff --git a/catalogue/client/grid/grid.less b/catalogue/client/grid/grid.less index 5a92f7cd27..5034ed6cd7 100644 --- a/catalogue/client/grid/grid.less +++ b/catalogue/client/grid/grid.less @@ -72,7 +72,7 @@ .api-card-info { margin-left: 4.8em; - margin-top: -1em; + margin-top: 0.3em; margin-right: 0.3em; } From eeb1810ce4951ca21344f0981576e136f53b99cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Mon, 10 Oct 2016 14:34:35 +0300 Subject: [PATCH 12/21] update currentusercanview helper --- apis/collection/helpers.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apis/collection/helpers.js b/apis/collection/helpers.js index ab889e90b9..9f90b811ff 100644 --- a/apis/collection/helpers.js +++ b/apis/collection/helpers.js @@ -37,7 +37,7 @@ Apis.helpers({ currentUserCanView () { // Check if API is public // Only user who can edit, can view private APIs - return (this.visibility === 'public' || this.currentUserCanEdit()); + return (this.isPublic || this.currentUserCanEdit()); }, currentUserIsManager () { // Get current User ID From 47a5531d5f69f4eabb23b6d787d49d29dacc434a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Mon, 10 Oct 2016 14:37:21 +0300 Subject: [PATCH 13/21] Add space --- apis/client/view/header/header.html | 2 +- catalogue/client/grid/grid.html | 2 +- catalogue/client/table/table.html | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apis/client/view/header/header.html b/apis/client/view/header/header.html index 25f5fec02e..ce3e956414 100644 --- a/apis/client/view/header/header.html +++ b/apis/client/view/header/header.html @@ -8,7 +8,7 @@

    {{ api.name }} {{> viewApiStatus api=api width="0.4" }}

    - {{#unless api.isPublic }} + {{# unless api.isPublic }} private {{/ unless }}
      diff --git a/catalogue/client/grid/grid.html b/catalogue/client/grid/grid.html index 221aaa6f05..2db99d2a53 100644 --- a/catalogue/client/grid/grid.html +++ b/catalogue/client/grid/grid.html @@ -17,7 +17,7 @@ {{_ "catalogueGrid_addedBy" }} {{ api.getApiManagersByName }} - {{#unless api.isPublic }} + {{# unless api.isPublic }} private {{/ unless }} {{# if api.description }} diff --git a/catalogue/client/table/table.html b/catalogue/client/table/table.html index 4c9943ca27..21d25360e8 100644 --- a/catalogue/client/table/table.html +++ b/catalogue/client/table/table.html @@ -17,7 +17,7 @@

      {{ api.name }}

      - {{#unless api.isPublic }} + {{# unless api.isPublic }} private {{/ unless }}
      From dc101bcfbf1f5a18adff2efaa32985babd66b2ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Mon, 10 Oct 2016 14:41:20 +0300 Subject: [PATCH 14/21] Add i18n --- core/lib/i18n/en.i18n.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/core/lib/i18n/en.i18n.json b/core/lib/i18n/en.i18n.json index 446cf36822..bb97c884e3 100644 --- a/core/lib/i18n/en.i18n.json +++ b/core/lib/i18n/en.i18n.json @@ -230,6 +230,8 @@ "flagApiModal_titleText": "Flag API Backend", "flagApiSchema_DefunctText": "Defunct", "flagApiSchema_inappropriateText": "Inappropriate", + "forbidden_Title": "403 Forbidden", + "forbidden_Message": "You don't have permissions to view this page.", "homeBody_contactUs_heading": "Contact Us", "homeBody_contactUs_text": "Contact us to ask anything.", "homeBody_feature_section_heading1": "Are you an API user?", From d595672e110d4a8c20b9a9caef7c2eab3d57bcfc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Jyrkk=C3=A4?= Date: Mon, 10 Oct 2016 15:57:42 +0300 Subject: [PATCH 15/21] Add help text for authorized users --- apis_authorization/client/list/list.html | 1 + apis_authorization/client/list/list.less | 6 ++++++ core/client/form_hints/form_hints.js | 12 +++++++++++- core/lib/i18n/en.i18n.json | 1 + 4 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 apis_authorization/client/list/list.less diff --git a/apis_authorization/client/list/list.html b/apis_authorization/client/list/list.html index 79008c7871..791b858239 100644 --- a/apis_authorization/client/list/list.html +++ b/apis_authorization/client/list/list.html @@ -1,6 +1,7 @@