Merge pull request #347 from topcoder-platform/dev-next

Dev next

Author: vikasrohit

src/permissions/constants.js

@@ -0,0 +1,36 @@
+/**
+ * Definitions of permissions which could be used with util methods
+ * `util.hasPermission` or `util.hasPermissionForProject`.
+ *
+ * We can define permission using two logics:
+ * 1. **WHAT** can be done with such a permission. Such constants may have names like:
+ *    - `VIEW_PROJECT`
+ *    - `EDIT_MILESTONE`
+ *    - `DELETE_WORK`
+ *    and os on.
+ * 2. **WHO** can do actions with such a permission. Such constants **MUST** start from the prefix `ROLES_`, examples:
+ *    - `ROLES_COPILOT_AND_ABOVE`
+ *    - `ROLES_PROJECT_MEMBERS`
+ *    - `ROLES_ADMINS`
+ */
+import {
+  PROJECT_MEMBER_ROLE,
+  ADMIN_ROLES,
+} from '../constants';
+
+export const PERMISSION = { // eslint-disable-line import/prefer-default-export
+  /**
+   * Permissions defined by logic: **WHO** can do actions with such a permission.
+   */
+  ROLES_COPILOT_AND_ABOVE: {
+    topcoderRoles: ADMIN_ROLES,
+    projectRoles: [
+      PROJECT_MEMBER_ROLE.MANAGER,
+      PROJECT_MEMBER_ROLE.COPILOT,
+    ],
+  },
+  /**
+   * Permissions defined by logic: **WHAT** can be done with such a permission.
+   */
+};
+

src/permissions/copilotAndAbove.js

@@ -1,11 +1,7 @@
 import _ from 'lodash';
 import util from '../util';
-import {
-  PROJECT_MEMBER_ROLE,
-  ADMIN_ROLES,
-} from '../constants';
 import models from '../models';
-
+import { PERMISSION } from './constants';
 
 /**
  * Permission to allow copilot and above roles to perform certain operations
@@ -16,27 +12,17 @@ import models from '../models';
  */
 module.exports = req => new Promise((resolve, reject) => {
   const projectId = _.parseInt(req.params.projectId);
-  const isAdmin = util.hasRoles(req, ADMIN_ROLES);
-
-  if (isAdmin) {
-    return resolve(true);
-  }
 
   return models.ProjectMember.getActiveProjectMembers(projectId)
     .then((members) => {
+      const hasPermission = util.hasPermission(PERMISSION.ROLES_COPILOT_AND_ABOVE, req.authUser, members);
+
+      // TODO should we really do this?
+      // if no, we can replace `getActiveProjectMembers + util.hasPermission` with one `util.hasPermissionForProject`
       req.context = req.context || {};
       req.context.currentProjectMembers = members;
-      const validMemberProjectRoles = [
-        PROJECT_MEMBER_ROLE.MANAGER,
-        PROJECT_MEMBER_ROLE.COPILOT,
-      ];
-      // check if the copilot or manager has access to this project
-      const isMember = _.some(
-        members,
-m => m.userId === req.authUser.userId && validMemberProjectRoles.includes(m.role),
-      );
 
-      if (!isMember) {
+      if (!hasPermission) {
         // the copilot or manager is not a registered project member
         return reject(new Error('You do not have permissions to perform this action'));
       }

src/routes/projectMemberInvites/create.js

@@ -60,14 +60,25 @@ const compareEmail = (email1, email2, options = { UNIQUE_GMAIL_VALIDATION: false
  * @param {Array}  invites existent invites from DB
  * @param {Object} data    template for new invites to be put in DB
  * @param {Array}  failed  failed invites error message
+ * @param {Array} members  already members of the project
  *
  * @returns {Promise<Promise[]>} list of promises
  */
-const buildCreateInvitePromises = (req, invite, invites, data, failed) => {
+const buildCreateInvitePromises = (req, invite, invites, data, failed, members) => {
   const invitePromises = [];
   if (invite.userIds) {
     // remove invites for users that are invited already
-    _.remove(invite.userIds, u => _.some(invites, i => i.userId === u));
+    const errMessageForAlreadyInvitedUsers = 'User with such handle is already invited to this project.';
+    _.remove(invite.userIds, u => _.some(invites, (i) => {
+      const isPresent = i.userId === u;
+      if (isPresent) {
+        failed.push(_.assign({}, {
+          userId: u,
+          message: errMessageForAlreadyInvitedUsers,
+        }));
+      }
+      return isPresent;
+    }));
     invite.userIds.forEach((userId) => {
       const dataNew = _.clone(data);
 
@@ -96,8 +107,34 @@ const buildCreateInvitePromises = (req, invite, invites, data, failed) => {
             compareEmail(existentUser.email, inviteEmail, { UNIQUE_GMAIL_VALIDATION: false })),
         );
 
+        // remove users that are already member of the team
+        const errMessageForAlreadyMemberUsers = 'User with such email is already a member of the team.';
+
+        _.remove(existentUsersWithNumberId, user => _.some(members, (m) => {
+          const isPresent = (m.userId === user.id);
+          if (isPresent) {
+            failed.push(_.assign({}, {
+              email: user.email,
+              message: errMessageForAlreadyMemberUsers,
+            }));
+          }
+          return isPresent;
+        }));
+
         // remove invites for users that are invited already
-        _.remove(existentUsersWithNumberId, user => _.some(invites, i => i.userId === user.id));
+        const errMessageForAlreadyInvitedUsers = 'User with such email is already invited to this project.';
+
+        _.remove(existentUsersWithNumberId, user => _.some(invites, (i) => {
+          const isPresent = (i.userId === user.id);
+          if (isPresent) {
+            failed.push(_.assign({}, {
+              email: i.email,
+              message: errMessageForAlreadyInvitedUsers,
+            }));
+          }
+          return isPresent;
+        }));
+
         existentUsersWithNumberId.forEach((user) => {
           const dataNew = _.clone(data);
 
@@ -109,8 +146,19 @@ const buildCreateInvitePromises = (req, invite, invites, data, failed) => {
 
         // remove invites for users that are invited already
         _.remove(nonExistentUserEmails, email =>
-          _.some(invites, i =>
-            compareEmail(i.email, email, { UNIQUE_GMAIL_VALIDATION: config.get('UNIQUE_GMAIL_VALIDATION') })));
+          _.some(invites, (i) => {
+            const areEmailsSame = compareEmail(i.email, email, {
+              UNIQUE_GMAIL_VALIDATION: config.get('UNIQUE_GMAIL_VALIDATION'),
+            });
+            if (areEmailsSame) {
+              failed.push(_.assign({}, {
+                email: i.email,
+                message: errMessageForAlreadyInvitedUsers,
+              }));
+            }
+            return areEmailsSame;
+          }),
+        );
         nonExistentUserEmails.forEach((email) => {
           const dataNew = _.clone(data);
 
@@ -204,9 +252,19 @@ module.exports = [
     const projectId = _.parseInt(req.params.projectId);
 
     const promises = [];
+    const errorMessageForAlreadyMemberUser = 'User with such handle is already a member of the team.';
     if (invite.userIds) {
       // remove members already in the team
-      _.remove(invite.userIds, u => _.some(members, m => m.userId === u));
+      _.remove(invite.userIds, u => _.some(members, (m) => {
+        const isPresent = m.userId === u;
+        if (isPresent) {
+          failed.push(_.assign({}, {
+            userId: m.userId,
+            message: errorMessageForAlreadyMemberUser,
+          }));
+        }
+        return isPresent;
+      }));
         // permission:
         // user has to have constants.MANAGER_ROLES role
         // to be invited as PROJECT_MEMBER_ROLE.MANAGER
@@ -262,7 +320,7 @@ module.exports = [
           };
 
           req.log.debug('Creating invites');
-          return models.sequelize.Promise.all(buildCreateInvitePromises(req, invite, invites, data, failed))
+          return models.sequelize.Promise.all(buildCreateInvitePromises(req, invite, invites, data, failed, members))
             .then((values) => {
               values.forEach((v) => {
                 req.app.emit(EVENT.ROUTING_KEY.PROJECT_MEMBER_INVITE_CREATED, {