Docker/planka
Docker/planka
1
0
Fork 0
mirror of https://github.com/plankanban/planka.git synced 2025-07-19 05:09:43 +02:00
Code Issues Releases Activity

feat: Permissions for board members

Browse source 
Closes #262
This commit is contained in:
Maksim Eltyshev 2022-08-19 14:00:40 +02:00
parent 281cb4a71b
commit f9e0147f33
61 changed files with 1063 additions and 191 deletions
Download patch file Download diff file Expand all files Collapse all files

17
server/api/controllers/cards/create.js
View file

@ -1,6 +1,9 @@
const moment = require('moment');
const Errors = {
NOT_ENOUGH_RIGHTS: {
notEnoughRights: 'Not enough rights',
},
BOARD_NOT_FOUND: {
boardNotFound: 'Board not found',
},
@ -67,6 +70,9 @@ module.exports = {
},
exits: {
notEnoughRights: {
responseType: 'forbidden',
},
boardNotFound: {
responseType: 'notFound',
},
@ -88,12 +94,19 @@ module.exports = {
.getProjectPath(inputs.boardId)
.intercept('pathNotFound', () => Errors.BOARD_NOT_FOUND);
const isBoardMember = await sails.helpers.users.isBoardMember(currentUser.id, board.id);
const boardMembership = await BoardMembership.findOne({
boardId: board.id,
userId: currentUser.id,
});
if (!isBoardMember) {
if (!boardMembership) {
throw Errors.BOARD_NOT_FOUND; // Forbidden
}
if (boardMembership.role !== BoardMembership.Roles.EDITOR) {
throw Errors.NOT_ENOUGH_RIGHTS;
}
let list;
if (!_.isUndefined(inputs.listId)) {
list = await List.findOne({

17
server/api/controllers/cards/delete.js
View file

@ -1,4 +1,7 @@
const Errors = {
NOT_ENOUGH_RIGHTS: {
notEnoughRights: 'Not enough rights',
},
CARD_NOT_FOUND: {
cardNotFound: 'Card not found',
},
@ -14,6 +17,9 @@ module.exports = {
},
exits: {
notEnoughRights: {
responseType: 'forbidden',
},
cardNotFound: {
responseType: 'notFound',
},
@ -26,12 +32,19 @@ module.exports = {
.getProjectPath(inputs.id)
.intercept('pathNotFound', () => Errors.CARD_NOT_FOUND);
const isBoardMember = await sails.helpers.users.isBoardMember(currentUser.id, card.boardId);
const boardMembership = await BoardMembership.findOne({
boardId: card.boardId,
userId: currentUser.id,
});
if (!isBoardMember) {
if (!boardMembership) {
throw Errors.CARD_NOT_FOUND; // Forbidden
}
if (boardMembership.role !== BoardMembership.Roles.EDITOR) {
throw Errors.NOT_ENOUGH_RIGHTS;
}
card = await sails.helpers.cards.deleteOne(card, this.req);
if (!card) {

28
server/api/controllers/cards/update.js
View file

@ -1,6 +1,9 @@
const moment = require('moment');
const Errors = {
NOT_ENOUGH_RIGHTS: {
notEnoughRights: 'Not enough rights',
},
CARD_NOT_FOUND: {
cardNotFound: 'Card not found',
},
@ -83,6 +86,9 @@ module.exports = {
},
exits: {
notEnoughRights: {
responseType: 'forbidden',
},
cardNotFound: {
responseType: 'notFound',
},
@ -110,23 +116,37 @@ module.exports = {
let { card } = path;
const { list, board } = path;
let isBoardMember = await sails.helpers.users.isBoardMember(currentUser.id, board.id);
let boardMembership = await BoardMembership.findOne({
boardId: board.id,
userId: currentUser.id,
});
if (!isBoardMember) {
if (!boardMembership) {
throw Errors.CARD_NOT_FOUND; // Forbidden
}
if (boardMembership.role !== BoardMembership.Roles.EDITOR) {
throw Errors.NOT_ENOUGH_RIGHTS;
}
let nextBoard;
if (!_.isUndefined(inputs.boardId)) {
({ board: nextBoard } = await sails.helpers.boards
.getProjectPath(inputs.boardId)
.intercept('pathNotFound', () => Errors.BOARD_NOT_FOUND));
isBoardMember = await sails.helpers.users.isBoardMember(currentUser.id, nextBoard.id);
boardMembership = await BoardMembership.findOne({
boardId: nextBoard.id,
userId: currentUser.id,
});
if (!isBoardMember) {
if (!boardMembership) {
throw Errors.BOARD_NOT_FOUND; // Forbidden
}
if (boardMembership.role !== BoardMembership.Roles.EDITOR) {
throw Errors.NOT_ENOUGH_RIGHTS;
}
}
let nextList;