Archives/gristlabs_grist-core
1
0
Fork 0
mirror of https://github.com/gristlabs/grist-core.git synced 2026-03-02 04:09:24 +00:00
Code Issues Projects Releases Wiki Activity

(core) Fixing the ViewAs feature when the example user exists

Browse Source 
Summary:
View as feature uses example.com emails for simulated users. This can break
when such a user already exists in the home db. Here we pretend that these users
don't exist during ACL checks.

Test Plan: Updated and existing

Reviewers: paulfitz

Reviewed By: paulfitz

Subscribers: paulfitz

Differential Revision: https://phab.getgrist.com/D3705
This commit is contained in:
Jarosław Sadziński
2022-11-17 15:14:49 +01:00
parent 7b7b26c983
commit af462fc938
2 changed files with 10 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/server/lib/GranularAccess.ts
View File

@@ -1837,7 +1837,11 @@ export class GranularAccess implements GranularAccessForBundle {
const dbUser = linkParameters.aclAsUserId ?
(await this._homeDbManager.getUser(integerParam(linkParameters.aclAsUserId, 'aclAsUserId'))) :
(await this._homeDbManager.getExistingUserByLogin(linkParameters.aclAsUser));
if (!dbUser && linkParameters.aclAsUser) {
// If this is one of example users we will pretend that it doesn't exist, otherwise we would
// end up using permissions of the real user.
const isExampleUser = this.getExampleViewAsUsers().some(e => e.email === dbUser?.loginEmail);
const userExists = dbUser && !isExampleUser;
if (!userExists && linkParameters.aclAsUser) {
// Look further for the user, in user attribute tables or examples.
const otherUsers = (await this.collectViewAsUsersFromUserAttributeTables())
.concat(this.getExampleViewAsUsers());
@@ -1854,12 +1858,12 @@ export class GranularAccess implements GranularAccessForBundle {
};
}
}
const docAuth = dbUser && await this._homeDbManager.getDocAuthCached({
const docAuth = userExists ? await this._homeDbManager.getDocAuthCached({
urlId: this._docId,
userId: dbUser.id
});
}) : null;
const access = docAuth?.access || null;
const user = dbUser && this._homeDbManager.makeFullUser(dbUser) || null;
const user = userExists ? this._homeDbManager.makeFullUser(dbUser) : null;
return { access, user };
}