Archives/gristlabs_grist-core
1
0
Fork 0
mirror of https://github.com/gristlabs/grist-core.git synced 2026-03-02 04:09:24 +00:00
Code Issues Projects Releases Wiki Activity

(core) Only owners should be able to rename a document.

Browse Source 
Summary:
Checking SCHEMA_EDIT permission when user wants to
update document's name.

Test Plan: New test

Reviewers: paulfitz

Reviewed By: paulfitz

Differential Revision: https://phab.getgrist.com/D3733
This commit is contained in:
Jarosław Sadziński
2022-12-19 11:37:21 +01:00
parent 620e86a9f1
commit fa75c93d67
2 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
test/server/lib/DocApi.ts
View File

@@ -213,6 +213,20 @@ function testDocApi() {
await assert.isFulfilled(kiwiApi.deleteDoc(doc1));
});
it("should allow only owners to rename a document", async () => {
const ws1 = (await userApi.getOrgWorkspaces('current'))[0].id;
const doc1 = await userApi.newDoc({name: 'testrenameme1'}, ws1);
const kiwiApi = makeUserApi(ORG_NAME, 'kiwi');
// Kiwi is editor of the document, so he can't rename it.
await userApi.updateDocPermissions(doc1, {users: {'kiwi@getgrist.com': 'editors'}});
await assert.isRejected(kiwiApi.renameDoc(doc1, "testrenameme2"), /Forbidden/);
// Kiwi is owner of the document - now he can rename it.
await userApi.updateDocPermissions(doc1, {users: {'kiwi@getgrist.com': 'owners'}});
await assert.isFulfilled(kiwiApi.renameDoc(doc1, "testrenameme2"));
});
it("guesses types of new columns", async () => {
const userActions = [
['AddTable', 'GuessTypes', []],