diff --git a/ExpressAPI/src/helpers/GitlabHelper.ts b/ExpressAPI/src/helpers/GitlabHelper.ts index a31451537c5d44645a7725f0dc3971afdeabdcd8..d4b61a7541c4963b85dc769aeab6dca45693eab4 100644 --- a/ExpressAPI/src/helpers/GitlabHelper.ts +++ b/ExpressAPI/src/helpers/GitlabHelper.ts @@ -3,6 +3,9 @@ import Config from '../config/Config'; import GitlabRepository from '../shared/types/Gitlab/GitlabRepository'; import GitlabAccessLevel from '../shared/types/Gitlab/GitlabAccessLevel'; import GitlabMember from '../shared/types/Gitlab/GitlabMember'; +import { StatusCodes } from 'http-status-codes'; +import GitlabVisibility from '../shared/types/Gitlab/GitlabVisibility'; +import ApiRequest from '../models/ApiRequest'; enum GitlabRoutes { @@ -65,6 +68,37 @@ class GitlabHelper { return response.data; } + + async checkTemplateAccess(idOrNamespace: string, req: ApiRequest): Promise<StatusCodes> { + // Get the Gitlab project and check if it have public or internal visibility + try { + const project: GitlabRepository = await this.getRepository(idOrNamespace); + + if ( [ GitlabVisibility.Public.valueOf(), GitlabVisibility.Internal.valueOf() ].includes(project.visibility) ) { + return StatusCodes.OK; + } + } catch ( e ) { + return StatusCodes.NOT_FOUND; + } + + // Check if the user and dojo are members (with at least reporter access) of the project + const members = await this.getRepositoryMembers(idOrNamespace); + const isUsersAtLeastReporter = { + user: false, + dojo: false + }; + members.forEach(member => { + if ( member.access_level >= GitlabAccessLevel.Reporter ) { + if ( member.id === req.session.profile.userGitlabId ) { + isUsersAtLeastReporter.user = true; + } else if ( member.id === Config.gitlab.account.id ) { + isUsersAtLeastReporter.dojo = true; + } + } + }); + + return isUsersAtLeastReporter.user && isUsersAtLeastReporter.dojo ? StatusCodes.OK : StatusCodes.UNAUTHORIZED; + } } diff --git a/ExpressAPI/src/routes/GitlabRoutes.ts b/ExpressAPI/src/routes/GitlabRoutes.ts index 77e9ed7490c8d91921acd4db90ca1ef92cbf54de..be2257a92eada2b2cf4c2b61d0ff29f7eba089df 100644 --- a/ExpressAPI/src/routes/GitlabRoutes.ts +++ b/ExpressAPI/src/routes/GitlabRoutes.ts @@ -1,15 +1,10 @@ import { Express } from 'express-serve-static-core'; import express from 'express'; -import { StatusCodes } from 'http-status-codes'; import RoutesManager from '../express/RoutesManager'; import ApiRequest from '../models/ApiRequest'; import SecurityMiddleware from '../middlewares/SecurityMiddleware'; import SecurityCheckType from '../types/SecurityCheckType'; import GitlabHelper from '../helpers/GitlabHelper'; -import GitlabRepository from '../shared/types/Gitlab/GitlabRepository'; -import GitlabVisibility from '../shared/types/Gitlab/GitlabVisibility'; -import Config from '../config/Config'; -import GitlabAccessLevel from '../shared/types/Gitlab/GitlabAccessLevel'; class EnonceRoutes implements RoutesManager { @@ -32,34 +27,7 @@ class EnonceRoutes implements RoutesManager { private async checkTemplateAccess(req: ApiRequest, res: express.Response) { const idOrNamespace: string = req.params.idOrNamespace; - // Get the Gitlab project and check if it have public or internal visibility - try { - const project: GitlabRepository = await GitlabHelper.getRepository(idOrNamespace); - - if ( [ GitlabVisibility.Public.valueOf(), GitlabVisibility.Internal.valueOf() ].includes(project.visibility) ) { - return res.status(StatusCodes.OK).send(); - } - } catch ( e ) { - return res.status(StatusCodes.NOT_FOUND).send(); - } - - // Check if the user and dojo are members (with at least reporter access) of the project - const members = await GitlabHelper.getRepositoryMembers(idOrNamespace); - const isUsersAtLeastReporter = { - user: false, - dojo: false - }; - members.forEach(member => { - if ( member.access_level >= GitlabAccessLevel.Reporter ) { - if ( member.id === req.session.profile.userGitlabId ) { - isUsersAtLeastReporter.user = true; - } else if ( member.id === Config.gitlab.account.id ) { - isUsersAtLeastReporter.dojo = true; - } - } - }); - - req.session.sendResponse(res, isUsersAtLeastReporter.user && isUsersAtLeastReporter.dojo ? StatusCodes.OK : StatusCodes.UNAUTHORIZED); + return res.status(await GitlabHelper.checkTemplateAccess(idOrNamespace, req)).send(); } }