Allow unxUsers to override createdBy...

Author: minottic

sci-log-db/src/__tests__/acceptance/basesnippet.controller.acceptance.ts

@@ -67,6 +67,7 @@ describe('Basesnippet', function (this: Suite) {
           expect(result.body.updateACL).to.be.eql(['basesnippetAcceptance']),
           expect(result.body.deleteACL).to.be.eql(['basesnippetAcceptance']),
           expect(result.body.adminACL).to.be.eql(['admin']),
+          expect(result.body.createdBy).to.be.eql('[email protected]'),
           (baseSnippetId = result.body.id)
         ),
       )

sci-log-db/src/__tests__/acceptance/logbook.controller.acceptance.ts

@@ -432,6 +432,18 @@ describe('Logbook', function (this: Suite) {
   });
 
   it('post a logbook with authentication and should create default ACLS from parent', async () => {
+    const unxUser = {
+      email: '[email protected]',
+      firstName: 'ExampleUnx',
+      lastName: 'UserUnx',
+      roles: ['any-authenticated-user', 'aUnxGroup'],
+    };
+    const unxToken = await createUserToken(
+      app,
+      client,
+      ['logbookAcceptance'],
+      unxUser,
+    );
     const locationSnippet = {
       isPrivate: true,
       defaultOrder: 0,
@@ -451,12 +463,14 @@ describe('Logbook', function (this: Suite) {
 
     await client
       .post('/logbooks')
-      .set('Authorization', 'Bearer ' + token)
+      .set('Authorization', 'Bearer ' + unxToken)
       .set('Content-Type', 'application/json')
       .send({
-        ..._.omit(logbookSnippet, 'location'),
+        ...logbookSnippet,
         accessGroups: ['anAccessGroups'],
         location: locationResponse.body.id,
+        createdBy: '[email protected]',
+        createdAt: '1999-10-10T14:04:19.522Z',
       })
       .expect(200)
       .then(
@@ -491,7 +505,9 @@ describe('Logbook', function (this: Suite) {
             adminUser.email,
             adminUser.unxGroup,
           ]),
-          expect(result.body.adminACL).to.be.eql(['admin', adminUser.unxGroup])
+          expect(result.body.adminACL).to.be.eql(['admin', adminUser.unxGroup]),
+          expect(result.body.createdBy).to.be.eql('[email protected]'),
+          expect(result.body.createdAt).to.be.eql('1999-10-10T14:04:19.522Z')
         ),
       )
       .catch(err => {

sci-log-db/src/__tests__/acceptance/test-helper.ts

@@ -93,8 +93,9 @@ export async function createUserToken(
   app: SciLogDbApplication,
   client: Client,
   additionalRoles: string[] = [],
+  userD = userData,
 ) {
-  const user = await createAUser(app, additionalRoles);
+  const user = await createAUser(app, additionalRoles, userD);
   const token = await createToken(client, user);
   return token;
 }

sci-log-db/src/repositories/autoadd.repository.base.ts

@@ -330,23 +330,28 @@ export class AutoAddRepository<
           ctx.instance.defaultOrder =
             ctx.instance.defaultOrder ?? Date.now() * 1000;
           // only admin may override createdAt/updateAt etc fields
-          if (currentUser.roles.includes('admin')) {
-            ctx.instance.createdAt = ctx.instance.createdAt ?? new Date();
-            ctx.instance.createdBy =
-              ctx.instance.createdBy ??
-              currentUser?.email ??
-              '[email protected]';
-            ctx.instance.updatedAt = ctx.instance.updatedAt ?? new Date();
-            ctx.instance.updatedBy =
-              ctx.instance.updatedBy ??
-              currentUser?.email ??
-              '[email protected]';
-          } else {
-            ctx.instance.createdAt = new Date();
-            ctx.instance.createdBy = currentUser?.email ?? '[email protected]';
-            ctx.instance.updatedAt = new Date();
-            ctx.instance.updatedBy = currentUser?.email ?? '[email protected]';
-          }
+          ctx.instance.createdAt = ctx.instance.createdAt ?? new Date();
+          ctx.instance.createdBy =
+            ctx.instance.createdBy ??
+            currentUser?.email ??
+            '[email protected]';
+          ctx.instance.updatedAt = ctx.instance.updatedAt ?? new Date();
+          ctx.instance.updatedBy =
+            ctx.instance.updatedBy ??
+            currentUser?.email ??
+            '[email protected]';
+          await this.aclDefaultOnCreation(ctx.instance);
+          if (
+            currentUser.roles.some(
+              (role: string) =>
+                role === 'admin' || ctx.instance.adminACL?.includes(role),
+            )
+          )
+            return;
+          ctx.instance.createdAt = new Date();
+          ctx.instance.createdBy = currentUser?.email ?? '[email protected]';
+          ctx.instance.updatedAt = new Date();
+          ctx.instance.updatedBy = currentUser?.email ?? '[email protected]';
 
           if (typeof ctx.instance.expiresAt == 'undefined') {
             // default expiration time is 3 days
@@ -355,7 +360,6 @@ export class AutoAddRepository<
               ctx.instance.expiresAt.getDate() + 3,
             );
           }
-          await this.aclDefaultOnCreation(ctx.instance);
           if (
             ctx.instance.snippetType === 'logbook' &&
             ctx.instance.readACL?.includes('any-authenticated-user')