wtclaude
14dfc122ba
Staff are a superset of players — every player ability plus their staff
tools on top — but the /player/* group ran requireRole('player'), so a
signed-in admin/editor/moderator got 403 on their own linked game
accounts (e.g. GET /player/shard/accounts). On the Android client this
hid "My characters" and greyed the personal notification streams for
staff accounts, even when they had linked characters.
Drop the role gate: the group is now requireAuth-only. Every handler is
already self-scoped to the caller by req.user.id (with the pre-existing
isAdmin bypass still letting a genuine admin read any character), so this
only ever widens access to the caller's OWN data. Staff also reach the
identical self-scoped handlers under /admin/shard/* (same controller).
- player.routes.js: requireRole('player') -> requireAuth; corrected the
five stale "Player role required" 403 descriptions and regenerated
swagger-output.json.
- New test/playerRouteAccess.test.js mounts the router and asserts
player/admin/editor/moderator all reach the handler, anon still 401s,
and a disabled account still 403s. Suite: 420 pass.
Co-Authored-By: Claude <noreply@anthropic.com>
85 lines
3.4 KiB
JavaScript
85 lines
3.4 KiB
JavaScript
// Point the DB at a closed port BEFORE requiring anything that builds the pool,
|
|
// so any stray query fails fast instead of holding the process open. The session
|
|
// service, users model, and shardLinks model are all stubbed, so no query runs.
|
|
process.env.DB_HOST = '127.0.0.1'
|
|
process.env.DB_PORT = '59999'
|
|
|
|
const { test, after, afterEach } = require('node:test')
|
|
const assert = require('node:assert/strict')
|
|
|
|
const { startApp } = require('./_helper')
|
|
const playerRouter = require('../src/router/v1/player/player.routes')
|
|
const sessionService = require('../src/auth/session.service')
|
|
const users = require('../src/model/users/users.model')
|
|
const shardLinks = require('../src/model/shardLinks/shardLinks.model')
|
|
const db = require('../src/utils/db')
|
|
|
|
after(() => db.close())
|
|
|
|
const originals = {
|
|
validateSession: sessionService.validateSession,
|
|
isSessionRevoked: sessionService.isSessionRevoked,
|
|
sessionMeta: sessionService.sessionMeta,
|
|
getById: users.getById,
|
|
listForUser: shardLinks.listForUser,
|
|
}
|
|
afterEach(() => {
|
|
sessionService.validateSession = originals.validateSession
|
|
sessionService.isSessionRevoked = originals.isSessionRevoked
|
|
sessionService.sessionMeta = originals.sessionMeta
|
|
users.getById = originals.getById
|
|
shardLinks.listForUser = originals.listForUser
|
|
})
|
|
|
|
// Sign every request in as the given DB user (role decides the gate outcome).
|
|
function signInAs(user) {
|
|
sessionService.validateSession = () => ({ userId: user.id, sessionId: 's1', createdAt: Date.now(), authMethod: 'jwt' })
|
|
sessionService.isSessionRevoked = async () => false
|
|
sessionService.sessionMeta = () => ({})
|
|
users.getById = async () => user
|
|
}
|
|
|
|
// The player self-service group is intentionally role-agnostic (staff are a
|
|
// superset of players): any authenticated, active account reaches the self-scoped
|
|
// handlers. Regression guard for the fix that dropped requireRole('player') so a
|
|
// staff/admin account is no longer 403'd out of its own characters.
|
|
for (const role of ['player', 'admin', 'editor', 'moderator']) {
|
|
test(`GET /player/shard/accounts is reachable by an authenticated ${role}`, async () => {
|
|
signInAs({ id: 7, username: 'u', role, status: 'active' })
|
|
shardLinks.listForUser = async (id) => {
|
|
assert.equal(id, 7) // self-scoped to the caller regardless of role
|
|
return [{ account: 'acctA' }]
|
|
}
|
|
const app = await startApp((a) => a.use('/api/v1/player', playerRouter))
|
|
try {
|
|
const res = await fetch(app.url + '/api/v1/player/shard/accounts')
|
|
assert.equal(res.status, 200, `${role} should reach the handler, got ${res.status}`)
|
|
assert.deepEqual(await res.json(), [{ account: 'acctA' }])
|
|
} finally {
|
|
await app.close()
|
|
}
|
|
})
|
|
}
|
|
|
|
test('GET /player/shard/accounts still rejects an unauthenticated caller with 401', async () => {
|
|
sessionService.validateSession = () => null
|
|
const app = await startApp((a) => a.use('/api/v1/player', playerRouter))
|
|
try {
|
|
const res = await fetch(app.url + '/api/v1/player/shard/accounts')
|
|
assert.equal(res.status, 401)
|
|
} finally {
|
|
await app.close()
|
|
}
|
|
})
|
|
|
|
test('a disabled account is still rejected with 403 (status gate, not role)', async () => {
|
|
signInAs({ id: 8, username: 'banned', role: 'player', status: 'disabled' })
|
|
const app = await startApp((a) => a.use('/api/v1/player', playerRouter))
|
|
try {
|
|
const res = await fetch(app.url + '/api/v1/player/shard/accounts')
|
|
assert.equal(res.status, 403)
|
|
} finally {
|
|
await app.close()
|
|
}
|
|
})
|