From 0b88ebd2e8f76d705d16af9eee3a4affcb8dd13d Mon Sep 17 00:00:00 2001 From: quentin Date: Thu, 19 Dec 2024 16:00:48 -0600 Subject: [PATCH] Missing permission for users to remove their own signup --- .../.idea/dataSources.xml | 13 ++ .../.idea/deployment.xml | 12 +- .../.idea/sqldialects.xml | 6 + .../.idea/sshConfigs.xml | 2 + .../.idea/webServers.xml | 14 ++ .../GrantNames/SignupGrantNames.cs | 1 + API/Authentication/SignupAuthentication.cs | 1 + API/Controllers/AuthController.cs | 5 +- Setup/Filler/Grants.sql | 139 +++++++++--------- Setup/Filler/Permissions.sql | 5 +- sanAntonioSeniorGolf.sln.DotSettings.user | 1 + 11 files changed, 116 insertions(+), 83 deletions(-) create mode 100644 .idea/.idea.sanAntonioSeniorGolf/.idea/sqldialects.xml create mode 100644 .idea/.idea.sanAntonioSeniorGolf/.idea/webServers.xml diff --git a/.idea/.idea.sanAntonioSeniorGolf/.idea/dataSources.xml b/.idea/.idea.sanAntonioSeniorGolf/.idea/dataSources.xml index ba4873d..ab79067 100644 --- a/.idea/.idea.sanAntonioSeniorGolf/.idea/dataSources.xml +++ b/.idea/.idea.sanAntonioSeniorGolf/.idea/dataSources.xml @@ -25,5 +25,18 @@ jdbc:sqlite:$USER_HOME$/.local/share/scoreSphere/core.sqlite $ProjectFileDir$ + + mysql.8 + true + com.mysql.cj.jdbc.Driver + jdbc:mysql://localhost:5618 + + + + + + + $ProjectFileDir$ + \ No newline at end of file diff --git a/.idea/.idea.sanAntonioSeniorGolf/.idea/deployment.xml b/.idea/.idea.sanAntonioSeniorGolf/.idea/deployment.xml index f0c7784..05bf693 100644 --- a/.idea/.idea.sanAntonioSeniorGolf/.idea/deployment.xml +++ b/.idea/.idea.sanAntonioSeniorGolf/.idea/deployment.xml @@ -1,14 +1,4 @@ - - - - - - - - - - - + \ No newline at end of file diff --git a/.idea/.idea.sanAntonioSeniorGolf/.idea/sqldialects.xml b/.idea/.idea.sanAntonioSeniorGolf/.idea/sqldialects.xml new file mode 100644 index 0000000..208fd82 --- /dev/null +++ b/.idea/.idea.sanAntonioSeniorGolf/.idea/sqldialects.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/.idea/.idea.sanAntonioSeniorGolf/.idea/sshConfigs.xml b/.idea/.idea.sanAntonioSeniorGolf/.idea/sshConfigs.xml index 936ba6a..86fbd84 100644 --- a/.idea/.idea.sanAntonioSeniorGolf/.idea/sshConfigs.xml +++ b/.idea/.idea.sanAntonioSeniorGolf/.idea/sshConfigs.xml @@ -2,6 +2,8 @@ + + diff --git a/.idea/.idea.sanAntonioSeniorGolf/.idea/webServers.xml b/.idea/.idea.sanAntonioSeniorGolf/.idea/webServers.xml new file mode 100644 index 0000000..8df7b3f --- /dev/null +++ b/.idea/.idea.sanAntonioSeniorGolf/.idea/webServers.xml @@ -0,0 +1,14 @@ + + + + + + \ No newline at end of file diff --git a/API/Authentication/GrantNames/SignupGrantNames.cs b/API/Authentication/GrantNames/SignupGrantNames.cs index 5d1202d..8ebb8b7 100644 --- a/API/Authentication/GrantNames/SignupGrantNames.cs +++ b/API/Authentication/GrantNames/SignupGrantNames.cs @@ -10,6 +10,7 @@ namespace API.Authentication.GrantNames public const string CanUpdate = "api.signup.update"; public const string CanDeleteAny = "api.signup.delete.any"; public const string CanDelete = "api.signup.delete"; + public const string CanDeleteSelf = "api.signup.delete.self"; public const string CanAddOthers = "api.signup.add.others"; } } diff --git a/API/Authentication/SignupAuthentication.cs b/API/Authentication/SignupAuthentication.cs index eccb7bf..680e021 100644 --- a/API/Authentication/SignupAuthentication.cs +++ b/API/Authentication/SignupAuthentication.cs @@ -42,6 +42,7 @@ namespace API.Authentication public bool canDelete(Signup model, User user) { return _grantManager.hasGrant(user.permissionId, SignupGrantNames.CanDeleteAny) || + (model.userId == user.id && _grantManager.hasGrant(user.permissionId, SignupGrantNames.CanDeleteSelf)) || _grantManager.getULongValues(user.permissionId, SignupGrantNames.CanDelete).Exists(x => x == model.id); } } diff --git a/API/Controllers/AuthController.cs b/API/Controllers/AuthController.cs index 1b8dffa..82d4ff8 100644 --- a/API/Controllers/AuthController.cs +++ b/API/Controllers/AuthController.cs @@ -54,7 +54,7 @@ namespace API.Controllers if (registerDTO.password == null) registerDTO.password = registerDTO.phoneNumber; - if (permissionId == null) + if (permissionId != null) { User? user = getUser(User); if (user == null) @@ -66,8 +66,7 @@ namespace API.Controllers return Ok(createdUser); } - - { + else { UserDTO? user = _userManager.registerUser(registerDTO); if (user == null) diff --git a/Setup/Filler/Grants.sql b/Setup/Filler/Grants.sql index 55c92c7..d58fe1e 100644 --- a/Setup/Filler/Grants.sql +++ b/Setup/Filler/Grants.sql @@ -1,207 +1,210 @@ SET FOREIGN_KEY_CHECKS = 0; -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.color.get.all', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.color.get.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.color.get', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.color.add', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.color.update.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.color.update', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.color.delete.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.color.delete', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.event.get.all', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.event.get.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.event.get', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.event.add', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.event.update.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.event.update', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.event.delete.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.event.delete', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.grant.get.self', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.grant.get.all', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.grant.get.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.grant.get', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.grant.add', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.grant.update.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.grant.update', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.grant.delete.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.grant.delete', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.image.get.all', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.image.get.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.image.get', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.image.add', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.image.update.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.image.update', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.image.delete.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.image.delete', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.permission.get.all', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.permission.get.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.permission.get', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.permission.add', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.permission.update.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.permission.update', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.permission.delete.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.permission.delete', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.savedEvent.get.all', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.savedEvent.get.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.savedEvent.get', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.savedEvent.add', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.savedEvent.update.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.savedEvent.update', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.savedEvent.delete.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.savedEvent.delete', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.get.all', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.get.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.get', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.add', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.update.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.update', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.update.self', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.update.names', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.update.phoneNumber', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.update.permission', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.user.delete.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.signup.get.all', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.signup.get.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.signup.get', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.signup.add', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.signup.update.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.signup.update', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.signup.delete.any', 1, NOW(), 1); -INSERT INTO san_antonio_senior_golf.grants (name, permissionId, updated, updater) +INSERT INTO grants (name, permissionId, updated, updater) VALUES ('api.signup.delete', 1, NOW(), 1); +INSERT INTO grants (name, permissionId, updated, updater) +VALUES ('api.signup.add.others', 1, NOW(), 1); + SET FOREIGN_KEY_CHECKS = 1; diff --git a/Setup/Filler/Permissions.sql b/Setup/Filler/Permissions.sql index 7446a68..d5b8470 100644 --- a/Setup/Filler/Permissions.sql +++ b/Setup/Filler/Permissions.sql @@ -1,6 +1,9 @@ SET FOREIGN_KEY_CHECKS = 0; -INSERT INTO san_antonio_senior_golf.permissions (name, updated, updater) +INSERT INTO permissions (name, updated, updater) VALUES ('admin', NOW(), 1); +INSERT INTO permissions (name, updated, updater) +VALUES ('attendee', NOW(), 1); + SET FOREIGN_KEY_CHECKS = 1; diff --git a/sanAntonioSeniorGolf.sln.DotSettings.user b/sanAntonioSeniorGolf.sln.DotSettings.user index a0e6ca6..3ce4b9c 100644 --- a/sanAntonioSeniorGolf.sln.DotSettings.user +++ b/sanAntonioSeniorGolf.sln.DotSettings.user @@ -1,4 +1,5 @@  + ForceIncluded ForceIncluded <SessionState ContinuousTestingMode="0" IsActive="True" Name="Test1" xmlns="urn:schemas-jetbrains-com:jetbrains-ut-session"> <TestAncestor>