Story map admin

app/api/chapters/chapter.openapi.yml

@@ -21,6 +21,9 @@
           application/json:
             schema:
               $ref: "#/components/schemas/ChaptersResponse"
+
+      '403':
+        $ref: "#/components/responses/UnauthorizedError"
 
 
 /stories/{storyId}/chapters/{id}:
@@ -74,7 +77,8 @@
           application/json:
             schema:
               $ref: "#/components/schemas/ChaptersResponse"
-
+      '403':
+        $ref: "#/components/responses/UnauthorizedError"
       '404':
         $ref: "#/components/responses/NotFoundError"
 
@@ -99,3 +103,5 @@
           application/json:
             schema:
               $ref: "#/components/schemas/SuccessMessageResponse"
+      '403':
+        $ref: "#/components/responses/UnauthorizedError"

app/api/chapters/chapters.controller.js

@@ -1,18 +1,21 @@
 const models = require("../../models");
 const { notFoundError } = require('../../utils/errors');
+const { validateStoryRight } = require('../../utils/story');
+const { route } = require("../../utils/express");
 
-const getChapterById = async (req, res) => {
+const getChapterById = route(async (req, res) => {
   const { id } = req.params;
   const chapter = await models.stories_chapters.findByPk(id);
   if (chapter) {
     res.json(chapter);
   } else {
     throw notFoundError(req);
   }
-};
+});
 
 //Add a chapter to the db
-const addChapter = async (req, res) => {
+const addChapter = route(async (req, res) => {
+  await validateStoryRight(req, res, req.params.storyId);
   const { storyId } = req.params;
   const { title, type, picture_id, url_media, description, zoom, indexinstory, view_custom } = req.body;
   const newChapter = await models.stories_chapters.create({
@@ -27,11 +30,12 @@ const addChapter = async (req, res) => {
       view_custom
   });
   res.status(201).json(newChapter); // Return the ID of the newly created chapter
-};
+});
 
 
 //Update a chapter
-const updateChapter = async (req, res) => {
+const updateChapter = route(async (req, res) => {
+  await validateStoryRight(req, res, req.params.storyId);
   const { storyId, id } = req.params;
   const { title, type, picture_id, url_media, description, zoom, indexinstory, view_custom } = req.body;
   const updatedChapter = await models.stories_chapters.update({
@@ -49,16 +53,17 @@ const updateChapter = async (req, res) => {
     where: {id: id}, returning: true, plain: true
   });
   res.status(200).json(updatedChapter[1]); // Return the ID of the newly created chapter
-};
+});
 
-const deleteChapter = async (req, res) => {
+const deleteChapter = route(async (req, res) => {
+  await validateStoryRight(req, res, req.params.storyId);
 
   await models.stories_chapters.destroy({where: {id:req.params.id}});
   res.send({
     message: "The story was deleted."
   });
 
-}
+});
 
 module.exports = {
   getChapterById,

app/api/chapters/chapters.delete.spec.js

@@ -25,6 +25,59 @@ describe('DELETE /stories/:storyId/chapters/:id', () => {
     ({ app } = createApplicationWithMocks());
   });
 
+  it('Delete a story with user without the right', async () => {
+    const user = await createUser({ roles: [ 'volunteer' ] });
+    const token = await generateJwtFor(user);
+    const [ owner1 ] = await generate(1, createOwner);
+    const yesterday = new Date(Date.now() - 24 * 60 * 60 * 1000);
+    const col1 = await createCollection({ date_publi: yesterday, is_owner_challenge: true, owner: owner1 });
+    const image = await createImage({ collection: col1, state: 'initial' });
+    const story = await createStory({
+      title: "Mon titre",
+      logo_link: "http://localhost",
+      description_preview: "abc",
+      description: "efg",
+      owner_id: owner1.id
+    });
+    const chapter = await createChapter({
+      title: 'titre',
+      type: 'IMAGE',
+      picture_id: image.id,
+      url_media: '',
+      description: 'description',
+      zoom: 14,
+      story_id: story.id,
+      indexinstory: 0,
+      view_custom: {
+        transparency: 0.5,
+        showBuilding: true,
+        buildingsSlider: 10,
+        depthSlider: 15
+      },
+    })
+
+    const initialState = await loadInitialState();
+
+    const req = {
+      method: 'DELETE',
+      path: `/stories/${story.id}/chapters/${chapter.id}`,
+      headers: {
+        Authorization: `Bearer ${token}`
+      }
+    };
+
+    expect(req).to.matchRequestDocumentation();
+
+    const res = await testHttpRequest(app, req);
+
+    expect(res)
+    .to.have.status(403)
+    .and.to.matchResponseDocumentation();
+
+    await expectNoSideEffects(app, initialState);
+
+  });
+
   it('Delete a story', async () => {
     const user = await createUser({ roles: [ 'owner_admin' ] });
     const token = await generateJwtFor(user);
@@ -37,7 +90,7 @@ describe('DELETE /stories/:storyId/chapters/:id', () => {
       logo_link: "http://localhost",
       description_preview: "abc",
       description: "efg",
-      owner_id: owner1.id
+      owner_id: user.owner_id
     });
     const initialState = await loadInitialState();
     const chapter = await createChapter({
@@ -80,4 +133,59 @@ describe('DELETE /stories/:storyId/chapters/:id', () => {
 
   });
 
+  it('Delete a story without owner_right', async () => {
+    const user = await createUser({ roles: [ 'owner_admin' ] });
+    const token = await generateJwtFor(user);
+    const [ owner1 ] = await generate(1, createOwner);
+    const yesterday = new Date(Date.now() - 24 * 60 * 60 * 1000);
+    const col1 = await createCollection({ date_publi: yesterday, is_owner_challenge: true, owner: owner1 });
+    const image = await createImage({ collection: col1, state: 'initial' });
+    const story = await createStory({
+      title: "Mon titre",
+      logo_link: "http://localhost",
+      description_preview: "abc",
+      description: "efg",
+      owner_id: owner1.id
+    });
+
+    const chapter = await createChapter({
+      title: 'titre',
+      type: 'IMAGE',
+      picture_id: image.id,
+      url_media: '',
+      description: 'description',
+      zoom: 14,
+      story_id: story.id,
+      indexinstory: 0,
+      view_custom: {
+        transparency: 0.5,
+        showBuilding: true,
+        buildingsSlider: 10,
+        depthSlider: 15
+      },
+    })
+
+    const currentCounts = await countDatabaseRows();
+    expect(currentCounts['stories_chapters']).to.be.equals(1);
+    const initialState = await loadInitialState();
+    const req = {
+      method: 'DELETE',
+      path: `/stories/${story.id}/chapters/${chapter.id}`,
+      headers: {
+        Authorization: `Bearer ${token}`
+      }
+    };
+
+    expect(req).to.matchRequestDocumentation();
+
+    const res = await testHttpRequest(app, req);
+
+    expect(res)
+    .to.have.status(403)
+    .and.to.matchResponseDocumentation();
+
+    await expectNoSideEffects(app, initialState);
+
+  });
+
 });

app/api/chapters/chapters.post.spec.js

@@ -22,8 +22,97 @@ describe('POST /stories/:id/chapters', () => {
     ({ app } = createApplicationWithMocks());
   });
 
-  describe('Post chapter when stories has no chapters and there is no view_custom', () => {
+  describe('Post chapter when user has not the right to create a chapter', () => {
     it('Add a chapter', async () => {
+      const user = await createUser({ roles: [ 'volunteer' ] });
+      const token = await generateJwtFor(user);
+      const [ owner1 ] = await generate(1, createOwner);
+      const yesterday = new Date(Date.now() - 24 * 60 * 60 * 1000);
+      const col1 = await createCollection({ date_publi: yesterday, is_owner_challenge: true, owner: owner1 });
+      const image = await createImage({ collection: col1, state: 'initial' });
+      const story = await createStory({
+        title: "Mon titre",
+        logo_link: "http://localhost",
+        description_preview: "abc",
+        description: "efg",
+        owner_id: user.owner_id
+      });
+      const chapter = {
+        title: 'titre',
+        type: 'IMAGE',
+        picture_id: image.id,
+        url_media: '',
+        description: 'description',
+        zoom: 14,
+        story_id: story.id,
+        indexinstory: 0,
+        view_custom: null,
+      }
+
+      const req = {
+        method: 'POST',
+        path: `/stories/${story.id}/chapters`,
+        body: chapter,
+        headers: {
+          Authorization: `Bearer ${token}`
+        }
+      };
+
+      expect(req).to.matchRequestDocumentation();
+
+      const res = await testHttpRequest(app, req);
+
+      expect(res)
+      .to.have.status(403)
+      .and.to.matchResponseDocumentation();
+
+    });
+    it('Add a chapter', async () => {
+      const user = await createUser({ roles: [ 'volunteer' ] });
+      const token = await generateJwtFor(user);
+      const [ owner1 ] = await generate(1, createOwner);
+      const yesterday = new Date(Date.now() - 24 * 60 * 60 * 1000);
+      const col1 = await createCollection({ date_publi: yesterday, is_owner_challenge: true, owner: owner1 });
+      const image = await createImage({ collection: col1, state: 'initial' });
+      const story = await createStory({
+        title: "Mon titre",
+        logo_link: "http://localhost",
+        description_preview: "abc",
+        description: "efg",
+        owner_id: user.owner_id
+      });
+      const chapter = {
+        title: 'titre',
+        type: 'IMAGE',
+        picture_id: image.id,
+        url_media: '',
+        description: 'description',
+        zoom: 14,
+        story_id: story.id,
+        indexinstory: 0,
+        view_custom: null,
+      }
+
+      const req = {
+        method: 'POST',
+        path: `/stories/${story.id}/chapters`,
+        body: chapter,
+        headers: {
+          Authorization: `Bearer ${token}`
+        }
+      };
+
+      expect(req).to.matchRequestDocumentation();
+
+      const res = await testHttpRequest(app, req);
+
+      expect(res)
+      .to.have.status(403)
+      .and.to.matchResponseDocumentation();
+
+    });
+
+    it('Add a chapter without owner right', async () => {
       const user = await createUser({ roles: [ 'owner_admin' ] });
       const token = await generateJwtFor(user);
       const [ owner1 ] = await generate(1, createOwner);
@@ -62,6 +151,53 @@ describe('POST /stories/:id/chapters', () => {
 
       const res = await testHttpRequest(app, req);
 
+      expect(res)
+      .to.have.status(403)
+      .and.to.matchResponseDocumentation();
+
+    });
+  });
+
+  describe('Post chapter when stories has no chapters and there is no view_custom', () => {
+    it('Add a chapter', async () => {
+      const user = await createUser({ roles: [ 'owner_admin' ] });
+      const token = await generateJwtFor(user);
+      const [ owner1 ] = await generate(1, createOwner);
+      const yesterday = new Date(Date.now() - 24 * 60 * 60 * 1000);
+      const col1 = await createCollection({ date_publi: yesterday, is_owner_challenge: true, owner: owner1 });
+      const image = await createImage({ collection: col1, state: 'initial' });
+      const story = await createStory({
+        title: "Mon titre",
+        logo_link: "http://localhost",
+        description_preview: "abc",
+        description: "efg",
+        owner_id: user.owner_id
+      });
+      const chapter = {
+        title: 'titre',
+        type: 'IMAGE',
+        picture_id: image.id,
+        url_media: '',
+        description: 'description',
+        zoom: 14,
+        story_id: story.id,
+        indexinstory: 0,
+        view_custom: null,
+      }
+
+      const req = {
+        method: 'POST',
+        path: `/stories/${story.id}/chapters`,
+        body: chapter,
+        headers: {
+          Authorization: `Bearer ${token}`
+        }
+      };
+
+      expect(req).to.matchRequestDocumentation();
+
+      const res = await testHttpRequest(app, req);
+
       chapter.id = 1;
 
       expect(res)
@@ -85,7 +221,7 @@ describe('POST /stories/:id/chapters', () => {
         logo_link: "http://localhost",
         description_preview: "abc",
         description: "efg",
-        owner_id: owner1.id
+        owner_id: user.owner_id
       });
 
       const chapter = {
@@ -141,7 +277,7 @@ describe('POST /stories/:id/chapters', () => {
         logo_link: "http://localhost",
         description_preview: "abc",
         description: "efg",
-        owner_id: owner1.id
+        owner_id: user.owner_id
       });
       await createChapter({
         title: 'titre',