mirror of
https://github.com/wekan/wekan.git
synced 2026-11-08 03:22:32 -05:00
Lauri Ojansivu
7595727917
A board can let every signed-in user edit it, when Admin Panel / Settings / Visibility allows it: a non-member then comments, edits and moves cards like a Normal member, and their first edit makes them one. Board-wide settings stay members-only. Lists can allow or refuse editing and commenting per role (list menu, board admins): built-in roles, custom roles and, on an open board, everyone signed in. The server applies it to card, checklist, attachment and comment writes and to moves into the list; the REST API honours a list's refusal on every per-list card route. A direct client write of the setting is refused and shown in Admin Panel / Problems. Every board has a key, unique in the instance, suggested from its title and set for existing boards at startup; card numbers show as KEY-7 and searching for KEY-7 finds the card. Shared labels in Admin Panel / Labels, for every board or an organization's or team's boards; a board uses them beside its own, and a rename or colour change reaches every board that uses it. New strings translated in all languages. Low confidence: chr, tlh, wal, ay, ace, nah, gn, iu, zgh, rup, wo, se, ff, tig, vo, bm, kl, bua, nap, mai, to, ks, qu, bo, fj, haw, om, ss, ts, ve-PP, lld, scn. Thanks to Meeques, justinr1234, tiFabGrinch, ejlkemper and xet7 ! Fixes #4575, Fixes #4527, Fixes #2449, Fixes #2450, Fixes #2761, Fixes #4698.
54 lines
2.8 KiB
JavaScript
54 lines
2.8 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { Meteor } from 'meteor/meteor';
|
|
import { Random } from 'meteor/random';
|
|
import Boards from '/models/boards';
|
|
import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
|
|
import { allowIsBoardMemberWithWriteAccess } from '/server/lib/utils';
|
|
import { joinOnEdit } from '/server/instanceEditing';
|
|
|
|
// #4575 on a running server: with Admin Panel allowing it and the board turned
|
|
// on, a signed-in non-member may write, and their first edit makes them a
|
|
// Normal member; with Admin Panel not allowing it, they may not.
|
|
describe('Boards every signed-in user may edit (runtime)', function () {
|
|
this.timeout(60000);
|
|
const owner = Random.id(), stranger = Random.id(), boardId = Random.id();
|
|
const SETTING = 'tableVisibilityMode-allowInstanceEditing';
|
|
let savedSetting;
|
|
const settle = () => new Promise(resolve => setTimeout(resolve, 300));
|
|
|
|
before(async function () {
|
|
if (!Meteor.isAppTest) this.skip();
|
|
savedSetting = await TableVisibilityModeSettings.findOneAsync(SETTING);
|
|
await Meteor.users.rawCollection().insertMany([
|
|
{ _id: owner, username: `ie-owner-${owner}`, profile: {} },
|
|
{ _id: stranger, username: `ie-stranger-${stranger}`, profile: {} },
|
|
]);
|
|
await Boards.rawCollection().insertOne({ _id: boardId, title: 'Open', type: 'board', permission: 'instance', archived: false,
|
|
allowsInstanceEditing: true, members: [{ userId: owner, isAdmin: true, isActive: true }] });
|
|
});
|
|
|
|
after(async function () {
|
|
if (!Meteor.isAppTest) return;
|
|
await TableVisibilityModeSettings.rawCollection().updateOne({ _id: SETTING }, { $set: { booleanValue: savedSetting ? savedSetting.booleanValue : false } }, { upsert: true });
|
|
await Boards.rawCollection().deleteOne({ _id: boardId });
|
|
await Meteor.users.rawCollection().deleteMany({ _id: { $in: [owner, stranger] } });
|
|
});
|
|
|
|
it('not allowed in the Admin Panel: a non-member may not write (negative)', async () => {
|
|
await TableVisibilityModeSettings.rawCollection().updateOne({ _id: SETTING }, { $set: { booleanValue: false } }, { upsert: true });
|
|
await settle();
|
|
assert.equal(allowIsBoardMemberWithWriteAccess(stranger, await Boards.findOneAsync(boardId)), false);
|
|
});
|
|
|
|
it('allowed: a non-member may write, and the first edit makes them a Normal member', async () => {
|
|
await TableVisibilityModeSettings.rawCollection().updateOne({ _id: SETTING }, { $set: { booleanValue: true } });
|
|
await settle();
|
|
assert.equal(allowIsBoardMemberWithWriteAccess(stranger, await Boards.findOneAsync(boardId)), true);
|
|
await joinOnEdit(stranger, boardId);
|
|
const m = (await Boards.findOneAsync(boardId)).members.find(x => x.userId === stranger);
|
|
assert.equal(m.isActive, true);
|
|
assert.equal(m.isAdmin, false);
|
|
assert.equal(m.isReadOnly, false);
|
|
});
|
|
});
|