Skip to content

Permissions hotfix#1743

Merged
jmgasper merged 10 commits intomasterfrom
permissions-hotfix
Mar 18, 2026
Merged

Permissions hotfix#1743
jmgasper merged 10 commits intomasterfrom
permissions-hotfix

Conversation

@jmgasper
Copy link
Copy Markdown
Collaborator

COPILOTS_URL: 'https://copilots.topcoder-dev.com',

// Projects API v6: keep dev default (switch to LOCAL_PROJECTS_API when needed)
PROJECT_API_URL: `${DEV_API_HOSTNAME}/v6/projects`,
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
The PROJECT_API_URL is set to use the development API host (DEV_API_HOSTNAME). Consider using the local endpoint LOCAL_PROJECTS_API for consistency with other local services, unless there's a specific reason to keep it on the dev environment.

checkAdmin: jest.fn(),
checkReadOnlyRoles: jest.fn(),
checkAdminOrCopilotOrManager: jest.fn(),
checkCanManageProject: jest.fn(),
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The function checkCanManageProject is replacing checkAdminOrCopilotOrManager. Ensure that the new function provides equivalent or improved functionality, as this change may affect permission checks.

checkCanViewProjectAssets: jest.fn(),
checkManager: jest.fn(),
getProjectMemberByUserId: jest.fn((project, userId) => {
getProjectMemberRole: jest.fn((project, userId) => {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The function getProjectMemberRole now returns the role directly instead of the member object. Verify that all usages of this function are updated accordingly, as this change alters the expected return value.

const roles = _.get(tokenData, 'roles')
const talentManagerRoles = ['talent manager', 'topcoder talent manager']
return roles.some(val => talentManagerRoles.indexOf(val.toLowerCase()) > -1)
return roles.some(val => TALENT_MANAGER_ROLES.indexOf(val.toLowerCase()) > -1)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
The constant TALENT_MANAGER_ROLES is defined at the top of the file and is used here. Ensure that this constant is imported from a shared constants file if it is used across multiple files to avoid duplication and improve maintainability.

return project && !_.isEmpty(project) && (_.find(
project.invites,
d => (
d.status === PROJECT_MEMBER_INVITE_STATUS_PENDING &&
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The addition of d.status === PROJECT_MEMBER_INVITE_STATUS_PENDING improves the correctness of the invitation check by ensuring only pending invites are considered. This is a necessary change to prevent processing non-actionable invites.

})

describe('getProjectMemberByUserId', () => {
it('matches project members even when ids differ by string vs number types', () => {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ correctness]
The test case for getProjectMemberByUserId relies on implicit type coercion between string and number for userId. Consider explicitly converting userId to a consistent type to avoid potential issues with type mismatches in the future.

decodeToken.mockReset()
})

it('returns the pending invite for the authenticated user', () => {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ correctness]
The test case for checkIsUserInvitedToProject assumes that the decodeToken function will always return a valid object with userId and email. Consider adding a test case to handle scenarios where decodeToken might return an unexpected value or throw an error, to ensure robustness.

@jmgasper jmgasper merged commit 9787c8b into master Mar 18, 2026
4 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant