Response filtering for comment endpoints

src/api/controllers/Comments.php

@@ -21,6 +21,13 @@ class Comments extends BaseController {
             return $this->jsonResponse($response);
         }
 
+        $task = new Task($this->container, $comment->task_id);
+        $column = new Column($this->container, $task->column_id);
+
+        if (!$this->checkBoardAccess($column->board_id, $request)) {
+            return $this->jsonResponse($response, 403);
+        }
+
         $this->apiJson->setSuccess();
         $this->apiJson->addData($comment);
 
@@ -37,7 +44,9 @@ class Comments extends BaseController {
         $comment = new Comment($this->container);
         $comment->loadFromJson($request->getBody());
 
-        if (!$comment->save()) {
+        $task = new Task($this->container, $comment->task_id);
+
+        if ($task->id === 0) {
             $this->logger->addError('Add Comment: ', [$comment]);
             $this->apiJson->addAlert('error', 'Error adding comment. ' .
                 'Please try again.');
@@ -45,7 +54,14 @@ class Comments extends BaseController {
             return $this->jsonResponse($response);
         }
 
+        if (!$this->checkBoardAccess($this->getBoardId($task->id), $request)) {
+            return $this->jsonResponse($response, 403);
+        }
+
+        $comment->save();
+
         $actor = new User($this->container, Auth::GetUserId($request));
+
         $this->dbLogger->logChange($this->container, $actor->id,
             $actor->username . ' added comment ' . $comment->id . '.',
             '', json_encode($comment), 'comment', $comment->id);
@@ -63,10 +79,23 @@ class Comments extends BaseController {
             return $this->jsonResponse($response, $status);
         }
 
-        // TODO: If user, verify submitting user
         $actor = new User($this->container, Auth::GetUserId($request));
 
-        $comment = new Comment($this->container, (int)$args['id']);
+        $id = (int)$args['id'];
+        $comment = new Comment($this->container, $id);
+
+        // If User level, only the user that created the comment
+        // may update it. If higher level, update is allowed.
+        if ($actor->security_level->getValue() === SecurityLevel::User) {
+            if ($actor->id !== $comment->user_id) {
+                $this->apiJson->addAlert('error',
+                    'You do not have sufficient permissions ' .
+                    'to update this comment.');
+
+                return $this->jsonResponse($response);
+            }
+        } // @codeCoverageIgnore
+
         $update = new Comment($this->container);
         $update->loadFromJson($request->getBody());
 
@@ -78,6 +107,11 @@ class Comments extends BaseController {
             return $this->jsonResponse($response);
         }
 
+        if (!$this->checkBoardAccess($this->getBoardId($comment->task_id),
+                $request)) {
+            return $this->jsonResponse($response, 403);
+        }
+
         $update->save();
 
         $this->dbLogger->logChange($this->container, $actor->id,
@@ -98,12 +132,23 @@ class Comments extends BaseController {
             return $this->jsonResponse($response, $status);
         }
 
-        // TODO: If user, verify submitting user
         $actor = new User($this->container, Auth::GetUserId($request));
 
         $id = (int)$args['id'];
         $comment = new Comment($this->container, $id);
 
+        // If User level, only the user that created the comment
+        // may delete it. If higher level, delete is allowed.
+        if ($actor->security_level->getValue() === SecurityLevel::User) {
+            if ($actor->id !== $comment->user_id) {
+                $this->apiJson->addAlert('error',
+                    'You do not have sufficient permissions ' .
+                    'to remove this comment.');
+
+                return $this->jsonResponse($response);
+            }
+        } // @codeCoverageIgnore
+
         if ($comment->id !== $id) {
             $this->logger->addError('Remove Comment: ', [$comment]);
             $this->apiJson->addAlert('error', 'Error removing comment. ' .
@@ -112,6 +157,11 @@ class Comments extends BaseController {
             return $this->jsonResponse($response);
         }
 
+        if (!$this->checkBoardAccess($this->getBoardId($comment->task_id),
+                $request)) {
+            return $this->jsonResponse($response, 403);
+        }
+
         $before = $comment;
         $comment->delete();
 
@@ -124,5 +174,13 @@ class Comments extends BaseController {
 
         return $this->jsonResponse($response);
     }
+
+    private function getBoardId($taskId) {
+        $task = new Task($this->container, $taskId);
+
+        $column = new Column($this->container, $task->column_id);
+
+        return $column->board_id;
+    }
 }
 

test/api/controllers/AttachmentsTest.php

@@ -175,7 +175,7 @@ class AttachmentsTest extends PHPUnit_Framework_TestCase {
         $args['id'] = 1;
 
         $this->attachments = new Attachments(new ContainerMock());
-        $request =new RequestMock();
+        $request = new RequestMock();
         $request->header = [DataMock::getJwt(2)];
 
         $actual = $this->attachments->removeAttachment($request,
@@ -183,7 +183,6 @@ class AttachmentsTest extends PHPUnit_Framework_TestCase {
 
         $this->assertEquals('You do not have sufficient permissions to ' .
             'remove this attachment.', $actual->alerts[0]['text']);
-
     }
 
     public function testRemoveAttachmentForbidden() {

test/api/controllers/ColumnsTest.php

@@ -179,8 +179,10 @@ class ColumnsTest extends PHPUnit_Framework_TestCase {
         $this->assertEquals('Access restricted.',
             $actual->alerts[0]['text']);
     }
+
     public function testUpdateColumn() {
         $this->createColumn();
+        $this->columns = new Columns(new ContainerMock());
 
         $column = DataMock::getColumn();
         $column->name = 'updated';
@@ -196,12 +198,13 @@ class ColumnsTest extends PHPUnit_Framework_TestCase {
             new ResponseMock(), $args);
         $this->assertEquals('success', $response->status);
 
+        $this->columns = new Columns(new ContainerMock());
         $request->payload = new stdClass();
         $request->header = [DataMock::getJwt()];
 
         $response = $this->columns->updateColumn($request,
             new ResponseMock(), $args);
-        $this->assertEquals('error', $response->alerts[2]['type']);
+        $this->assertEquals('error', $response->alerts[0]['type']);
     }
 
     public function testUpdateColumnUnprivileged() {

test/api/controllers/CommentsTest.php

@@ -1,6 +1,9 @@
 <?php
 require_once __DIR__ . '/../Mocks.php';
 
+/**
+ * @group single
+ */
 class CommentsTest extends PHPUnit_Framework_TestCase {
     private $comments;
 
@@ -42,6 +45,25 @@ class CommentsTest extends PHPUnit_Framework_TestCase {
         $this->assertEquals(2, count($actual->data));
     }
 
+    public function testGetCommentForbidden() {
+        $this->createComment();
+
+        DataMock::createBoardAdminUser();
+
+        $args = [];
+        $args['id'] = 1;
+
+        $request = new RequestMock();
+        $request->header = [DataMock::getJwt(2)];
+
+        $this->comments = new Comments(new ContainerMock());
+
+        $actual = $this->comments->getComment($request,
+            new ResponseMock(), $args);
+        $this->assertEquals('Access restricted.',
+            $actual->alerts[0]['text']);
+    }
+
     public function testGetCommentUnprivileged() {
         $res = DataMock::createUnpriviligedUser();
         $this->assertEquals('success', $res->status);
@@ -124,6 +146,66 @@ class CommentsTest extends PHPUnit_Framework_TestCase {
         $this->assertEquals('failure', $response->status);
     }
 
+    public function testAddCommentForbidden() {
+        $this->createBoard();
+        $this->createTask();
+        DataMock::createBoardAdminUser();
+
+        $request = new RequestMock();
+        $request->header = [DataMock::getJwt(2)];
+
+        $comment = DataMock::getComment();
+        $comment->id = 0;
+
+        $request->payload = $comment;
+
+        $this->comments = new Comments(new ContainerMock());
+
+        $actual = $this->comments->addComment($request,
+            new ResponseMock(), null);
+        $this->assertEquals('Access restricted.',
+            $actual->alerts[0]['text']);
+    }
+
+    public function testRemoveCommentForbidden() {
+        $this->createComment();
+
+        DataMock::createBoardAdminUser();
+
+        $args = [];
+        $args['id'] = 1;
+
+        $request = new RequestMock();
+        $request->header = [DataMock::getJwt(2)];
+
+        $this->comments = new Comments(new ContainerMock());
+
+        $actual = $this->comments->removeComment($request,
+            new ResponseMock(), $args);
+        $this->assertEquals('Access restricted.',
+            $actual->alerts[0]['text']);
+    }
+
+    public function testRemoveCommentUserSecurity() {
+        $this->createComment();
+
+        DataMock::createStandardUser();
+
+        $args = [];
+        $args['id'] = 1;
+
+        $this->comments = new Comments(new ContainerMock());
+
+        $request = new RequestMock();
+        $request->header = [DataMock::getJwt(2)];
+
+        $actual = $this->comments->removeComment($request,
+            new ResponseMock(), $args);
+
+        $this->assertEquals('You do not have sufficient permissions to ' .
+            'remove this comment.', $actual->alerts[0]['text']);
+    }
+
     public function testUpdateComment() {
         $this->createComment();
         $this->comments = new Comments(new ContainerMock());
@@ -174,7 +256,81 @@ class CommentsTest extends PHPUnit_Framework_TestCase {
             $actual->alerts[0]['text']);
     }
 
+    public function testUpdateCommentForbidden() {
+        $this->createComment();
+
+        DataMock::createBoardAdminUser();
+
+        $comment = DataMock::getComment();
+        $comment->text = 'updated';
+
+        $args = [];
+        $args['id'] = $comment->id;
+
+        $request = new RequestMock();
+        $request->header = [DataMock::getJwt(2)];
+        $request->payload = $comment;
+
+        $this->comments = new Comments(new ContainerMock());
+
+        $actual = $this->comments->updateComment($request,
+            new ResponseMock(), $args);
+        $this->assertEquals('Access restricted.',
+            $actual->alerts[0]['text']);
+    }
+
+    public function testUpdateCommentUserSecurity() {
+        $this->createComment();
+        DataMock::createStandardUser();
+
+        $args = [];
+        $args['id'] = 1;
+
+        $comment = DataMock::getComment();
+        $comment->text = 'updated';
+
+        $this->comments = new Comments(new ContainerMock());
+        $request = new RequestMock();
+        $request->header = [DataMock::getJwt(2)];
+        $request->payload = $comment;
+
+        $actual = $this->comments->updateComment($request,
+            new ResponseMock(), $args);
+
+        $this->assertEquals('You do not have sufficient permissions to ' .
+            'update this comment.', $actual->alerts[0]['text']);
+    }
+
+    private function createBoard() {
+        $board = DataMock::getBoard();
+        $board->users = [];
+        $board->users[] = new User(new ContainerMock(), 1);
+        $board->auto_actions = [];
+
+        $request = new RequestMock();
+        $request->payload = $board;
+        $request->header = [DataMock::getJwt()];
+
+        $boards = new Boards(new ContainerMock());
+        $boards->addBoard($request, new ResponseMock(), null);
+    }
+
+    private function createTask() {
+        $task = DataMock::getTask();
+        $task->id = 0;
+
+        $request = new RequestMock();
+        $request->payload = $task;
+        $request->header = [DataMock::getJwt()];
+
+        $tasks = new Tasks(new ContainerMock());
+        $tasks->addTask($request, new ResponseMock(), null);
+    }
+
     private function createComment() {
+        $this->createBoard();
+        $this->createTask();
+
         $request = new RequestMock();
         $comment = DataMock::getComment();
         $comment->id = 0;