fix(members): allow users to fetch own email. Fixes HELP-2449 (#912)

Co-authored-by: WikiRik <[email protected]>

Author: WikiRik

middlewares/members.js

@@ -92,20 +92,20 @@ exports.getUser = async (req, res) => {
 };
 
 exports.getUsersEmail = async (req, res) => {
-    if (!req.permissions.hasPermission('global:mail:member')) {
-        return errors.makeForbiddenError(res, 'Permission global:mail:member is required, but not present.');
-    }
+    const correctQuery = req.query.query && typeof req.query.query === 'string' && req.query.query.trim().length > 0 && req.query.query.match(/^\d+(?:,\d+)*$/g);
 
-    if (req.query.query && !req.query.query.match(/^\d+(?:,\d+)*$/g)) {
+    if (!correctQuery) {
         return errors.makeBadRequestError(res, 'Query should be a string of 1 id or multiple ids seperated by commas.');
     }
 
-    let where = {};
+    const userIds = req.query.query.split(',');
 
-    if (typeof req.query.query === 'string' && req.query.query.trim().length > 0) {
-        where = { id: { [Sequelize.Op.or]: req.query.query.split(',') } };
+    if (!req.permissions.hasPermission('global:mail:member') && Number(userIds[0]) !== req.user.id) {
+        return errors.makeForbiddenError(res, 'Permission global:mail:member is required, but not present.');
     }
 
+    const where = { id: { [Sequelize.Op.or]: userIds } };
+
     const result = await User.findAndCountAll({
         where,
         attributes: ['id', 'email', 'gsuite_id', 'primary_email', 'notification_email']

test/api/users-email.test.js

@@ -15,7 +15,7 @@ describe('Users list', () => {
         await generator.clearAll();
     });
 
-    test('should fail if no permission', async () => {
+    test('should fail without query', async () => {
         const user = await generator.createUser();
         const token = await generator.createAccessToken(user);
 
@@ -25,20 +25,35 @@ describe('Users list', () => {
             headers: { 'X-Auth-Token': token.value }
         });
 
-        expect(res.statusCode).toEqual(403);
+        expect(res.statusCode).toEqual(400);
         expect(res.body.success).toEqual(false);
         expect(res.body).toHaveProperty('message');
         expect(res.body).not.toHaveProperty('data');
     });
 
-    test('should succeed when everything is okay', async () => {
-        const user = await generator.createUser({ superadmin: true });
+    test('should fail if no permission', async () => {
+        const user = await generator.createUser();
+        const secondUser = await generator.createUser();
         const token = await generator.createAccessToken(user);
 
-        await generator.createPermission({ scope: 'global', action: 'mail', object: 'member' });
+        const res = await request({
+            uri: '/members_email?query=' + secondUser.id,
+            method: 'GET',
+            headers: { 'X-Auth-Token': token.value }
+        });
+
+        expect(res.statusCode).toEqual(403);
+        expect(res.body.success).toEqual(false);
+        expect(res.body).toHaveProperty('message');
+        expect(res.body).not.toHaveProperty('data');
+    });
+
+    test('should find own by id without permission', async () => {
+        const user = await generator.createUser();
+        const token = await generator.createAccessToken(user);
 
         const res = await request({
-            uri: '/members_email',
+            uri: '/members_email?query=' + user.id,
             method: 'GET',
             headers: { 'X-Auth-Token': token.value }
         });
@@ -54,12 +69,13 @@ describe('Users list', () => {
 
     test('should find one by id', async () => {
         const user = await generator.createUser({ superadmin: true });
+        const secondUser = await generator.createUser();
         const token = await generator.createAccessToken(user);
 
         await generator.createPermission({ scope: 'global', action: 'mail', object: 'member' });
 
         const res = await request({
-            uri: '/members_email?query=' + user.id,
+            uri: '/members_email?query=' + secondUser.id,
             method: 'GET',
             headers: { 'X-Auth-Token': token.value }
         });
@@ -70,7 +86,7 @@ describe('Users list', () => {
         expect(res.body).not.toHaveProperty('errors');
 
         expect(res.body.data.length).toEqual(1);
-        expect(res.body.data[0].id).toEqual(user.id);
+        expect(res.body.data[0].id).toEqual(secondUser.id);
     });
 
     test('should find multiple by id array', async () => {
@@ -121,7 +137,7 @@ describe('Users list', () => {
         await generator.createPermission({ scope: 'global', action: 'mail', object: 'member' });
 
         const res = await request({
-            uri: '/members_email',
+            uri: '/members_email?query=' + user.id,
             method: 'GET',
             headers: { 'X-Auth-Token': token.value }
         });