'.format(self.username, self._id)
@@ -1881,6 +1886,79 @@ def is_allowed_to_use_institution(self, institution):
"""Return if this user is supper or is admin affiliated with ``institution``."""
return self.is_super_admin or (self.is_admin and self.is_affiliated_with_institution(institution))
+ def _get_match_service_access_control_setting_queryset(self):
+ """Get user's best match service access control setting queryset"""
+ from osf.models import ServiceAccessControlSetting
+ # Get user's institution GUID
+ affiliated_institution = self.representative_affiliated_institution
+ affiliated_institution_guid = affiliated_institution.guid if affiliated_institution is not None else None
+
+ # Get user's domain from eppn
+ domain = None
+ if self.eppn:
+ eppn_string_split = self.eppn.split('@', 1)
+ if len(eppn_string_split) > 1:
+ domain = eppn_string_split[1]
+
+ # Get user's is_ial2_or_aal2 status
+ user_is_ial2_or_aal2 = not (self.ial is None and self.aal is None)
+ # Create common queryset to get best match service access control setting for current user
+ query_set = ServiceAccessControlSetting.objects.filter(
+ institution_id=affiliated_institution_guid,
+ domain__in=[domain, 'default'],
+ is_ial2_or_aal2=user_is_ial2_or_aal2,
+ is_deleted=False,
+ ).annotate(
+ email_domain=models.Value(self.username, output_field=models.CharField())
+ ).filter(
+ models.Q(email_domain__endswith=models.F('user_domain')) | models.Q(user_domain='default')
+ ).annotate(
+ domain_order=models.Case(
+ models.When(domain='default', then=models.Value(2)),
+ default=models.Value(1),
+ output_field=models.IntegerField(),
+ ),
+ user_domain_order=models.Case(
+ models.When(user_domain='default', then=models.Value(2)),
+ default=models.Value(1),
+ output_field=models.IntegerField(),
+ ),
+ ).order_by('domain_order', 'user_domain_order')
+ return query_set
+
+ @property
+ def can_create_new_project(self):
+ """Check and return boolean if this user is allowed to create a new project"""
+ from osf.models import Node
+ # Get project limit number from the best match service access control setting if have
+ query_set = self._get_match_service_access_control_setting_queryset()
+ project_limit_number = query_set.values_list('project_limit_number', flat=True).first()
+ # Set default permission value to True
+ can_create_new_project = True
+ if project_limit_number is not None:
+ # If there is project limit number for current user, compare it to number of created project by current user
+ project_created_number = Node.objects.filter(creator=self, is_deleted=False).count()
+ can_create_new_project = project_created_number < project_limit_number
+ return can_create_new_project
+
+ def is_allowed_to_access_api(self, function_code):
+ """Check and return boolean if this user is allowed to access api in function code"""
+ if not function_code:
+ # Invalid function code, return True
+ return True
+ # Get is_whitelist and function_codes from the best match service access control setting if have
+ query_set = self._get_match_service_access_control_setting_queryset()
+ match_setting = query_set.annotate(function_codes=ArrayAgg('functions__function_code')).values('is_whitelist', 'function_codes').first()
+ # Set default permission value to True
+ is_allowed_to_access_api = True
+ if match_setting is not None:
+ is_whitelist = match_setting.get('is_whitelist')
+ # Check if provided function_code in the function codes list
+ is_function_code_in_list = function_code in match_setting.get('function_codes', [])
+ # User is allowed to access API if both is_whitelist and is_function_code_in_list are True or False
+ is_allowed_to_access_api = is_whitelist == is_function_code_in_list
+ return is_allowed_to_access_api
+
def update_affiliated_institutions_by_email_domain(self):
"""
Append affiliated_institutions by email domain.
diff --git a/osf_tests/factories.py b/osf_tests/factories.py
index c17f354d7eb..bc3612b6ab6 100644
--- a/osf_tests/factories.py
+++ b/osf_tests/factories.py
@@ -1224,3 +1224,22 @@ class Meta:
class RdmFileTimestamptokenVerifyResultFactory(DjangoModelFactory):
class Meta:
model = models.RdmFileTimestamptokenVerifyResult
+
+
+class ServiceAccessControlSettingFactory(DjangoModelFactory):
+ institution_id = factory.Faker('text')
+ domain = factory.Faker('text')
+ is_ial2_or_aal2 = False
+ user_domain = factory.Faker('text')
+ is_whitelist = False
+
+ class Meta:
+ model = models.ServiceAccessControlSetting
+
+
+class FunctionFactory(DjangoModelFactory):
+ function_code = factory.Faker('text')
+ service_access_control_setting = factory.SubFactory(ServiceAccessControlSettingFactory)
+
+ class Meta:
+ model = models.Function
diff --git a/osf_tests/test_app.py b/osf_tests/test_app.py
index 24b51636841..c7c290b3356 100644
--- a/osf_tests/test_app.py
+++ b/osf_tests/test_app.py
@@ -25,6 +25,7 @@ def test_attach_handlers():
framework.sessions.prepare_private_key,
framework.sessions.before_request,
framework.csrf.handlers.before_request,
+ framework.function_control.handlers.function_control_before_request,
}
assert_after_funcs = {
diff --git a/osf_tests/test_function.py b/osf_tests/test_function.py
new file mode 100644
index 00000000000..aa7cfe85a15
--- /dev/null
+++ b/osf_tests/test_function.py
@@ -0,0 +1,30 @@
+import pytest
+from django.db import IntegrityError
+
+from osf.models import Function
+from osf_tests.factories import ServiceAccessControlSettingFactory
+
+
+@pytest.mark.django_db
+class TestFunction:
+ def test_has_an_integer_pk(self):
+ service_access_control_setting = ServiceAccessControlSettingFactory()
+ function = Function(function_code='test', service_access_control_setting=service_access_control_setting)
+ function.save()
+ assert type(function.pk) is int
+
+ def test_validation__no_values(self):
+ function = Function()
+ with pytest.raises(IntegrityError):
+ function.save()
+
+ def test_validation__no_related_service_acccess_control_setting(self):
+ function = Function(function_code='test')
+ with pytest.raises(IntegrityError):
+ function.save()
+
+ def test_validation__no_function_code(self):
+ service_access_control_setting = ServiceAccessControlSettingFactory()
+ function = Function(function_code=None, service_access_control_setting=service_access_control_setting)
+ with pytest.raises(IntegrityError):
+ function.save()
diff --git a/osf_tests/test_service_access_control_setting.py b/osf_tests/test_service_access_control_setting.py
new file mode 100644
index 00000000000..73866ca0863
--- /dev/null
+++ b/osf_tests/test_service_access_control_setting.py
@@ -0,0 +1,80 @@
+import pytest
+from django.db import IntegrityError
+
+from osf.models import ServiceAccessControlSetting
+
+
+@pytest.mark.django_db
+class TestServiceAccessControlSetting:
+ def test_has_an_integer_pk(self):
+ setting = ServiceAccessControlSetting(
+ institution_id='gakunin',
+ domain='test.com',
+ is_ial2_or_aal2=True,
+ user_domain='example.com',
+ is_whitelist=True
+ )
+ setting.save()
+ assert type(setting.pk) is int
+
+ def test_validation__no_values(self):
+ setting = ServiceAccessControlSetting()
+ with pytest.raises(IntegrityError):
+ setting.save()
+
+ def test_validation__no_institution_id(self):
+ setting = ServiceAccessControlSetting(
+ institution_id=None,
+ domain='test.com',
+ is_ial2_or_aal2=True,
+ user_domain='example.com',
+ is_whitelist=True
+
+ )
+ with pytest.raises(IntegrityError):
+ setting.save()
+
+ def test_validation__no_domain(self):
+ setting = ServiceAccessControlSetting(
+ institution_id='gakunin',
+ domain=None,
+ is_ial2_or_aal2=True,
+ user_domain='example.com',
+ is_whitelist=True
+ )
+ with pytest.raises(IntegrityError):
+ setting.save()
+
+ def test_validation__no_is_ial2_or_aal2(self):
+ # Null is_ial2_or_aal2
+ setting = ServiceAccessControlSetting(
+ institution_id='gakunin',
+ domain='test.com',
+ is_ial2_or_aal2=None,
+ user_domain='example.com',
+ is_whitelist=True
+ )
+ with pytest.raises(IntegrityError):
+ setting.save()
+
+ def test_validation__no_user_domain(self):
+ setting = ServiceAccessControlSetting(
+ institution_id='gakunin',
+ domain='test.com',
+ is_ial2_or_aal2=True,
+ user_domain=None,
+ is_whitelist=True
+ )
+ with pytest.raises(IntegrityError):
+ setting.save()
+
+ def test_validation__no_is_whitelist(self):
+ setting = ServiceAccessControlSetting(
+ institution_id='gakunin',
+ domain='test.com',
+ is_ial2_or_aal2=True,
+ user_domain='example.com',
+ is_whitelist=None
+ )
+ with pytest.raises(IntegrityError):
+ setting.save()
diff --git a/osf_tests/test_user.py b/osf_tests/test_user.py
index a47669155b9..5d80be23f47 100644
--- a/osf_tests/test_user.py
+++ b/osf_tests/test_user.py
@@ -40,6 +40,7 @@
PreprintContributor,
DraftRegistrationContributor,
Institution,
+ ServiceAccessControlSetting,
)
from addons.github.tests.factories import GitHubAccountFactory
from addons.osfstorage.models import Region
@@ -71,6 +72,8 @@
PreprintFactory,
ExportDataLocationFactory,
RegionFactory,
+ ServiceAccessControlSettingFactory,
+ FunctionFactory,
)
from tests.base import OsfTestCase
from tests.utils import run_celery_tasks
@@ -2852,3 +2855,79 @@ def test_check_spam(self, mock_do_check_spam, user):
with mock.patch('osf.models.OSFUser._get_spam_content', mock.Mock(return_value='some content!')):
user.check_spam(saved_fields={'schools': ['one']}, request_headers=None)
assert mock_do_check_spam.call_count == 1
+
+
+class TestUserServiceAccessControlPermission:
+ @pytest.fixture
+ def user(self):
+ institution = InstitutionFactory()
+ user = AuthUserFactory()
+ user.affiliated_institutions.add(institution)
+ user.eppn = 'test@test.com'
+ user.save()
+ return user
+
+ @pytest.fixture
+ def service_access_control_setting(self, user):
+ return ServiceAccessControlSettingFactory(
+ institution_id=user.representative_affiliated_institution.guid,
+ domain='default',
+ user_domain='default',
+ is_whitelist=True
+ )
+
+ @pytest.fixture
+ def function(self, service_access_control_setting):
+ return FunctionFactory(function_code='test_001', service_access_control_setting=service_access_control_setting)
+
+ def test__get_match_service_access_control_setting_queryset(self, user, service_access_control_setting, function):
+ queryset = user._get_match_service_access_control_setting_queryset()
+ assert queryset.exists()
+
+ def test_can_create_new_project__no_record(self, user):
+ with mock.patch('osf.models.user.OSFUser._get_match_service_access_control_setting_queryset') as mock_queryset:
+ mock_queryset.return_value = ServiceAccessControlSetting.objects.none()
+ assert_equal(user.can_create_new_project, True)
+ mock_queryset.assert_called()
+
+ def test_can_create_new_project__true(self, user, service_access_control_setting):
+ service_access_control_setting.project_limit_number = 100
+ service_access_control_setting.save()
+
+ with mock.patch('osf.models.user.OSFUser._get_match_service_access_control_setting_queryset') as mock_queryset:
+ mock_queryset.return_value = ServiceAccessControlSetting.objects.filter(id=service_access_control_setting.id)
+ assert_equal(user.can_create_new_project, True)
+ mock_queryset.assert_called()
+
+ def test_can_create_new_project__false(self, user, service_access_control_setting):
+ service_access_control_setting.project_limit_number = 0
+ service_access_control_setting.save()
+
+ with mock.patch('osf.models.user.OSFUser._get_match_service_access_control_setting_queryset') as mock_queryset:
+ mock_queryset.return_value = ServiceAccessControlSetting.objects.filter(id=service_access_control_setting.id)
+ assert_equal(user.can_create_new_project, False)
+ mock_queryset.assert_called()
+
+ def test_is_allowed_to_access_api__no_function_code(self, user, service_access_control_setting, function):
+ with mock.patch('osf.models.user.OSFUser._get_match_service_access_control_setting_queryset') as mock_queryset:
+ mock_queryset.return_value = ServiceAccessControlSetting.objects.filter(id=service_access_control_setting.id)
+ assert_equal(user.is_allowed_to_access_api(None), True)
+ mock_queryset.assert_not_called()
+
+ def test_is_allowed_to_access_api__no_record(self, user, service_access_control_setting, function):
+ with mock.patch('osf.models.user.OSFUser._get_match_service_access_control_setting_queryset') as mock_queryset:
+ mock_queryset.return_value = ServiceAccessControlSetting.objects.none()
+ assert_equal(user.is_allowed_to_access_api('test_001'), True)
+ mock_queryset.assert_called()
+
+ def test_is_allowed_to_access_api__true(self, user, service_access_control_setting, function):
+ with mock.patch('osf.models.user.OSFUser._get_match_service_access_control_setting_queryset') as mock_queryset:
+ mock_queryset.return_value = ServiceAccessControlSetting.objects.filter(id=service_access_control_setting.id)
+ assert_equal(user.is_allowed_to_access_api('test_001'), True)
+ mock_queryset.assert_called()
+
+ def test_is_allowed_to_access_api__false(self, user, service_access_control_setting, function):
+ with mock.patch('osf.models.user.OSFUser._get_match_service_access_control_setting_queryset') as mock_queryset:
+ mock_queryset.return_value = ServiceAccessControlSetting.objects.filter(id=service_access_control_setting.id)
+ assert_equal(user.is_allowed_to_access_api('test_002'), False)
+ mock_queryset.assert_called()
diff --git a/tests/framework_tests/test_function_control.py b/tests/framework_tests/test_function_control.py
new file mode 100644
index 00000000000..fd347d0d91a
--- /dev/null
+++ b/tests/framework_tests/test_function_control.py
@@ -0,0 +1,183 @@
+import json
+import unittest
+
+import mock
+import pytest
+from django.http import JsonResponse
+from flask import Flask
+
+from framework.flask import add_handlers
+from framework.function_control.handlers import handlers, check_api_service_access, function_control_before_request
+from framework.routing import Rule, process_rules, json_renderer
+from osf_tests.factories import AuthUserFactory, ServiceAccessControlSettingFactory, FunctionFactory, InstitutionFactory
+from tests.base import ApiTestCase
+from webtest_plus import TestApp
+
+
+@pytest.mark.django_db
+class TestFunctionControlUtils(ApiTestCase):
+ def setUp(self):
+ self.institution = InstitutionFactory()
+ self.user = AuthUserFactory()
+ self.user.affiliated_institutions.add(self.institution)
+ self.user.save()
+ self.service_access_control_setting = ServiceAccessControlSettingFactory(
+ institution_id=self.institution.guid,
+ domain='default',
+ user_domain='default',
+ is_whitelist=True
+ )
+ self.function = FunctionFactory(function_code='function_001', service_access_control_setting=self.service_access_control_setting)
+ self.test_config_json = json.dumps({
+ 'function_001': {
+ 'function_name': 'test',
+ 'api_group': [{
+ 'api': r'^/test/?',
+ 'method': 'GET',
+ }]
+ }
+ })
+
+ def test_check_api_service_access__no_user(self):
+ assert check_api_service_access('/test/', 'GET', None) is None
+
+ def test_check_api_service_access__config_data_error(self):
+ with mock.patch('framework.function_control.handlers.open', mock.mock_open(read_data=self.test_config_json)) as mock_open_file:
+ mock_open_file.side_effect = ValueError('test parse json fail')
+ assert check_api_service_access('/test/', 'GET', self.user) is None
+ mock_open_file.assert_called()
+
+ def test_check_api_service_access__user_is_allowed(self):
+ with mock.patch('framework.function_control.handlers.open', mock.mock_open(read_data=self.test_config_json)) as mock_open_file:
+ assert check_api_service_access('/test/', 'GET', self.user) is None
+ mock_open_file.assert_called()
+
+ def test_check_api_service_access__config_invalid_regex(self):
+ self.test_config_json = json.dumps({
+ 'function_002': {
+ 'function_name': 'test',
+ 'api_group': [{
+ 'api': r'/[test/',
+ 'method': 'GET',
+ }]
+ }
+ })
+ with mock.patch('framework.function_control.handlers.open', mock.mock_open(read_data=self.test_config_json)) as mock_open_file:
+ assert check_api_service_access('/test/', 'GET', self.user) is None
+ mock_open_file.assert_called()
+
+ def test_check_api_service_access__user_is_not_allowed_type_0(self):
+ self.test_config_json = json.dumps({
+ 'function_002': {
+ 'function_name': 'test',
+ 'api_group': [{
+ 'api': r'^/test/?',
+ 'method': 'GET',
+ }]
+ }
+ })
+ with mock.patch('framework.function_control.handlers.open', mock.mock_open(read_data=self.test_config_json)) as mock_open_file:
+ error_response = check_api_service_access('/test/', 'GET', self.user)
+ assert error_response is not None
+ assert error_response.status_code == 403
+ error_dict = json.loads(error_response.content.decode('utf-8'))
+ assert len(error_dict['errors']) == 1
+ assert error_dict['errors'][0].get('type') == 0
+ mock_open_file.assert_called()
+
+ def test_check_api_service_access__user_is_not_allowed_type_0_invalid_regex(self):
+ invalid_api_list = [{
+ 'api': r'^/[test/$',
+ 'method': 'GET',
+ }, None]
+ self.test_config_json = json.dumps({
+ 'function_002': {
+ 'function_name': 'test',
+ 'api_group': [{
+ 'api': r'^/test/?',
+ 'method': 'GET',
+ }]
+ }
+ })
+ with mock.patch('framework.function_control.handlers.open', mock.mock_open(read_data=self.test_config_json)) as mock_open_file:
+ with mock.patch('api.base.settings.ERROR_MESSAGE_API_LIST', invalid_api_list):
+ error_response = check_api_service_access('/test/', 'GET', self.user)
+ assert error_response is not None
+ assert error_response.status_code == 403
+ error_dict = json.loads(error_response.content.decode('utf-8'))
+ assert len(error_dict['errors']) == 1
+ assert error_dict['errors'][0].get('type') == 0
+ mock_open_file.assert_called()
+
+ def test_check_api_service_access__user_is_not_allowed_type_1(self):
+ api_list = [{
+ 'api': r'^/search/$',
+ 'method': 'GET',
+ }]
+ self.test_config_json = json.dumps({
+ 'function_002': {
+ 'function_name': 'test',
+ 'api_group': api_list
+ }
+ })
+ with mock.patch('framework.function_control.handlers.open', mock.mock_open(read_data=self.test_config_json)) as mock_open_file:
+ with mock.patch('api.base.settings.ERROR_MESSAGE_API_LIST', api_list):
+ error_response = check_api_service_access('/search/', 'GET', self.user)
+ assert error_response is not None
+ assert error_response.status_code == 403
+ error_dict = json.loads(error_response.content.decode('utf-8'))
+ assert len(error_dict['errors']) == 1
+ assert error_dict['errors'][0].get('type') == 1
+ mock_open_file.assert_called()
+
+
+@pytest.mark.django_db
+class TestFunctionControlHandler(unittest.TestCase):
+ def setUp(self):
+ self.app = Flask(__name__)
+ self.app.debug = True
+ add_handlers(self.app, handlers)
+
+ self.webTestApp = TestApp(self.app)
+ rule = Rule(['/search/'], 'get', {}, renderer=json_renderer)
+ process_rules(self.app, [rule])
+
+ @mock.patch('framework.function_control.handlers.check_api_service_access')
+ def test_function_control_before_request__no_error(self, mock_check_api_service_access):
+ mock_check_api_service_access.return_value = None
+ res = self.webTestApp.get('/search/')
+ assert res.status_code == 200
+ assert mock_check_api_service_access.called
+
+ @mock.patch('framework.function_control.handlers.check_api_service_access')
+ def test_function_control_before_request__error_html(self, mock_check_api_service_access):
+ mock_check_api_service_access.return_value = JsonResponse({
+ 'errors': [{
+ 'message': 'User is not allowed to access this API.',
+ 'type': 0,
+ 'status': 403
+ }]
+ }, status=403)
+ headers = {
+ 'Accept': 'text/html'
+ }
+ res = self.webTestApp.get('/search/', headers=headers, expect_errors=True)
+ assert res.status_code == 302
+ assert '/403' in res.location
+ assert mock_check_api_service_access.called
+
+ @mock.patch('framework.function_control.handlers.check_api_service_access')
+ def test_function_control_before_request__error_message(self, mock_check_api_service_access):
+ mock_check_api_service_access.return_value = JsonResponse({
+ 'errors': [{
+ 'message': 'User is not allowed to access this API.',
+ 'type': 1,
+ 'status': 403
+ }]
+ }, status=403)
+ res = self.webTestApp.get('/search/', expect_errors=True)
+ assert res.status_code == 403
+ assert mock_check_api_service_access.called
+
+ def test_handlers(self):
+ assert handlers.get('before_request') == function_control_before_request
diff --git a/website/app.py b/website/app.py
index c3e4133569b..eab3a298d7e 100644
--- a/website/app.py
+++ b/website/app.py
@@ -21,6 +21,7 @@
from framework.postcommit_tasks import handlers as postcommit_handlers
from framework.sentry import sentry
from framework.transactions import handlers as transaction_handlers
+from framework.function_control import handlers as function_control_handlers
# Imports necessary to connect signals
from website.archiver import listeners # noqa
from website.mails import listeners # noqa
@@ -70,6 +71,9 @@ def attach_handlers(app, settings):
add_handlers(app, {'before_request': framework.sessions.before_request,
'after_request': framework.sessions.after_request})
+ # Attach handler for checking URL access for user
+ add_handlers(app, function_control_handlers.handlers)
+
return app
diff --git a/website/routes.py b/website/routes.py
index b3de0fbefdd..8bc601c4166 100644
--- a/website/routes.py
+++ b/website/routes.py
@@ -362,6 +362,16 @@ def make_url_map(app):
),
])
+ # HTTP error page
+ process_rules(app, [
+ Rule(
+ '/403',
+ ['get'],
+ HTTPError(http_status.HTTP_403_FORBIDDEN),
+ notemplate
+ ),
+ ])
+
### GUID ###
process_rules(app, [
diff --git a/website/static/js/addProjectPlugin.js b/website/static/js/addProjectPlugin.js
index c95d2017794..039734a0a67 100644
--- a/website/static/js/addProjectPlugin.js
+++ b/website/static/js/addProjectPlugin.js
@@ -54,7 +54,9 @@ var AddProject = {
self.saveResult = m.prop({});
self.errorMessageType = m.prop('unknown');
self.errorMessage = {
- 'unknown' : _('There was an unknown error. Please try again later.')
+ 'unknown' : _('There was an unknown error. Please try again later.'),
+ 'forbidden' : _('You do not have permission to operate a project.'),
+ 'create_project_limited' : _('The new project cannot be created due to the created project number is greater than or equal the project number can create.')
};
self.userProjects = m.prop([]); // User nodes
@@ -121,6 +123,21 @@ var AddProject = {
self.isAdding(false);
};
var error = function _error (result) {
+ self.errorMessageType('unknown');
+ var errors = result.errors;
+ if (errors && errors.length > 0) {
+ var status_code = errors[0].status;
+ var type = errors[0].type;
+ if (status_code && status_code === 403) {
+ if (type === 0) {
+ window.location.href = '/403';
+ return;
+ }
+ self.errorMessageType('forbidden');
+ } else if (status_code && status_code === 400 && type === 1) {
+ self.errorMessageType('create_project_limited');
+ }
+ }
self.viewState('error');
self.isAdding(false);
};
diff --git a/website/static/js/citationList.js b/website/static/js/citationList.js
index 60dea56518d..3d0e0441db0 100644
--- a/website/static/js/citationList.js
+++ b/website/static/js/citationList.js
@@ -109,9 +109,18 @@ var ViewModel = oop.defclass({
if (!self.customCitation()) {
self.fetch();
}
- }).fail(function() {
- $osf.growl('Error', _('Your custom citation not updated. Please refresh the page and try ') +
- sprintf(_('again or contact %1$s') , $osf.osfSupportLink()) + _(' if the problem persists.'), 'danger');
+ }).fail(function(xhr) {
+ self.customCitation(self.initialCustomCitation());
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ $osf.growl('Error', _('You do not have permission to operate a project.'));
+ } else {
+ $osf.growl('Error', _('Your custom citation not updated. Please refresh the page and try ') +
+ sprintf(_('again or contact %1$s') , $osf.osfSupportLink()) + _(' if the problem persists.'), 'danger');
+ }
}).always(function() {
self.loading(false);
});
diff --git a/website/static/js/contribAdder.js b/website/static/js/contribAdder.js
index a8af7b66611..5766ebfeb95 100644
--- a/website/static/js/contribAdder.js
+++ b/website/static/js/contribAdder.js
@@ -327,10 +327,10 @@ AddContributorViewModel = oop.extend(Paginator, {
validateInviteForm: function () {
var self = this;
// Make sure Full Name is not blank
- if (!self.inviteName().trim().length) {
+ if (!self.inviteName() || !self.inviteName().trim().length) {
return _('Full Name is required.');
}
- if (self.inviteEmail() && !$osf.isEmail(self.inviteEmail().replace(/^\s+|\s+$/g, ''))) {
+ if (!self.inviteEmail() || !$osf.isEmail(self.inviteEmail().replace(/^\s+|\s+$/g, ''))) {
return _('Not a valid email address.');
}
// Make sure that entered email is not already in selection
@@ -455,6 +455,13 @@ AddContributorViewModel = oop.extend(Paginator, {
}
}).fail(function (xhr, status, error) {
var errorMessage = lodashGet(xhr, 'responseJSON.message') || (sprintf(_('There was a problem trying to add contributors%1$s.') , osfLanguage.REFRESH_OR_SUPPORT));
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ errorMessage = _('You do not have permission to operate a project.');
+ }
$osf.growl(_('Could not add contributors'), errorMessage);
Raven.captureMessage(_('Error adding contributors'), {
extra: {
@@ -502,9 +509,16 @@ AddContributorViewModel = oop.extend(Paginator, {
},
onInviteError: function (xhr) {
var self = this;
- var response = JSON.parse(xhr.responseText);
- // Update error message
- self.inviteError(response.message);
+ if (xhr.status === 403) {
+ if ($osf.handleErrorResponse(xhr) === false) {
+ return;
+ }
+ self.inviteError(_('You do not have permission to operate a project.'));
+ } else {
+ var response = JSON.parse(xhr.responseText);
+ // Update error message
+ self.inviteError(response.message);
+ }
self.canSubmit(true);
},
hasChildren: function() {
diff --git a/website/static/js/contribManager.js b/website/static/js/contribManager.js
index 6f7fc9a12b0..66eb47cc2ef 100644
--- a/website/static/js/contribManager.js
+++ b/website/static/js/contribManager.js
@@ -428,9 +428,17 @@ var ContributorsViewModel = function(contributors, adminContributors, user, isRe
}
}).fail(function(xhr) {
var response = xhr.responseJSON;
- $osf.growl('Error:',
- _('Submission failed: ') + response.message_long
- );
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ $osf.growl('Error:', _('You do not have permission to operate a project.'));
+ } else {
+ $osf.growl('Error:',
+ _('Submission failed: ') + response.message_long
+ );
+ }
self.forceSubmit(false);
});
}
diff --git a/website/static/js/contribRemover.js b/website/static/js/contribRemover.js
index d567610be09..0830d0dc595 100644
--- a/website/static/js/contribRemover.js
+++ b/website/static/js/contribRemover.js
@@ -229,14 +229,22 @@ var RemoveContributorViewModel = oop.extend(Paginator, {
} else {
window.location.reload();
} }).fail(function(xhr, status, error) {
- $osf.growl('Error', _('Unable to delete Contributor'));
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ $osf.growl('Error', _('You do not have permission to operate a project.'));
+ } else {
+ $osf.growl('Error', _('Unable to delete Contributor'));
+ }
Raven.captureMessage(_('Could not DELETE Contributor.') + error, {
extra: {
url: window.contextVars.node.urls.api + 'contributor/remove/', status: status, error: error
}
});
self.clear();
- window.location.reload();
+ $('.modal').modal('hide');
});
},
deleteAllNodes: function() {
diff --git a/website/static/js/licensePicker.js b/website/static/js/licensePicker.js
index d8ad2a2fc10..e015a785e85 100644
--- a/website/static/js/licensePicker.js
+++ b/website/static/js/licensePicker.js
@@ -192,7 +192,15 @@ var LicensePicker = oop.extend(ChangeMessageMixin, {
onSaveFail: function(xhr, status, error) {
var self = this;
- self.changeMessage(_('There was a problem updating your license. Please try again.'), 'text-danger', 2500);
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ self.changeMessage(_('You do not have permission to operate a project.'), 'text-danger', 2500);
+ } else {
+ self.changeMessage(_('There was a problem updating your license. Please try again.'), 'text-danger', 2500);
+ }
Raven.captureMessage(_('Error fetching user profile'), {
extra: {
diff --git a/website/static/js/myProjects.js b/website/static/js/myProjects.js
index 4f52fafeeda..d7997a77d81 100644
--- a/website/static/js/myProjects.js
+++ b/website/static/js/myProjects.js
@@ -1110,9 +1110,11 @@ var MyProjects = {
m('small.hidden-xs', _('Browse and organize all your projects'))
])),
m('.col-xs-4.p-sm', m('.pull-right', m.component(AddProject, {
- buttonTemplate: m('.btn.btn-success.btn-success-high-contrast.f-w-xl[data-toggle="modal"][data-target="#addProject"]', {onclick: function() {
- $osf.trackClick('myProjects', 'add-project', 'open-add-project-modal');
- }}, _('Create Project')),
+ buttonTemplate: !window.contextVars.canCreateNewProject ?
+ m('.btn.btn-success.btn-success-high-contrast.f-w-xl[disabled]', _('Create Project')) :
+ m('.btn.btn-success.btn-success-high-contrast.f-w-xl[data-toggle="modal"][data-target="#addProject"]', {onclick: function() {
+ $osf.trackClick('myProjects', 'add-project', 'open-add-project-modal');
+ }}, _('Create Project')),
parentID: null,
modalID: 'addProject',
title: _('Create new project'),
diff --git a/website/static/js/nodeControl.js b/website/static/js/nodeControl.js
index 112c4d2aecb..2cfcd9afd72 100644
--- a/website/static/js/nodeControl.js
+++ b/website/static/js/nodeControl.js
@@ -91,7 +91,18 @@ var ProjectViewModel = function(data, options) {
success: function () {
document.location.reload(true);
},
- error: $osf.handleEditableError,
+ error: function (xhr) {
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ Raven.captureMessage(_('Unexpected error occurred in an editable input'));
+ return _('You do not have permission to operate a project.');
+ } else {
+ $osf.handleEditableError(xhr);
+ }
+ },
placement: 'bottom'
};
@@ -157,7 +168,15 @@ var ProjectViewModel = function(data, options) {
$osf.postJSON('/api/v1/pointer/', jsonData)
.fail(function(data) {
self.inDashboard(false);
- $osf.handleJSONError(data);
+ if (data.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(data);
+ if (continueHandle === false) {
+ return;
+ }
+ $osf.growl('Error', _('You do not have permission to operate a project.'));
+ } else {
+ $osf.handleJSONError(data);
+ }
});
};
/**
@@ -170,9 +189,17 @@ var ProjectViewModel = function(data, options) {
$osf.ajaxJSON('DELETE', deleteUrl, {
'data': {'data': [{'type':'linked_nodes', 'id': self._id}]},
'isCors': true
- }).fail(function() {
+ }).fail(function(xhr) {
self.inDashboard(true);
- $osf.growl('Error', _('The project could not be removed'), 'danger');
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ $osf.growl('Error', _('You do not have permission to operate a project.'));
+ } else {
+ $osf.growl('Error', _('The project could not be removed'), 'danger');
+ }
});
};
diff --git a/website/static/js/nodesDelete.js b/website/static/js/nodesDelete.js
index 307963f4b83..0c2d3bebb98 100644
--- a/website/static/js/nodesDelete.js
+++ b/website/static/js/nodesDelete.js
@@ -78,10 +78,16 @@ QuickDeleteViewModel.prototype.confirmChanges = function () {
});
request.fail( function (xhr, status, error) {
var errorMessage = sprintf(_('Unable to delete %1$s') , self.nodeType);
- if (xhr.responseJSON && xhr.responseJSON.errors) {
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ errorMessage = _('You do not have permission to operate a project.');
+ } else if (xhr.responseJSON && xhr.responseJSON.errors) {
errorMessage = xhr.responseJSON.errors[0].detail;
}
- $osf.growl(sprintf(_('Problem deleting %1$s') , self.nodeType, errorMessage));
+ $osf.growl(sprintf(_('Problem deleting %1$s') , self.nodeType), errorMessage);
Raven.captureMessage(sprintf(_('Could not delete %$1s') , self.nodeType), {
extra: {
url: self.nodeApiUrl, status: status, error: error
@@ -338,7 +344,9 @@ function batchNodesDelete(nodes) {
}, function (xhr) {
$osf.unblock();
var errorMessage = sprintf(_('Unable to delete %1$s') , self.nodeType);
- if (xhr.responseJSON && xhr.responseJSON.errors) {
+ if (xhr.status === 403) {
+ errorMessage = _('You do not have permission to operate a project.');
+ } else if (xhr.responseJSON && xhr.responseJSON.errors) {
errorMessage = xhr.responseJSON.errors[0].detail;
}
$osf.growl(sprintf(_('Problem deleting %1$s') , self.nodeType), errorMessage);
diff --git a/website/static/js/nodesPrivacy.js b/website/static/js/nodesPrivacy.js
index b6838b27193..4cef47c9844 100644
--- a/website/static/js/nodesPrivacy.js
+++ b/website/static/js/nodesPrivacy.js
@@ -255,7 +255,13 @@ NodesPrivacyViewModel.prototype.confirmChanges = function() {
}).fail(function (xhr) {
$osf.unblock();
var errorMessage = _('Unable to update project privacy');
- if (xhr.responseJSON && xhr.responseJSON.errors) {
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ errorMessage = _('You do not have permission to operate a project.');
+ } else if (xhr.responseJSON && xhr.responseJSON.errors) {
errorMessage = xhr.responseJSON.errors[0].detail;
}
$osf.growl(_('Problem changing privacy'), errorMessage);
diff --git a/website/static/js/osfHelpers.js b/website/static/js/osfHelpers.js
index 71e0a9ac8d2..99ac0c0b546 100644
--- a/website/static/js/osfHelpers.js
+++ b/website/static/js/osfHelpers.js
@@ -102,7 +102,12 @@ var ajaxJSON = function(method, url, options) {
}
$.extend(true, ajaxFields, opts.fields);
- return $.ajax(ajaxFields);
+ return $.ajax(ajaxFields).fail(function(xhr) {
+ if (xhr.status === 403 && handleErrorResponse(xhr) === false) {
+ // If response status is 403, check if the response requests to redirect to 403 page
+ return;
+ }
+ });
};
/**
@@ -1061,6 +1066,27 @@ function linkifyText(content) {
return linkify(content);
}
+/**
+ * Utility function handle error response
+ * @param xhr {Object} XHR response
+ * @returns {boolean} a boolean that indicates if redirect to 403 page or show error message
+ */
+function handleErrorResponse(xhr) {
+ if (xhr && xhr.status === 403) {
+ var data = xhr.responseJSON;
+ if (data && data.errors && data.errors.length > 0) {
+ var error_message = data.errors[0];
+ if (error_message.type != null && error_message.type === 0) {
+ // Redirect to HTTP 403
+ window.location.href = '/403';
+ return false;
+ }
+ }
+ }
+ // Continue handle on client
+ return true;
+}
+
// Also export these to the global namespace so that these can be used in inline
// JS. This is used on the /goodbye page at the moment.
module.exports = window.$.osf = {
@@ -1113,4 +1139,5 @@ module.exports = window.$.osf = {
osfSupportEmail: osfSupportEmail,
osfSupportLink: osfSupportLink,
refreshOrSupport: refreshOrSupport,
+ handleErrorResponse: handleErrorResponse,
};
diff --git a/website/static/js/pages/project-addons-page.js b/website/static/js/pages/project-addons-page.js
index e6e049f591a..869b29e9700 100644
--- a/website/static/js/pages/project-addons-page.js
+++ b/website/static/js/pages/project-addons-page.js
@@ -11,7 +11,10 @@ var changeAddonSettingsSuccess = function () {
location.reload();
};
-var changeAddonSettingsFailure = function () {
+var changeAddonSettingsFailure = function (xhr) {
+ if ($osf.handleErrorResponse(xhr) === false) {
+ return;
+ }
var msg = _('Sorry, we had trouble saving your settings. If this persists please contact ') + 'rdm_support@nii.ac.jp ';
$osf.growl('Failure', msg, 'danger');
};
diff --git a/website/static/js/pages/project-dashboard-page.js b/website/static/js/pages/project-dashboard-page.js
index 6b8453dd08e..6ad753329ba 100644
--- a/website/static/js/pages/project-dashboard-page.js
+++ b/website/static/js/pages/project-dashboard-page.js
@@ -669,6 +669,13 @@ $(document).ready(function () {
request.fail(function(xhr, textStatus, error) {
window.contextVars.node.tags.splice(window.contextVars.node.tags.indexOf(tag),1);
+ if (xhr.status === 403) {
+ if ($osf.handleErrorResponse(xhr) === false) {
+ return;
+ }
+ $osf.growl('Error', _('You do not have permission to operate a project.'));
+ }
+ $('#node-tags').importTags(window.contextVars.node.tags.join(','));
Raven.captureMessage(_('Failed to add tag'), {
extra: {
tag: tag, url: tagsApiUrl, textStatus: textStatus, error: error
@@ -680,13 +687,13 @@ $(document).ready(function () {
if (!tag) {
return false;
}
- window.contextVars.node.tags.splice(window.contextVars.node.tags.indexOf(tag),1);
+ var newTags = $.extend(true, [], window.contextVars.node.tags);
var payload = {
data: {
type: nodeType,
id: window.contextVars.node.id,
attributes: {
- tags: window.contextVars.node.tags
+ tags: newTags.splice(newTags.indexOf(tag),1)
}
}
};
@@ -698,13 +705,22 @@ $(document).ready(function () {
data: payload,
isCors: true
}
- );
+ ).done(function (){
+ window.contextVars.node.tags.splice(window.contextVars.node.tags.indexOf(tag),1);
+ });
request.fail(function(xhr, textStatus, error) {
- window.contextVars.node.tags.push(tag);
// Suppress "tag not found" errors, as the end result is what the user wanted (tag is gone)- eg could be because two people were working at same time
if (xhr.status !== 409) {
- $osf.growl('Error', _('Could not remove tag'));
+ if (xhr.status === 403) {
+ if ($osf.handleErrorResponse(xhr) === false) {
+ return;
+ }
+ $osf.growl('Error', _('You do not have permission to operate a project.'));
+ } else {
+ $osf.growl('Error', _('Could not remove tag'));
+ }
+ $('#node-tags').importTags(window.contextVars.node.tags.join(','));
Raven.captureMessage(_('Failed to remove tag'), {
extra: {
tag: tag, url: tagsApiUrl, textStatus: textStatus, error: error
diff --git a/website/static/js/pointers.js b/website/static/js/pointers.js
index 53c11eb58c5..7b4cb3e7765 100644
--- a/website/static/js/pointers.js
+++ b/website/static/js/pointers.js
@@ -225,7 +225,15 @@ var AddPointerViewModel = oop.extend(Paginator, {
self.dirty = true;
});
request.fail(function(xhr, status, error){
- self.logErrors(addUrl, status, error, 'Unable to link project');
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ self.logErrors(addUrl, status, error, _('You do not have permission to operate a project.'));
+ } else {
+ self.logErrors(addUrl, status, error, 'Unable to link project');
+ }
self.processing(false);
});
},
diff --git a/website/static/js/privateLinkManager.js b/website/static/js/privateLinkManager.js
index c20c58ae1b1..039d4d583ca 100644
--- a/website/static/js/privateLinkManager.js
+++ b/website/static/js/privateLinkManager.js
@@ -114,7 +114,15 @@ var PrivateLinkViewModel = function(url) {
).done(function() {
window.location.reload();
}).fail(function(response) {
- self.changeMessage(response.responseJSON.message_long, 'text-danger');
+ if (response.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(response);
+ if (continueHandle === false) {
+ return;
+ }
+ self.changeMessage(_('You do not have permission to operate a project.'), 'text-danger');
+ } else {
+ self.changeMessage(response.responseJSON.message_long, 'text-danger');
+ }
self.disableSubmit(false);
self.submitText('Create');
});
diff --git a/website/static/js/privateLinkTable.js b/website/static/js/privateLinkTable.js
index 2780d89a42c..04f50a43b4b 100644
--- a/website/static/js/privateLinkTable.js
+++ b/website/static/js/privateLinkTable.js
@@ -105,8 +105,16 @@ function ViewModel(url, nodeIsPublic, table) {
data: JSON.stringify(dataToSend)
}).done(function() {
self.privateLinks.remove(data);
- }).fail(function() {
- $osf.growl('Error:',_('Failed to delete the private link.'));
+ }).fail(function(xhr) {
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ $osf.growl('Error:', _('You do not have permission to operate a project.'));
+ } else {
+ $osf.growl('Error:',_('Failed to delete the private link.'));
+ }
});
}
},
diff --git a/website/static/js/project.js b/website/static/js/project.js
index 8684a52d50a..96bcdb80663 100644
--- a/website/static/js/project.js
+++ b/website/static/js/project.js
@@ -83,7 +83,15 @@ NodeActions.forkNode = function() {
isCors: true,
data: payload
}
- );
+ ).fail(function(xhr) {
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ $osf.growl('Error', _('You do not have permission to operate a project.'));
+ }
+ });
$osf.growl('Fork status', _('Your fork is being created. You\'ll receive an email when it is complete.'), 'info');
});
};
@@ -168,7 +176,15 @@ NodeActions.useAsTemplate = function() {
window.location = response.url;
}).fail(function(response) {
$osf.unblock();
- $osf.handleJSONError(response);
+ if (response.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(response);
+ if (continueHandle === false) {
+ return;
+ }
+ $osf.growl('Error', _('You do not have permission to operate a project.'));
+ } else {
+ $osf.handleJSONError(response);
+ }
});
});
};
@@ -194,9 +210,17 @@ NodeActions.removePointer = function(pointerId, pointerElm) {
dataType: 'json'
}).done(function() {
pointerElm.remove();
- }).fail(
- $osf.handleJSONError
- );
+ }).fail(function(xhr) {
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ $osf.growl('Error', _('You do not have permission to operate a project.'));
+ } else {
+ $osf.handleJSONError(xhr);
+ }
+ });
};
// TODO: remove this
diff --git a/website/static/js/projectSettings.js b/website/static/js/projectSettings.js
index 3293954993a..5dc0f638790 100644
--- a/website/static/js/projectSettings.js
+++ b/website/static/js/projectSettings.js
@@ -53,7 +53,14 @@ var ProjectSettings = oop.extend(
updateError: function(xhr, status, error) {
var self = this;
var errorMessage;
- if (error === 'BAD REQUEST') {
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ self.changeMessage(_('You do not have permission to operate a project.'), 'text-danger');
+ errorMessage = _('You do not have permission to operate a project.');
+ } else if (error === 'BAD REQUEST') {
self.changeMessage(language.updateErrorMessage400, 'text-danger');
errorMessage = language.updateErrorMessage400;
}
@@ -184,7 +191,17 @@ var getConfirmationCode = function(nodeType, isSupplementalProject) {
// Redirect to either the parent project or the dashboard
window.location.href = response.url;
});
- request.fail($osf.handleJSONError);
+ request.fail(function(xhr) {
+ if (xhr.status === 403) {
+ var continueHandle = $osf.handleErrorResponse(xhr);
+ if (continueHandle === false) {
+ return;
+ }
+ $osf.growl('Error:', _('You do not have permission to operate a project.'));
+ } else {
+ $osf.handleJSONError(xhr);
+ }
+ });
},
buttons: {
success: {
diff --git a/website/static/js/search-grdm.js b/website/static/js/search-grdm.js
index 5d9c479f0db..3679143da02 100644
--- a/website/static/js/search-grdm.js
+++ b/website/static/js/search-grdm.js
@@ -620,6 +620,9 @@ var ViewModel = function(params) {
self.searching(false);
}).fail(function(response){
+ if ($osf.handleErrorResponse(response) === false) {
+ return;
+ }
self.totalResults(0);
self.currentPage(0);
self.results([]);
diff --git a/website/templates/my_projects.mako b/website/templates/my_projects.mako
index 8b5cf3ab80b..290a967195e 100644
--- a/website/templates/my_projects.mako
+++ b/website/templates/my_projects.mako
@@ -28,6 +28,7 @@
window.contextVars = $.extend(true, {}, window.contextVars, {
storageRegions: ${ storage_regions | sjson, n },
storageFlagIsActive: ${ storage_flag_is_active | sjson, n },
+ canCreateNewProject: ${ can_create_new_project | sjson, n },
});
diff --git a/website/templates/project/settings.mako b/website/templates/project/settings.mako
index 0ee4c3e2ae9..c45ecfc99cd 100644
--- a/website/templates/project/settings.mako
+++ b/website/templates/project/settings.mako
@@ -131,7 +131,7 @@
% endif
${_("Cancel")}
- ${_("Save changes")}