Merge branch 'develop' into fix/github-username-assignment

Author: kitlord

contributor_docs/installation.md

@@ -37,6 +37,13 @@ _Note_: The installation steps assume you are using a Unix-like shell. If you ar
 7. Install MongoDB and make sure it is running
    * For Mac OSX with [homebrew](http://brew.sh/): `brew tap mongodb/brew` then `brew install mongodb-community` and finally start the server with `brew services start mongodb-community` or you can visit the installation guide here [Installation Guide For MacOS](https://docs.mongodb.com/manual/tutorial/install-mongodb-on-os-x/)
    * For Windows and Linux: [MongoDB Installation](https://docs.mongodb.com/manual/installation/)
+   * If you have trouble setting up MongoDB locally, an alternative is to use [MongoDB Atlas](https://cloud.mongodb.com/) to get a connection string that you can use as your `MONGO_URL` in the `.env` file. To get your connection string:
+      - Navigate to [mongodb.com](https://www.mongodb.com/) and sign up or log in.
+      - Create a new project. Give it any name, and either add a key-value pair or skip that step.
+      - Create a cluster by choosing the free tier. Give your cluster a name, choose a region, and keep the provider as AWS.
+      - Set a username and password for your database-user, these will be part of your connection string.
+      - Choose **Node.js** as the driver for your connection method. You will see a connection string, with or without the password filled in.
+      - Copy the string and use it as your `MONGO_URL` in the `.env` file.
 8. `$ cp .env.example .env`
 9. (Optional) Update `.env` with necessary keys to enable certain app behaviors, i.e. add Github ID and Github Secret if you want to be able to log in with Github.
    * See the [GitHub API Configuration](#github-api-configuration) section for information on how to authenticate with Github.

package-lock.json

@@ -190,7 +190,7 @@
     "rimraf": "^2.7.1",
     "sass": "^1.66.1",
     "sass-loader": "^13.3.3",
-    "storybook": "^10.2.9",
+    "storybook": "^10.2.10",
     "storybook-addon-theme-playground": "^3.1.0",
     "style-loader": "^3.3.4",
     "terser-webpack-plugin": "^5.3.1",

package.json

@@ -131,6 +131,14 @@ export async function getProjectAsset(req, res) {
       .send({ message: 'Project with that id does not exist' });
   }
 
+  // Check visibility and ownership for private projects
+  if (
+    project.visibility === 'Private' &&
+    (!req.user || !project.user._id.equals(req.user._id))
+  ) {
+    return res.status(403).send({ message: 'Project is private' });
+  }
+
   const filePath = req.params[0];
   const resolvedFile = resolvePathToFile(filePath, project.files);
   if (!resolvedFile) {

server/controllers/project.controller.js

@@ -0,0 +1,213 @@
+/**
+ * @jest-environment node
+ */
+import { Request, Response } from 'jest-express';
+import axios from 'axios';
+import mime from 'mime';
+import Project from '../../../models/project';
+import { getProjectAsset } from '../../project.controller';
+import { resolvePathToFile } from '../../../utils/filePath';
+
+jest.mock('../../../models/project');
+jest.mock('../../../utils/filePath');
+jest.mock('mime');
+jest.mock('axios');
+
+describe('project.controller', () => {
+  describe('getProjectAsset()', () => {
+    let request;
+    let response;
+
+    beforeEach(() => {
+      request = new Request();
+      response = new Response();
+      response.send = jest.fn();
+      response.status = jest.fn().mockReturnThis();
+      response.set = jest.fn().mockReturnThis();
+      request.setParams({ project_id: 'project-123', 0: 'image.png' });
+      Project.findOne = jest.fn().mockReturnValue({
+        populate: jest.fn().mockReturnThis(),
+        exec: jest.fn()
+      });
+      jest.clearAllMocks();
+    });
+
+    afterEach(() => {
+      request.resetMocked();
+      response.resetMocked();
+    });
+
+    it('returns 404 if project does not exist', async () => {
+      Project.findOne().populate().exec.mockResolvedValue(null);
+
+      await getProjectAsset(request, response);
+
+      expect(response.status).toHaveBeenCalledWith(404);
+      expect(response.send).toHaveBeenCalledWith({
+        message: 'Project with that id does not exist'
+      });
+    });
+
+    it('returns 403 if private project is accessed by unauthenticated user', async () => {
+      const project = {
+        _id: 'project-123',
+        visibility: 'Private',
+        user: { _id: { equals: jest.fn() } },
+        files: []
+      };
+      request.user = undefined;
+
+      Project.findOne().populate().exec.mockResolvedValue(project);
+
+      await getProjectAsset(request, response);
+
+      expect(response.status).toHaveBeenCalledWith(403);
+      expect(response.send).toHaveBeenCalledWith({
+        message: 'Project is private'
+      });
+    });
+
+    it('returns 403 if private project is accessed by non-owner', async () => {
+      const ownerId = { equals: jest.fn().mockReturnValue(false) };
+      const project = {
+        _id: 'project-123',
+        visibility: 'Private',
+        user: { _id: ownerId },
+        files: []
+      };
+      request.user = { _id: 'other-user-id' };
+
+      Project.findOne().populate().exec.mockResolvedValue(project);
+
+      await getProjectAsset(request, response);
+
+      expect(response.status).toHaveBeenCalledWith(403);
+      expect(response.send).toHaveBeenCalledWith({
+        message: 'Project is private'
+      });
+      expect(ownerId.equals).toHaveBeenCalledWith('other-user-id');
+    });
+
+    it('allows owner to access private project assets', async () => {
+      const ownerId = 'owner-123';
+      const ownerIdObj = { equals: jest.fn().mockReturnValue(true) };
+      const project = {
+        _id: 'project-123',
+        visibility: 'Private',
+        user: { _id: ownerIdObj },
+        files: []
+      };
+      const resolvedFile = {
+        name: 'image.png',
+        content: Buffer.from('image content')
+      };
+
+      request.user = { _id: ownerId };
+      Project.findOne().populate().exec.mockResolvedValue(project);
+      resolvePathToFile.mockReturnValue(resolvedFile);
+      mime.getType.mockReturnValue('image/png');
+
+      await getProjectAsset(request, response);
+
+      expect(ownerIdObj.equals).toHaveBeenCalledWith(ownerId);
+      expect(response.status).not.toHaveBeenCalledWith(403);
+      expect(response.set).toHaveBeenCalledWith('Content-Type', 'image/png');
+      expect(response.send).toHaveBeenCalledWith(resolvedFile.content);
+    });
+
+    it('allows anyone to access public project assets', async () => {
+      const project = {
+        _id: 'project-123',
+        visibility: 'Public',
+        user: { _id: { equals: jest.fn() } },
+        files: []
+      };
+      const resolvedFile = {
+        name: 'image.png',
+        content: Buffer.from('image content')
+      };
+
+      request.user = undefined; // unauthenticated
+      Project.findOne().populate().exec.mockResolvedValue(project);
+      resolvePathToFile.mockReturnValue(resolvedFile);
+      mime.getType.mockReturnValue('image/png');
+
+      await getProjectAsset(request, response);
+
+      expect(response.status).not.toHaveBeenCalledWith(403);
+      expect(response.set).toHaveBeenCalledWith('Content-Type', 'image/png');
+      expect(response.send).toHaveBeenCalledWith(resolvedFile.content);
+    });
+
+    it('returns 404 if asset does not exist', async () => {
+      const project = {
+        _id: 'project-123',
+        visibility: 'Public',
+        user: { _id: { equals: jest.fn() } },
+        files: []
+      };
+
+      Project.findOne().populate().exec.mockResolvedValue(project);
+      resolvePathToFile.mockReturnValue(null);
+
+      await getProjectAsset(request, response);
+
+      expect(response.status).toHaveBeenCalledWith(404);
+      expect(response.send).toHaveBeenCalledWith({
+        message: 'Asset does not exist'
+      });
+    });
+
+    it('fetches and serves asset from URL when resolvedFile has url', async () => {
+      const project = {
+        _id: 'project-123',
+        visibility: 'Public',
+        user: { _id: { equals: jest.fn() } },
+        files: []
+      };
+      const resolvedFile = {
+        name: 'image.png',
+        url: 'https://example.com/image.png'
+      };
+      const imageData = Buffer.from('image data');
+
+      Project.findOne().populate().exec.mockResolvedValue(project);
+      resolvePathToFile.mockReturnValue(resolvedFile);
+      mime.getType.mockReturnValue('image/png');
+      axios.get.mockResolvedValue({ data: imageData });
+
+      await getProjectAsset(request, response);
+
+      expect(axios.get).toHaveBeenCalledWith(resolvedFile.url, {
+        responseType: 'arraybuffer'
+      });
+      expect(response.set).toHaveBeenCalledWith('Content-Type', 'image/png');
+      expect(response.send).toHaveBeenCalledWith(imageData);
+    });
+
+    it('returns 404 if fetching asset URL fails', async () => {
+      const project = {
+        _id: 'project-123',
+        visibility: 'Public',
+        user: { _id: { equals: jest.fn() } },
+        files: []
+      };
+      const resolvedFile = {
+        name: 'image.png',
+        url: 'https://example.com/image.png'
+      };
+
+      Project.findOne().populate().exec.mockResolvedValue(project);
+      resolvePathToFile.mockReturnValue(resolvedFile);
+      mime.getType.mockReturnValue('image/png');
+      axios.get.mockRejectedValue(new Error('Network error'));
+
+      await getProjectAsset(request, response);
+
+      expect(response.status).toHaveBeenCalledWith(404);
+      expect(response.send).toHaveBeenCalledWith({
+        message: 'Asset does not exist'
+      });
+    });
+  });
+});