Closes #885

benkeen · Dec 15, 2024 · e1d8de8 · e1d8de8
1 parent fd8b2e2
commit e1d8de8
Show file tree

Hide file tree

Showing 5 changed files with 60 additions and 25 deletions.
diff --git a/client/src/components/creatablePillField/CreatablePillField.tsx b/client/src/components/creatablePillField/CreatablePillField.tsx
@@ -88,7 +88,8 @@ const CreatablePillField = ({
 	const [tempValue, setTempValue] = React.useState('');
 	const options = value.map(createOption);
 
-	const handleInputChange = (newTempValue: string): void => setTempValue(newTempValue);
+	const handleInputChange = (newTempValue: string): void =>
+		setTempValue(newTempValue);
 	const handleKeyDown = (e: any): void => {
 		if (!tempValue) {
 			return;
@@ -108,7 +109,13 @@ const CreatablePillField = ({
 		}
 	};
 
-	const onSortEnd = ({ oldIndex, newIndex }: { oldIndex: number; newIndex: number }): void => {
+	const onSortEnd = ({
+		oldIndex,
+		newIndex
+	}: {
+		oldIndex: number;
+		newIndex: number;
+	}): void => {
 		const sortedOptions = arrayMove(options, oldIndex, newIndex);
 		onChange(sortedOptions.map((i: DropdownOption) => i.value));
 	};
@@ -123,21 +130,30 @@ const CreatablePillField = ({
 
 	// onCreateOption={(a: any) => console.log(a)}
 	return (
-		<ErrorTooltip title={error} arrow disableHoverListener={!error} disableFocusListener={!error}>
+		<ErrorTooltip
+			title={error}
+			arrow
+			disableHoverListener={!error}
+			disableFocusListener={!error}
+		>
 			<SortableCreatableSelect
 				className={classes.join(' ')}
 				styles={selectStyles}
 				components={customComponents}
 				inputValue={tempValue}
 				axis="xy"
 				distance={4}
-				getHelperDimensions={({ node }: any): any => node.getBoundingClientRect()}
+				getHelperDimensions={({ node }: any): any =>
+					node.getBoundingClientRect()
+				}
 				isClearable={isClearable}
 				isMulti
 				onSortEnd={onSortEnd}
 				menuIsOpen={false}
 				onChange={(options: any): void => {
-					const newValues = options ? options.map(({ value }: DropdownOption) => value) : [];
+					const newValues = options
+						? options.map(({ value }: DropdownOption) => value)
+						: [];
 					onChange(newValues);
 				}}
 				onInputChange={handleInputChange}

diff --git a/client/src/core/account/dataSets/DataSets.component.tsx b/client/src/core/account/dataSets/DataSets.component.tsx
@@ -3,7 +3,9 @@ import { useMutation, useQuery } from '@apollo/client';
 import Button from '@material-ui/core/Button';
 import HighlightOffIcon from '@material-ui/icons/HighlightOff';
 import Pagination from '~components/Pagination';
-import TableHeader, { ColSortDir } from '~components/tables/TableHeader.component';
+import TableHeader, {
+	ColSortDir
+} from '~components/tables/TableHeader.component';
 import * as queries from '~core/queries';
 import DeleteDataSetDialog from '~core/dialogs/deleteDataSet/DeleteDataSetDialog.component';
 import styles from './DataSets.scss';
@@ -18,10 +20,20 @@ import { GDLocale } from '~types/general';
 const Row = ({ onDelete, onLoad, dataSet, i18n }: any): JSX.Element => (
 	<div className={styles.row}>
 		<div className={styles.dataSetName}>{dataSet.dataSetName}</div>
-		<div className={styles.dateCreated}>{formatUnixTime(dataSet.historyDateCreatedUnix)}</div>
-		<div className={styles.numRowsGenerated}>{getFormattedNum(dataSet.numRowsGenerated)}</div>
+		<div className={styles.dateCreated}>
+			{formatUnixTime(dataSet.historyDateCreatedUnix)}
+		</div>
+		<div className={styles.numRowsGenerated}>
+			{getFormattedNum(dataSet.numRowsGenerated)}
+		</div>
 		<div className={styles.open}>
-			<Button size="small" type="submit" color="primary" variant="outlined" onClick={onLoad}>
+			<Button
+				size="small"
+				type="submit"
+				color="primary"
+				variant="outlined"
+				onClick={onLoad}
+			>
 				{i18n.open}
 			</Button>
 		</div>
@@ -94,7 +106,8 @@ const DataSets = ({
 			setDeleteDialogVisibility(false);
 
 			if (currentDataSetId) {
-				const { dataSetId: deletedDataSetId } = selectedDataSet as DataSetListItem;
+				const { dataSetId: deletedDataSetId } =
+					selectedDataSet as DataSetListItem;
 
 				// double == intentional. Maybe a string
 				if (currentDataSetId == deletedDataSetId) {

diff --git a/server/graphql/resolvers/account.js b/server/graphql/resolvers/account.js
@@ -2,7 +2,7 @@ const dateFns = require('date-fns');
 const db = require('../../database');
 const authUtils = require('../../utils/authUtils');
 
-const updateCurrentAccount = async (root, args, { token, user }) => {
+const updateCurrentAccount = async (_root, args, { token, user }) => {
 	if (!authUtils.authenticate(token)) {
 		return { success: false };
 	}
@@ -24,7 +24,7 @@ const updateCurrentAccount = async (root, args, { token, user }) => {
 	};
 };
 
-const updateAccount = async (root, args, { token, user }) => {
+const updateAccount = async (_root, args, { token, user }) => {
 	if (!authUtils.authenticate(token)) {
 		return { success: false };
 	}
@@ -179,7 +179,7 @@ const createUserAccount = async (root, args, { token, user }) => {
 	};
 };
 
-const deleteAccount = async (root, { accountId, content }, { token, user }) => {
+const deleteAccount = async (_root, { accountId }, { token, user }) => {
 	if (!authUtils.authenticate(token)) {
 		return { success: false };
 	}

diff --git a/server/graphql/resolvers/auth.js b/server/graphql/resolvers/auth.js
@@ -22,7 +22,7 @@ const getAccountNumRowsGenerated = async (accountId) => {
 	return results[0].dataValues.totalRowsGenerated || 0;
 };
 
-const login = async (root, { email, password }, { res }) => {
+const login = async (_root, { email, password }, { res }) => {
 	const user = await db.accounts.findOne({
 		attributes: [
 			'accountId',
@@ -153,7 +153,7 @@ const sendPasswordResetEmail = async (root, { email }, { req }) => {
 	return { success: true };
 };
 
-const loginWithGoogle = async (root, { googleToken }, { res }) => {
+const loginWithGoogle = async (_root, { googleToken }, { res }) => {
 	const client = new OAuth2Client(process.env.GD_GOOGLE_AUTH_CLIENT_ID);
 	let email = '';
 	let profileImage = '';
@@ -249,7 +249,7 @@ const loginWithGoogle = async (root, { googleToken }, { res }) => {
 	};
 };
 
-const checkAndUpdateRefreshToken = async (root, args, { token, req, res }) => {
+const checkAndUpdateRefreshToken = async (_root, _args, { req, res }) => {
 	if (!req.cookies.refreshToken) {
 		return { success: false };
 	}

diff --git a/server/graphql/resolvers/dataSets.js b/server/graphql/resolvers/dataSets.js
@@ -2,7 +2,7 @@ const db = require('../../database');
 const authUtils = require('../../utils/authUtils');
 
 const saveNewDataSet = async (
-	root,
+	_root,
 	{ dataSetName, content },
 	{ token, user }
 ) => {
@@ -33,12 +33,15 @@ const saveNewDataSet = async (
 	};
 };
 
-const renameDataSet = async (root, { dataSetId, dataSetName }, { token }) => {
+const renameDataSet = async (_root, { dataSetId, dataSetName }, { token }) => {
 	authUtils.authenticate(token);
 
-	// TODO security. Check user can update this data set
-
 	const dataSet = await db.dataSets.findByPk(dataSetId);
+	if (dataSet.accountId !== user.accountId) {
+		return {
+			success: false
+		};
+	}
 
 	await dataSet.update({ dataSetName });
 
@@ -47,12 +50,15 @@ const renameDataSet = async (root, { dataSetId, dataSetName }, { token }) => {
 	};
 };
 
-const saveDataSet = async (root, { dataSetId, content }, { token, user }) => {
+const saveDataSet = async (_root, { dataSetId, content }, { token, user }) => {
 	authUtils.authenticate(token);
 
-	// now check the user is able to access and change this data set
-	let hasAccess = false;
-	const dataSet = db.dataSets.findByPk(dataSetId);
+	const dataSet = await db.dataSets.findByPk(dataSetId);
+	if (dataSet.accountId !== user.accountId) {
+		return {
+			success: false
+		};
+	}
 
 	const dateCreated = new Date().getTime();
 	await db.dataSetHistory.create({
@@ -89,7 +95,7 @@ const deleteDataSet = async (_root, { dataSetId }, { token, user }) => {
 };
 
 const updateDataSetGenerationCount = async (
-	root,
+	_root,
 	{ dataSetId, generatedRows },
 	{ token, user }
 ) => {