diff --git a/src/lib/services/access-service.ts b/src/lib/services/access-service.ts index f76a5863fb..f3e1fea05d 100644 --- a/src/lib/services/access-service.ts +++ b/src/lib/services/access-service.ts @@ -1,3 +1,4 @@ +import { catch } from 'fetch-mock'; import { AccessStore, IRole, @@ -125,16 +126,22 @@ export class AccessService { `Checking permission=${permission}, userId=${user.id} projectId=${projectId}`, ); - const userP = await this.store.getPermissionsForUser(user.id); + try { + const userP = await this.store.getPermissionsForUser(user.id); - return userP - .filter( - p => - !p.project || - p.project === projectId || - p.project === ALL_PROJECTS, - ) - .some(p => p.permission === permission || p.permission === ADMIN); + return userP + .filter( + p => + !p.project || + p.project === projectId || + p.project === ALL_PROJECTS, + ) + .some(p => p.permission === permission || p.permission === ADMIN); + } catch(e) { + this.logger.error(`Error checking permission=${permission}, userId=${user.id} projectId=${projectId}`, e); + return Promise.resolve(false); + } + } async getPermissionsForUser(user: User): Promise { diff --git a/src/test/e2e/services/access-service.e2e.test.js b/src/test/e2e/services/access-service.e2e.test.js index 16a8593db0..e9f180ab89 100644 --- a/src/test/e2e/services/access-service.e2e.test.js +++ b/src/test/e2e/services/access-service.e2e.test.js @@ -399,3 +399,22 @@ test.serial('should switch root role for user', async t => { t.is(roles.length, 1); t.is(roles[0].name, RoleName.VIEWER); }); + +test.serial('should not crash if user does not have permission', async t => { + const { userStore } = stores; + + const user = await userStore.insert({ + name: 'Some User', + email: 'random55Read@getunleash.io', + }); + + await accessService.setUserRootRole(user.id, readRole.id); + + const { UPDATE_CONTEXT_FIELD } = permissions; + const hasAccess = await accessService.hasPermission( + user, + UPDATE_CONTEXT_FIELD, + ); + + t.false(hasAccess); +}); diff --git a/src/test/e2e/stores/feature-toggle-store.e2e.test.js b/src/test/e2e/stores/feature-toggle-store.e2e.test.js new file mode 100644 index 0000000000..2ddf87e4ea --- /dev/null +++ b/src/test/e2e/stores/feature-toggle-store.e2e.test.js @@ -0,0 +1,26 @@ +'use strict'; + +const test = require('ava'); +const dbInit = require('../helpers/database-init'); +const getLogger = require('../../fixtures/no-logger'); + +let stores; +let db; +let featureToggleStore; + +test.before(async () => { + db = await dbInit('feature_toggle_store_serial', getLogger); + stores = db.stores; + featureToggleStore = stores.featureToggleStore; +}); + +test.after(async () => { + await db.destroy(); +}); + +test.serial('should not crash for unknown toggle', async t => { + const project = await featureToggleStore.getProjectId( + 'missing-toggle-name', + ); + t.is(project, undefined); +});