Skip to content
This repository was archived by the owner on Jan 23, 2025. It is now read-only.

Commit df292bf

Browse files
TheOschskyhit
TheOsch
authored and
skyhit
committed
Improve challenge visibility control: getChallenge and getRegistrants (#504)
* IMPROVE CHALLENGE VISIBILITY CONTROL (https://www.topcoder.com/challenge-details/30057891/?type=develop) Verification guide: docs/Verification_Guide-Improve Challenge Visibility Control.doc * Restoring an accidentially modified file * Fixed the case with a challenge that doesn't have eligibility * Shared the eligibility verification with challengeRegistration. The eligibility check routine is now in challengeHelper and can be added anywhere by a couple of simple lines of code. * Improve challenge visibility control: getChallenge and getRegistrants
1 parent f875a09 commit df292bf

File tree

6 files changed

+714
-72
lines changed

6 files changed

+714
-72
lines changed

‎actions/challenges.js‎

Lines changed: 46 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -80,8 +80,8 @@
8080
* Changes in 1.31:
8181
* - Remove screeningScorecardId and reviewScorecardId from search challenges api.
8282
* Changes in 1.32:
83-
* - validateChallenge function now checks if an user belongs to a group via
84-
* user_group_xref for old challenges and by calling V3 API for new ones.
83+
* - validateChallenge, getRegistrants, getChallenge, getSubmissions and getPhases functions now check
84+
* if an user belongs to a group via user_group_xref for old challenges and by calling V3 API for new ones.
8585
*/
8686
"use strict";
8787
/*jslint stupid: true, unparam: true, continue: true, nomen: true */
@@ -1081,19 +1081,20 @@ var getChallenge = function (api, connection, dbConnectionMap, isStudio, next) {
10811081
};
10821082

10831083
// Do the private check.
1084+
api.challengeHelper.checkUserChallengeEligibility(
1085+
connection,
1086+
connection.params.challengeId,
1087+
cb
1088+
);
1089+
}, function (cb) {
10841090
api.dataAccess.executeQuery('check_is_related_with_challenge', sqlParams, dbConnectionMap, cb);
10851091
}, function (result, cb) {
1086-
if (result[0].is_private && !result[0].has_access) {
1087-
cb(new UnauthorizedError('The user is not allowed to visit the challenge.'));
1088-
return;
1089-
}
1090-
10911092
if (result[0].is_manager) {
10921093
isManager = true;
10931094
}
10941095

10951096
// If the user has the access to the challenge or is a resource for the challenge then he is related with this challenge.
1096-
if (result[0].has_access || result[0].is_related || isManager || helper.isAdmin(caller)) {
1097+
if (result[0].is_private || result[0].is_related || isManager || helper.isAdmin(caller)) {
10971098
isRelated = true;
10981099
}
10991100

@@ -3342,33 +3343,32 @@ var getRegistrants = function (api, connection, dbConnectionMap, isStudio, next)
33423343
};
33433344

33443345
// Do the private check.
3345-
api.dataAccess.executeQuery('check_is_related_with_challenge', sqlParams, dbConnectionMap, cb);
3346-
}, function (result, cb) {
3347-
if (result[0].is_private && !result[0].has_access) {
3348-
cb(new UnauthorizedError('The user is not allowed to visit the challenge.'));
3349-
return;
3350-
}
3351-
3346+
api.challengeHelper.checkUserChallengeEligibility(
3347+
connection,
3348+
connection.params.challengeId,
3349+
cb
3350+
);
3351+
}, function (cb) {
33523352
api.dataAccess.executeQuery('challenge_registrants', sqlParams, dbConnectionMap, cb);
33533353
}, function (results, cb) {
33543354
var mapRegistrants = function (results) {
3355-
if (!_.isDefined(results)) {
3356-
return [];
3355+
if (!_.isDefined(results)) {
3356+
return [];
3357+
}
3358+
return _.map(results, function (item) {
3359+
var registrant = {
3360+
handle: item.handle,
3361+
reliability: !_.isDefined(item.reliability) ? "n/a" : item.reliability + "%",
3362+
registrationDate: formatDate(item.inquiry_date),
3363+
submissionDate: formatDate(item.submission_date)
3364+
};
3365+
if (!isStudio) {
3366+
registrant.rating = item.rating;
3367+
registrant.colorStyle = helper.getColorStyle(item.rating);
33573368
}
3358-
return _.map(results, function (item) {
3359-
var registrant = {
3360-
handle: item.handle,
3361-
reliability: !_.isDefined(item.reliability) ? "n/a" : item.reliability + "%",
3362-
registrationDate: formatDate(item.inquiry_date),
3363-
submissionDate: formatDate(item.submission_date)
3364-
};
3365-
if (!isStudio) {
3366-
registrant.rating = item.rating;
3367-
registrant.colorStyle = helper.getColorStyle(item.rating);
3368-
}
3369-
return registrant;
3370-
});
3371-
};
3369+
return registrant;
3370+
});
3371+
};
33723372
registrants = mapRegistrants(results);
33733373
cb();
33743374
}
@@ -3440,18 +3440,16 @@ var getSubmissions = function (api, connection, dbConnectionMap, isStudio, next)
34403440
submission_type: [helper.SUBMISSION_TYPE.challenge.id, helper.SUBMISSION_TYPE.checkpoint.id]
34413441
};
34423442

3443-
async.parallel({
3444-
privateCheck: execQuery("check_is_related_with_challenge"),
3445-
challengeStatus: execQuery("get_challenge_status")
3446-
}, cb);
3447-
}, function (result, cb) {
3448-
if (result.privateCheck[0].is_private && !result.privateCheck[0].has_access) {
3449-
cb(new UnauthorizedError('The user is not allowed to visit the challenge.'));
3450-
return;
3451-
}
3452-
3443+
api.challengeHelper.checkUserChallengeEligibility(
3444+
connection,
3445+
connection.params.challengeId,
3446+
cb
3447+
);
3448+
},
3449+
execQuery("get_challenge_status"),
3450+
function (result, cb) {
34533451
// If the caller is not admin and challenge status is still active.
3454-
if (!helper.isAdmin(caller) && result.challengeStatus[0].challenge_status_id === 1) {
3452+
if (!helper.isAdmin(caller) && result[0].challenge_status_id === 1) {
34553453
cb(new BadRequestError("The challenge is not finished."));
34563454
return;
34573455
}
@@ -3567,13 +3565,12 @@ var getPhases = function (api, connection, dbConnectionMap, isStudio, next) {
35673565
};
35683566

35693567
// Do the private check.
3570-
api.dataAccess.executeQuery('check_is_related_with_challenge', sqlParams, dbConnectionMap, cb);
3571-
}, function (result, cb) {
3572-
if (result[0].is_private && !result[0].has_access) {
3573-
cb(new UnauthorizedError('The user is not allowed to visit the challenge.'));
3574-
return;
3575-
}
3576-
3568+
api.challengeHelper.checkUserChallengeEligibility(
3569+
connection,
3570+
connection.params.challengeId,
3571+
cb
3572+
);
3573+
}, function (cb) {
35773574
var execQuery = function (name) {
35783575
return function (cbx) {
35793576
api.dataAccess.executeQuery(name, sqlParams, dbConnectionMap, cbx);

‎db_scripts/test_eligibility.insert.sql‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,28 @@ INSERT INTO project_info (project_id, project_info_type_id, value, create_user,
150150
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
151151
VALUES (1110005, 2, "3330333", "132456", CURRENT, "132456", CURRENT);
152152

153+
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
154+
VALUES (1110001, 6, "Not private", "132456", CURRENT, "132456", CURRENT);
155+
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
156+
VALUES (1110002, 6, "Old logic - access allowed", "132456", CURRENT, "132456", CURRENT);
157+
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
158+
VALUES (1110003, 6, "Old logic - access denied", "132456", CURRENT, "132456", CURRENT);
159+
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
160+
VALUES (1110004, 6, "New logic - access allowed", "132456", CURRENT, "132456", CURRENT);
161+
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
162+
VALUES (1110005, 6, "New logic - access denied", "132456", CURRENT, "132456", CURRENT);
163+
164+
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
165+
VALUES (1110001, 26, "---", "132456", CURRENT, "132456", CURRENT);
166+
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
167+
VALUES (1110002, 26, "---", "132456", CURRENT, "132456", CURRENT);
168+
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
169+
VALUES (1110003, 26, "---", "132456", CURRENT, "132456", CURRENT);
170+
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
171+
VALUES (1110004, 26, "---", "132456", CURRENT, "132456", CURRENT);
172+
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
173+
VALUES (1110005, 26, "---", "132456", CURRENT, "132456", CURRENT);
174+
153175
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
154176
VALUES (1110001, 6, 3330333, "Not private", CURRENT, "132456", CURRENT);
155177
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
@@ -162,6 +184,7 @@ INSERT INTO project_info (project_id, project_info_type_id, value, create_user,
162184
VALUES (1110005, 6, 3330333, "New logic - access denied", CURRENT, "132456", CURRENT);
163185

164186
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
187+
>>>>>>> upstream/dev
165188
VALUES (1110001, 79, "---", "132456", CURRENT, "132456", CURRENT);
166189
INSERT INTO project_info (project_id, project_info_type_id, value, create_user, create_date, modify_user, modify_date)
167190
VALUES (1110002, 79, "---", "132456", CURRENT, "132456", CURRENT);

‎docs/Verification_Guide-Improve Challenge Visibility Control.doc‎

4 KB
Binary file not shown.

‎initializers/challengeHelper.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -374,7 +374,7 @@ exports.challengeHelper = function (api, next) {
374374
} else if (connection.caller.accessLevel === "anon") {
375375
next(new UnauthorizedError());
376376
} else {
377-
next(new ForbiddenError());
377+
next(new ForbiddenError('The user is not allowed to visit the challenge.'));
378378
}
379379
});
380380
});

‎queries/check_is_related_with_challenge‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,21 @@ SELECT
22
(SELECT
33
max(1)
44
FROM contest_eligibility ce
5-
INNER JOIN group_contest_eligibility gce ON gce.contest_eligibility_id = ce.contest_eligibility_id
6-
LEFT JOIN user_group_xref ugx ON ugx.group_id = gce.group_id
75
WHERE ce.contest_id = @challengeId@
8-
AND ((ugx.login_id = @user_id@ AND gce.group_id < 2000000) OR gce.group_id >= 2000000)) AS has_access
9-
, (SELECT
10-
1
11-
FROM contest_eligibility ce
12-
WHERE ce.contest_id = @challengeId@) AS is_private
13-
, (
14-
SELECT
6+
) AS is_private
7+
, (SELECT
158
decode(max(ri.value), null, null, 1)
169
FROM resource r
17-
INNER JOIN resource_info ri ON ri.resource_id = r.resource_id AND ri.resource_info_type_id = 1
10+
INNER JOIN resource_info ri ON ri.resource_id = r.resource_id AND ri.resource_info_type_id = 1
1811
WHERE r.project_id = @challengeId@
19-
AND ri.value = @user_id@) AS is_related
20-
, (SELECT max(project_metadata_id) FROM direct_project_metadata m, project p
21-
WHERE metadata_value = @user_id@ AND p.tc_direct_project_id = m.tc_direct_project_id and p.project_id = @challengeId@ AND project_metadata_key_id IN (1, 2, 14)) AS is_manager
12+
AND ri.value = @user_id@
13+
) AS is_related
14+
, (SELECT
15+
max(project_metadata_id)
16+
FROM direct_project_metadata m, project p
17+
WHERE metadata_value = @user_id@
18+
AND p.tc_direct_project_id = m.tc_direct_project_id
19+
AND p.project_id = @challengeId@
20+
AND project_metadata_key_id IN (1, 2, 14)
21+
) AS is_manager
2222
FROM dual

0 commit comments

Comments
 (0)