Opened LIST and GET endpoints for projectTemplates, productTemplates and projectTypes

Restricted write endpoints to only connect admin and topcoder admins

Author: Vikas Agarwal

src/permissions/index.js

@@ -26,14 +26,14 @@ module.exports = () => {
   Authorizer.setPolicy('project.updateMember', projectEdit);
   Authorizer.setPolicy('project.admin', projectAdmin);
 
-  Authorizer.setPolicy('projectTemplate.create', connectManagerOrAdmin);
-  Authorizer.setPolicy('projectTemplate.edit', connectManagerOrAdmin);
-  Authorizer.setPolicy('projectTemplate.delete', connectManagerOrAdmin);
+  Authorizer.setPolicy('projectTemplate.create', projectAdmin);
+  Authorizer.setPolicy('projectTemplate.edit', projectAdmin);
+  Authorizer.setPolicy('projectTemplate.delete', projectAdmin);
   Authorizer.setPolicy('projectTemplate.view', true);
 
-  Authorizer.setPolicy('productTemplate.create', connectManagerOrAdmin);
-  Authorizer.setPolicy('productTemplate.edit', connectManagerOrAdmin);
-  Authorizer.setPolicy('productTemplate.delete', connectManagerOrAdmin);
+  Authorizer.setPolicy('productTemplate.create', projectAdmin);
+  Authorizer.setPolicy('productTemplate.edit', projectAdmin);
+  Authorizer.setPolicy('productTemplate.delete', projectAdmin);
   Authorizer.setPolicy('productTemplate.view', true);
 
   Authorizer.setPolicy('project.addProjectPhase', copilotAndAbove);

src/routes/index.js

@@ -26,6 +26,21 @@ router.get(`/${apiVersion}/projects/health`, (req, res) => {
 // All project service endpoints need authentication
 const jwtAuth = require('tc-core-library-js').middleware.jwtAuthenticator;
 
+router.route('/v4/projectTemplates')
+  .get(require('./projectTemplates/list'));
+router.route('/v4/projectTemplates/:templateId(\\d+)')
+  .get(require('./projectTemplates/get'));
+
+router.route('/v4/productTemplates')
+  .get(require('./productTemplates/list'));
+router.route('/v4/productTemplates/:templateId(\\d+)')
+  .get(require('./productTemplates/get'));
+
+router.route('/v4/projectTypes')
+  .get(require('./projectTypes/list'));
+router.route('/v4/projectTypes/:key')
+  .get(require('./projectTypes/get'));
+
 router.all(
   RegExp(`\\/${apiVersion}\\/(projects|projectTemplates|productTemplates|projectTypes)(?!\\/health).*`),
   jwtAuth());
@@ -71,20 +86,16 @@ router.route('/v4/projects/:projectId(\\d+)/upgrade')
   .post(require('./projectUpgrade/create'));
 
 router.route('/v4/projectTemplates')
-  .post(require('./projectTemplates/create'))
-  .get(require('./projectTemplates/list'));
+  .post(require('./projectTemplates/create'));
 
 router.route('/v4/projectTemplates/:templateId(\\d+)')
-  .get(require('./projectTemplates/get'))
   .patch(require('./projectTemplates/update'))
   .delete(require('./projectTemplates/delete'));
 
 router.route('/v4/productTemplates')
-  .post(require('./productTemplates/create'))
-  .get(require('./productTemplates/list'));
+  .post(require('./productTemplates/create'));
 
 router.route('/v4/productTemplates/:templateId(\\d+)')
-  .get(require('./productTemplates/get'))
   .patch(require('./productTemplates/update'))
   .delete(require('./productTemplates/delete'));
 
@@ -107,11 +118,9 @@ router.route('/v4/projects/:projectId(\\d+)/phases/:phaseId(\\d+)/products/:prod
   .delete(require('./phaseProducts/delete'));
 
 router.route('/v4/projectTypes')
-  .post(require('./projectTypes/create'))
-  .get(require('./projectTypes/list'));
+  .post(require('./projectTypes/create'));
 
 router.route('/v4/projectTypes/:key')
-  .get(require('./projectTypes/get'))
   .patch(require('./projectTypes/update'))
   .delete(require('./projectTypes/delete'));
 

src/routes/productTemplates/get.spec.js

@@ -56,11 +56,6 @@ describe('GET product template', () => {
   after(testUtil.clearDb);
 
   describe('GET /productTemplates/{templateId}', () => {
-    it('should return 403 if user is not authenticated', (done) => {
-      request(server)
-        .get(`/v4/productTemplates/${templateId}`)
-        .expect(403, done);
-    });
 
     it('should return 404 for non-existed template', (done) => {
       request(server)
@@ -112,6 +107,12 @@ describe('GET product template', () => {
         });
     });
 
+    it('should return 200 even if user is not authenticated', (done) => {
+      request(server)
+        .get(`/v4/productTemplates/${templateId}`)
+        .expect(200, done);
+    });
+
     it('should return 200 for connect admin', (done) => {
       request(server)
         .get(`/v4/productTemplates/${templateId}`)

src/routes/productTemplates/list.spec.js

@@ -92,11 +92,6 @@ describe('LIST product templates', () => {
   after(testUtil.clearDb);
 
   describe('GET /productTemplates', () => {
-    it('should return 403 if user is not authenticated', (done) => {
-      request(server)
-        .get('/v4/productTemplates')
-        .expect(403, done);
-    });
 
     it('should return 200 for admin', (done) => {
       request(server)
@@ -113,6 +108,18 @@ describe('LIST product templates', () => {
         });
     });
 
+    it('should return 200 even if user is not authenticated', (done) => {
+      request(server)
+        .get('/v4/productTemplates')
+        .expect(200)
+        .end((err, res) => {
+          const resJson = res.body.result.content;
+          validateProductTemplates(2, resJson, templates);
+          resJson[0].id.should.be.eql(templateId);
+          done();
+        });
+    });
+
     it('should return 200 for connect admin', (done) => {
       request(server)
         .get('/v4/productTemplates')

src/routes/projectTemplates/get.spec.js

@@ -58,11 +58,6 @@ describe('GET project template', () => {
   after(testUtil.clearDb);
 
   describe('GET /projectTemplates/{templateId}', () => {
-    it('should return 403 if user is not authenticated', (done) => {
-      request(server)
-        .get(`/v4/projectTemplates/${templateId}`)
-        .expect(403, done);
-    });
 
     it('should return 404 for non-existed template', (done) => {
       request(server)
@@ -110,6 +105,12 @@ describe('GET project template', () => {
           done();
         });
     });
+    
+    it('should return 200 even if user is not authenticated', (done) => {
+      request(server)
+        .get(`/v4/projectTemplates/${templateId}`)
+        .expect(200, done);
+    });
 
     it('should return 200 for connect admin', (done) => {
       request(server)

src/routes/projectTemplates/list.spec.js

@@ -75,11 +75,6 @@ describe('LIST project templates', () => {
   after(testUtil.clearDb);
 
   describe('GET /projectTemplates', () => {
-    it('should return 403 if user is not authenticated', (done) => {
-      request(server)
-        .get('/v4/projectTemplates')
-        .expect(403, done);
-    });
 
     it('should return 200 for admin', (done) => {
       request(server)
@@ -110,6 +105,12 @@ describe('LIST project templates', () => {
         });
     });
 
+    it('should return 200 for anonymous user', (done) => {
+      request(server)
+        .get('/v4/projectTemplates')
+        .expect(200, done);
+    });
+
     it('should return 200 for connect admin', (done) => {
       request(server)
         .get('/v4/projectTemplates')

src/routes/projectTypes/get.spec.js

@@ -33,11 +33,6 @@ describe('GET project type', () => {
   after(testUtil.clearDb);
 
   describe('GET /projectTypes/{key}', () => {
-    it('should return 403 if user is not authenticated', (done) => {
-      request(server)
-        .get(`/v4/projectTypes/${key}`)
-        .expect(403, done);
-    });
 
     it('should return 404 for non-existed type', (done) => {
       request(server)
@@ -88,6 +83,12 @@ describe('GET project type', () => {
         });
     });
 
+    it('should return 200 even if user is not authenticated', (done) => {
+      request(server)
+        .get(`/v4/projectTypes/${key}`)
+        .expect(200, done);
+    });
+
     it('should return 200 for connect admin', (done) => {
       request(server)
         .get(`/v4/projectTypes/${key}`)

src/routes/projectTypes/list.spec.js

@@ -46,11 +46,6 @@ describe('LIST project types', () => {
   after(testUtil.clearDb);
 
   describe('GET /projectTypes', () => {
-    it('should return 403 if user is not authenticated', (done) => {
-      request(server)
-        .get('/v4/projectTypes')
-        .expect(403, done);
-    });
 
     it('should return 200 for admin', (done) => {
       request(server)
@@ -83,6 +78,12 @@ describe('LIST project types', () => {
         });
     });
 
+    it('should return 200 even if user is not authenticated', (done) => {
+      request(server)
+        .get('/v4/projectTypes')
+        .expect(200, done);
+    });
+
     it('should return 200 for connect admin', (done) => {
       request(server)
         .get('/v4/projectTypes')