🐛 Fixed permission for "Administrator" to be able to edit post visibi…

…lity closes #11825 - The initial implementation had a typo in a role name which didn't allow "Administrator" to edit post's "visibility" attribute - Added unit tests to check administrator specific role and visibility attribute permission
TryGhost · May 20, 2020 · 2d41e5c · 2d41e5c
1 parent efdc230
commit 2d41e5c
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 3 deletions.
diff --git a/core/server/models/post.js b/core/server/models/post.js
@@ -960,7 +960,7 @@ Post = ghostBookshelf.Model.extend({
 
         isContributor = loadedPermissions.user && _.some(loadedPermissions.user.roles, {name: 'Contributor'});
         isOwner = loadedPermissions.user && _.some(loadedPermissions.user.roles, {name: 'Owner'});
-        isAdmin = loadedPermissions.user && _.some(loadedPermissions.user.roles, {name: 'Admin'});
+        isAdmin = loadedPermissions.user && _.some(loadedPermissions.user.roles, {name: 'Administrator'});
         isEditor = loadedPermissions.user && _.some(loadedPermissions.user.roles, {name: 'Editor'});
         isIntegration = loadedPermissions.apiKey && _.some(loadedPermissions.apiKey.roles, {name: 'Admin Integration'});
 

diff --git a/test/unit/models/post_spec.js b/test/unit/models/post_spec.js
@@ -1235,7 +1235,7 @@ describe('Unit: models/post: uses database (@TODO: fix me)', function () {
                 });
             });
 
-            it('resolves if changing visibility', function () {
+            it('resolves if changing visibility as owner', function (done) {
                 const mockPostObj = {
                     get: sinon.stub(),
                     related: sinon.stub()
@@ -1251,13 +1251,45 @@ describe('Unit: models/post: uses database (@TODO: fix me)', function () {
                     'edit',
                     context,
                     unsafeAttrs,
-                    testUtils.permissions.editor,
+                    testUtils.permissions.owner,
                     false,
                     true,
                     true
                 ).then(() => {
                     should(mockPostObj.get.called).be.false();
                     should(mockPostObj.related.calledOnce).be.true();
+                    done();
+                }).catch(() => {
+                    done(new Error('Permissible function should have passed for owner.'));
+                });
+            });
+
+            it('resolves if changing visibility as administrator', function (done) {
+                const mockPostObj = {
+                    get: sinon.stub(),
+                    related: sinon.stub()
+                };
+                const context = {user: 1};
+                const unsafeAttrs = {visibility: 'public'};
+
+                mockPostObj.get.withArgs('visibility').returns('paid');
+                mockPostObj.related.withArgs('authors').returns({models: [{id: 1}]});
+
+                models.Post.permissible(
+                    mockPostObj,
+                    'edit',
+                    context,
+                    unsafeAttrs,
+                    testUtils.permissions.admin,
+                    false,
+                    true,
+                    true
+                ).then(() => {
+                    should(mockPostObj.get.called).be.false();
+                    should(mockPostObj.related.calledOnce).be.true();
+                    done();
+                }).catch(() => {
+                    done(new Error('Permissible function should have passed for administrator.'));
                 });
             });
         });