2
0
mirror of https://github.com/inventree/inventree-app.git synced 2025-04-28 05:26:47 +00:00

Improve checks for API user permissions

This commit is contained in:
Oliver Walters 2022-06-03 20:42:25 +10:00
parent c8fa6bd992
commit 21e7a976ee
3 changed files with 11 additions and 3 deletions

View File

@ -60,6 +60,7 @@ jobs:
invoke import-fixtures invoke import-fixtures
invoke server -a 127.0.0.1:12345 & invoke server -a 127.0.0.1:12345 &
invoke wait invoke wait
sleep 30
- name: Unit Tests - name: Unit Tests
run: | run: |
flutter test --coverage flutter test --coverage

View File

@ -497,7 +497,7 @@ class InvenTreeAPI {
/* /*
* Request the user roles (permissions) from the InvenTree server * Request the user roles (permissions) from the InvenTree server
*/ */
Future<void> getUserRoles() async { Future<bool> getUserRoles() async {
roles.clear(); roles.clear();
@ -511,7 +511,7 @@ class InvenTreeAPI {
final response = await get(_URL_GET_ROLES, expectedStatusCode: 200); final response = await get(_URL_GET_ROLES, expectedStatusCode: 200);
if (!response.successful()) { if (!response.successful()) {
return; return false;
} }
var data = response.asMap(); var data = response.asMap();
@ -519,6 +519,10 @@ class InvenTreeAPI {
if (data.containsKey("roles")) { if (data.containsKey("roles")) {
// Save a local copy of the user roles // Save a local copy of the user roles
roles = (response.data["roles"] ?? {}) as Map<String, dynamic>; roles = (response.data["roles"] ?? {}) as Map<String, dynamic>;
return true;
} else {
return false;
} }
} }

View File

@ -129,10 +129,13 @@ void main() {
assert(api.supportsNotifications); assert(api.supportsNotifications);
assert(api.supportsPoReceive); assert(api.supportsPoReceive);
// Ensure we can request (and receive) user roles
assert(await api.getUserRoles());
// Check available permissions // Check available permissions
assert(api.checkPermission("part", "change")); assert(api.checkPermission("part", "change"));
assert(api.checkPermission("stocklocation", "delete")); assert(api.checkPermission("stocklocation", "delete"));
assert(api.checkPermission("part", "weirdpermission")); assert(!api.checkPermission("part", "weirdpermission"));
assert(api.checkPermission("blah", "bloo")); assert(api.checkPermission("blah", "bloo"));
}); });