From ced91c3c59970997a24975c9acab091bf9e0bd47 Mon Sep 17 00:00:00 2001 From: liuliquan Date: Thu, 5 Oct 2023 00:40:46 +0800 Subject: [PATCH 1/3] PLAT-3453 Stop copilots from paying themselves 1. Stop copilots from paying themselves, thus copilots will need to contact manager to launch/complete the task 2. When updateChallenge, the helper.getChallengeResources function is called multiple times, now it's called only once --- src/common/challenge-helper.js | 4 +-- src/common/helper.js | 12 ++++--- src/services/ChallengeService.js | 55 ++++++++++++++++++++++++++++---- 3 files changed, 59 insertions(+), 12 deletions(-) diff --git a/src/common/challenge-helper.js b/src/common/challenge-helper.js index aef2bd1a..ac691cdb 100644 --- a/src/common/challenge-helper.js +++ b/src/common/challenge-helper.js @@ -105,9 +105,9 @@ class ChallengeHelper { } } - async validateChallengeUpdateRequest(currentUser, challenge, data) { + async validateChallengeUpdateRequest(currentUser, challenge, data, challengeResources) { if (process.env.LOCAL != "true") { - await helper.ensureUserCanModifyChallenge(currentUser, challenge); + await helper.ensureUserCanModifyChallenge(currentUser, challenge, challengeResources); } helper.ensureNoDuplicateOrNullElements(data.tags, "tags"); diff --git a/src/common/helper.js b/src/common/helper.js index f39800f0..46db3d85 100644 --- a/src/common/helper.js +++ b/src/common/helper.js @@ -528,14 +528,17 @@ async function getResourceRoles() { * Check if a user has full access on a challenge * @param {String} challengeId the challenge UUID * @param {String} userId the user ID + * @param {Array} challengeResources the challenge resources */ -async function userHasFullAccess(challengeId, userId) { +async function userHasFullAccess(challengeId, userId, challengeResources) { const resourceRoles = await getResourceRoles(); const rolesWithFullAccess = _.map( _.filter(resourceRoles, (r) => r.fullWriteAccess), "id" ); - const challengeResources = await getChallengeResources(challengeId); + if (!challengeResources) { + challengeResources = await getChallengeResources(challengeId); + } return ( _.filter( challengeResources, @@ -982,13 +985,14 @@ async function ensureUserCanViewChallenge(currentUser, challenge) { * * @param {Object} currentUser the user who perform operation * @param {Object} challenge the challenge to check + * @param {Array} challengeResources the challenge resources * @returns {Promise} */ -async function ensureUserCanModifyChallenge(currentUser, challenge) { +async function ensureUserCanModifyChallenge(currentUser, challenge, challengeResources) { // check groups authorization await ensureAccessibleByGroupsAccess(currentUser, challenge); // check full access - const isUserHasFullAccess = await userHasFullAccess(challenge.id, currentUser.userId); + const isUserHasFullAccess = await userHasFullAccess(challenge.id, currentUser.userId, challengeResources); if ( !currentUser.isMachine && !hasAdminRole(currentUser) && diff --git a/src/services/ChallengeService.js b/src/services/ChallengeService.js index 9b0fd8da..12f42ebf 100644 --- a/src/services/ChallengeService.js +++ b/src/services/ChallengeService.js @@ -1364,10 +1364,9 @@ function isDifferentPrizeSets(prizeSets = [], otherPrizeSets = []) { /** * Validate the winners array. * @param {Array} winners the Winner Array - * @param {String} winchallengeIdners the challenge ID + * @param {Array} challengeResources the challenge resources */ -async function validateWinners(winners, challengeId) { - const challengeResources = await helper.getChallengeResources(challengeId); +async function validateWinners(winners, challengeResources) { const registrants = _.filter(challengeResources, (r) => r.roleId === config.SUBMITTER_ROLE_ID); for (const prizeType of _.values(constants.prizeSetTypes)) { const filteredWinners = _.filter(winners, (w) => w.type === prizeType); @@ -1410,6 +1409,48 @@ async function validateWinners(winners, challengeId) { } } +/** + * Task shouldn't be launched/completed when it is assigned to the current user self. + * E.g: stop copilots from paying themselves, thus copilots will need to contact manager to launch/complete the task. + * @param {Object} currentUser the user who perform operation + * @param {Object} challenge the existing challenge + * @param {Object} data the new input challenge data + * @param {Array} challengeResources the challenge resources + */ +function validateTaskSelfAssign(currentUser, challenge, data, challengeResources) { + if (currentUser.isMachine) { + return; + } + + const finalStatus = data.status || challenge.status; + + // Only validate when launch/complete a task + const isLaunchCompleteTask = + _.get(challenge, "legacy.pureV5Task") && + (finalStatus === constants.challengeStatuses.Active || + finalStatus === constants.challengeStatuses.Completed); + if (!isLaunchCompleteTask) { + return; + } + + // Whether task is assigned to current user + const assignedToCurrentUser = + _.filter( + challengeResources, + (r) => + r.roleId === config.SUBMITTER_ROLE_ID && + _.toString(r.memberId) === _.toString(currentUser.userId) + ).length > 0; + + if (assignedToCurrentUser) { + throw new errors.ForbiddenError( + `You are not allowed to ${ + finalStatus === constants.challengeStatuses.Active ? "lanuch" : "complete" + } task assigned to yourself. Please contact manager to operate.` + ); + } +} + /** * Update challenge. * @param {Object} currentUser the user who perform operation @@ -1441,7 +1482,10 @@ async function updateChallenge(currentUser, challengeId, data) { data = sanitizeData(sanitizeChallenge(data), challenge); logger.debug(`Sanitized Data: ${JSON.stringify(data)}`); - await validateChallengeUpdateRequest(currentUser, challenge, data); + const challengeResources = await helper.getChallengeResources(challengeId); + + await validateChallengeUpdateRequest(currentUser, challenge, data, challengeResources); + validateTaskSelfAssign(currentUser, challenge, data, challengeResources); let sendActivationEmail = false; let sendSubmittedEmail = false; @@ -1716,7 +1760,7 @@ async function updateChallenge(currentUser, challengeId, data) { } if (data.winners && data.winners.length && data.winners.length > 0) { - await validateWinners(data.winners, challengeId); + await validateWinners(data.winners, challengeResources); } // Only m2m tokens are allowed to modify the `task.*` information on a challenge @@ -1777,7 +1821,6 @@ async function updateChallenge(currentUser, challengeId, data) { if (_.get(type, "isTask")) { if (!_.isEmpty(_.get(data, "task.memberId"))) { - const challengeResources = await helper.getChallengeResources(challengeId); const registrants = _.filter( challengeResources, (r) => r.roleId === config.SUBMITTER_ROLE_ID From d1e5d122a4d680fcd404ef20e2ef09a37c9cb815 Mon Sep 17 00:00:00 2001 From: liuliquan Date: Thu, 5 Oct 2023 18:31:05 +0800 Subject: [PATCH 2/3] Only restrict launch/complete self-assigned Task Also validate winners is present in request payload when complete a Task --- src/services/ChallengeService.js | 59 ++++++++++++++++++-------------- 1 file changed, 33 insertions(+), 26 deletions(-) diff --git a/src/services/ChallengeService.js b/src/services/ChallengeService.js index 12f42ebf..2bf79f2f 100644 --- a/src/services/ChallengeService.js +++ b/src/services/ChallengeService.js @@ -1417,37 +1417,44 @@ async function validateWinners(winners, challengeResources) { * @param {Object} data the new input challenge data * @param {Array} challengeResources the challenge resources */ -function validateTaskSelfAssign(currentUser, challenge, data, challengeResources) { - if (currentUser.isMachine) { +function validateTask(currentUser, challenge, data, challengeResources) { + if (!_.get(challenge, "legacy.pureV5Task")) { + // Not a Task return; } - const finalStatus = data.status || challenge.status; + // Status from Draft -> Active, indicating launch a Task + const isLaunchTask = + data.status === constants.challengeStatuses.Active && + challenge.status === constants.challengeStatuses.Draft; - // Only validate when launch/complete a task - const isLaunchCompleteTask = - _.get(challenge, "legacy.pureV5Task") && - (finalStatus === constants.challengeStatuses.Active || - finalStatus === constants.challengeStatuses.Completed); - if (!isLaunchCompleteTask) { - return; + // Status from Active -> Completed, indicating complete a Task + const isCompleteTask = + data.status === constants.challengeStatuses.Completed && + challenge.status === constants.challengeStatuses.Active; + + // When complete a Task, input data should have winners + if (isCompleteTask && (!data.winners || !data.winners.length)) { + throw new errors.BadRequestError("The winners is required to complete a Task"); } - // Whether task is assigned to current user - const assignedToCurrentUser = - _.filter( - challengeResources, - (r) => - r.roleId === config.SUBMITTER_ROLE_ID && - _.toString(r.memberId) === _.toString(currentUser.userId) - ).length > 0; - - if (assignedToCurrentUser) { - throw new errors.ForbiddenError( - `You are not allowed to ${ - finalStatus === constants.challengeStatuses.Active ? "lanuch" : "complete" - } task assigned to yourself. Please contact manager to operate.` - ); + if (!currentUser.isMachine && (isLaunchTask || isCompleteTask)) { + // Whether task is assigned to current user + const assignedToCurrentUser = + _.filter( + challengeResources, + (r) => + r.roleId === config.SUBMITTER_ROLE_ID && + _.toString(r.memberId) === _.toString(currentUser.userId) + ).length > 0; + + if (assignedToCurrentUser) { + throw new errors.ForbiddenError( + `You are not allowed to ${ + data.status === constants.challengeStatuses.Active ? "lanuch" : "complete" + } task assigned to yourself. Please contact manager to operate.` + ); + } } } @@ -1485,7 +1492,7 @@ async function updateChallenge(currentUser, challengeId, data) { const challengeResources = await helper.getChallengeResources(challengeId); await validateChallengeUpdateRequest(currentUser, challenge, data, challengeResources); - validateTaskSelfAssign(currentUser, challenge, data, challengeResources); + validateTask(currentUser, challenge, data, challengeResources); let sendActivationEmail = false; let sendSubmittedEmail = false; From 8ee4255fcfb2dd6da62bcefdd49fff31d315ea9c Mon Sep 17 00:00:00 2001 From: liuliquan Date: Thu, 5 Oct 2023 06:31:36 -0500 Subject: [PATCH 3/3] Task status change (#665) --- src/services/ChallengeService.js | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/services/ChallengeService.js b/src/services/ChallengeService.js index 2bf79f2f..4b1e9e2d 100644 --- a/src/services/ChallengeService.js +++ b/src/services/ChallengeService.js @@ -1423,15 +1423,15 @@ function validateTask(currentUser, challenge, data, challengeResources) { return; } - // Status from Draft -> Active, indicating launch a Task + // Status changed to Active, indicating launch a Task const isLaunchTask = data.status === constants.challengeStatuses.Active && - challenge.status === constants.challengeStatuses.Draft; + challenge.status !== constants.challengeStatuses.Active; - // Status from Active -> Completed, indicating complete a Task + // Status changed to Completed, indicating complete a Task const isCompleteTask = data.status === constants.challengeStatuses.Completed && - challenge.status === constants.challengeStatuses.Active; + challenge.status !== constants.challengeStatuses.Completed; // When complete a Task, input data should have winners if (isCompleteTask && (!data.winners || !data.winners.length)) {