Skip to content

fix(progresses): enforce discord membership for progress updates #2517

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iamitprakash merged 2 commits into from
Dec 11, 2025
Merged

fix(progresses): enforce discord membership for progress updates #2517

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f5fe2dc
fix(progresses): enforce discord membership for progress updates
Achintya-Chatterjee Dec 11, 2025
2d9ec27
fix(progresses): restrict updates to active discord members
Achintya-Chatterjee Dec 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion controllers/progresses.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ const { PROGRESS_DOCUMENT_RETRIEVAL_SUCCEEDED, PROGRESS_DOCUMENT_CREATED_SUCCEED
*/

const createProgress = async (req, res) => {
if (req.userData.roles.archived) {
if (req.userData.roles?.archived || req.userData.roles?.in_discord !== true) {
return res.boom.forbidden(UNAUTHORIZED_WRITE);
}

Expand Down
13 changes: 7 additions & 6 deletions test/integration/progressesTasks.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ const {
} = require("../fixtures/progress/progresses");

const userData = require("../fixtures/user/user")();
const withDiscordMembership = require("../utils/withDiscordMembership");
const taskData = require("../fixtures/tasks/tasks")();
const { INTERNAL_SERVER_ERROR_MESSAGE, UNAUTHORIZED_WRITE } = require("../../constants/progresses");
const cookieName = config.get("userToken.cookieName");
Expand All @@ -41,7 +42,7 @@ describe("Test Progress Updates API for Tasks", function () {
now: new Date(Date.UTC(2023, 4, 2, 0, 25)).getTime(), // UTC time equivalent to 5:55 AM IST
toFake: ["Date"],
});
userId = await addUser(userData[1]);
userId = await addUser(withDiscordMembership(userData[1]));
archivedUserId = await addUser(userData[5]);
archivedUserToken = authService.generateAuthToken({ userId: archivedUserId });
userToken = authService.generateAuthToken({ userId: userId });
Expand Down Expand Up @@ -196,8 +197,8 @@ describe("Test Progress Updates API for Tasks", function () {
let taskId3;

beforeEach(async function () {
userId1 = await addUser(userData[1]);
userId2 = await addUser(userData[2]);
userId1 = await addUser(withDiscordMembership(userData[1]));
userId2 = await addUser(withDiscordMembership(userData[2]));
const taskObject1 = await tasks.updateTask(taskData[0]);
taskId1 = taskObject1.taskId;
const taskObject2 = await tasks.updateTask(taskData[1]);
Expand Down Expand Up @@ -393,7 +394,7 @@ describe("Test Progress Updates API for Tasks", function () {
let taskId2;

beforeEach(async function () {
userId = await addUser(userData[1]);
userId = await addUser(withDiscordMembership(userData[1]));
taskObject1 = await tasks.updateTask(taskData[0]);
taskId1 = taskObject1.taskId;
taskObject2 = await tasks.updateTask(taskData[1]);
Expand Down Expand Up @@ -469,7 +470,7 @@ describe("Test Progress Updates API for Tasks", function () {
let anotherTaskId;

beforeEach(async function () {
userId = await addUser(userData[0]);
userId = await addUser(withDiscordMembership(userData[0]));
const taskObject = await tasks.updateTask(taskData[0]);
taskId = taskObject.taskId;
const anotherTaskObject = await tasks.updateTask(taskData[0]);
Expand Down Expand Up @@ -556,7 +557,7 @@ describe("Test Progress Updates API for Tasks", function () {

describe("GET /progresses (getPaginatedProgressDocument)", function () {
beforeEach(async function () {
const userId = await addUser(userData[1]);
const userId = await addUser(withDiscordMembership(userData[1]));
const taskObject1 = await tasks.updateTask(taskData[0]);
const taskId1 = taskObject1.taskId;
const progressData1 = stubbedModelTaskProgressData(userId, taskId1, 1683626400000, 1683590400000); // 2023-05-09
Expand Down
45 changes: 33 additions & 12 deletions test/integration/progressesUsers.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,8 @@ const {
} = require("../fixtures/progress/progresses");

const userData = require("../fixtures/user/user")();
const { INTERNAL_SERVER_ERROR_MESSAGE } = require("../../constants/progresses");
const withDiscordMembership = require("../utils/withDiscordMembership");
const { INTERNAL_SERVER_ERROR_MESSAGE, UNAUTHORIZED_WRITE } = require("../../constants/progresses");
const cookieName = config.get("userToken.cookieName");
const { expect } = chai;

Expand All @@ -37,9 +38,9 @@ describe("Test Progress Updates API for Users", function () {
now: new Date(Date.UTC(2023, 4, 2, 0, 25)).getTime(), // UTC time equivalent to 5:55 AM IST
toFake: ["Date"],
});
userId = await addUser(userData[1]);
userId = await addUser(withDiscordMembership(userData[1]));
userToken = authService.generateAuthToken({ userId: userId });
anotherUserId = await addUser(userData[8]);
anotherUserId = await addUser(withDiscordMembership(userData[8]));
anotherUserToken = authService.generateAuthToken({ userId: anotherUserId });
const progressData = stubbedModelProgressData(anotherUserId, 1682935200000, 1682899200000);
await firestore.collection("progresses").doc("anotherUserProgressDocument").set(progressData);
Expand Down Expand Up @@ -157,6 +158,26 @@ describe("Test Progress Updates API for Users", function () {
return done();
});
});

it("Returns forbidden error when user is not in discord", async function () {
const nonDiscordFixture = {
...userData[1],
username: `${(userData[1].username || "user").split("-")[0]}-non-discord`,
github_id: `${userData[1].github_id || "github"}-non-discord-${Date.now()}`,
roles: { ...(userData[1].roles || {}), archived: false, in_discord: false },
};
const nonDiscordUserId = await addUser(nonDiscordFixture);
const nonDiscordToken = authService.generateAuthToken({ userId: nonDiscordUserId });

const res = await chai
.request(app)
.post("/progresses")
.set("Cookie", `${cookieName}=${nonDiscordToken}`)
.send(standupProgressDay1);

expect(res).to.have.status(403);
expect(res.body.message).to.equal(UNAUTHORIZED_WRITE);
});
});

describe("Verify the GET progress records", function () {
Expand All @@ -165,9 +186,9 @@ describe("Test Progress Updates API for Users", function () {
let userId3;

beforeEach(async function () {
userId1 = await addUser(userData[0]);
userId2 = await addUser(userData[1]);
userId3 = await addUser(userData[2]);
userId1 = await addUser(withDiscordMembership(userData[0]));
userId2 = await addUser(withDiscordMembership(userData[1]));
userId3 = await addUser(withDiscordMembership(userData[2]));
const progressData1 = stubbedModelProgressData(userId1, 1683957764140, 1683936000000);
const progressData2 = stubbedModelProgressData(userId2, 1683957764140, 1683936000000);
await firestore.collection("progresses").doc("progressDoc1").set(progressData1);
Expand Down Expand Up @@ -270,8 +291,8 @@ describe("Test Progress Updates API for Users", function () {
let userId2;

beforeEach(async function () {
userId = await addUser(userData[1]);
userId2 = await addUser(userData[2]);
userId = await addUser(withDiscordMembership(userData[1]));
userId2 = await addUser(withDiscordMembership(userData[2]));
const progressData1 = stubbedModelProgressData(userId, 1683626400000, 1683590400000); // 2023-05-09
const progressData2 = stubbedModelProgressData(userId, 1683885600000, 1683849600000); // 2023-05-12
await firestore.collection("progresses").doc("progressDoc1").set(progressData1);
Expand Down Expand Up @@ -342,8 +363,8 @@ describe("Test Progress Updates API for Users", function () {
let anotherUserId;

beforeEach(async function () {
userId = await addUser(userData[0]);
anotherUserId = await addUser(userData[1]);
userId = await addUser(withDiscordMembership(userData[0]));
anotherUserId = await addUser(withDiscordMembership(userData[1]));
const progressData = stubbedModelProgressData(userId, 1683072000000, 1682985600000);
await firestore.collection("progresses").doc("progressDoc").set(progressData);
});
Expand Down Expand Up @@ -425,8 +446,8 @@ describe("Test Progress Updates API for Users", function () {

describe("GET /progresses (getPaginatedProgressDocument)", function () {
beforeEach(async function () {
const userId1 = await addUser(userData[0]);
const userId2 = await addUser(userData[1]);
const userId1 = await addUser(withDiscordMembership(userData[0]));
const userId2 = await addUser(withDiscordMembership(userData[1]));
const progressData1 = stubbedModelProgressData(userId1, 1683957764140, 1683936000000);
const progressData2 = stubbedModelProgressData(userId2, 1683957764140, 1683936000000);
await firestore.collection("progresses").doc("progressDoc1").set(progressData1);
Expand Down
12 changes: 12 additions & 0 deletions test/utils/withDiscordMembership.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
/**
* Ensures the provided user fixture represents an active Discord member.
*
* @param {object} user - Original user fixture.
* @returns {object} Updated fixture with archived: false and in_discord: true.
*/
const withDiscordMembership = (user = {}) => ({
...user,
roles: { ...(user.roles || {}), archived: false, in_discord: true },
});

module.exports = withDiscordMembership;
Loading