diff --git a/_scripts/db/dumps/domifa_test.postgres.custom.gz b/_scripts/db/dumps/domifa_test.postgres.custom.gz index c3dbdd74dd..2c2fc547cf 100644 Binary files a/_scripts/db/dumps/domifa_test.postgres.custom.gz and b/_scripts/db/dumps/domifa_test.postgres.custom.gz differ diff --git a/_scripts/db/dumps/domifa_test.postgres.restore-data-only.sql b/_scripts/db/dumps/domifa_test.postgres.restore-data-only.sql index d7a27342f4..145d8e7ec0 100644 --- a/_scripts/db/dumps/domifa_test.postgres.restore-data-only.sql +++ b/_scripts/db/dumps/domifa_test.postgres.restore-data-only.sql @@ -187,7 +187,6 @@ cc452c79-3669-4dc6-85fa-564631a3d48b 2024-06-10 23:41:59.530897+02 2024-10-29 23 -- COPY public.public_stats_cache (uuid, "createdAt", "updatedAt", version, key, stats) FROM stdin; -127f1519-0037-4715-96b6-2c9e9235474e 2024-10-30 22:33:21.504391+01 2024-10-30 22:33:21.504391+01 1 public-stats {"actifs": 11, "usersCount": 10, "usagersCount": 20, "courrierInCount": 5, "structuresCount": 5, "courrierOutCount": 2, "usagersCountByMonth": [{"name": "oct.", "value": 0}, {"name": "nov.", "value": 0}, {"name": "déc.", "value": 0}, {"name": "janv.", "value": 0}, {"name": "févr.", "value": 0}, {"name": "mars", "value": 0}, {"name": "avr.", "value": 0}, {"name": "mai", "value": 0}, {"name": "juin", "value": 0}, {"name": "juil.", "value": 0}, {"name": "août", "value": 0}, {"name": "sept.", "value": 0}], "structuresCountByRegion": [{"count": 2, "region": "52"}, {"count": 1, "region": "03"}, {"count": 1, "region": "11"}, {"count": 1, "region": "75"}], "interactionsCountByMonth": [{"name": "oct.", "value": 0}, {"name": "nov.", "value": 0}, {"name": "déc.", "value": 0}, {"name": "janv.", "value": 0}, {"name": "févr.", "value": 0}, {"name": "mars", "value": 0}, {"name": "avr.", "value": 0}, {"name": "mai", "value": 0}, {"name": "juin", "value": 0}, {"name": "juil.", "value": 0}, {"name": "août", "value": 0}, {"name": "sept.", "value": 0}], "structuresCountByTypeMap": {"asso": 2, "ccas": 1, "cias": 2}} \. diff --git a/_scripts/db/dumps/domifa_test.postgres.truncate-restore-data-only.sql b/_scripts/db/dumps/domifa_test.postgres.truncate-restore-data-only.sql index f3c8defe4a..a97bee2d84 100644 --- a/_scripts/db/dumps/domifa_test.postgres.truncate-restore-data-only.sql +++ b/_scripts/db/dumps/domifa_test.postgres.truncate-restore-data-only.sql @@ -227,7 +227,6 @@ cc452c79-3669-4dc6-85fa-564631a3d48b 2024-06-10 23:41:59.530897+02 2024-10-29 23 -- COPY public.public_stats_cache (uuid, "createdAt", "updatedAt", version, key, stats) FROM stdin; -127f1519-0037-4715-96b6-2c9e9235474e 2024-10-30 22:33:21.504391+01 2024-10-30 22:33:21.504391+01 1 public-stats {"actifs": 11, "usersCount": 10, "usagersCount": 20, "courrierInCount": 5, "structuresCount": 5, "courrierOutCount": 2, "usagersCountByMonth": [{"name": "oct.", "value": 0}, {"name": "nov.", "value": 0}, {"name": "déc.", "value": 0}, {"name": "janv.", "value": 0}, {"name": "févr.", "value": 0}, {"name": "mars", "value": 0}, {"name": "avr.", "value": 0}, {"name": "mai", "value": 0}, {"name": "juin", "value": 0}, {"name": "juil.", "value": 0}, {"name": "août", "value": 0}, {"name": "sept.", "value": 0}], "structuresCountByRegion": [{"count": 2, "region": "52"}, {"count": 1, "region": "03"}, {"count": 1, "region": "11"}, {"count": 1, "region": "75"}], "interactionsCountByMonth": [{"name": "oct.", "value": 0}, {"name": "nov.", "value": 0}, {"name": "déc.", "value": 0}, {"name": "janv.", "value": 0}, {"name": "févr.", "value": 0}, {"name": "mars", "value": 0}, {"name": "avr.", "value": 0}, {"name": "mai", "value": 0}, {"name": "juin", "value": 0}, {"name": "juil.", "value": 0}, {"name": "août", "value": 0}, {"name": "sept.", "value": 0}], "structuresCountByTypeMap": {"asso": 2, "ccas": 1, "cias": 2}} \. diff --git a/packages/backend/src/auth/guards/usager-doc-access.guard.ts b/packages/backend/src/auth/guards/usager-doc-access.guard.ts index 41201614f7..6a06815394 100644 --- a/packages/backend/src/auth/guards/usager-doc-access.guard.ts +++ b/packages/backend/src/auth/guards/usager-doc-access.guard.ts @@ -17,11 +17,7 @@ export class UsagerDocAccessGuard implements CanActivate { const request = context.switchToHttp().getRequest(); const user = request?.user as UserStructureAuthenticated; - if ( - user?.role === "facteur" || - !isUUID(request.params.docUuid) || - !isNumber(user?.structureId) - ) { + if (!isUUID(request.params.docUuid) || !isNumber(user?.structureId)) { appLogger.error("[UsagerDocAccessGuard] invalid docUuid or structureId", { sentry: true, context: { @@ -34,6 +30,10 @@ export class UsagerDocAccessGuard implements CanActivate { throw new HttpException("USAGER_DOC_NOT_FOUND", HttpStatus.BAD_REQUEST); } + if (user?.role === "facteur") { + throw new HttpException("CANNOT_GET_DOC", HttpStatus.UNAUTHORIZED); + } + const docUuid = request.params.docUuid; try { diff --git a/packages/backend/src/usagers/controllers/security-tests/usager-docs.controller.security-tests.ts b/packages/backend/src/usagers/controllers/security-tests/usager-docs.controller.security-tests.ts index c48bbc3be8..32c3ecea97 100644 --- a/packages/backend/src/usagers/controllers/security-tests/usager-docs.controller.security-tests.ts +++ b/packages/backend/src/usagers/controllers/security-tests/usager-docs.controller.security-tests.ts @@ -43,13 +43,14 @@ export const UsagerDocsControllerSecurityTests: AppTestHttpClientSecurityTestDef context.user, { roles: ["simple", "responsable", "admin"], + validStructureIds: [1], validExpectedResponseStatus: HttpStatus.OK, // filesystem document does not exists in tests } ), }), }, { - label: `${CONTROLLER}.patchDocument`, + label: `${CONTROLLER}.patchDocument (wrong payload)`, query: async (context: AppTestContext) => ({ response: await AppTestHttpClient.patch( "/docs/7/542a0da1-ea1c-48ab-8026-67a4248b1c47", @@ -66,12 +67,16 @@ export const UsagerDocsControllerSecurityTests: AppTestHttpClientSecurityTestDef { roles: ["simple", "responsable", "admin"], validExpectedResponseStatus: HttpStatus.BAD_REQUEST, + invalidStructureIdExpectedResponseStatus: HttpStatus.BAD_REQUEST, + + allowSuperAdminDomifa: false, + validStructureIds: [1], } ), }), }, { - label: `${CONTROLLER}.patchDocument`, + label: `${CONTROLLER}.patchDocument (Good payload)`, query: async (context: AppTestContext) => ({ response: await AppTestHttpClient.patch( "/docs/7/542a0da1-ea1c-48ab-8026-67a4248b1c47", @@ -87,16 +92,19 @@ export const UsagerDocsControllerSecurityTests: AppTestHttpClientSecurityTestDef context.user, { roles: ["simple", "responsable", "admin"], - validExpectedResponseStatus: HttpStatus.BAD_REQUEST, + validExpectedResponseStatus: HttpStatus.OK, + invalidStructureIdExpectedResponseStatus: HttpStatus.BAD_REQUEST, + allowSuperAdminDomifa: false, + validStructureIds: [1], } ), }), }, { - label: `${CONTROLLER}.patchDocument`, + label: `${CONTROLLER}.patchDocument (wrong id)`, query: async (context: AppTestContext) => ({ response: await AppTestHttpClient.patch( - "/docs/7/542a0da1-ea1c-48ab-8026-67a4248b1c47", + "/docs/xxxxxxx/542a0da1-ea1c-48ab-8026-67a4248b1c47", { context, body: { @@ -106,10 +114,13 @@ export const UsagerDocsControllerSecurityTests: AppTestHttpClientSecurityTestDef } ), expectedStatus: expectedResponseStatusBuilder.allowStructureOnly( - { ...context.user, structureRole: "facteur" }, + context.user, { + allowSuperAdminDomifa: false, roles: ["simple", "responsable", "admin"], validExpectedResponseStatus: HttpStatus.BAD_REQUEST, + invalidStructureIdExpectedResponseStatus: HttpStatus.BAD_REQUEST, + validStructureIds: [1], } ), }), diff --git a/packages/frontend/src/app/modules/structure-stats/components/structure-stats/structure-stats.component.html b/packages/frontend/src/app/modules/structure-stats/components/structure-stats/structure-stats.component.html index 64b324388c..9e74339dc4 100644 --- a/packages/frontend/src/app/modules/structure-stats/components/structure-stats/structure-stats.component.html +++ b/packages/frontend/src/app/modules/structure-stats/components/structure-stats/structure-stats.component.html @@ -4,6 +4,9 @@ class="px-0 py-2 mx-0 d-md-flex justify-content-between align-items-center" >

Rapport d'activité et statistiques

+
+ {{ me?.structure.nom }} +