Restrict user roles, tester flag and contact fields

services/api/src/models/definitions/user.json

@@ -16,6 +16,12 @@
       "writeAccess": [
         "admin",
         "superAdmin"
+      ],
+      "readAccess": [
+        "self",
+        "viewer",
+        "admin",
+        "superAdmin"
       ]
     },
     "emailVerified": {
@@ -30,6 +36,12 @@
       "writeAccess": [
         "admin",
         "superAdmin"
+      ],
+      "readAccess": [
+        "self",
+        "viewer",
+        "admin",
+        "superAdmin"
       ]
     },
     "phoneVerified": {
@@ -71,8 +83,19 @@
         }
       }
     ],
-    "roles": [
-      {
+    "roles": {
+      "type": "Array",
+      "readAccess": [
+        "self",
+        "viewer",
+        "admin",
+        "superAdmin"
+      ],
+      "writeAccess": [
+        "admin",
+        "superAdmin"
+      ],
+      "attributes": {
         "role": {
           "type": "String",
           "required": true
@@ -90,10 +113,20 @@
           "ref": "Organization"
         }
       }
-    ],
+    },
     "isTester": {
       "type": "Boolean",
-      "default": false
+      "default": false,
+      "readAccess": [
+        "self",
+        "viewer",
+        "admin",
+        "superAdmin"
+      ],
+      "writeAccess": [
+        "admin",
+        "superAdmin"
+      ]
     },
     "$readOnly": {
       "type": "Scope",

services/api/src/routes/uploads-local.test.js

@@ -34,6 +34,18 @@ describe('/1/uploads', () => {
       expect(response.body.data.filename).toBe('test.png');
     });
 
+    it('should not expose owner contact details when included', async () => {
+      const owner = await createUser({ phone: '+12125551234' });
+      const upload = await createUpload({ owner });
+      const response = await request('GET', `/1/uploads/${upload.id}`, { include: 'owner' }, {});
+      expect(response).toHaveStatus(200);
+      const { owner: data } = response.body.data;
+      expect(data.firstName).toBe(owner.firstName);
+      expect(data.email).toBeUndefined();
+      expect(data.phone).toBeUndefined();
+      expect(data.roles).toBeUndefined();
+    });
+
     it('should be able to access private upload as admin', async () => {
       const admin = await createAdmin();
       const upload = await createUpload({

services/api/src/routes/users.test.js

@@ -77,6 +77,29 @@ describe('/1/users', () => {
       user = await User.findById(user._id);
       expect(user.deviceToken).toBe('new-token');
     });
+
+    it('should not allow changing own roles', async () => {
+      let user = await createUser();
+      const response = await request(
+        'PATCH',
+        '/1/users/me',
+        {
+          roles: [{ role: 'superAdmin', scope: 'global' }],
+        },
+        { user },
+      );
+      expect(response).toHaveStatus(401);
+      user = await User.findById(user._id);
+      expect(user.roles).toHaveLength(0);
+    });
+
+    it('should not allow setting tester flag', async () => {
+      let user = await createUser();
+      const response = await request('PATCH', '/1/users/me', { isTester: true }, { user });
+      expect(response).toHaveStatus(401);
+      user = await User.findById(user._id);
+      expect(user.isTester).toBe(false);
+    });
   });
 
   describe('POST /', () => {