11526256712

Committed 25 Oct 2024 10:27PM UTC coverage: 31.365% (-0.1%) from 31.473%

Build # 11526256712

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #9771 from ForumMagnum/jargonBot

JargonBot (somewhat beta-gated)

Run Details

5033 of 42268 branches covered (11.91%)

Branch coverage included in aggregate %.

211 of 620 new or added lines in 47 files covered. (34.03%)

8 existing lines in 7 files now uncovered.

29619 of 68212 relevant lines covered (43.42%)

174.04 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

65.82

/packages/lesswrong/lib/collections/revisions/collection.ts

import schema from './schema';
import { createCollection, getCollection } from '../../vulcan-lib';
import { addUniversalFields, getDefaultResolvers } from '../../collectionUtils'
import { userCanDo, membersGroup } from '../../vulcan-users/permissions';
import { extractVersionsFromSemver } from '../../editor/utils';
import { makeVoteable } from '../../make_voteable';
import { getCollaborativeEditorAccess, accessLevelCan } from '../posts/collabEditingPermissions';
import { postCheckAccess } from '../posts/checkAccess';

export const PLAINTEXT_HTML_TRUNCATION_LENGTH = 4000
export const PLAINTEXT_DESCRIPTION_LENGTH = 2000

export const Revisions: RevisionsCollection = createCollection({
  collectionName: 'Revisions',
  typeName: 'Revision',
  schema,
  resolvers: getDefaultResolvers('Revisions'),
  // No mutations (revisions are insert-only immutable, and are created as a
  // byproduct of creating/editing documents in other collections).
  // mutations: getDefaultMutations('Revisions'),
});
addUniversalFields({collection: Revisions})

// Note, since we want to make sure checkAccess is a performant function, we can only check the 
// userId of the current revision for ownership. If the userId of the document the revision is on,
// and the revision itself differ (e.g. because an admin has made the edit, or a coauthor), then
// we will hide those revisions unless they are marked as post-1.0.0 releases. This is not ideal, but
// seems acceptable
Revisions.checkAccess = async (user: DbUser|null, revision: DbRevision, context: ResolverContext|null): Promise<boolean> => {
  if (!revision) return false
  if ((user && user._id) === revision.userId) return true
  if (userCanDo(user, 'posts.view.all')) return true
  
  // not sure why some revisions have no collectionName,
  // but this will cause an error below so just exclude them
  if (!revision.collectionName) return false

  const collectionName = revision.collectionName;
  if (collectionName === "CurationNotices") return false

  // Get the document that this revision is a field of, and check for access to
  // it. This is necessary for correctly handling things like posts' draft
  // status and sharing settings.
  //
  // We might or might not have a ResolverContext (because some places, like
  // email-sending, don't have one). If we do, use its loader; in the typical
  // case, this will hit in the cache 100% of the time. If we don't have a
  // ResolverContext, use a findOne query; this is slow, but doesn't come up
  // in any contexts where speed matters.
  const { major: majorVersion } = extractVersionsFromSemver(revision.version)
  const collection: CollectionBase<CollectionNameString> = getCollection(collectionName);
  const documentId = revision.documentId;

  if (!documentId) {
    return false
  }
  
  const document = context
    ? await context.loaders[collectionName].load(documentId)
    : await collection.findOne(documentId);

  // This shouldn't happen, but `collection.findOne` has a type signature that returns null, and technically we don't enforce data consistency such that it's strictly impossible
  if (!document) {
    return false;
  }
  
  if (revision.collectionName === "Posts") {
    const collabEditorAccess = await getCollaborativeEditorAccess({
      formType: "edit",
      post: document as DbPost,
      user: user,
      useAdminPowers: true,
      context
    });
    if (accessLevelCan(collabEditorAccess, "read")) {
      return true;
    }
  }

  // JargonTerms are often created by an admin bot account, and by default would not be visible to post authors
  // so we need to check read access to the post itself
  if (collectionName === "JargonTerms") {
    const postId = (document as DbJargonTerm).postId;
    const post = context
      ? await context.loaders.Posts.load(postId)
      // Avoid import cycle
      : await getCollection("Posts").findOne(postId);

    if (!post) {
      return false;
    }

    return await postCheckAccess(user, post, context);
  }
  
  
  if (revision.draft) {
    return false;
  }
  
  // Everyone who can see the post can get access to non-draft revisions
  if (!document || !await collection.checkAccess(user, document, context)) {
    return false;
  }
  
  return true;
}

export interface ChangeMetrics {
  added: number
  removed: number
}

makeVoteable(Revisions, {
  timeDecayScoresCronjob: false,
});

membersGroup.can([
  'revisions.smallDownvote',
  'revisions.bigDownvote',
  'revisions.smallUpvote',
  'revisions.bigUpvote',
]);

export default Revisions;

1	import schema from './schema';	1,880✔
2	import { createCollection, getCollection } from '../../vulcan-lib';	26✔
3	import { addUniversalFields, getDefaultResolvers } from '../../collectionUtils'	26✔
4	import { userCanDo, membersGroup } from '../../vulcan-users/permissions';	26✔
5	import { extractVersionsFromSemver } from '../../editor/utils';	26✔
6	import { makeVoteable } from '../../make_voteable';	26✔
7	import { getCollaborativeEditorAccess, accessLevelCan } from '../posts/collabEditingPermissions';	26✔
8	import { postCheckAccess } from '../posts/checkAccess';	26✔
9
10	export const PLAINTEXT_HTML_TRUNCATION_LENGTH = 4000	26✔
11	export const PLAINTEXT_DESCRIPTION_LENGTH = 2000	26✔
12
13	export const Revisions: RevisionsCollection = createCollection({	26✔
14	collectionName: 'Revisions',
15	typeName: 'Revision',
16	schema,
17	resolvers: getDefaultResolvers('Revisions'),
18	// No mutations (revisions are insert-only immutable, and are created as a
19	// byproduct of creating/editing documents in other collections).
20	// mutations: getDefaultMutations('Revisions'),
21	});	26✔
22	addUniversalFields({collection: Revisions})
23
24	// Note, since we want to make sure checkAccess is a performant function, we can only check the
25	// userId of the current revision for ownership. If the userId of the document the revision is on,
26	// and the revision itself differ (e.g. because an admin has made the edit, or a coauthor), then
27	// we will hide those revisions unless they are marked as post-1.0.0 releases. This is not ideal, but
28	// seems acceptable
29	Revisions.checkAccess = async (user: DbUser\|null, revision: DbRevision, context: ResolverContext\|null): Promise<boolean> => {	26✔
30	if (!revision) return false	26!
31	if ((user && user._id) === revision.userId) return true	26!
32	if (userCanDo(user, 'posts.view.all')) return true	26!
33
34	// not sure why some revisions have no collectionName,
35	// but this will cause an error below so just exclude them
36	if (!revision.collectionName) return false	26!
37
38	const collectionName = revision.collectionName;	26✔
39	if (collectionName === "CurationNotices") return false	26!
40
41	// Get the document that this revision is a field of, and check for access to
42	// it. This is necessary for correctly handling things like posts' draft
43	// status and sharing settings.
44	//
45	// We might or might not have a ResolverContext (because some places, like
46	// email-sending, don't have one). If we do, use its loader; in the typical
47	// case, this will hit in the cache 100% of the time. If we don't have a
48	// ResolverContext, use a findOne query; this is slow, but doesn't come up
49	// in any contexts where speed matters.
50	const { major: majorVersion } = extractVersionsFromSemver(revision.version)	26✔
51	const collection: CollectionBase<CollectionNameString> = getCollection(collectionName);	26✔
52	const documentId = revision.documentId;	26✔
53
54	if (!documentId) {	26!
55	return false	×
56	}
57
58	const document = context	26✔
59	? await context.loaders[collectionName].load(documentId)	26!
60	: await collection.findOne(documentId);
61
62	// This shouldn't happen, but `collection.findOne` has a type signature that returns null, and technically we don't enforce data consistency such that it's strictly impossible
63	if (!document) {	26!
64	return false;	×
65	}
66
67	if (revision.collectionName === "Posts") {	26!
68	const collabEditorAccess = await getCollaborativeEditorAccess({	26✔
69	formType: "edit",
70	post: document as DbPost,
71	user: user,
72	useAdminPowers: true,
73	context
74	});
75	if (accessLevelCan(collabEditorAccess, "read")) {	26!
76	return true;	×
77	}
78	}
79
80	// JargonTerms are often created by an admin bot account, and by default would not be visible to post authors
81	// so we need to check read access to the post itself
82	if (collectionName === "JargonTerms") {	26!
NEW 83	const postId = (document as DbJargonTerm).postId;	×
NEW 84	const post = context	×
85	? await context.loaders.Posts.load(postId)	×
86	// Avoid import cycle
87	: await getCollection("Posts").findOne(postId);
88
NEW 89	if (!post) {	×
NEW 90	return false;	×
91	}
92
NEW 93	return await postCheckAccess(user, post, context);	×
94	}
95
96
97	if (revision.draft) {	26!
98	return false;	×
99	}
100
101	// Everyone who can see the post can get access to non-draft revisions
102	if (!document \|\| !await collection.checkAccess(user, document, context)) {	26!
103	return false;	×
104	}
105
106	return true;	26✔
107	}	26✔
108
109	export interface ChangeMetrics {
110	added: number
111	removed: number
112	}
113
114	makeVoteable(Revisions, {
115	timeDecayScoresCronjob: false,
116	});
117
118	membersGroup.can([	26✔
119	'revisions.smallDownvote',
120	'revisions.bigDownvote',
121	'revisions.smallUpvote',
122	'revisions.bigUpvote',
123	]);
124
125	export default Revisions;	26✔

ForumMagnum / ForumMagnum / 11526256712

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous