UIORGS-424 Accurately handle user permissions for banking information operations (#609)

CHANGELOG.md

@@ -15,6 +15,7 @@
 * Suppress banking information management for unauthorized user. Refs UIORGS-418.
 * Add validation for `Day` field in `Monthly` scheduler for export method. Refs UIORGS-417.
 * Support `data-export-spring` interface `v2.0`. Refs UXPROD-3903.
+* Accurately handle user permissions for banking information operations. Refs UIORGS-424.
 
 ## [5.0.0](https://github.com/folio-org/ui-organizations/tree/v5.0.0) (2023-10-12)
 [Full Changelog](https://github.com/folio-org/ui-organizations/compare/v4.0.0...v5.0.0)

src/Organizations/useBankingInformationManager.js

@@ -10,13 +10,21 @@ import {
 } from '../common/hooks';
 import { getArrayItemsChanges } from '../common/utils';
 
-const executeSequentially = (fn, arr) => arr.reduce((acc, curr) => {
- return acc.then(() => fn({ bankingInformation: curr }));
-}, Promise.resolve());
+const executeSequentially = (fn, arr, hasPerm) => {
+ if (!hasPerm) return Promise.resolve();
 
-const executeParallel = (fn, arr) => chunk(arr, 5).reduce((acc, chunked) => {
- return acc.then(() => Promise.all(chunked.map((bankingInformation) => fn({ bankingInformation }))));
-}, Promise.resolve());
+ return arr.reduce((acc, curr) => {
+ return acc.then(() => fn({ bankingInformation: curr }));
+ }, Promise.resolve());
+};
+
+const executeParallel = (fn, arr, hasPerm) => {
+ if (!hasPerm) return Promise.resolve();
+
+ return chunk(arr, 5).reduce((acc, chunked) => {
+ return acc.then(() => Promise.all(chunked.map((bankingInformation) => fn({ bankingInformation }))));
+ }, Promise.resolve());
+};
 
 export const useBankingInformationManager = () => {
  const stripes = useStripes();
@@ -36,13 +44,7 @@ export const useBankingInformationManager = () => {
  bankingInformation,
  organization,
  }) => {
- const isOperationRestricted = !(
- organization.isVendor
- && isBankingInformationEnabled
- && stripes.hasPerm('organizations.banking-information.item.post')
- && stripes.hasPerm('organizations.banking-information.item.put')
- && stripes.hasPerm('organizations.banking-information.item.delete')
- );
+ const isOperationRestricted = !(organization.isVendor && isBankingInformationEnabled);
 
  if (isOperationRestricted) return Promise.resolve();
 
@@ -53,12 +55,13 @@ export const useBankingInformationManager = () => {
  } = getArrayItemsChanges(initBankingInformation, bankingInformation);
 
  return Promise.all([
- executeSequentially(createBankingInformation, created.map((item) => ({
- organizationId: organization.id,
- ...item,
- }))),
- executeParallel(updateBankingInformation, updated),
- executeParallel(deleteBankingInformation, deleted),
+ executeSequentially(
+ createBankingInformation,
+ created.map((item) => ({ organizationId: organization.id, ...item })),
+ stripes.hasPerm('organizations.banking-information.item.post'),
+ ),
+ executeParallel(updateBankingInformation, updated, stripes.hasPerm('organizations.banking-information.item.put')),
+ executeParallel(deleteBankingInformation, deleted, stripes.hasPerm('organizations.banking-information.item.delete')),
  ]).catch(() => {
  showCallout({
  type: 'error',

src/Organizations/useBankingInformationManager.test.js

@@ -1,4 +1,5 @@
 import { renderHook } from '@folio/jest-config-stripes/testing-library/react';
+import { useStripes } from '@folio/stripes/core';
 
 import { organization } from 'fixtures';
 import {
@@ -13,6 +14,11 @@ const mutationsMock = {
  deleteBankingInformation: jest.fn(),
 };
 
+jest.mock('@folio/stripes/core', () => ({
+ ...jest.requireActual('@folio/stripes/core'),
+ useStripes: jest.fn(),
+}));
+
 jest.mock('../common/hooks', () => ({
  ...jest.requireActual('../common/hooks'),
  useBankingInformationMutation: jest.fn(),
@@ -29,7 +35,15 @@ const bankingInformation = [
  { id: 3, bankName: 'Bank name 3' },
 ];
 
-describe('useBankingAccountTypes', () => {
+const hasPermFactory = (permsMap) => (perm) => {
+ return permsMap ? permsMap[perm] : true;
+};
+
+const stripesStub = {
+ hasPerm: hasPermFactory(),
+};
+
+describe('useBankingInformationManager', () => {
  beforeEach(() => {
  Object
  .values(mutationsMock)
@@ -40,6 +54,9 @@ describe('useBankingAccountTypes', () => {
  useBankingInformationSettings
  .mockClear()
  .mockReturnValue({ enabled: true });
+ useStripes
+ .mockClear()
+ .mockReturnValue(stripesStub);
  });
 
  it('should handle banking information fields change', async () => {
@@ -100,4 +117,79 @@ describe('useBankingAccountTypes', () => {
  expect(mutationsMock.deleteBankingInformation).not.toHaveBeenCalled();
  expect(mutationsMock.updateBankingInformation).not.toHaveBeenCalled();
  });
+
+ describe('Permissions handling', () => {
+ it('edit banking information item', async () => {
+ useStripes.mockReturnValue({ hasPerm: hasPermFactory({ 'organizations.banking-information.item.put': true }) });
+
+ const { result } = renderHook(() => useBankingInformationManager());
+ const { manageBankingInformation } = result.current;
+
+ await manageBankingInformation({
+ initBankingInformation,
+ bankingInformation,
+ organization,
+ });
+
+ expect(mutationsMock.createBankingInformation).not.toHaveBeenCalled();
+ expect(mutationsMock.deleteBankingInformation).not.toHaveBeenCalled();
+ expect(mutationsMock.updateBankingInformation).toHaveBeenCalled();
+ });
+
+ it('create banking information item', async () => {
+ useStripes.mockReturnValue({ hasPerm: hasPermFactory({ 'organizations.banking-information.item.post': true }) });
+
+ const { result } = renderHook(() => useBankingInformationManager());
+ const { manageBankingInformation } = result.current;
+
+ await manageBankingInformation({
+ initBankingInformation,
+ bankingInformation,
+ organization,
+ });
+
+ expect(mutationsMock.createBankingInformation).toHaveBeenCalled();
+ expect(mutationsMock.deleteBankingInformation).not.toHaveBeenCalled();
+ expect(mutationsMock.updateBankingInformation).not.toHaveBeenCalled();
+ });
+
+ it('delete banking information item', async () => {
+ useStripes.mockReturnValue({ hasPerm: hasPermFactory({ 'organizations.banking-information.item.delete': true }) });
+
+ const { result } = renderHook(() => useBankingInformationManager());
+ const { manageBankingInformation } = result.current;
+
+ await manageBankingInformation({
+ initBankingInformation,
+ bankingInformation,
+ organization,
+ });
+
+ expect(mutationsMock.createBankingInformation).not.toHaveBeenCalled();
+ expect(mutationsMock.deleteBankingInformation).toHaveBeenCalled();
+ expect(mutationsMock.updateBankingInformation).not.toHaveBeenCalled();
+ });
+
+ it('create and edit banking information item', async () => {
+ const permsMap = {
+ 'organizations.banking-information.item.post': true,
+ 'organizations.banking-information.item.put': true,
+ };
+
+ useStripes.mockReturnValue({ hasPerm: hasPermFactory(permsMap) });
+
+ const { result } = renderHook(() => useBankingInformationManager());
+ const { manageBankingInformation } = result.current;
+
+ await manageBankingInformation({
+ initBankingInformation,
+ bankingInformation,
+ organization,
+ });
+
+ expect(mutationsMock.createBankingInformation).toHaveBeenCalled();
+ expect(mutationsMock.deleteBankingInformation).not.toHaveBeenCalled();
+ expect(mutationsMock.updateBankingInformation).toHaveBeenCalled();
+ });
+ });
 });