From eae19ca33d9d19851cc3d6337c31bff3927ec785 Mon Sep 17 00:00:00 2001
From: aonomike <aonomike@gmail.com>
Date: Thu, 3 Oct 2019 14:31:39 +0300
Subject: [PATCH 1/5] Display user email for administrators

---
 webapp/pages/admin/users.vue | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/webapp/pages/admin/users.vue b/webapp/pages/admin/users.vue
index e58b413aa..8797d6a22 100644
--- a/webapp/pages/admin/users.vue
+++ b/webapp/pages/admin/users.vue
@@ -33,6 +33,16 @@
             <b>{{ scope.row.name | truncate(20) }}</b>
           </nuxt-link>
         </template>
+        <template slot="email" slot-scope="scope">
+          <nuxt-link
+            :to="{
+              name: 'profile-id-slug',
+              params: { id: scope.row.id, slug: scope.row.slug },
+            }"
+          >
+            <b>{{ scope.row.email }}</b>
+          </nuxt-link>
+        </template>
         <template slot="slug" slot-scope="scope">
           <nuxt-link
             :to="{
@@ -128,6 +138,7 @@ export default {
               id
               name
               slug
+              email
               role
               createdAt
               contributionsCount

From 64b9ca7f432ec02acef71ef45d57c586e6645c8d Mon Sep 17 00:00:00 2001
From: aonomike <aonomike@gmail.com>
Date: Fri, 4 Oct 2019 16:55:53 +0300
Subject: [PATCH 2/5] Implement dislplay email for admins

---
 webapp/locales/de.json       |  1 +
 webapp/locales/en.json       |  1 +
 webapp/pages/admin/users.vue | 10 +++-------
 3 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/webapp/locales/de.json b/webapp/locales/de.json
index 7b7bc3ec1..751674c22 100644
--- a/webapp/locales/de.json
+++ b/webapp/locales/de.json
@@ -259,6 +259,7 @@
         "columns": {
           "number": "Nr.",
           "name": "Name",
+          "email": "E-mail",
           "slug": "Slug",
           "role": "Rolle",
           "createdAt": "Erstellt am"
diff --git a/webapp/locales/en.json b/webapp/locales/en.json
index 8204d4741..2b5a164a1 100644
--- a/webapp/locales/en.json
+++ b/webapp/locales/en.json
@@ -260,6 +260,7 @@
         "columns": {
           "number": "No.",
           "name": "Name",
+          "email": "E-mail",
           "slug": "Slug",
           "role": "Role",
           "createdAt": "Created at"
diff --git a/webapp/pages/admin/users.vue b/webapp/pages/admin/users.vue
index 8797d6a22..d5590f474 100644
--- a/webapp/pages/admin/users.vue
+++ b/webapp/pages/admin/users.vue
@@ -34,14 +34,9 @@
           </nuxt-link>
         </template>
         <template slot="email" slot-scope="scope">
-          <nuxt-link
-            :to="{
-              name: 'profile-id-slug',
-              params: { id: scope.row.id, slug: scope.row.slug },
-            }"
-          >
+          <a :href="`mailto:${scope.row.email}`">
             <b>{{ scope.row.email }}</b>
-          </nuxt-link>
+          </a>
         </template>
         <template slot="slug" slot-scope="scope">
           <nuxt-link
@@ -102,6 +97,7 @@ export default {
       return {
         index: this.$t('admin.users.table.columns.number'),
         name: this.$t('admin.users.table.columns.name'),
+        email: this.$t('admin.users.table.columns.email'),
         slug: this.$t('admin.users.table.columns.slug'),
         createdAt: this.$t('admin.users.table.columns.createdAt'),
         contributionsCount: {

From 45a6016427fc34d9ad9aa024cbf4b1c50926ee83 Mon Sep 17 00:00:00 2001
From: aonomike <aonomike@gmail.com>
Date: Sat, 5 Oct 2019 16:00:29 +0300
Subject: [PATCH 3/5] Allow admin to receive user email back

---
 backend/src/middleware/permissionsMiddleware.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/src/middleware/permissionsMiddleware.js b/backend/src/middleware/permissionsMiddleware.js
index ce98090ad..e8816d2df 100644
--- a/backend/src/middleware/permissionsMiddleware.js
+++ b/backend/src/middleware/permissionsMiddleware.js
@@ -172,7 +172,7 @@ const permissions = shield(
       markAsRead: isAuthenticated,
     },
     User: {
-      email: isMyOwn,
+      email: or(isMyOwn, isAdmin),
     },
   },
   {

From 14c44877b75483ae43db038d830b8604e03164e4 Mon Sep 17 00:00:00 2001
From: aonomike <aonomike@gmail.com>
Date: Sat, 5 Oct 2019 16:06:19 +0300
Subject: [PATCH 4/5] Refactor the unauthenticated path test

---
 .../middleware/permissionsMiddleware.spec.js  | 88 ++++++++++++-------
 1 file changed, 54 insertions(+), 34 deletions(-)

diff --git a/backend/src/middleware/permissionsMiddleware.spec.js b/backend/src/middleware/permissionsMiddleware.spec.js
index 6cf9dc302..096bb5819 100644
--- a/backend/src/middleware/permissionsMiddleware.spec.js
+++ b/backend/src/middleware/permissionsMiddleware.spec.js
@@ -1,22 +1,56 @@
-import { GraphQLClient } from 'graphql-request'
+import { createTestClient } from 'apollo-server-testing'
+import createServer from '../server'
 import Factory from '../seed/factories'
-import { host, login } from '../jest/helpers'
+import { gql } from '../jest/helpers'
+import { getDriver, neode as getNeode } from '../bootstrap/neo4j'
 
 const factory = Factory()
+const instance = getNeode()
+const driver = getDriver()
+
+let query, authenticatedUser, owner, someoneElse, adminExtraordinaire, variables
+
+const userQuery = gql`
+  query($name: String) {
+    User(name: $name) {
+      email
+    }
+  }
+`
 
 describe('authorization', () => {
+  beforeAll(async()=>{
+    await factory.cleanDatabase()
+    const { server } = createServer({
+      context: () => ({
+        driver,
+        instance,
+        user: authenticatedUser,
+      }),
+    })
+    query = createTestClient(server).query
+  })
+
   describe('given two existing users', () => {
     beforeEach(async () => {
-      await factory.create('User', {
-        email: 'owner@example.org',
-        name: 'Owner',
-        password: 'iamtheowner',
-      })
-      await factory.create('User', {
-        email: 'someone@example.org',
-        name: 'Someone else',
-        password: 'else',
-      })
+      [owner, someoneElse, adminExtraordinaire] = await Promise.all([
+        factory.create('User', {
+          email: 'owner@example.org',
+          name: 'Owner',
+          password: 'iamtheowner',
+        }),
+      factory.create('User', {
+          email: 'someone@example.org',
+          name: 'Someone else',
+          password: 'else',
+        }),
+        factory.create('User', {
+          email: 'admin@example.org',
+          name: 'Admin extraordinaire',
+          password: 'admin',
+        }),
+      ])
+      variables = {}
     })
 
     afterEach(async () => {
@@ -24,30 +58,16 @@ describe('authorization', () => {
     })
 
     describe('access email address', () => {
-      let headers = {}
-      let loginCredentials = null
-      const action = async () => {
-        if (loginCredentials) {
-          headers = await login(loginCredentials)
-        }
-        const graphQLClient = new GraphQLClient(host, { headers })
-        return graphQLClient.request('{User(name: "Owner") { email } }')
-      }
-
       describe('not logged in', () => {
-        it('rejects', async () => {
-          await expect(action()).rejects.toThrow('Not Authorised!')
+        beforeEach(()=>{
+          authenticatedUser = null
         })
-
-        it("does not expose the owner's email address", async () => {
-          let response = {}
-          try {
-            await action()
-          } catch (error) {
-            response = error.response.data
-          } finally {
-            expect(response).toEqual({ User: [null] })
-          }
+        it("throws an error and does not expose the owner's email address", async () => {
+          const expected = await query({ query: userQuery, variables: { name: 'Owner' } })
+          await expect(query({ query: userQuery, variables: { name: 'Owner' } })).resolves.toMatchObject({ 
+            errors: [{ message: 'Not Authorised!'}],
+            data: { User: [null]}
+          })
         })
       })
 

From f8cf975d6c2bb4fc93c429eab1b7d23feccba117 Mon Sep 17 00:00:00 2001
From: aonomike <aonomike@gmail.com>
Date: Sat, 5 Oct 2019 17:18:11 +0300
Subject: [PATCH 5/5] Test that admin can access the email of a user

- Refactor all tests on permissionsMiddleware
---
 .../middleware/permissionsMiddleware.spec.js  | 110 +++++++++++-------
 1 file changed, 71 insertions(+), 39 deletions(-)

diff --git a/backend/src/middleware/permissionsMiddleware.spec.js b/backend/src/middleware/permissionsMiddleware.spec.js
index 096bb5819..da703fb11 100644
--- a/backend/src/middleware/permissionsMiddleware.spec.js
+++ b/backend/src/middleware/permissionsMiddleware.spec.js
@@ -8,7 +8,7 @@ const factory = Factory()
 const instance = getNeode()
 const driver = getDriver()
 
-let query, authenticatedUser, owner, someoneElse, adminExtraordinaire, variables
+let query, authenticatedUser, owner, anotherRegularUser, administrator, variables, moderator
 
 const userQuery = gql`
   query($name: String) {
@@ -19,7 +19,7 @@ const userQuery = gql`
 `
 
 describe('authorization', () => {
-  beforeAll(async()=>{
+  beforeAll(async () => {
     await factory.cleanDatabase()
     const { server } = createServer({
       context: () => ({
@@ -33,21 +33,28 @@ describe('authorization', () => {
 
   describe('given two existing users', () => {
     beforeEach(async () => {
-      [owner, someoneElse, adminExtraordinaire] = await Promise.all([
+      ;[owner, anotherRegularUser, administrator, moderator] = await Promise.all([
         factory.create('User', {
           email: 'owner@example.org',
           name: 'Owner',
           password: 'iamtheowner',
         }),
-      factory.create('User', {
-          email: 'someone@example.org',
-          name: 'Someone else',
+        factory.create('User', {
+          email: 'another.regular.user@example.org',
+          name: 'Another Regular User',
           password: 'else',
         }),
         factory.create('User', {
           email: 'admin@example.org',
-          name: 'Admin extraordinaire',
+          name: 'Admin',
           password: 'admin',
+          role: 'admin',
+        }),
+        factory.create('User', {
+          email: 'moderator@example.org',
+          name: 'Moderator',
+          password: 'moderator',
+          role: 'moderator',
         }),
       ])
       variables = {}
@@ -58,52 +65,77 @@ describe('authorization', () => {
     })
 
     describe('access email address', () => {
-      describe('not logged in', () => {
-        beforeEach(()=>{
+      describe('unauthenticated', () => {
+        beforeEach(() => {
           authenticatedUser = null
         })
         it("throws an error and does not expose the owner's email address", async () => {
-          const expected = await query({ query: userQuery, variables: { name: 'Owner' } })
-          await expect(query({ query: userQuery, variables: { name: 'Owner' } })).resolves.toMatchObject({ 
-            errors: [{ message: 'Not Authorised!'}],
-            data: { User: [null]}
+          await expect(
+            query({ query: userQuery, variables: { name: 'Owner' } }),
+          ).resolves.toMatchObject({
+            errors: [{ message: 'Not Authorised!' }],
+            data: { User: [null] },
           })
         })
       })
 
-      describe('as owner', () => {
-        beforeEach(() => {
-          loginCredentials = {
-            email: 'owner@example.org',
-            password: 'iamtheowner',
-          }
+      describe('authenticated', () => {
+        describe('as the owner', () => {
+          beforeEach(async () => {
+            authenticatedUser = await owner.toJson()
+          })
+
+          it("exposes the owner's email address", async () => {
+            variables = { name: 'Owner' }
+            await expect(query({ query: userQuery, variables })).resolves.toMatchObject({
+              data: { User: [{ email: 'owner@example.org' }] },
+              errors: undefined,
+            })
+          })
         })
 
-        it("exposes the owner's email address", async () => {
-          await expect(action()).resolves.toEqual({ User: [{ email: 'owner@example.org' }] })
-        })
-      })
+        describe('as another regular user', () => {
+          beforeEach(async () => {
+            authenticatedUser = await anotherRegularUser.toJson()
+          })
 
-      describe('authenticated as another user', () => {
-        beforeEach(async () => {
-          loginCredentials = {
-            email: 'someone@example.org',
-            password: 'else',
-          }
+          it("throws an error and does not expose the owner's email address", async () => {
+            await expect(
+              query({ query: userQuery, variables: { name: 'Owner' } }),
+            ).resolves.toMatchObject({
+              errors: [{ message: 'Not Authorised!' }],
+              data: { User: [null] },
+            })
+          })
         })
 
-        it('rejects', async () => {
-          await expect(action()).rejects.toThrow('Not Authorised!')
+        describe('as a moderator', () => {
+          beforeEach(async () => {
+            authenticatedUser = await moderator.toJson()
+          })
+
+          it("throws an error and does not expose the owner's email address", async () => {
+            await expect(
+              query({ query: userQuery, variables: { name: 'Owner' } }),
+            ).resolves.toMatchObject({
+              errors: [{ message: 'Not Authorised!' }],
+              data: { User: [null] },
+            })
+          })
         })
 
-        it("does not expose the owner's email address", async () => {
-          let response
-          try {
-            await action()
-          } catch (error) {
-            response = error.response.data
-          }
-          expect(response).toEqual({ User: [null] })
+        describe('administrator', () => {
+          beforeEach(async () => {
+            authenticatedUser = await administrator.toJson()
+          })
+
+          it("exposes the owner's email address", async () => {
+            variables = { name: 'Owner' }
+            await expect(query({ query: userQuery, variables })).resolves.toMatchObject({
+              data: { User: [{ email: 'owner@example.org' }] },
+              errors: undefined,
+            })
+          })
         })
       })
     })