mirror of
https://github.com/outline/outline.git
synced 2026-06-13 11:25:03 +03:00
fix: Unable to search drafts without a collection (#12079)
* fix: Unable to search drafts without a collection * PR feedback
This commit is contained in:
@@ -391,6 +391,46 @@ describe("PostgresSearchProvider", () => {
|
||||
expect(results.length).toBe(1);
|
||||
});
|
||||
|
||||
it("should include drafts with no collection created by user", async () => {
|
||||
const user = await buildUser();
|
||||
const draft = await buildDraftDocument({
|
||||
teamId: user.teamId,
|
||||
userId: user.id,
|
||||
createdById: user.id,
|
||||
collectionId: null,
|
||||
title: "test",
|
||||
});
|
||||
const { results } = await provider.searchForUser(user, {
|
||||
query: "test",
|
||||
statusFilter: [StatusFilter.Draft],
|
||||
});
|
||||
expect(results.length).toBe(1);
|
||||
expect(results[0].document?.id).toBe(draft.id);
|
||||
});
|
||||
|
||||
it("should not include drafts created by user in inaccessible collections", async () => {
|
||||
const team = await buildTeam();
|
||||
const user = await buildUser({ teamId: team.id });
|
||||
const otherUser = await buildUser({ teamId: team.id });
|
||||
const privateCollection = await buildCollection({
|
||||
teamId: team.id,
|
||||
userId: otherUser.id,
|
||||
permission: null,
|
||||
});
|
||||
await buildDraftDocument({
|
||||
teamId: team.id,
|
||||
userId: user.id,
|
||||
createdById: user.id,
|
||||
collectionId: privateCollection.id,
|
||||
title: "test",
|
||||
});
|
||||
const { results } = await provider.searchForUser(user, {
|
||||
query: "test",
|
||||
statusFilter: [StatusFilter.Draft],
|
||||
});
|
||||
expect(results.length).toBe(0);
|
||||
});
|
||||
|
||||
it("should not include drafts with user read permission", async () => {
|
||||
const user = await buildUser();
|
||||
await buildDraftDocument({
|
||||
|
||||
@@ -628,6 +628,18 @@ export default class PostgresSearchProvider extends BaseSearchProvider {
|
||||
{ "$memberships.id$": { [Op.ne]: null } },
|
||||
{ "$groupMemberships.id$": { [Op.ne]: null } }
|
||||
);
|
||||
|
||||
// Allow users to see their own drafts that have no collection, where no
|
||||
// membership or collection access applies. Drafts in collections remain
|
||||
// gated by the collection/membership checks above.
|
||||
if (options.statusFilter?.includes(StatusFilter.Draft)) {
|
||||
where[Op.or].push({
|
||||
createdById: model.id,
|
||||
collectionId: { [Op.is]: null },
|
||||
publishedAt: { [Op.eq]: null },
|
||||
archivedAt: { [Op.eq]: null },
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// Ensure we're filtering by the users accessible collections. If
|
||||
|
||||
Reference in New Issue
Block a user