Prior to this commit the following situation existed:
> The path /dashboard/analytics/org/:id requires user
> authentication (e.g. signed in). However, it does not enforce
> authorization. Anyone can see this page. The page, however, uses
> javascript to populate the data. So no information, aside from the org
> name associated with the :id leaks out. The javascript API end point
> enforces organization membership.
>
> I would expect that the authorization in the HTML rendering would be
> the same as the javascript API end point.
This commit ensures that the dashboards#analytics end point uses the
same policy logic as the API analytics end points. Further, it keeps
folks who aren't org members out of the base HTML page for other orgs.
Closes forem/forem/#16985
We only have one reference to the UnauthorizedError, which is shadows
the ApplicationPolicy::NotAuthorizedError. This commit removes the
exception.
Related to forem/forem#16985 but only barely
* Remove pro role on user, expose pro dashboard to all users as analytics
* Remove pro from Elasticsearch mappings
* Update user role docs to use :trusted over :pro
* Remove pro from Role model spec
* Remove more references to pro, as noted by @rhymes
* Add ProMembership model
* Implement ProMembershipsController#create
* Implement basic ProMembershipsController#show
* Add ProMembership to ledger
* Populate user history after pro subscription is created
* Add fields for expiration notifications
* Add ProMemberships::ExpirationNotifier to notify users of expiring memberships
* Add tasks for recurring jobs to notify users of expiration
* Add auto_recharge column to ProMembership
* Add ProMemberships::Biller (incomplete)
* Fix specs
* Add ProMembership to Administrate
* Fix spec
* Add has_enough_credits? to User and Organization
* Add Payments::Customer class
* Finish ProMembership::Biller functionality
* Fix ProMemberships::Creator check for credits
* Disable destroy actions for ProMembershipsController
* Correctly authenticate ProMembershipsController actions
* Make sure only pro user's history can be indexed
* Add ProMembershipsController#update action for auto recharge
* Use regular AR to save new credits and add touch to the purchaser
* Clarify Pro membership create policy
* Display information about an existing pro membership
* Add UI to show page
* Add system test for Pro membership creation
* Implement edit membership
* Make sure users with pro memberships can access history and dashboard pro
* Fix padding issue
* Show a different text for a user that has credits but not enough for Pro
* Move Pro Membership functionality inside settings
* Update Pro Membership link in email notifications
* Bust all relevant caches
* Add the Pro checkmark around the website
* Use Users::ResaveArticlesJob instead of delay
* Add/remove user from pro-members chat channel
* Use the appropriate Pro checkmark
* Remove unfinished pro elements
* Remove checkmark JS
* Update specs for doorkeeper test
* Add bang
* Create #authenticate
* Create /api/articles/ endpoint
* Update specs
* Update me.json.jbuilder
* Fix typo and spacing
* Support pagination for #me
* Update #authenticate! to support cookies
* Make per_page a param
* Disable method-complexity check
* Enable refresh_token
* Create /api/users/me endpoint
* Reorganize PageViewsController
* Add domain and path to PageView model
* Add before_create callback to populate domain and path
* Add list of referrers to AnalyticsService
* Add referrers to the UI
* Remove useless referrers card and tweak table line height
* Add referrer stats to article stats page
* Add not null and empty default to domain and path
* Refactor JS analytics client
* create_list is a step back here
* Revert "Add not null and empty default to domain and path"
This reverts commit bc02440076047a887c65d300bccd4661ecc8ffd0.
* Add index on domain concurrently
* Make the script more robust
* Use proper auth chain before checking parameters
* Refactor AnalyticsController
* Add a bunch of test and rewrite reactions counts with a single query
* Add tests for follows totals
* Use round and add more refactoring
* Add tests to group by day to fallback during refactoring
* Use group by to calculate comments count by day
* Use group by to calculate follows count by day
* Use group by to calculate reactions stats by day
* Use group by to calculate page_views stats by day
* Move calculations per day back in the cached block
* Add a few comments and a little bit of refactoring
* Add indexes (concurrently) for analytics
* Make tests more time robust
* Use a date range cache related to the requesting user or org
* Freezing time in UTC should help when tests are ran on time zones over the day line
* Remove explicit returns
* Page title is escaped, guard against that
* Move Analytics service spec in the proper place
* Allow user to have many orgs
* Allow users to handle multi orgs in settings
* Make rounded buttons inline
* Add multi org function to dashboards
* Fix merge conflicts
* Fix mistake in merge conflict fix oops
* Display the correct membership level
* Fix accessibility issues
* Display organizations for article editors
* Handle submitting org id with preact editors
* Make listings work with multiple organizations
* Allow listings to have multiple orgs on create
* Display the correct number of credits for each org
* Move script tag to Webpack
* Allow multi orgs for purchasing and viewing credits
* Use OrganizationMembership as authorization check
* Display multiple organizations for notifications
* Allow dashboard to be viewable under multi-orgs
* Remove unused method
* Add multi-org functionality for article editors
* Show pro dashboard buttons for member+ org levels
* Leave the correct organization
* Allow article API to change org id
* Add left-out authorization method oops
* Make nav buttons a bit more clear
* Fix merge conflict
* Fix adding org id for /api/articles and tests
* Fix tests for org policy
* Use proper logic for displaying org members
* Update org actions with new authorization
* Use correct org when creating a listing
* Remove additional payment charge oops
* Mark org notifications as read with authorization
* Remove deprecated post_as_organization attribute
* Use new org_admin syntax
* Remove deprecated org logic for article create and update
* Default all RSS posts to not belong to any org
* Render org_member page for guest users
* Update org policy spec to work with multi orgs
* Use org_membership for org traits and move identity code
* Use org_member trait
* Update to work with multi-orgs
* Validate article's org_id if param org_id is blank
* Make a let variable
* Remove unnecessary eager load for credits
* Fix HTML structure and org logic for non-org users
* Update credits spec for multi-org
* Add test for failed payment when purchased by org
* Lint listings_spec
* Test that the listing was created under the user
* Add tests for POST /listings multi-org
* Use double quotes for classes
* Fix /manage and a few other multi-org bugs
* Fix test for multi org
* Use correct method SQL exists? not Rails exist?
* Fix reads spec for multi-org
* Fix org_controller actions to work with multi org
* Test only multi org and not old usage and fix leave_org
* Fix org showing user profile img test for multi-org
* Fix org logic for users with no orgs
* Remove switch org functionality
* Update tests and add hidden param for org id
* Redirect to the specific organization
* Test other org button actions
* Use settings_notice instead of legacy notice and refactor
* Fix weird extra end issue prob from merge conflicts
* Test for with new flash key
* Fix user_views_org tests for multi-org
* Test for new flash message
* Update snapshot with new a11y html
* Move styling to stylesheet
* Add site admins functionality
* Move org_member? method in user model and refactor
* Use unspent_credits_count for organizations
* Add tests for /listings/new and minor bug fixes
* Use .present? in case of empty array
* Fix a lingering deprecated method
* Use greater than 1 for random numbers
* Add tests for counting spent and unspent credits
* Add system test to create article from the editor
* Move article creation from API to app controller
* Fix system test to edit posts
* Move article update from API to app controller
* Rewrite create article API using API key
* Add main_image and canonical_url to allowed creation params
* Rewrite update article API using API key
* Fix tests and have Comments API inherit from API
* Add specs for single article functionality
* Add single article functionality
* Use article_id instead of single_article_id
* Add published: true when querying for one article
* Use article_id in specs oops
* Add basic tests for Analytics service
* User/Organization are always required
* Add some data to the test
* Use queries and date times
* Fix AnalyticsService interface in the controller
* s/HTTP_API_KEY/api-key
* Defend against nils and support datetime objects
* Update app/services/analytics_service.rb
Co-Authored-By: rhymes <rhymesete@gmail.com>
* Use SQL sum, not Rails sum
* Group average_read_time
* Use SQL, not Rails
* Use ISO date
* Fix specs
* Add API endpoints for analytics
* Remove comment and spacing
* Use proper time formatting
* Refactor and clean up some logic
* Add pro and org member traits
* Use shared examples for analytics API spec
* Add analytics authorization specs
* Remove accidental include Pundit
* Raise not_authorized for invalid requests
* Make attributes and time methods private
* Add custom UnauthorizedError
* Raise and use rescue_from to handle 4xx requests
* Enforce date parameters to follow a specific format
* Use current user to allow same origin requests
* Use custom headers and not params for token auth
* Default to current user for same origin requests
* Use correct boolean for choosing user
* Update tests to use request headers and add stricter tests
