fix: resolve cross-org sharing as admin bug

Esri · Aug 22, 2022 · 1ae4f1a · 1ae4f1a
1 parent 048de4d
commit 1ae4f1a
Show file tree

Hide file tree

Showing 2 changed files with 62 additions and 4 deletions.
diff --git a/packages/arcgis-rest-portal/src/sharing/share-item-with-group.ts b/packages/arcgis-rest-portal/src/sharing/share-item-with-group.ts
@@ -63,6 +63,8 @@ export function shareItemWithGroup(
       if (itemOwner !== username) {
         // need to track if the user is an admin
         let isAdmin = false;
+        // track if the admin & owner are in the same org
+        let isCrossOrgSharing = false;
         // next perform any necessary membership adjustments for
         // current user and/or item owner
         return Promise.all([
@@ -79,6 +81,7 @@ export function shareItemWithGroup(
           .then(([currentUser, ownerUser, membership]) => {
             const isSharedEditingGroup = !!confirmItemControl;
             isAdmin = currentUser.role === "org_admin" && !currentUser.roleId;
+            isCrossOrgSharing = currentUser.orgId !== ownerUser.orgId;
             return getMembershipAdjustments(
               currentUser,
               isSharedEditingGroup,
@@ -103,7 +106,7 @@ export function shareItemWithGroup(
             )
               .then(() => {
                 // then attempt the share
-                return shareToGroup(requestOptions, isAdmin);
+                return shareToGroup(requestOptions, isAdmin, isCrossOrgSharing);
               })
               .then((sharingResults) => {
                 // lastly, if the admin user was added to the group,
@@ -192,7 +195,8 @@ function getMembershipAdjustments(
 
 function shareToGroup(
   requestOptions: IGroupSharingOptions,
-  isAdmin = false
+  isAdmin = false,
+  isCrossOrgSharing = false
 ): Promise<ISharingResponse> {
   const username = requestOptions.authentication.username;
   const itemOwner = requestOptions.owner || username;
@@ -204,8 +208,8 @@ function shareToGroup(
 
   // but if they are the owner, or org_admin, use this route
   // Note: When using this end-point as an admin, apparently the admin does not need to be a member of the group (the itemOwner does)
-  // Have not validated this but came up in conversations w/ Sharing API team
-  if (itemOwner === username || isAdmin) {
+  // Note: Admin's can only use this route when the item is in the same org they are admin for
+  if (itemOwner === username || (isAdmin && !isCrossOrgSharing)) {
     url = `${getPortalUrl(requestOptions)}/content/users/${itemOwner}/items/${
       requestOptions.id
     }/share`;

diff --git a/packages/arcgis-rest-portal/test/sharing/share-item-with-group.test.ts b/packages/arcgis-rest-portal/test/sharing/share-item-with-group.test.ts
@@ -1325,4 +1325,58 @@ describe("shareItemWithGroup() ::", () => {
         });
     });
   });
+  describe("share item from another org to admin user's favorites group ::", () => {
+    it("should share item", (done) => {
+      fetchMock
+        .once(
+          "https://myorg.maps.arcgis.com/sharing/rest/community/users/jsmith?f=json&token=fake-token",
+          {
+            ...OrgAdminUserResponse,
+            favGroupId: "t6b"
+          }
+        )
+        .once(
+          "https://myorg.maps.arcgis.com/sharing/rest/search",
+          NoResultsSearchResponse
+        )
+        .get(
+          "https://myorg.maps.arcgis.com/sharing/rest/community/groups/t6b?f=json&token=fake-token",
+          GroupOwnerResponse
+        )
+        .once(
+          "https://myorg.maps.arcgis.com/sharing/rest/community/users/casey?f=json&token=fake-token",
+          {
+            username: "casey",
+            orgId: "SOMEOTHERORG",
+            groups: [] as any[]
+          }
+        )
+        .post(
+          "https://myorg.maps.arcgis.com/sharing/rest/content/items/n3v/share",
+          { notSharedWith: [], itemId: "n3v" }
+        );
+
+      shareItemWithGroup({
+        authentication: MOCK_USER_SESSION,
+        id: "n3v",
+        groupId: "t6b",
+        owner: "casey"
+      })
+        .then((result) => {
+          expect(fetchMock.done()).toBeTruthy(
+            "All fetchMocks should have been called"
+          );
+          // verify we shared the item
+          const shareOptions: RequestInit = fetchMock.lastOptions(
+            "https://myorg.maps.arcgis.com/sharing/rest/content/items/n3v/share"
+          );
+          expect(shareOptions.body).toContain("groups=t6b");
+
+          done();
+        })
+        .catch((e) => {
+          fail();
+        });
+    });
+  });
 });