yet another test

RocketChat · Jun 22, 2022 · a996183 · a996183
1 parent d0c4fa0
commit a996183
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/apps/meteor/app/livechat/imports/server/rest/departments.ts b/apps/meteor/app/livechat/imports/server/rest/departments.ts
@@ -80,6 +80,10 @@ API.v1.addRoute(
 	{ authRequired: true },
 	{
 		async get() {
+			if (!hasAtLeastOnePermission(this.userId, ['view-livechat-departments', 'view-l-room'])) {
+				return API.v1.unauthorized();
+			}
+
 			check(this.urlParams, {
 				_id: String,
 			});

diff --git a/apps/meteor/tests/end-to-end/api/livechat/01-department.js b/apps/meteor/tests/end-to-end/api/livechat/01-department.js
@@ -32,7 +32,7 @@ describe('LIVECHAT - departments', function () {
 						.expect(403)
 						.expect((res) => {
 							expect(res.body).to.have.property('success', false);
-							expect(res.body.error).to.be.equal('error-not-authorized');
+							expect(res.body.error).to.be.equal('unauthorized');
 						})
 						.end(done);
 				});
@@ -90,7 +90,7 @@ describe('LIVECHAT - departments', function () {
 						.get(api(`livechat/department/${department._id}`))
 						.set(credentials)
 						.expect('Content-Type', 'application/json')
-						.expect(400)
+						.expect(403)
 						.expect((res) => {
 							expect(res.body).to.have.property('success', false);
 							expect(res.body.error).to.be.equal('error-not-authorized');