feat(auth): verify user rights on login/create and filter data by Portail DF perimeter #1508
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
loicguillois
force-pushed
the
feat/verify-user-rights-on-login-create
branch
from
f7a1cd1 to
6591c2b
Compare
Contributor
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
loicguillois
force-pushed
the
feat/verify-user-rights-on-login-create
branch
2 times, most recently
from
ee6e79b to
8096bad
Compare
loicguillois
changed the title
loicguillois
force-pushed
the
feat/verify-user-rights-on-login-create
branch
from
7e07257 to
6e62fce
Compare
- Add suspendedAt and deletedAt checks on login (accountController) - Re-verify Portail DF LOVAC rights at account creation time - Fix ceremaService authentication to use multipart/form-data - Validate that LOVAC access date is in the future (not just non-null) - Add UserSuspendedError and UserDeletedError for proper error handling - Add tests for suspended and deleted user login attempts
…eter - Add CeremaGroup and CeremaPerimeter interfaces to retrieve user group and perimeter info from Portail DF API - Create perimeterService with functions to verify: - LOVAC access level (niveau_acces = 'lovac' or lovac = true) - Geographic perimeter matching (fr_entiere, reg, dep, epci, comm) - Update account creation to verify access rights before creating user - Add support for new suspension causes in frontend: - niveau_acces_invalide: invalid LOVAC access level - perimetre_invalide: geographic perimeter mismatch - Update SuspendedUserModal to display appropriate error messages for new suspension causes
- Remove 403 error for suspended users - only deleted accounts are blocked - Add test users with various suspension causes in development seeds - Add [email protected] for testing account deletion (LOGIN-09) - Add SuspendedUserModal tests for new suspension causes - Add test scripts and documentation for manual Portail DF rights testing
- Remove unused interfaces and variables in generate-test-cases.ts - Escape apostrophes in SuspendedUserModal.tsx
… login - Add getByEmailIncludingDeleted method to userRepository to find deleted users - Update signIn to check deleted status before password validation (returns 403) - Allow suspended users to login successfully (200) - frontend shows modal - Update test to expect 200 for suspended users instead of 403
Add CEREMA_ENABLED=false to test environment setup to prevent the real CeremaService from being used during tests. Also add wildcard SIREN support to MockCeremaService for test compatibility with randomly generated establishments.
…l DF Add effectiveGeoCodes calculation based on intersection of establishment geoCodes and user perimeter. Apply filtering to housing list, count, create, update, export and localities (map). Admin/Visitor roles bypass perimeter filtering.
Groups and campaigns are now hidden if they contain at least one housing outside the user's perimeter. This ensures users only see groups/campaigns they have full access to based on their Portail DF rights. - Add geoCodes filter to groupRepository with whereNotExists subquery - Add geoCodes filter to campaignRepository with whereNotExists subquery - Update groupController and campaignController to use effectiveGeoCodes - Update documentation diagrams to reflect new filtering rules
Fix TypeScript error with Knex whereNotIn expecting array for column names. Use whereRaw with parameterized query instead.
loicguillois
force-pushed
the
feat/verify-user-rights-on-login-create
branch
from
0e62ed6 to
cdfe009
Compare
- Create users_establishments junction table for N-N relationship - Identify multi-structure users at account creation and login - Verify access rights (LOVAC level + geographic perimeter) at login - Suspend user if current establishment loses access rights - Return authorizedEstablishments in login response for dropdown
…N/VISITOR bypass - Save user perimeter to user_perimeters table on each login - Add ADMIN/VISITOR bypass for perimeter filtering in: - localityController (map data) - campaignController (campaigns list) - groupController (groups list) - Update documentation with perimeter sync code example
…, and improve UX - Add EPCI perimeter support: users with EPCI-level access can now see all housing in their establishment without commune restriction - Fix critical bug where empty localities array was ignored, causing users with no perimeter intersection to see all housing instead of none - Add multi-structure dropdown for USUAL users with multiple authorized establishments - Fix RTK Query cache not being reset on logout, requiring page refresh - Fix lastAuthenticatedAt being overwritten when user is suspended at login - Add migration for EPCI column in user_perimeters table
Add EPCI perimeter logic and clarify effectiveGeoCodes semantics: - Add epci[] field to perimeter structure and user_perimeters table - Document EPCI perimeter matching with establishment SIREN - Clarify difference between undefined (no restriction) and [] (no access) - Update filterGeoCodesByPerimeter() documentation with SIREN parameter
- Change EstablishmentSearchableSelect to use frontend Establishment type - Transform API responses from EstablishmentDTO to Establishment in auth.service - Update AuthUser.authorizedEstablishments to use Establishment type - Remove unnecessary toEstablishmentDTO/fromEstablishmentDTO calls in SmallHeader
- Add establishment field to auth mock response for transformAuthUser - Filter out wildcard SIREN '*' from establishment lookup queries
loicguillois
force-pushed
the
feat/verify-user-rights-on-login-create
branch
from
6d64a1b to
632ae16
Compare
|
loicguillois
temporarily deployed
to
pr1508-front
GitHub Actions
Inactive
loicguillois
had a problem deploying
to
pr1508-api
GitHub Actions
Failure
loicguillois
temporarily deployed
to
pr1508-queue
GitHub Actions
Inactive
loicguillois
had a problem deploying
to
pr1508-api
GitHub Actions
Failure
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Cette PR implémente la vérification des droits utilisateurs via l'API Portail DF lors de la connexion et de la création de compte, ainsi que le filtrage des données par périmètre géographique.
Fonctionnalités principales
1. Vérification des droits à la connexion/création
acces_lovac)lovac=trueouniveau_acces='lovac')2. Suspension automatique
droits structure expires,niveau_acces_invalide,perimetre_invalide,droits utilisateur expires,cgu vides3. Support multi-structure (USUAL users)
4. Filtrage des données par périmètre utilisateur
user_perimetersà chaque connexioneffectiveGeoCodes= intersection(établissement.geoCodes, user.perimeter)5. Support périmètre EPCI
epci[]dans les périmètres (codes SIREN EPCI)perimeter.epciet qu'il n'y a pas de restriction commune/département/région, l'utilisateur a accès completepciajoutée à la tableuser_perimeters6. Corrections de bugs
lastAuthenticatedAtécrasé lors de la suspensionSémantique
effectiveGeoCodesundefined[](array vide)['67482', '67043']Fichiers modifiés
Backend:
server/src/controllers/accountController.ts- Vérification droits + stockage périmètreserver/src/controllers/userController.ts- Vérification création compteserver/src/middlewares/auth.ts- CalculeffectiveGeoCodesserver/src/models/UserPerimeterApi.ts-filterGeoCodesByPerimeter()avec support EPCIserver/src/repositories/housingRepository.ts- Fix array videserver/src/repositories/userPerimeterRepository.ts- CRUD périmètresserver/src/services/ceremaService/perimeterService.ts- Validation périmètreFrontend:
frontend/src/hooks/useUser.tsx- Reset cache à la déconnexionfrontend/src/components/modals/SuspendedUserModal/- Modal suspensionfrontend/src/components/Account/AccountDropdown.tsx- Dropdown multi-structureDocumentation:
docs/portail-df-decision-tree.md- Diagrammes et documentation complèteTest plan