reactioncommerce · mikemurray · Dec 17, 2019 · Dec 13, 2019 · Dec 17, 2019 · Dec 17, 2019
diff --git a/src/plugins/navigation/mutations/updateNavigationTree.js b/src/plugins/navigation/mutations/updateNavigationTree.js
@@ -18,6 +18,12 @@ export default async function updateNavigationTree(context, input) {
   const { NavigationTrees } = collections;
   const { navigationTreeId, shopId, navigationTree } = input;
 
+  const treeSelector = { _id: navigationTreeId, shopId };
+  const existingNavigationTree = await NavigationTrees.findOne(treeSelector);
+  if (!existingNavigationTree) {
+    throw new ReactionError("navigation-tree-not-found", "No navigation tree was found");
+  }
+
   const {
     shouldNavigationTreeItemsBeAdminOnly,
     shouldNavigationTreeItemsBePubliclyVisible,
@@ -46,12 +52,6 @@ export default async function updateNavigationTree(context, input) {
 
   await context.validatePermissions(`reaction:navigationTrees:${navigationTreeId}`, "update", { shopId, legacyRoles: ["core"] });
 
-  const treeSelector = { _id: navigationTreeId, shopId };
-  const existingNavigationTree = await NavigationTrees.findOne(treeSelector);
-  if (!existingNavigationTree) {
-    throw new ReactionError("navigation-tree-not-found", "No navigation tree was found");
-  }
-
   const update = {};
 
   if (draftItems) {

diff --git a/tests/integration/api/mutations/navigationTree/UpdateNavigationTreeMutation.graphql b/tests/integration/api/mutations/navigationTree/UpdateNavigationTreeMutation.graphql
@@ -0,0 +1,23 @@
+mutation UpdateNavigationTree($updateNavigationTreeInput: UpdateNavigationTreeInput!) {
+	updateNavigationTree(input: $updateNavigationTreeInput) {
+    navigationTree {
+      ...NavigationTree
+    }
+  }
+}
+
+fragment NavigationTree on NavigationTree {
+  _id
+  draftItems {
+    expanded
+    isPrivate
+    isSecondary
+    isVisible
+    navigationItem {
+      _id
+    }
+  }
+  hasUnpublishedChanges
+  name
+  shopId
+}
diff --git a/.../integration/api/mutations/navigationTree/__snapshots__/updateNavigationTree.test.js.snap b/.../integration/api/mutations/navigationTree/__snapshots__/updateNavigationTree.test.js.snap
@@ -0,0 +1,28 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`an unauthorized user should not be able to update the navigation tree 1`] = `
+Array [
+  Object {
+    "extensions": Object {
+      "code": "FORBIDDEN",
+      "exception": Object {
+        "details": Object {},
+        "error": "access-denied",
+        "eventData": Object {},
+        "isClientSafe": true,
+        "reason": "Access Denied",
+      },
+    },
+    "locations": Array [
+      Object {
+        "column": 3,
+        "line": 2,
+      },
+    ],
+    "message": "Access Denied",
+    "path": Array [
+      "updateNavigationTree",
+    ],
+  },
+]
+`;
diff --git a/tests/integration/api/mutations/navigationTree/updateNavigationTree.test.js b/tests/integration/api/mutations/navigationTree/updateNavigationTree.test.js
@@ -0,0 +1,116 @@
+import encodeOpaqueId from "@reactioncommerce/api-utils/encodeOpaqueId.js";
+import importAsString from "@reactioncommerce/api-utils/importAsString.js";
+import Factory from "/tests/util/factory.js";
+import TestApp from "/tests/util/TestApp.js";
+
+const UpdateNavigationTreeMutation = importAsString("./UpdateNavigationTreeMutation.graphql");
+
+jest.setTimeout(300000);
+
+const internalShopId = "123";
+const opaqueShopId = "cmVhY3Rpb24vc2hvcDoxMjM="; // reaction/shop:123
+const shopName = "Test Shop";
+const encodeNavigationTreeOpaqueId = encodeOpaqueId("reaction/navigationTree");
+const encodeNavigationItemOpaqueId = encodeOpaqueId("reaction/navigationItem");
+
+const mockAdminAccount = Factory.Account.makeOne({
+  roles: {
+    [internalShopId]: ["admin", "core"]
+  }
+});
+
+const mockNavigationTree = Factory.NavigationTree.makeOne({
+  _id: "1001",
+  name: "Default Navigation",
+  shopId: internalShopId,
+  draftItems: Factory.NavigationTreeItem.makeMany(2, {
+    isPrivate: false,
+    isSecondary: false,
+    isVisible: false
+  })
+});
+
+const mockNavigationItem = Factory.NavigationItem.makeOne({
+  shopId: internalShopId
+});
+
+const updateNavigationTreeInput = {
+  shopId: opaqueShopId,
+  navigationTree: {
+    name: "Not Default Navigation",
+    draftItems: [
+      {
+        navigationItemId: encodeNavigationItemOpaqueId(mockNavigationItem._id),
+        isPrivate: false,
+        isSecondary: false,
+        isVisible: true
+      }
+    ]
+  },
+  id: encodeNavigationTreeOpaqueId(mockNavigationTree._id)
+};
+
+let testApp;
+let updateNavigationTree;
+
+beforeAll(async () => {
+  testApp = new TestApp();
+  await testApp.start();
+  await testApp.insertPrimaryShop({ _id: internalShopId, name: shopName });
+  await testApp.createUserAndAccount(mockAdminAccount);
+  await testApp.setLoggedInUser(mockAdminAccount);
+  await testApp.collections.NavigationTrees.insertOne(mockNavigationTree);
+  await testApp.collections.NavigationItems.insertOne(mockNavigationItem);
+
+  updateNavigationTree = await testApp.mutate(UpdateNavigationTreeMutation);
+});
+
+beforeEach(async () => {
+  await testApp.clearLoggedInUser();
+});
+
+afterAll(async () => {
+  await testApp.collections.NavigationItems.deleteMany({});
+  await testApp.collections.Shops.deleteMany({});
+  await testApp.stop();
+});
+
+test("an authorized user should be able to update the navigation tree", async () => {
+  let result;
+  try {
+    await testApp.setLoggedInUser(mockAdminAccount);
+    result = await updateNavigationTree({
+      updateNavigationTreeInput
+    });
+  } catch (error) {
+    expect(error).toBeUndefined();
+  }
+
+  expect(result.updateNavigationTree.navigationTree).toEqual({
+    _id: encodeNavigationTreeOpaqueId(mockNavigationTree._id),
+    draftItems: [
+      {
+        expanded: null,
+        isPrivate: false,
+        isSecondary: false,
+        isVisible: true,
+        navigationItem: {
+          _id: encodeNavigationItemOpaqueId(mockNavigationItem._id)
+        }
+      }
+    ],
+    hasUnpublishedChanges: true,
+    name: "Not Default Navigation",
+    shopId: opaqueShopId
+  });
+});
+
+test("an unauthorized user should not be able to update the navigation tree", async () => {
+  try {
+    await updateNavigationTree({
+      updateNavigationTreeInput
+    });
+  } catch (error) {
+    expect(error).toMatchSnapshot();
+  }
+});
diff --git a/tests/util/factory.js b/tests/util/factory.js
@@ -82,6 +82,12 @@ import {
   extendSimplePricingSchemas
 } from "../../src/plugins/simple-pricing/simpleSchemas.js";
 
+import {
+  NavigationItem,
+  NavigationTree,
+  NavigationTreeItem
+} from "../../src/plugins/navigation/simpleSchemas.js";
+
 import { AddressValidationRule } from "../../src/core-services/address/simpleSchemas.js";
 
 const schemasToAddToFactory = {
@@ -102,6 +108,9 @@ const schemasToAddToFactory = {
   Email,
   EmailTemplates,
   Group,
+  NavigationItem,
+  NavigationTree,
+  NavigationTreeItem,
   Order,
   OrderAddress,
   OrderFulfillmentGroup,