create read only validator

apps/app/src/server/middlewares/read-only-validator.ts

@@ -0,0 +1,20 @@
+import { ErrorV3 } from '@growi/core';
+import { NextFunction, Response } from 'express';
+import { Request } from 'express-validator/src/base';
+
+import loggerFactory from '~/utils/logger';
+
+const logger = loggerFactory('growi:middleware:read-only-validator');
+
+export const readOnlyValidator = (req: Request, res: Response & { apiv3Err }, next: () => NextFunction): NextFunction => {
+  const user = req.user;
+
+  if (user.readOnly) {
+    const message = 'This user is read only user';
+    logger.warn(message);
+
+    return res.apiv3Err(new ErrorV3(message, 'validatioin_failed'));
+  }
+
+  return next();
+};

apps/app/test/unit/middlewares/read-only-validator.test.ts

@@ -0,0 +1,39 @@
+import { ErrorV3 } from '@growi/core';
+
+import { readOnlyValidator } from '../../../src/server/middlewares/read-only-validator';
+
+describe('readOnlyValidator', () => {
+  let req;
+  let res;
+  let next;
+
+  beforeEach(() => {
+    req = {
+      user: {},
+    };
+    res = {
+      apiv3Err: jest.fn(),
+    };
+    next = jest.fn();
+  });
+
+  test('should call next if user is not read only', () => {
+    req.user.readOnly = false;
+
+    readOnlyValidator(req, res, next);
+
+    expect(next).toBeCalled();
+    expect(res.apiv3Err).not.toBeCalled();
+  });
+
+  test('should return error response if user is read only', () => {
+    req.user.readOnly = true;
+
+    readOnlyValidator(req, res, next);
+
+    expect(next).not.toBeCalled();
+    expect(res.apiv3Err).toBeCalledWith(
+      new ErrorV3('This user is read only user', 'validatioin_failed'),
+    );
+  });
+});