[$600] Misc fixes for the WM + more

[ThomasKranitsas]

Issues fixed

• [prod] Copilot unable to update Challenge Spec work-manager#821 - Updated the API to allow any resource with full access to modify a challenge instead of just the member that matches the challenge.createdBy. Fixed in: dd0743d
• Getting 'Member with userId: 23278999 is not registered on the challenge' when user tries to close a Task work-manager#800 - Updated the API to check if the resource exists before assigning a task to a member or closing a Task. This will require to first create the resource and then assign the Task to a member. Also, updated the API so we do NOT allow assigning a member during the challenge creation. This is because the resource creation should happen in the Resources API which will make the appropriate checks for terms etc. Having this as part of the challenge creation could lead to issues such as "the challenge got created but the assignment of the member failed due to missing terms". PR: Prevent assigning a task member without the appropriate resource #294
• Created detailed documentation on how to launch/close tasks using the V5 APIs: TaskFlow.md.zip
• Created a migration script to fix the timelineTemplateIds on all challenges: topcoder-archive/legacy-challenge-migration-script@664aa1e
• Fixed the issue with assigning resources on a challenge topcoder-platform/resources-api@4edee0c...ffb23ce
• Fixed issue with deleting a resource from a task topcoder-platform/challenge-processor@bf95042

Not an API issue

• Unable to update Challenge  work-manager#806 - This is a frontend issue. Will provide more details on the issue.
• Copilot is not able to view a task after assigning to someone else work-manager#822 - This has been fixed. Will comment on the issue about the correct usage of the API.
• Able to create challenge with html tag and SQL queries work-manager#497 - Not sure if it's actually a security risk.
• Unauthorize Copilot Can Access Challenges work-manager#558 - Outdated
• Cannot Proceed w/ Set-Up work-manager#761 - Not an API issue
• When user register and submit to a public challenge it is not updated on the WM challenge listing page work-manager#813 - We already have a processor in place that updates those values. As long as the processor is running (not crashed), those should get updated automatically.

Notes

• Need to create a new RESOURCE_ROLES_API_URL config on the challenge API with the value of http://api.topcoder-dev.com/v5/resource-roles . I have temporarily added the default value in the config file.
• The resource model has a fullAccess flag but I believe we should split that into fullReadAccess and fullWriteAccess. We may want to have resources that can view anything but can't modify anything.

@rootelement ☝️

[rootelement]

topcoder-platform/work-manager#497 - Not sure if it's actually a security risk.
Did this challenge not get created in the backend because of some issue with the processor? Just want to make sure this title didn't prevent it from being created.

[ThomasKranitsas]

Nope, it's getting created just fine. The only "issue" is that legacy sanitizes the challenge title.
Example:
http://api.topcoder-dev.com/v5/challenges/1e66d539-4d24-4e0c-bb77-46945e1c5863
http://api.topcoder-dev.com/v4/challenges/30057099

Title on V5: I am a challenger <script>alert('test')</script> Task Draft
Title on V4: I am a challenger <script>alert('test')</script> Task Draft

We can use https://www.npmjs.com/package/xss to sanitize the title and the description but I'm not really sure if that is something we really worry about that as challenges can only get created by admins (tc staff) + copilots (trusted/verified tc members).

@rootelement thoughts?

[vikasrohit]

@ThomasKranitsas just on the note of the sanitizing, we are trying to standardize the input validation across our apps, and in that endeavor, we have settled on the express-santizer as standard library for sanitizing the input data.

[rootelement]

Need to create a new RESOURCE_ROLES_API_URL config on the challenge API with the value of http://api.topcoder-dev.com/v5/resource-roles . I have temporarily added the default value in the config file.

Done.

The resource model has a fullAccess flag but I believe we should split that into fullReadAccess and fullWriteAccess. We may want to have resources that can view anything but can't modify anything.

I'm fine with this approach. We'll need to update dynamo, correct?

[rootelement]

Contest https://www.topcoder.com/challenges/30143208 has been created for this ticket.

This is an automated message for jcori via Topcoder X

[rootelement]

Contest https://www.topcoder.com/challenges/30143208 has been updated - it has been assigned to thomaskranitsas.

This is an automated message for jcori via Topcoder X

[rootelement]

The full access piece has been pulled out here:
#302