Require builder access for group listing

Author: Dakuan

packages/worker/src/api/routes/global/groups.ts

@@ -39,6 +39,7 @@ router
   )
   .get(
     "/api/global/groups",
+    auth.builderOrAdmin,
     proMiddleware.feature.requireFeature(Feature.USER_GROUPS),
     controller.fetch
   )

packages/worker/src/api/routes/global/tests/groups.spec.ts

@@ -377,6 +377,12 @@ describe("/api/global/groups", () => {
       })
     })
 
+    it("fetch should return 200", async () => {
+      await config.withUser(builder, async () => {
+        await config.api.groups.fetch()
+      })
+    })
+
     it("update should return forbidden", async () => {
       await config.withUser(builder, async () => {
         await config.api.groups.updateGroupUsers(
@@ -391,6 +397,19 @@ describe("/api/global/groups", () => {
     })
   })
 
+  describe("with basic role", () => {
+    it("fetch should return forbidden", async () => {
+      const user = await config.createUser({
+        builder: { global: false },
+        admin: { global: false },
+      })
+
+      await config.withUser(user, async () => {
+        await config.api.groups.fetch({ expect: 403 })
+      })
+    })
+  })
+
   describe("bulk add users via CSV", () => {
     let groupId: string
     let existingUsers: { _id: string; email: string }[] = []