Remove sitesAdmin & sitesOwner checks from canUpdateSite, canDeleteSite.
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -377,14 +377,12 @@ export default class Authorizations {
return Authorizations.canPerformAction(loggedUser, Entity.SITE, Action.CREATE);
}
- public static canUpdateSite(loggedUser: UserToken, siteID: string): boolean {
- return Authorizations.canPerformAction(loggedUser, Entity.SITE, Action.UPDATE,
- { site: siteID, sitesAdmin: loggedUser.sitesAdmin, sitesOwner: loggedUser.sitesOwner });
+ public static canUpdateSite(loggedUser: UserToken): boolean {
+ return Authorizations.canPerformAction(loggedUser, Entity.SITE, Action.UPDATE);
}
- public static canDeleteSite(loggedUser: UserToken, siteID: string): boolean {
- return Authorizations.canPerformAction(loggedUser, Entity.SITE, Action.DELETE,
- { site: siteID, sites: loggedUser.sitesAdmin });
+ public static canDeleteSite(loggedUser: UserToken): boolean {
+ return Authorizations.canPerformAction(loggedUser, Entity.SITE, Action.DELETE);
}
public static canListSettings(loggedUser: UserToken): boolean {

MODIFY
src/authorization/AuthorizationsDefinition.ts
src/authorization/AuthorizationsDefinition.ts
@@ -276,10 +276,7 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
{ resource: Entity.USER, action: [Action.READ], attributes: ['*'] },
{ resource: Entity.USERS_SITES, action: Action.LIST, attributes: ['*'] },
{ resource: Entity.USERS_SITES, action: Action.UNASSIGN, attributes: ['*'] },
- {
- resource: Entity.SITE, action: [Action.UPDATE], attributes: ['*'],
- condition: { Fn: 'LIST_CONTAINS', args: { 'sitesAdmin': '$.site' } }
- },
+ { resource: Entity.SITE, action: [Action.UPDATE, Action.DELETE], attributes: ['*'] },
{
resource: Entity.SITE_AREA, action: [Action.CREATE, Action.UPDATE, Action.DELETE], attributes: ['*'],
condition: { Fn: 'LIST_CONTAINS', args: { 'sites': '$.site' } }
@@ -323,10 +320,7 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
grants: [
{ resource: Entity.USERS, action: Action.LIST, attributes: ['*'] },
{ resource: Entity.USER, action: [Action.READ], attributes: ['*'] },
- {
- resource: Entity.SITE, action: [Action.UPDATE], attributes: ['*'],
- condition: { Fn: 'LIST_CONTAINS', args: { 'sitesOwner': '$.site' } }
- },
+ { resource: Entity.SITE, action: [Action.UPDATE], attributes: ['*'] },
{
resource: Entity.TRANSACTION, action: [Action.READ, Action.REFUND_TRANSACTION], attributes: ['*'],
condition: { Fn: 'LIST_CONTAINS', args: { 'sitesOwner': '$.site' } }

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -76,9 +76,17 @@ export default class AuthorizationService {
userToken.sitesOwner = siteOwnerIDs;
// Enrich
for (const site of sites) {
+ if (userToken.role === UserRole.ADMIN) {
+ site.canRead = true;
+ site.canUpdate = true;
+ site.canDelete = true;
+ } else {
site.canRead = Authorizations.canReadSite(userToken);
- site.canUpdate = Authorizations.canUpdateSite(userToken, site.id);
- site.canDelete = Authorizations.canDeleteSite(userToken, site.id);
+ site.canUpdate = Authorizations.canUpdateSite(userToken)
+ && (userToken.sitesAdmin.includes(site.id) || userToken.sitesOwner.includes(site.id));
+ site.canDelete = Authorizations.canDeleteSite(userToken)
+ && (userToken.sitesAdmin.includes(site.id) || userToken.sitesOwner.includes(site.id));
+ }
}
}

MODIFY
src/server/rest/v1/service/SiteService.ts
src/server/rest/v1/service/SiteService.ts
@@ -66,7 +66,7 @@ export default class SiteService {
actionOnUser: filteredRequest.userID
});
}
- if (!Authorizations.canUpdateSite(req.user, filteredRequest.siteID)) {
+ if (!Authorizations.canUpdateSite(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
@@ -349,7 +349,7 @@ export default class SiteService {
// Check Mandatory fields
UtilsService.assertIdIsProvided(action, siteID, MODULE_NAME, 'handleDeleteSite', req.user);
// Check
- if (!Authorizations.canDeleteSite(req.user, siteID)) {
+ if (!Authorizations.canDeleteSite(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
@@ -579,7 +579,7 @@ export default class SiteService {
const filteredRequest = SiteSecurity.filterSiteUpdateRequest(req.body);
UtilsService.assertIdIsProvided(action, filteredRequest.id, MODULE_NAME, 'handleUpdateSite', req.user);
// Check auth
- if (!Authorizations.canUpdateSite(req.user, filteredRequest.id)) {
+ if (!Authorizations.canUpdateSite(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,

Remove sitesAdmin & sitesOwner checks from canUpdateSite, canDeleteSite.