Optimized Settings service
MODIFY
src/server/rest/v1/service/SettingService.ts
src/server/rest/v1/service/SettingService.ts
@@ -27,10 +27,8 @@ export default class SettingService {
throw new AppAuthError({
errorCode: HTTPAuthError.ERROR,
user: req.user,
- action: Action.DELETE,
- entity: Entity.SETTING,
- module: MODULE_NAME,
- method: 'handleDeleteSetting',
+ action: Action.DELETE, entity: Entity.SETTING,
+ module: MODULE_NAME, method: 'handleDeleteSetting',
value: settingID
});
}
@@ -62,10 +60,8 @@ export default class SettingService {
throw new AppAuthError({
errorCode: HTTPAuthError.ERROR,
user: req.user,
- action: Action.READ,
- entity: Entity.SETTING,
- module: MODULE_NAME,
- method: 'handleGetSetting',
+ action: Action.READ, entity: Entity.SETTING,
+ module: MODULE_NAME, method: 'handleGetSetting',
value: settingID
});
}
@@ -77,10 +73,7 @@ export default class SettingService {
// Hash sensitive data before being sent to the front end
Cypher.hashSensitiveDataInJSON(setting);
// Return
- res.json(
- // Filter
- SettingSecurity.filterSettingResponse(setting, req.user)
- );
+ res.json(setting);
next();
}
@@ -90,10 +83,8 @@ export default class SettingService {
throw new AppAuthError({
errorCode: HTTPAuthError.ERROR,
user: req.user,
- action: Action.LIST,
- entity: Entity.SETTINGS,
- module: MODULE_NAME,
- method: 'handleGetSettings'
+ action: Action.LIST, entity: Entity.SETTINGS,
+ module: MODULE_NAME, method: 'handleGetSettings'
});
}
// Filter
@@ -102,9 +93,6 @@ export default class SettingService {
const settings = await SettingStorage.getSettings(req.user.tenantID,
{ identifier: filteredRequest.Identifier },
{ limit: filteredRequest.Limit, skip: filteredRequest.Skip, sort: filteredRequest.Sort });
- settings.result = settings.result.map((setting) => setting);
- // Filter
- settings.result = SettingSecurity.filterSettingsResponse(settings.result, req.user);
// Process the sensitive data if any
settings.result.forEach((setting) => {
// Hash sensitive data before being sent to the front end
@@ -121,10 +109,8 @@ export default class SettingService {
throw new AppAuthError({
errorCode: HTTPAuthError.ERROR,
user: req.user,
- action: Action.CREATE,
- entity: Entity.SETTING,
- module: MODULE_NAME,
- method: 'handleCreateSetting'
+ action: Action.CREATE, entity: Entity.SETTING,
+ module: MODULE_NAME, method: 'handleCreateSetting'
});
}
// Filter
@@ -158,10 +144,8 @@ export default class SettingService {
throw new AppAuthError({
errorCode: HTTPAuthError.ERROR,
user: req.user,
- action: Action.UPDATE,
- entity: Entity.SETTING,
- module: MODULE_NAME,
- method: 'handleUpdateSetting',
+ action: Action.UPDATE, entity: Entity.SETTING,
+ module: MODULE_NAME, method: 'handleUpdateSetting',
value: settingUpdate.id
});
}

MODIFY
src/server/rest/v1/service/security/SettingSecurity.ts
src/server/rest/v1/service/security/SettingSecurity.ts
-import { AnalyticsSettingsType, AssetConnectionSetting, AssetConnectionType, AssetSettingsType, BillingSettingsType, ConcurRefundSetting, OcpiBusinessDetails, OcpiSetting, PricingSettingsType, RefundSettingsType, RoamingSettingsType, Setting, SettingDB, SettingDBContent, SettingLink, SimplePricingSetting, SmartChargingSettingsType } from '../../../../../types/Setting';
+import { AnalyticsSettingsType, AssetConnectionSetting, AssetConnectionType, AssetSettingsType, BillingSettingsType, ConcurRefundSetting, OcpiBusinessDetails, OcpiSetting, PricingSettingsType, RefundSettingsType, RoamingSettingsType, SettingDB, SettingDBContent, SettingLink, SimplePricingSetting, SmartChargingSettingsType } from '../../../../../types/Setting';
import { HttpSettingRequest, HttpSettingsRequest } from '../../../../../types/requests/HttpSettingRequest';
-import Authorizations from '../../../../../authorization/Authorizations';
-import TenantComponents from '../../../../../types/TenantComponents';
-import UserToken from '../../../../../types/UserToken';
import Utils from '../../../../../utils/Utils';
import UtilsSecurity from './UtilsSecurity';
import sanitize from 'mongo-sanitize';
@@ -190,58 +187,4 @@ export default class SettingSecurity {
}
return settings;
}
-
- public static filterSettingResponse(setting: SettingDB, loggedUser: UserToken, contentFilter = false): SettingDB {
- let filteredSetting: SettingDB;
- if (!setting) {
- return null;
- }
- // Check auth
- if (Authorizations.canReadSetting(loggedUser, setting)) {
- filteredSetting = setting;
- if (contentFilter) {
- filteredSetting.content = SettingSecurity.filterAuthorizedSettingContent(loggedUser, setting);
- }
- // Created By / Last Changed By
- UtilsSecurity.filterCreatedAndLastChanged(
- filteredSetting, setting, loggedUser);
- }
- return filteredSetting;
- }
-
- public static filterSettingsResponse(settings, loggedUser: UserToken, contentFilter = false): SettingDB[] {
- const filteredSettings: SettingDB[] = [];
-
- if (!settings) {
- return null;
- }
- if (!Authorizations.canListSettings(loggedUser)) {
- return null;
- }
- for (const setting of settings) {
- // Filter
- const filteredSetting = SettingSecurity.filterSettingResponse(setting, loggedUser, contentFilter);
- // Ok?
- if (filteredSetting) {
- // Add
- filteredSettings.push(filteredSetting);
- }
- }
- return filteredSettings;
- }
-
- private static filterAuthorizedSettingContent(loggedUser: UserToken, setting: SettingDB) {
- if (!setting.content) {
- return null;
- }
- if (Authorizations.isSuperAdmin(loggedUser) || setting.identifier !== TenantComponents.ANALYTICS) {
- return setting.content;
- }
- if (setting.content.links && Array.isArray(setting.content.links)) {
- const filteredLinks = setting.content.links.filter((link) => !link.role || link.role === '' ||
- (link.role && link.role.includes(loggedUser.role)));
- setting.content.links = filteredLinks;
- }
- return setting.content;
- }
}

MODIFY
src/storage/mongodb/SettingStorage.ts
src/storage/mongodb/SettingStorage.ts
@@ -14,16 +14,16 @@ import Utils from '../../utils/Utils';
const MODULE_NAME = 'SettingStorage';
export default class SettingStorage {
- public static async getSetting(tenantID: string, id: string = Constants.UNKNOWN_OBJECT_ID): Promise<SettingDB> {
+ public static async getSetting(tenantID: string, id: string = Constants.UNKNOWN_OBJECT_ID, projectFields?: string[]): Promise<SettingDB> {
const settingMDB = await SettingStorage.getSettings(tenantID, {
settingID: id
- }, Constants.DB_PARAMS_SINGLE_RECORD);
+ }, Constants.DB_PARAMS_SINGLE_RECORD, projectFields);
return settingMDB.count === 1 ? settingMDB.result[0] : null;
}
- public static async getSettingByIdentifier(tenantID: string, identifier: string = Constants.UNKNOWN_STRING_ID): Promise<SettingDB> {
+ public static async getSettingByIdentifier(tenantID: string, identifier: string = Constants.UNKNOWN_STRING_ID, projectFields?: string[]): Promise<SettingDB> {
const settingsMDB = await SettingStorage.getSettings(
- tenantID, { identifier: identifier }, Constants.DB_PARAMS_SINGLE_RECORD);
+ tenantID, { identifier: identifier }, Constants.DB_PARAMS_SINGLE_RECORD, projectFields);
return settingsMDB.count === 1 ? settingsMDB.result[0] : null;
}

Optimized Settings service