Same issue in handleRevokeRegistrationToken() as for handleUpdateRegistrationToken
MODIFY
src/server/rest/v1/service/RegistrationTokenService.ts
src/server/rest/v1/service/RegistrationTokenService.ts
@@ -170,8 +170,13 @@ export default class RegistrationTokenService {
static async handleRevokeRegistrationToken(action: ServerAction, req: Request, res: Response, next: NextFunction): Promise<void> {
const tokenID = RegistrationTokenSecurity.filterRegistrationTokenByIDRequest(req.query);
+ UtilsService.assertIdIsProvided(action, tokenID, MODULE_NAME, 'handleDeleteRegistrationToken', req.user);
+ // Get Token
+ const registrationToken = await RegistrationTokenStorage.getRegistrationToken(req.user.tenantID, tokenID);
+ UtilsService.assertObjectExists(action, registrationToken, `Registration Token '${tokenID}' does not exist`,
+ MODULE_NAME, 'handleRevokeRegistrationToken', req.user);
// Check auth
- if (!Authorizations.canUpdateRegistrationToken(req.user, req.body.siteAreaID)) {
+ if (!Authorizations.canUpdateRegistrationToken(req.user, registrationToken.siteArea?.siteID)) {
throw new AppAuthError({
errorCode: HTTPAuthError.ERROR,
user: req.user,
@@ -180,11 +185,6 @@ export default class RegistrationTokenService {
value: tokenID
});
}
- UtilsService.assertIdIsProvided(action, tokenID, MODULE_NAME, 'handleDeleteRegistrationToken', req.user);
- // Get Token
- const registrationToken = await RegistrationTokenStorage.getRegistrationToken(req.user.tenantID, tokenID);
- UtilsService.assertObjectExists(action, registrationToken, `Registration Token '${tokenID}' does not exist`,
- MODULE_NAME, 'handleRevokeRegistrationToken', req.user);
// Update
registrationToken.revocationDate = new Date();
registrationToken.lastChangedBy = { 'id': req.user.id };

Same issue in handleRevokeRegistrationToken() as for handleUpdateRegistrationToken