Fix user check
MODIFY
src/server/rest/v1/service/CarService.ts
src/server/rest/v1/service/CarService.ts
@@ -582,7 +582,7 @@ export default class CarService {
UtilsService.assertObjectExists(action, foundUser, `User ID '${userToCheck.user.id}' does not exist`,
MODULE_NAME, 'handleAssignCarUsers', loggedUser);
// Auth
- if (!(await Authorizations.canReadUser(loggedUser)).authorized) {
+ if (!(await Authorizations.canReadUser(loggedUser, { UserID: foundUser.id })).authorized) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: loggedUser,

MODIFY
src/server/rest/v1/service/TransactionService.ts
src/server/rest/v1/service/TransactionService.ts
@@ -566,7 +566,7 @@ export default class TransactionService {
});
}
// Check User
- if (!(await Authorizations.canReadUser(req.user)).authorized) {
+ if (!(await Authorizations.canReadUser(req.user, { UserID: transaction.userID })).authorized) {
// Remove User
delete transaction.user;
delete transaction.userID;

MODIFY
src/server/rest/v1/service/UserService.ts
src/server/rest/v1/service/UserService.ts
@@ -69,7 +69,7 @@ export default class UserService {
const userID = UserSecurity.filterDefaultTagCarRequestByUserID(req.query);
UtilsService.assertIdIsProvided(action, userID, MODULE_NAME, 'handleGetUserDefaultTagCar', req.user);
// Check auth
- if (!(await Authorizations.canReadUser(req.user)).authorized) {
+ if (!(await Authorizations.canReadUser(req.user, { UserID: userID })).authorized) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
@@ -151,7 +151,7 @@ export default class UserService {
});
}
// Check auth
- if (!(await Authorizations.canReadUser(req.user)).authorized) {
+ if (!(await Authorizations.canReadUser(req.user, { UserID: filteredRequest.userID })).authorized) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
@@ -589,7 +589,7 @@ export default class UserService {
const filteredRequest = UserSecurity.filterUserRequest(req.query);
UtilsService.assertIdIsProvided(action, filteredRequest.ID, MODULE_NAME, 'handleGetUser', req.user);
// Check auth
- if (!(await Authorizations.canReadUser(req.user)).authorized) {
+ if (!(await Authorizations.canReadUser(req.user, { UserID: filteredRequest.ID })).authorized) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
@@ -620,7 +620,7 @@ export default class UserService {
const userID = UserSecurity.filterUserByIDRequest(req.query);
UtilsService.assertIdIsProvided(action, userID, MODULE_NAME, 'handleGetUserImage', req.user);
// Check auth
- if (!(await Authorizations.canReadUser(req.user)).authorized) {
+ if (!(await Authorizations.canReadUser(req.user, { UserID: userID })).authorized) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
@@ -668,7 +668,7 @@ export default class UserService {
const filteredRequest = UserSecurity.filterUserSitesRequest(req.query);
UtilsService.assertIdIsProvided(action, filteredRequest.UserID, MODULE_NAME, 'handleGetSites', req.user);
// Check auth
- if (!(await Authorizations.canReadUser(req.user)).authorized) {
+ if (!(await Authorizations.canReadUser(req.user, { UserID: filteredRequest.UserID })).authorized) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,

Fix user check