Align company check like charging station
MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -465,20 +465,15 @@ export default class AuthorizationService {
};
// Check projection
if (!Utils.isEmptyArray(filteredRequest.ProjectFields)) {
- authorizationFilters.projectFields = authorizationFilters.projectFields.filter((projectField) => filteredRequest.ProjectFields.includes(projectField));
+ authorizationFilters.projectFields = authorizationFilters.projectFields.filter(
+ (projectField) => filteredRequest.ProjectFields.includes(projectField));
}
// Not an Admin?
if (userToken.role !== UserRole.ADMIN) {
if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
+ // Get Company IDs from sssigned Sites
const companyIDs = await AuthorizationService.getAssignedSitesCompanyIDs(tenant.id, userToken);
- if (Utils.isEmptyArray(companyIDs) || !companyIDs.includes(filteredRequest.ID)) {
- throw new AppAuthError({
- errorCode: HTTPAuthError.FORBIDDEN,
- user: userToken,
- action: Action.READ, entity: Entity.COMPANY,
- module: MODULE_NAME, method: 'checkAndGetCompanyAuthorizationFilters',
- });
- } else {
+ if (!Utils.isEmptyArray(companyIDs) && companyIDs.includes(filteredRequest.ID)) {
authorizationFilters.authorized = true;
}
} else {
@@ -630,6 +625,7 @@ export default class AuthorizationService {
}
// Not an Admin?
if (userToken.role !== UserRole.ADMIN) {
+ if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
// Get assigned Site IDs assigned to user from DB
const siteIDs = await AuthorizationService.getAssignedSiteIDs(tenant.id, userToken);
if (!Utils.isEmptyArray(siteIDs)) {
@@ -639,6 +635,9 @@ export default class AuthorizationService {
if (!Utils.isEmptyArray(authorizationFilters.filters.siteIDs)) {
authorizationFilters.authorized = true;
}
+ } else {
+ authorizationFilters.authorized = true;
+ }
}
return authorizationFilters;
}

MODIFY
src/server/rest/v1/service/ChargingStationService.ts
src/server/rest/v1/service/ChargingStationService.ts
@@ -982,8 +982,8 @@ export default class ChargingStationService {
// check dynamic auth
const chargingStationAuthorizationFilters =
await AuthorizationService.checkAndGetChargingStationAuthorizationFilters(req.tenant, req.user, filteredRequest);
- if (!chargingStationAuthorizationFilters.authorized) {
// Force the failure
+ if (!chargingStationAuthorizationFilters.authorized) {
UtilsService.assertObjectExists(action, null, `Charging Station '${filteredRequest.ID}' does not exist`,
MODULE_NAME, 'handleGetChargingStation', req.user);
return;
@@ -1234,7 +1234,7 @@ export default class ChargingStationService {
const chargingStation = await ChargingStationStorage.getChargingStation(req.user.tenantID, filteredRequest.chargeBoxID);
UtilsService.assertObjectExists(action, chargingStation, `Charging Station with ID '${filteredRequest.chargeBoxID}' does not exist`,
MODULE_NAME, 'handleAction', req.user);
- let result;
+ let result = null;
// Remote Stop Transaction / Unlock Connector
if (command === Command.REMOTE_STOP_TRANSACTION) {
// Check Transaction ID

MODIFY
src/server/rest/v1/service/CompanyService.ts
src/server/rest/v1/service/CompanyService.ts
@@ -41,6 +41,12 @@ export default class CompanyService {
// Get authorization filters
const authorizationCompanyFilters = await AuthorizationService.checkAndGetCompanyAuthorizationFilters(
req.tenant, req.user, { ID: companyID });
+ // Force the failure
+ if (!authorizationCompanyFilters.authorized) {
+ UtilsService.assertObjectExists(action, null, `Company with ID '${companyID}' does not exist`,
+ MODULE_NAME, 'handleDeleteCompany', req.user);
+ return;
+ }
// Get
const company = await CompanyStorage.getCompany(req.user.tenantID, companyID, authorizationCompanyFilters.filters);
UtilsService.assertObjectExists(action, company, `Company with ID '${companyID}' does not exist`,
@@ -89,7 +95,14 @@ export default class CompanyService {
// Check mandatory fields
UtilsService.assertIdIsProvided(action, filteredRequest.ID, MODULE_NAME, 'handleGetCompany', req.user);
// Check dynamic auth
- const authorizationCompanyFilters = await AuthorizationService.checkAndGetCompanyAuthorizationFilters(req.tenant, req.user, filteredRequest);
+ const authorizationCompanyFilters =
+ await AuthorizationService.checkAndGetCompanyAuthorizationFilters(req.tenant, req.user, filteredRequest);
+ // Force the failure
+ if (!authorizationCompanyFilters.authorized) {
+ UtilsService.assertObjectExists(action, null, `Company with ID '${filteredRequest.ID}' does not exist`,
+ MODULE_NAME, 'handleGetCompany', req.user);
+ return;
+ }
// Get company
const company = await CompanyStorage.getCompany(req.user.tenantID, filteredRequest.ID,
{
@@ -240,6 +253,12 @@ export default class CompanyService {
// Check dynamic auth
const authorizationCompanyFilters = await AuthorizationService.checkAndGetCompanyAuthorizationFilters(
req.tenant, req.user, { ID: filteredRequest.id });
+ // Force the failure
+ if (!authorizationCompanyFilters.authorized) {
+ UtilsService.assertObjectExists(action, null, `Company with ID '${filteredRequest.id}' does not exist`,
+ MODULE_NAME, 'handleUpdateCompany', req.user);
+ return;
+ }
// Get Company
const company = await CompanyStorage.getCompany(req.user.tenantID, filteredRequest.id, authorizationCompanyFilters.filters);
UtilsService.assertObjectExists(action, company, `Company with ID '${filteredRequest.id}' does not exist`,

Align company check like charging station