Upgate handleGetSite logic (previous was handleGetSites)
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -370,12 +370,12 @@ export default class Authorizations {
{ user: userID, owner: loggedUser.id });
}
- public static async canListSites(loggedUser: UserToken): Promise<boolean> {
- return Authorizations.canPerformAction(loggedUser, Entity.SITES, Action.LIST);
+ public static async canListSites(loggedUser: UserToken, authContext?: AuthorizationContext): Promise<AuthorizationResult> {
+ return Authorizations.can(loggedUser, Entity.SITES, Action.LIST, authContext);
}
- public static async canReadSite(loggedUser: UserToken): Promise<boolean> {
- return Authorizations.canPerformAction(loggedUser, Entity.SITE, Action.READ);
+ public static async canReadSite(loggedUser: UserToken, authContext?: AuthorizationContext): Promise<AuthorizationResult> {
+ return Authorizations.can(loggedUser, Entity.SITE, Action.READ, authContext);
}
public static async canCreateSite(loggedUser: UserToken): Promise<boolean> {

MODIFY
src/authorization/dynamic-data-source/AssignedSitesDynamicAuthorizationDataSource.ts
src/authorization/dynamic-data-source/AssignedSitesDynamicAuthorizationDataSource.ts
@@ -21,7 +21,7 @@ export default class AssignedSitesDynamicAuthorizationDataSource
}
private async getAssignedSiteIDs(): Promise<string[]> {
- // Get the Company IDs of the assigned Sites
+ // Get the Site IDs of the assigned Sites
const sites = await SiteStorage.getSites(this.tenant.id,
{
userID: this.userToken.id,

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -48,31 +48,33 @@ export default class AuthorizationService {
}
}
- public static async checkAndGetSiteAuthorizationFilters(
- tenant: Tenant, userToken: UserToken, filteredRequest: HttpSiteRequest, action: ServerAction): Promise<AuthorizationFilter> {
+ public static async checkAndGetSiteAuthorizationFilters(tenant: Tenant, userToken: UserToken,
+ filteredRequest: HttpSiteRequest): Promise<AuthorizationFilter> {
const authorizationFilters: AuthorizationFilter = {
filters: {},
dataSources: new Map(),
- projectFields: [
- 'id', 'name', 'issuer', 'image', 'address', 'companyID', 'company.name', 'autoUserSiteAssignment', 'public'
- ],
- authorized: userToken.role === UserRole.ADMIN,
+ projectFields: [],
+ authorized: false,
};
+ // Check static auth
+ const authorizationContext: AuthorizationContext = {};
+ const authResult = await Authorizations.canReadSite(userToken, authorizationContext);
+ authorizationFilters.authorized = authResult.authorized;
+ // Check
+ if (!authorizationFilters.authorized) {
+ throw new AppAuthError({
+ errorCode: HTTPAuthError.FORBIDDEN,
+ user: userToken,
+ action: Action.READ, entity: Entity.SITE,
+ module: MODULE_NAME, method: 'checkAndGetSiteAuthorizationFilters',
+ });
+ }
+ // Process dynamic filters
+ await AuthorizationService.processDynamicFilters(tenant, userToken, Action.READ, Entity.SITE,
+ authorizationFilters, authorizationContext, { SiteID: filteredRequest.ID });
// Filter projected fields
authorizationFilters.projectFields = AuthorizationService.filterProjectFields(
authorizationFilters.projectFields, filteredRequest.ProjectFields);
- // Not an Admin user?
- if (userToken.role !== UserRole.ADMIN) {
- if (action === ServerAction.SITE_UPDATE) {
- // Check assigned Site
- await AuthorizationService.checkAssignedSiteAdmins(
- tenant, userToken, { SiteID: filteredRequest.ID }, authorizationFilters);
- } else {
- // Check assigned Site
- await AuthorizationService.checkAssignedSites(
- tenant, userToken, { SiteID: filteredRequest.ID }, authorizationFilters);
- }
- }
return authorizationFilters;
}

MODIFY
src/server/rest/v1/service/SiteService.ts
src/server/rest/v1/service/SiteService.ts
@@ -272,7 +272,6 @@ export default class SiteService {
Action.READ, Entity.SITE, MODULE_NAME, 'handleGetSite');
// Filter request
const filteredRequest = SiteSecurity.filterSiteRequest(req.query);
- // Check Mandatory fields
UtilsService.assertIdIsProvided(action, filteredRequest.ID, MODULE_NAME, 'handleGetSite', req.user);
// Check and Get Site
const site = await UtilsService.checkAndGetSiteAuthorization(
@@ -280,9 +279,6 @@ export default class SiteService {
withCompany: filteredRequest.WithCompany,
withImage: true,
}, true);
- // Add authorizations
- // todo: add back
- // await AuthorizationService.addSiteAuthorizations(req.tenant, req.user, site);
// Return
res.json(site);
next();

MODIFY
src/server/rest/v1/service/UtilsService.ts
src/server/rest/v1/service/UtilsService.ts
@@ -216,21 +216,11 @@ export default class UtilsService {
public static async checkAndGetSiteAuthorization(tenant: Tenant, userToken: UserToken, siteID: string, authAction: Action,
action: ServerAction, additionalFilters: Record<string, any>, applyProjectFields = false): Promise<Site> {
- // Check static auth for reading site
- if (!await Authorizations.canReadSite(userToken)) {
- throw new AppAuthError({
- errorCode: HTTPAuthError.FORBIDDEN,
- user: userToken,
- action: Action.READ, entity: Entity.SITE,
- module: MODULE_NAME, method: 'checkAndGetSiteAuthorization',
- value: siteID
- });
- }
// Check mandatory fields
UtilsService.assertIdIsProvided(action, siteID, MODULE_NAME, 'checkAndGetSiteAuthorization', userToken);
// Get dynamic auth
const authorizationFilter = await AuthorizationService.checkAndGetSiteAuthorizationFilters(
- tenant, userToken, { ID: siteID }, action);
+ tenant, userToken, { ID: siteID });
if (!authorizationFilter.authorized) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
@@ -262,7 +252,7 @@ export default class UtilsService {
});
}
// Add actions
- await AuthorizationService.addSiteAuthorizations(tenant, userToken, site);
+ await AuthorizationService.addSiteAuthorizations(tenant, userToken, site, authorizationFilter);
// Check
const authorized = AuthorizationService.canPerfomAction(site, authAction);
if (!authorized) {

Upgate handleGetSite logic (previous was handleGetSites)