Add check on Org component in PoC Authorization Service
MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -11,6 +11,7 @@ import { ServerAction } from '../../../../types/Server';
import Site from '../../../../types/Site';
import SiteStorage from '../../../../storage/mongodb/SiteStorage';
import Tenant from '../../../../types/Tenant';
+import TenantComponents from '../../../../types/TenantComponents';
import UserStorage from '../../../../storage/mongodb/UserStorage';
import UserToken from '../../../../types/UserToken';
import Utils from '../../../../utils/Utils';
@@ -33,6 +34,7 @@ export default class AuthorizationService {
}
// Not an Admin?
if (userToken.role !== UserRole.ADMIN) {
+ if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
// Get Site IDs from Site Admin flag
const siteIDs = await AuthorizationService.getAssignedSiteIDs(tenant.id, userToken, filteredRequest.ID);
if (Utils.isEmptyArray(siteIDs)) {
@@ -43,6 +45,9 @@ export default class AuthorizationService {
module: MODULE_NAME, method: 'checkAndGetSiteAuthorizationFilters',
});
}
+ } else {
+ authorizationFilters.authorized = true;
+ }
}
return authorizationFilters;
}
@@ -82,6 +87,7 @@ export default class AuthorizationService {
}
// Not an Admin?
if (userToken.role !== UserRole.ADMIN) {
+ if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
// Get Site IDs from Site Admin flag
const siteIDs = await AuthorizationService.getAssignedSiteIDs(tenant.id, userToken);
if (!Utils.isEmptyArray(siteIDs)) {
@@ -98,6 +104,9 @@ export default class AuthorizationService {
if (!Utils.isEmptyArray(authorizationFilters.filters.siteIDs)) {
authorizationFilters.authorized = true;
}
+ } else {
+ authorizationFilters.authorized = true;
+ }
}
return authorizationFilters;
}
@@ -117,6 +126,7 @@ export default class AuthorizationService {
}
// Not an Admin?
if (userToken.role !== UserRole.ADMIN) {
+ if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
// Get Site IDs from Site Admin flag
const siteIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
if (!Utils.isEmptyArray(siteIDs)) {
@@ -133,6 +143,9 @@ export default class AuthorizationService {
if (!Utils.isEmptyArray(authorizationFilters.filters.siteIDs)) {
authorizationFilters.authorized = true;
}
+ } else {
+ authorizationFilters.authorized = true;
+ }
}
return authorizationFilters;
}
@@ -152,6 +165,7 @@ export default class AuthorizationService {
}
// Not an Admin?
if (userToken.role !== UserRole.ADMIN) {
+ if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
// Get Site IDs from Site Admin flag
const siteIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
if (!Utils.isEmptyArray(siteIDs)) {
@@ -161,6 +175,9 @@ export default class AuthorizationService {
if (!Utils.isEmptyArray(authorizationFilters.filters.siteIDs)) {
authorizationFilters.authorized = true;
}
+ } else {
+ authorizationFilters.authorized = true;
+ }
}
return authorizationFilters;
}
@@ -180,6 +197,7 @@ export default class AuthorizationService {
}
// Not an Admin?
if (userToken.role !== UserRole.ADMIN) {
+ if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
// Get Site IDs from Site Admin flag
const siteIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
// Get User IDs from Site Admin flag
@@ -213,6 +231,9 @@ export default class AuthorizationService {
module: MODULE_NAME, method: 'checkAndAssignSiteUsersAuthorizationFilters'
});
}
+ } else {
+ authorizationFilters.authorized = true;
+ }
}
return authorizationFilters;
}
@@ -224,7 +245,8 @@ export default class AuthorizationService {
projectFields: [
'id', 'name', 'firstName', 'email', 'role', 'status', 'issuer',
'createdOn', 'lastChangedOn', 'errorCodeDetails', 'errorCode'
- ]
+ ],
+ authorized: userToken.role === UserRole.ADMIN,
};
// Check projection
if (!Utils.isEmptyArray(filteredRequest.ProjectFields)) {
@@ -255,7 +277,8 @@ export default class AuthorizationService {
'id', 'name', 'firstName', 'email', 'role', 'status', 'issuer', 'createdOn', 'createdBy',
'lastChangedOn', 'lastChangedBy', 'eulaAcceptedOn', 'eulaAcceptedVersion', 'locale',
'billingData.customerID', 'billingData.lastChangedOn'
- ]
+ ],
+ authorized: userToken.role === UserRole.ADMIN,
};
// Check projection
if (!Utils.isEmptyArray(filteredRequest.ProjectFields)) {
@@ -263,6 +286,7 @@ export default class AuthorizationService {
}
// Get from users
if (userToken.role === UserRole.BASIC) {
+ if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
// Must be Site Admin as only Basic User with site admin role can access list of users
const siteIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
// Force the filter
@@ -276,6 +300,9 @@ export default class AuthorizationService {
authorizationFilters.filters.siteIDs = filteredSiteIDs.filter(
(siteID) => authorizationFilters.filters.siteIDs.includes(siteID));
}
+ } else {
+ authorizationFilters.authorized = true;
+ }
}
return authorizationFilters;
}
@@ -287,7 +314,8 @@ export default class AuthorizationService {
projectFields: [
'id', 'name', 'firstName', 'email', 'role', 'status', 'issuer', 'locale', 'deleted', 'plateID',
'notificationsActive', 'notifications', 'phone', 'mobile', 'iNumber', 'costCenter', 'address'
- ]
+ ],
+ authorized: userToken.role === UserRole.ADMIN,
};
// Check projection
if (!Utils.isEmptyArray(filteredRequest.ProjectFields)) {
@@ -295,12 +323,16 @@ export default class AuthorizationService {
}
// Not an Admin?
if (userToken.role !== UserRole.ADMIN) {
+ if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
// Must be Site Admin as only Basic User with site admin role can access list of users
const siteIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
// Force the filter
if (!Utils.isEmptyArray(siteIDs)) {
authorizationFilters.filters.siteIDs = siteIDs;
}
+ } else {
+ authorizationFilters.authorized = true;
+ }
}
return authorizationFilters;
}

Add check on Org component in PoC Authorization Service