handleGetCompany changes
MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -5,8 +5,10 @@ import User, { UserRole } from '../../../../types/User';
import AppAuthError from '../../../../exception/AppAuthError';
import Authorizations from '../../../../authorization/Authorizations';
+import CompanyStorage from '../../../../storage/mongodb/CompanyStorage';
import Constants from '../../../../utils/Constants';
import { HTTPAuthError } from '../../../../types/HTTPError';
+import { HttpCompanyRequest } from '../../../../types/requests/HttpCompanyRequest';
import { ServerAction } from '../../../../types/Server';
import Site from '../../../../types/Site';
import SiteStorage from '../../../../storage/mongodb/SiteStorage';
@@ -323,6 +325,62 @@ export default class AuthorizationService {
return authorizationFilters;
}
+ // Replace HttpUserRequest with apporpriate
+ public static async checkAndGetCompanyAuthorizationFilters(tenant: Tenant, userToken: UserToken, filteredRequest: HttpCompanyRequest):Promise<AuthorizationFilter> {
+ const authorizationFilters: AuthorizationFilter = {
+ filters: {},
+ projectFields: [
+ 'id', 'name', 'issuer', 'logo', 'address'
+ ],
+ authorized: userToken.role === UserRole.ADMIN,
+ };
+ // Check projection
+ if (!Utils.isEmptyArray(filteredRequest.ProjectFields)) {
+ authorizationFilters.projectFields = authorizationFilters.projectFields.filter((projectField) => filteredRequest.ProjectFields.includes(projectField));
+ }
+ // Not an Admin?
+ if (userToken.role !== UserRole.ADMIN) {
+ if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
+ const companyIDs = await AuthorizationService.getAssignedSitesCompanyIDs(tenant.id, userToken);
+ if (!Utils.isEmptyArray(companyIDs)) {
+ if (!companyIDs.includes(filteredRequest.ID)) {
+ throw new AppAuthError({
+ errorCode: HTTPAuthError.FORBIDDEN,
+ user: userToken,
+ action: Action.READ, entity: Entity.SITE,
+ module: MODULE_NAME, method: 'checkAndGetSiteAuthorizationFilters',
+ });
+ } else {
+ authorizationFilters.authorized = true;
+ }
+ } else {
+ throw new AppAuthError({
+ errorCode: HTTPAuthError.FORBIDDEN,
+ user: userToken,
+ action: Action.READ, entity: Entity.SITE,
+ module: MODULE_NAME, method: 'checkAndGetCompanyAuthorizationFilters',
+ });
+ }
+ } else {
+ authorizationFilters.authorized = true;
+ }
+ }
+ return authorizationFilters;
+ }
+
+ private static async getAssignedSitesCompanyIDs(tenantID: string, userToken: UserToken, siteID?: string): Promise<string[]> {
+ // Get the Company IDs of the assigned Sites
+ const sites = await SiteStorage.getSites(tenantID,
+ {
+ siteIDs: siteID ? [ siteID ] : null,
+ userID: userToken.id,
+ issuer: true,
+ }, Constants.DB_PARAMS_MAX_LIMIT,
+ [ 'companyID' ]
+ );
+ return sites.result.map((site) => site.companyID);
+ }
+
private static async getSiteAdminSiteIDs(tenantID: string, userToken: UserToken): Promise<string[]> {
// Get the Sites where the user is Site Admin
const userSites = await UserStorage.getUserSites(tenantID,

MODIFY
src/server/rest/v1/service/CompanyService.ts
src/server/rest/v1/service/CompanyService.ts
@@ -4,6 +4,7 @@ import { NextFunction, Request, Response } from 'express';
import AppAuthError from '../../../../exception/AppAuthError';
import AppError from '../../../../exception/AppError';
+import AuthorizationService from './AuthorizationService';
import Authorizations from '../../../../authorization/Authorizations';
import Company from '../../../../types/Company';
import CompanySecurity from './security/CompanySecurity';
@@ -85,10 +86,17 @@ export default class CompanyService {
value: filteredRequest.ID
});
}
- // Get it
+ // Get authorization filters
+ const authorizationCompanyFilters = await AuthorizationService.checkAndGetCompanyAuthorizationFilters(req.tenant, req.user, filteredRequest);
+ // Get company
const company = await CompanyStorage.getCompany(req.user.tenantID, filteredRequest.ID,
- { withLogo: true },
- [ 'id', 'name', 'issuer', 'logo', 'address' ]);
+ {
+ withLogo: true,
+ ...authorizationCompanyFilters.filters
+ },
+ authorizationCompanyFilters.projectFields
+ );
+ // Check Company exists
UtilsService.assertObjectExists(action, company, `Company with ID '${filteredRequest.ID}' does not exist`,
MODULE_NAME, 'handleGetCompany', req.user);
// Return

MODIFY
src/types/requests/HttpCompanyRequest.ts
src/types/requests/HttpCompanyRequest.ts
import HttpByIDRequest from './HttpByIDRequest';
import HttpDatabaseRequest from './HttpDatabaseRequest';
+export type HttpCompanyRequest = HttpByIDRequest;
+
export interface HttpCompaniesRequest extends HttpDatabaseRequest {
Search?: string;
Issuer?: boolean;

handleGetCompany changes