Fixed Site Admin cannot Soft Stop his Transaction
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -253,8 +253,21 @@ export default class Authorizations {
return Authorizations.canPerformAction(loggedUser, Entity.REPORT, Action.READ);
}
- public static async canUpdateTransaction(loggedUser: UserToken): Promise<boolean> {
- return Authorizations.canPerformAction(loggedUser, Entity.TRANSACTION, Action.UPDATE);
+ public static async canUpdateTransaction(loggedUser: UserToken, transaction: Transaction): Promise<boolean> {
+ if (!transaction) {
+ return false;
+ }
+ const context: AuthorizationContext = {
+ user: transaction.userID,
+ owner: loggedUser.id,
+ tagIDs: loggedUser.tagIDs,
+ tagID: transaction.tagID,
+ site: transaction.siteID,
+ sites: loggedUser.sites,
+ sitesAdmin: loggedUser.sitesAdmin,
+ sitesOwner: loggedUser.sitesOwner
+ };
+ return Authorizations.canPerformAction(loggedUser, Entity.TRANSACTION, Action.UPDATE, context);
}
public static async canDeleteTransaction(loggedUser: UserToken): Promise<boolean> {

MODIFY
src/authorization/AuthorizationsDefinition.ts
src/authorization/AuthorizationsDefinition.ts
@@ -723,7 +723,7 @@ export const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
},
{ resource: Entity.TRANSACTION, action: [Action.LIST, Action.EXPORT] },
{
- resource: Entity.TRANSACTION, action: [Action.READ],
+ resource: Entity.TRANSACTION, action: [Action.READ, Action.UPDATE],
condition: {
Fn: 'OR',
args: [
@@ -1128,7 +1128,7 @@ export const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
},
},
{
- resource: Entity.TRANSACTION, action: [Action.READ],
+ resource: Entity.TRANSACTION, action: [Action.READ, Action.UPDATE],
condition: {
Fn: 'LIST_CONTAINS',
args: { 'sitesAdmin': '$.site' }

MODIFY
src/server/rest/v1/service/TransactionService.ts
src/server/rest/v1/service/TransactionService.ts
@@ -174,8 +174,12 @@ export default class TransactionService {
const filteredRequest = TransactionValidator.getInstance().validateTransactionCdrPushReq(req.body);
// Check Mandatory fields
UtilsService.assertIdIsProvided(action, filteredRequest.transactionId, MODULE_NAME, 'handlePushTransactionCdr', req.user);
+ // Check Transaction
+ const transaction = await TransactionStorage.getTransaction(req.tenant, filteredRequest.transactionId, { withUser: true, withTag: true });
+ UtilsService.assertObjectExists(action, transaction, `Transaction ID '${filteredRequest.transactionId}' does not exist`,
+ MODULE_NAME, 'handlePushTransactionCdr', req.user);
// Check auth
- if (!await Authorizations.canUpdateTransaction(req.user)) {
+ if (!await Authorizations.canUpdateTransaction(req.user, transaction)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
@@ -184,10 +188,6 @@ export default class TransactionService {
value: filteredRequest.transactionId.toString()
});
}
- // Check Transaction
- const transaction = await TransactionStorage.getTransaction(req.tenant, filteredRequest.transactionId, { withUser: true, withTag: true });
- UtilsService.assertObjectExists(action, transaction, `Transaction ID '${filteredRequest.transactionId}' does not exist`,
- MODULE_NAME, 'handlePushTransactionCdr', req.user);
// Check Charging Station
const chargingStation = await ChargingStationStorage.getChargingStation(req.tenant, transaction.chargeBoxID);
UtilsService.assertObjectExists(action, chargingStation, `Charging Station ID '${transaction.chargeBoxID}' does not exist`,
@@ -330,8 +330,12 @@ export default class TransactionService {
const transactionId = TransactionValidator.getInstance().validateTransactionGetReq(req.body).ID;
// Transaction Id is mandatory
UtilsService.assertIdIsProvided(action, transactionId, MODULE_NAME, 'handleTransactionSoftStop', req.user);
+ // Get Transaction
+ const transaction = await TransactionStorage.getTransaction(req.tenant, transactionId);
+ UtilsService.assertObjectExists(action, transaction, `Transaction ID ${transactionId} does not exist`,
+ MODULE_NAME, 'handleTransactionSoftStop', req.user);
// Check auth
- if (!await Authorizations.canUpdateTransaction(req.user)) {
+ if (!await Authorizations.canUpdateTransaction(req.user, transaction)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
@@ -340,10 +344,6 @@ export default class TransactionService {
value: transactionId.toString()
});
}
- // Get Transaction
- const transaction = await TransactionStorage.getTransaction(req.tenant, transactionId);
- UtilsService.assertObjectExists(action, transaction, `Transaction ID ${transactionId} does not exist`,
- MODULE_NAME, 'handleTransactionSoftStop', req.user);
// Get the Charging Station
const chargingStation = await ChargingStationStorage.getChargingStation(req.tenant, transaction.chargeBoxID, { withSiteArea: true });
UtilsService.assertObjectExists(action, chargingStation, `Charging Station ID '${transaction.chargeBoxID}' does not exist`,

Fixed Site Admin cannot Soft Stop his Transaction