security: added authorization for sub-account creation
MODIFY
src/authorization/AuthorizationsDefinition.ts
src/authorization/AuthorizationsDefinition.ts
@@ -373,7 +373,7 @@ export const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
'dimensions.parkingTime.active', 'dimensions.parkingTime.price', 'dimensions.parkingTime.stepSize', 'dimensions.parkingTime.pricedData',
]
},
- { resource: Entity.BILLING, action: [Action.CHECK_CONNECTION, Action.CLEAR_BILLING_TEST_DATA] },
+ { resource: Entity.BILLING, action: [Action.CHECK_CONNECTION, Action.CLEAR_BILLING_TEST_DATA, Action.BILLING_CREATE_SUB_ACCOUNT] },
{ resource: Entity.TAX, action: [Action.LIST] },
{
resource: Entity.INVOICE, action: [Action.LIST],

MODIFY
src/server/rest/v1/service/BillingService.ts
src/server/rest/v1/service/BillingService.ts
@@ -475,8 +475,10 @@ export default class BillingService {
public static async handleCreateSubAccount(action: ServerAction, req: Request, res: Response, next: NextFunction): Promise<void> {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.BILLING,
- Action.CREATE, Entity.BILLING_SUB_ACCOUNT, MODULE_NAME, 'handleCreateSubAccount');
+ Action.CREATE, Entity.BILLING, MODULE_NAME, 'handleCreateSubAccount');
const filteredRequest = BillingValidator.getInstance().validateBillingCreateSubAccountReq(req.body);
+ // Check authorization
+ await AuthorizationService.checkAndGetBillingAuthorizations(req.tenant, req.user, Action.BILLING_CREATE_SUB_ACCOUNT);
// Get the billing impl
const billingImpl = await BillingFactory.getBillingImpl(req.tenant);
if (!billingImpl) {

MODIFY
src/types/Authorization.ts
src/types/Authorization.ts
@@ -76,7 +76,6 @@ export enum Entity {
PRICING = 'Pricing',
PRICING_DEFINITION = 'PricingDefinition',
BILLING = 'Billing',
- BILLING_SUB_ACCOUNT = 'BillingSubAccount',
SETTING = 'Setting',
ASYNC_TASK = 'AsyncTask',
OCPI_ENDPOINT = 'OcpiEndpoint',
@@ -135,6 +134,7 @@ export enum Action {
BILLING_PAYMENT_METHODS = 'BillingPaymentMethods',
BILLING_DELETE_PAYMENT_METHOD = 'BillingDeletePaymentMethod',
BILLING_CHARGE_INVOICE = 'BillingChargeInvoice',
+ BILLING_CREATE_SUB_ACCOUNT = 'BillingCreateSubAccount',
CHECK_CONNECTION = 'CheckConnection',
CLEAR_BILLING_TEST_DATA = 'ClearBillingTestData',
RETRIEVE_CONSUMPTION = 'RetrieveConsumption',

security: added authorization for sub-account creation