Change DeleteSiteArea logic
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -538,9 +538,8 @@ export default class Authorizations {
});
}
- public static canDeleteSiteArea(loggedUser: UserToken, siteID: string): boolean {
- return Authorizations.canPerformAction(loggedUser, Entity.SITE_AREA, Action.DELETE,
- { site: siteID, sites: loggedUser.sitesAdmin });
+ public static canDeleteSiteArea(loggedUser: UserToken): boolean {
+ return Authorizations.canPerformAction(loggedUser, Entity.SITE_AREA, Action.DELETE);
}
public static canListCompanies(loggedUser: UserToken): boolean {

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -481,11 +481,39 @@ export default class AuthorizationService {
}
public static async checkCreateSiteAreaAuthorization(tenant: Tenant, userToken: UserToken, siteID: string): Promise<boolean> {
- const { siteAdminIDs, siteOwnerIDs } = await AuthorizationService.getSiteAdminOwnerIDs(tenant, userToken);
+ const authorized = true;
+ // Not an Admin?
+ if (userToken.role !== UserRole.ADMIN) {
+ const siteAdminIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
if (Utils.isEmptyArray(siteAdminIDs) || !siteAdminIDs.includes(siteID)) {
- return false;
+ throw new AppAuthError({
+ errorCode: HTTPAuthError.FORBIDDEN,
+ user: userToken,
+ action: Action.CREATE, entity: Entity.SITE_AREA,
+ module: MODULE_NAME, method: 'checkCreateSiteAreaAuthorization',
+ });
+ }
}
- return true;
+ return authorized;
+ }
+
+ public static async checkDeleteSiteAreaAuthorization(tenant: Tenant, userToken: UserToken, siteAreaID: string): Promise<boolean> {
+ const authorized = true;
+ // Not an Admin?
+ if (userToken.role !== UserRole.ADMIN) {
+ const siteAreaIDs = await AuthorizationService.getAssignedSiteAreaIDs(tenant.id, userToken),
+ siteID = await AuthorizationService.getSiteAreaSiteID(tenant.id, siteAreaID),
+ sitesAdminIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
+ if (Utils.isEmptyArray(siteAreaIDs) || !siteAreaIDs.includes(siteAreaID) || !sitesAdminIDs.includes(siteID)) {
+ throw new AppAuthError({
+ errorCode: HTTPAuthError.FORBIDDEN,
+ user: userToken,
+ action: Action.DELETE, entity: Entity.SITE_AREA,
+ module: MODULE_NAME, method: 'checkDeleteSiteAreaAuthorization',
+ });
+ }
+ }
+ return authorized;
}
public static async checkAndGetSiteAreaAuthorizationFilters(tenant: Tenant, userToken: UserToken, filteredRequest: HttpSiteAreaRequest): Promise<AuthorizationFilter> {
@@ -678,5 +706,10 @@ export default class AuthorizationService {
);
return _.uniq(_.map(siteAreas.result, 'id'));
}
-}
+ private static async getSiteAreaSiteID(tenantID: string, siteAreaID: string) {
+ // Get the Site IDs of SiteArea
+ const siteArea = await SiteAreaStorage.getSiteArea(tenantID, siteAreaID);
+ return siteArea.siteID;
+ }
+}

MODIFY
src/server/rest/v1/service/SiteAreaService.ts
src/server/rest/v1/service/SiteAreaService.ts
@@ -221,8 +221,9 @@ export default class SiteAreaService {
const siteAreaID = SiteAreaSecurity.filterSiteAreaRequestByID(req.query);
// Check Mandatory fields
UtilsService.assertIdIsProvided(action, siteAreaID, MODULE_NAME, 'handleDeleteSiteArea', req.user);
- // Check statuc auth
- if (!Authorizations.canDeleteSiteArea(req.user, siteAreaID)) {
+ // Check static auth
+ const deleteSiteAreaAuthorization = await AuthorizationService.checkDeleteSiteAreaAuthorization(req.tenant,req.user, siteAreaID);
+ if (!Authorizations.canDeleteSiteArea(req.user) || !deleteSiteAreaAuthorization) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
@@ -231,9 +232,20 @@ export default class SiteAreaService {
value: siteAreaID
});
}
+ // Check static auth for reading SiteArea
+ if (!Authorizations.canReadSiteArea(req.user)) {
+ throw new AppAuthError({
+ errorCode: HTTPAuthError.FORBIDDEN,
+ user: req.user,
+ action: Action.READ, entity: Entity.SITE_AREA,
+ module: MODULE_NAME, method: 'handleDeleteSiteArea'
+ });
+ }
+ // Check dynamic auth for reading SiteArea
+ const readSiteAreaAuthorizationFilters = await AuthorizationService.checkAndGetSiteAreaAuthorizationFilters(req.tenant, req.user, { ID: siteAreaID });
// Get
- // todo: check and get... (can read); check it exists
- const siteArea = await SiteAreaStorage.getSiteArea(req.user.tenantID, siteAreaID);
+ const siteArea = await SiteAreaStorage.getSiteArea(req.user.tenantID, siteAreaID, readSiteAreaAuthorizationFilters.filters);
+ // Check SiteArea exists
UtilsService.assertObjectExists(action, siteArea, `Site Area with ID '${siteAreaID}' does not exist`,
MODULE_NAME, 'handleDeleteSiteArea', req.user);
// OCPI Site Area

Change DeleteSiteArea logic