Get rid of checking the IDs in static auth
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -510,23 +510,20 @@ export default class Authorizations {
return Authorizations.canPerformAction(loggedUser, Entity.COMPANIES, Action.LIST);
}
- public static canReadCompany(loggedUser: UserToken, companyID: string, context?: AuthorizationContext): boolean {
- return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.READ,
- { company: companyID, companies: context.companies });
+ public static canReadCompany(loggedUser: UserToken): boolean {
+ return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.READ);
}
public static canCreateCompany(loggedUser: UserToken): boolean {
return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.CREATE);
}
- public static canUpdateCompany(loggedUser: UserToken, companyID: string, context?: AuthorizationContext): boolean {
- return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.UPDATE,
- { company: companyID, companies: context.companies, sitesAdmin: loggedUser.sitesAdmin, sitesOwner: loggedUser.sitesOwner });
+ public static canUpdateCompany(loggedUser: UserToken): boolean {
+ return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.UPDATE);
}
- public static canDeleteCompany(loggedUser: UserToken, companyID: string, context?: AuthorizationContext): boolean {
- return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.DELETE,
- { company: companyID, companies: context.companies });
+ public static canDeleteCompany(loggedUser: UserToken): boolean {
+ return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.DELETE);
}
public static canListCarCatalogs(loggedUser: UserToken): boolean {

MODIFY
src/authorization/AuthorizationsDefinition.ts
src/authorization/AuthorizationsDefinition.ts
@@ -109,8 +109,7 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
{ resource: Entity.CAR, action: [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE], attributes: ['*'] },
{ resource: Entity.CARS, action: Action.LIST, attributes: ['*'] },
{
- resource: Entity.COMPANY, action: Action.READ, attributes: ['*'],
- condition: { Fn: 'LIST_CONTAINS', args: { 'companies': '$.company' } }
+ resource: Entity.COMPANY, action: Action.READ, attributes: ['*']
},
{ resource: Entity.INVOICES, action: [Action.LIST, Action.SYNCHRONIZE], attributes: ['*'] },
{

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -335,9 +335,9 @@ export default class AuthorizationService {
const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(tenant.id, userToken);
// Enrich
for (const company of companies) {
- company.canRead = Authorizations.canReadCompany(userToken, company.id, { companies: assignedCompanies });
- company.canUpdate = Authorizations.canUpdateCompany(userToken, company.id, { companies: assignedCompanies });
- company.canDelete = Authorizations.canDeleteCompany(userToken, company.id, { companies: assignedCompanies });
+ company.canRead = Authorizations.canReadCompany(userToken) && assignedCompanies.includes(company.id);
+ company.canUpdate = Authorizations.canUpdateCompany(userToken) && assignedCompanies.includes(company.id);
+ company.canDelete = Authorizations.canDeleteCompany(userToken) && assignedCompanies.includes(company.id);
}
}

MODIFY
src/server/rest/v1/service/CompanyService.ts
src/server/rest/v1/service/CompanyService.ts
@@ -24,21 +24,18 @@ export default class CompanyService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.DELETE, Entity.COMPANY, MODULE_NAME, 'handleDeleteCompany');
- // Filter
- const companyID = CompanySecurity.filterCompanyRequestByID(req.query);
- // Check Mandatory fields
- UtilsService.assertIdIsProvided(action, companyID, MODULE_NAME, 'handleDeleteCompany', req.user);
- // Check auth
- const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(req.tenant.id, req.user);
- if (!Authorizations.canDeleteCompany(req.user, companyID, { companies: assignedCompanies })) {
+ // Check static auth
+ if (!Authorizations.canDeleteCompany(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
action: Action.DELETE, entity: Entity.COMPANY,
module: MODULE_NAME, method: 'handleDeleteCompany',
- value: companyID
});
}
+ // Filter
+ const companyID = CompanySecurity.filterCompanyRequestByID(req.query);
+ UtilsService.assertIdIsProvided(action, companyID, MODULE_NAME, 'handleDeleteCompany', req.user);
// Get authorization filters
const authorizationCompanyFilters = await AuthorizationService.checkAndGetCompanyAuthorizationFilters(
req.tenant, req.user, { ID: companyID });
@@ -76,22 +73,19 @@ export default class CompanyService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.READ, Entity.COMPANY, MODULE_NAME, 'handleGetCompany');
- // Filter
- const filteredRequest = CompanySecurity.filterCompanyRequest(req.query);
- // ID is mandatory
- UtilsService.assertIdIsProvided(action, filteredRequest.ID, MODULE_NAME, 'handleGetCompany', req.user);
- // Check auth
- const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(req.tenant.id, req.user);
- if (!Authorizations.canReadCompany(req.user, filteredRequest.ID, { companies: assignedCompanies })) {
+ // Check static auth
+ if (!Authorizations.canReadCompany(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
action: Action.READ, entity: Entity.COMPANY,
module: MODULE_NAME, method: 'handleGetCompany',
- value: filteredRequest.ID
});
}
- // Get authorization filters
+ // Filter
+ const filteredRequest = CompanySecurity.filterCompanyRequest(req.query);
+ UtilsService.assertIdIsProvided(action, filteredRequest.ID, MODULE_NAME, 'handleGetCompany', req.user);
+ // Check dynamic auth
const authorizationCompanyFilters = await AuthorizationService.checkAndGetCompanyAuthorizationFilters(req.tenant, req.user, filteredRequest);
// Get company
const company = await CompanyStorage.getCompany(req.user.tenantID, filteredRequest.ID,
@@ -137,7 +131,7 @@ export default class CompanyService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.LIST, Entity.COMPANIES, MODULE_NAME, 'handleGetCompanies');
- // Check auth
+ // Check static auth
if (!Authorizations.canListCompanies(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
@@ -148,7 +142,7 @@ export default class CompanyService {
}
// Filter
const filteredRequest = CompanySecurity.filterCompaniesRequest(req.query);
- // Check auth
+ // Check dynamic auth
const authorizationCompaniesFilter = await AuthorizationService.checkAndGetCompaniesAuthorizationFilters(req.tenant, req.user, filteredRequest);
if (!authorizationCompaniesFilter.authorized) {
UtilsService.sendEmptyDataResult(res, next);
@@ -224,21 +218,19 @@ export default class CompanyService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.UPDATE, Entity.COMPANY, MODULE_NAME, 'handleUpdateCompany');
- // Filter
- const filteredRequest = CompanySecurity.filterCompanyUpdateRequest(req.body);
- UtilsService.assertIdIsProvided(action, filteredRequest.id, MODULE_NAME, 'handleUpdateCompany', req.user);
- // Check auth
- const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(req.tenant.id, req.user);
- if (!Authorizations.canUpdateCompany(req.user, filteredRequest.id, { companies: assignedCompanies })) {
+ // Check static auth
+ if (!Authorizations.canUpdateCompany(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
action: Action.UPDATE, entity: Entity.COMPANY,
module: MODULE_NAME, method: 'handleUpdateCompany',
- value: filteredRequest.id
});
}
- // Get authorization filters
+ // Filter
+ const filteredRequest = CompanySecurity.filterCompanyUpdateRequest(req.body);
+ UtilsService.assertIdIsProvided(action, filteredRequest.id, MODULE_NAME, 'handleUpdateCompany', req.user);
+ // Check dynamic auth
const authorizationCompanyFilters = await AuthorizationService.checkAndGetCompanyAuthorizationFilters(
req.tenant, req.user, { ID: filteredRequest.id });
// Get Company

MODIFY
src/server/rest/v1/service/SiteService.ts
src/server/rest/v1/service/SiteService.ts
@@ -592,9 +592,8 @@ export default class SiteService {
const company = await CompanyStorage.getCompany(req.user.tenantID, filteredRequest.companyID);
UtilsService.assertObjectExists(action, company, `Company ID '${filteredRequest.companyID}' does not exist`,
MODULE_NAME, 'handleUpdateSite', req.user);
- const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(req.tenant.id, req.user);
// Check auth
- if (!Authorizations.canReadCompany(req.user, company.id, { companies: assignedCompanies })) {
+ if (!Authorizations.canReadCompany(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,

Get rid of checking the IDs in static auth