canDeleteCompany change.
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -524,8 +524,9 @@ export default class Authorizations {
{ company: companyID, companies: context.companies, sitesAdmin: loggedUser.sitesAdmin, sitesOwner: loggedUser.sitesOwner });
}
- public static canDeleteCompany(loggedUser: UserToken): boolean {
- return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.DELETE);
+ public static canDeleteCompany(loggedUser: UserToken, companyID: string, context?: AuthorizationContext): boolean {
+ return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.DELETE,
+ { company: companyID, companies: context.companies });
}
public static canListCarCatalogs(loggedUser: UserToken): boolean {

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -336,7 +336,7 @@ export default class AuthorizationService {
for (const company of companies) {
company.canRead = Authorizations.canReadCompany(userToken, company.id, { companies: assignedCompanies });
company.canUpdate = Authorizations.canUpdateCompany(userToken, company.id, { companies: assignedCompanies });
- company.canDelete = Authorizations.canDeleteCompany(userToken);
+ company.canDelete = Authorizations.canDeleteCompany(userToken, company.id, { companies: assignedCompanies });
}
}

MODIFY
src/server/rest/v1/service/CompanyService.ts
src/server/rest/v1/service/CompanyService.ts
@@ -29,7 +29,8 @@ export default class CompanyService {
// Check Mandatory fields
UtilsService.assertIdIsProvided(action, companyID, MODULE_NAME, 'handleDeleteCompany', req.user);
// Check auth
- if (!Authorizations.canDeleteCompany(req.user)) {
+ const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(req.tenant.id, req.user);
+ if (!Authorizations.canDeleteCompany(req.user, companyID, { companies: assignedCompanies })) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
@@ -79,8 +80,8 @@ export default class CompanyService {
const filteredRequest = CompanySecurity.filterCompanyRequest(req.query);
// ID is mandatory
UtilsService.assertIdIsProvided(action, filteredRequest.ID, MODULE_NAME, 'handleGetCompany', req.user);
- const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(req.tenant.id, req.user);
// Check auth
+ const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(req.tenant.id, req.user);
if (!Authorizations.canReadCompany(req.user, filteredRequest.ID, { companies: assignedCompanies })) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,

canDeleteCompany change.