Refinced Auth for downloading invoice
MODIFY
src/authorization/AuthorizationsDefinition.ts
src/authorization/AuthorizationsDefinition.ts
@@ -64,7 +64,8 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
action: [Action.CHECK_CONNECTION, Action.SYNCHRONIZE_USER, Action.SYNCHRONIZE_USERS]
},
{ resource: Entity.TAXES, action: [Action.LIST], attributes: ['*'] },
- { resource: Entity.INVOICES, action: [Action.LIST, Action.SYNCHRONIZE_INVOICES, Action.DOWNLOAD], attributes: ['*'] },
+ { resource: Entity.INVOICES, action: [Action.LIST, Action.SYNCHRONIZE_INVOICES], attributes: ['*'] },
+ { resource: Entity.INVOICE, action: [Action.DOWNLOAD], attributes: ['*'] },
{ resource: Entity.ASSET, action: [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE, Action.CHECK_CONNECTION, Action.RETRIEVE_CONSUMPTION], attributes: ['*'] },
{ resource: Entity.ASSETS, action: Action.LIST, attributes: ['*'] },
{ resource: Entity.SETTINGS, action: Action.LIST, attributes: ['*'] },
@@ -112,7 +113,7 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
resource: Entity.COMPANY, action: Action.READ, attributes: ['*'],
condition: { Fn: 'LIST_CONTAINS', args: { 'companies': '$.company' } }
},
- { resource: Entity.INVOICES, action: [Action.LIST, Action.SYNCHRONIZE_INVOICES, Action.DOWNLOAD], attributes: ['*'] },
+ { resource: Entity.INVOICES, action: [Action.LIST, Action.SYNCHRONIZE_INVOICES], attributes: ['*'] },
{ resource: Entity.INVOICE, action: [Action.DOWNLOAD], attributes: ['*'] },
{ resource: Entity.SITES, action: Action.LIST, attributes: ['*'] },
{

MODIFY
src/server/rest/service/BillingService.ts
src/server/rest/service/BillingService.ts
@@ -451,6 +451,7 @@ export default class BillingService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.BILLING,
Action.DOWNLOAD, Entity.BILLING, MODULE_NAME, 'handleDownloadInvoice');
+ // Check Auth
if (!Authorizations.canDownloadInvoiceBilling(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.ERROR,

MODIFY
src/server/rest/service/security/BillingSecurity.ts
src/server/rest/service/security/BillingSecurity.ts
@@ -65,7 +65,7 @@ export default class BillingSecurity {
// Check auth
if (Authorizations.canReadInvoicesBilling(loggedUser)) {
// Set only necessary info
- filteredInvoice.user = UserSecurity.filterMinimalUserResponse(invoice.user, loggedUser);
+ filteredInvoice.id = invoice.id;
filteredInvoice.invoiceID = invoice.invoiceID;
filteredInvoice.number = invoice.number;
filteredInvoice.status = invoice.status;
@@ -74,6 +74,7 @@ export default class BillingSecurity {
filteredInvoice.currency = invoice.currency;
filteredInvoice.customerID = invoice.customerID;
filteredInvoice.downloadable = invoice.downloadable;
+ filteredInvoice.user = UserSecurity.filterMinimalUserResponse(invoice.user, loggedUser);
}
return filteredInvoice;
}

Refinced Auth for downloading invoice