Refactor
Add appropriate projectfield in action auth
remove 'custom' projectField creation and use auth def
remove user fields for basic user since not authorized
MODIFY
src/authorization/AuthorizationsDefinition.ts
src/authorization/AuthorizationsDefinition.ts
@@ -670,7 +670,7 @@ export const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
]
},
{
- resource: Entity.INVOICE, action: [Action.LIST],
+ resource: Entity.INVOICE, action: Action.LIST,
condition: {
Fn: 'custom:dynamicAuthorizations',
args: {
@@ -679,11 +679,24 @@ export const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
}
},
attributes: [
- 'id', 'number', 'status', 'amount', 'createdOn', 'currency', 'downloadable', 'sessions', 'userID', 'user.id', 'user.name', 'user.firstName', 'user.email'
+ 'id', 'number', 'status', 'amount', 'createdOn', 'currency', 'downloadable', 'sessions'
+ ]
+ },
+ {
+ resource: Entity.INVOICE, action: Action.READ,
+ condition: {
+ Fn: 'custom:dynamicAuthorizations',
+ args: {
+ asserts: [],
+ filters: ['OwnUser']
+ }
+ },
+ attributes: [
+ 'id', 'number', 'status', 'amount', 'createdOn', 'currency', 'downloadable', 'sessions'
]
},
{
- resource: Entity.INVOICE, action: [Action.DOWNLOAD, Action.READ],
+ resource: Entity.INVOICE, action: Action.DOWNLOAD,
condition: {
Fn: 'custom:dynamicAuthorizations',
args: {

MODIFY
src/server/rest/v1/service/BillingService.ts
src/server/rest/v1/service/BillingService.ts
@@ -228,18 +228,8 @@ export default class BillingService {
Action.LIST, Entity.INVOICE, MODULE_NAME, 'handleGetInvoice');
// Filter
const filteredRequest = BillingValidator.getInstance().validateBillingInvoiceGetReq(req.query);
- // Get Users authorizations and retrieve projected fields
- const authorizationUsersFilters = await AuthorizationService.checkAndGetUsersAuthorizations(req.tenant, req.user, filteredRequest, false);
- // User projected field if authorized
- let userProjectedField : string[] = [];
- if (authorizationUsersFilters.authorized) {
- userProjectedField = [ 'userID', 'user.id', 'user.name', 'user.firstName', 'user.email' ];
- }
- // Build dynamic projected fields based on user authorizations
- const projectedFields = ['id', 'number', 'status', 'amount', 'createdOn', 'currency', 'downloadable', 'sessions', ...userProjectedField];
- // Check and get invoice, pass custom projected fields
- const invoice = await UtilsService.checkAndGetInvoiceAuthorization(req.tenant, req.user, filteredRequest.ID, Action.READ, action, null, {},
- projectedFields, true);
+ // Check and get invoice
+ const invoice = await UtilsService.checkAndGetInvoiceAuthorization(req.tenant, req.user, filteredRequest.ID, Action.READ, action, null, {}, true);
res.json(invoice);
next();
}
@@ -367,7 +357,7 @@ export default class BillingService {
UtilsService.assertObjectExists(action, billingInvoice, `Invoice ID '${filteredRequest.ID}' does not exist`,
MODULE_NAME, 'handleDownloadInvoice', req.user);
// Check and get authorizations
- await UtilsService.checkAndGetInvoiceAuthorization(req.tenant, req.user, filteredRequest.ID, Action.DOWNLOAD, action, null, {}, [], true);
+ await UtilsService.checkAndGetInvoiceAuthorization(req.tenant, req.user, filteredRequest.ID, Action.DOWNLOAD, action, null, {}, true);
// Get the billing impl
const billingImpl = await BillingFactory.getBillingImpl(req.tenant);
if (!billingImpl) {

MODIFY
src/server/rest/v1/service/UtilsService.ts
src/server/rest/v1/service/UtilsService.ts
@@ -893,8 +893,7 @@ export default class UtilsService {
}
public static async checkAndGetInvoiceAuthorization(tenant: Tenant, userToken: UserToken, invoiceID: string, authAction: Action,
- action: ServerAction, entityData?: EntityData, additionalFilters: Record<string, any> = {}, additionalProjectedFields: string[] = [],
- applyProjectFields = false): Promise<BillingInvoice> {
+ action: ServerAction, entityData?: EntityData, additionalFilters: Record<string, any> = {}, applyProjectFields = false): Promise<BillingInvoice> {
// Check mandatory fields
UtilsService.assertIdIsProvided(action, invoiceID, MODULE_NAME, 'checkAndGetInvoiceAuthorization', userToken);
// Get dynamic auth
@@ -910,21 +909,19 @@ export default class UtilsService {
});
}
- const projectedFields: string[] = [ ...authorizationFilter.projectFields, ...additionalProjectedFields ];
-
// Get Invoice
const invoice = await BillingStorage.getInvoice(tenant, invoiceID,
{
...additionalFilters,
...authorizationFilter.filters
},
- applyProjectFields ? projectedFields : null
+ applyProjectFields ? authorizationFilter.projectFields : null
);
UtilsService.assertObjectExists(action, invoice, `Invoice ID '${invoiceID}' does not exist`,
MODULE_NAME, 'checkAndGetInvoiceAuthorization', userToken);
// Assign projected fields
- if (projectedFields && applyProjectFields) {
- invoice.projectFields = projectedFields;
+ if (authorizationFilter.projectFields && applyProjectFields) {
+ invoice.projectFields = authorizationFilter.projectFields;
}
// Assign Metadata
if (authorizationFilter.metadata) {

Refactor

- Add appropriate projectfield in action auth
- remove 'custom' projectField creation and use auth def
- remove user fields for basic user since not authorized