Update canReadCompany.
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -120,7 +120,6 @@ export default class Authorizations {
}
public static async buildUserToken(tenantID: string, user: User, tags: Tag[]): Promise<UserToken> {
- const companyIDs = new Set<string>();
const siteIDs = [];
const siteAdminIDs = [];
const siteOwnerIDs = [];
@@ -130,7 +129,6 @@ export default class Authorizations {
for (const siteUser of sites) {
if (!Authorizations.isAdmin(user)) {
siteIDs.push(siteUser.site.id);
- companyIDs.add(siteUser.site.companyID);
if (siteUser.siteAdmin) {
siteAdminIDs.push(siteUser.site.id);
}
@@ -173,7 +171,6 @@ export default class Authorizations {
'userHashID': SessionHashService.buildUserHashID(user),
'tenantHashID': tenantHashID,
'scopes': Authorizations.getUserScopes(tenantID, user, siteAdminIDs.length, siteOwnerIDs.length),
- 'companies': [...companyIDs],
'sitesAdmin': siteAdminIDs,
'sitesOwner': siteOwnerIDs,
'sites': siteIDs,
@@ -513,9 +510,9 @@ export default class Authorizations {
return Authorizations.canPerformAction(loggedUser, Entity.COMPANIES, Action.LIST);
}
- public static canReadCompany(loggedUser: UserToken, companyID: string): boolean {
+ public static canReadCompany(loggedUser: UserToken, companyID: string, context?: AuthorizationContext): boolean {
return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.READ,
- { company: companyID, companies: loggedUser.companies });
+ { company: companyID, companies: context.companies });
}
public static canCreateCompany(loggedUser: UserToken): boolean {

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -331,9 +331,10 @@ export default class AuthorizationService {
// Set to user
userToken.sitesAdmin = siteAdminIDs;
userToken.sitesOwner = siteOwnerIDs;
+ const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(tenant.id, userToken);
// Enrich
for (const company of companies) {
- company.canRead = Authorizations.canReadCompany(userToken, company.id);
+ company.canRead = Authorizations.canReadCompany(userToken, company.id, { companies: assignedCompanies });
company.canUpdate = Authorizations.canUpdateCompany(userToken);
company.canDelete = Authorizations.canDeleteCompany(userToken);
}
@@ -423,7 +424,7 @@ export default class AuthorizationService {
return authorizationFilters;
}
- private static async getAssignedSitesCompanyIDs(tenantID: string, userToken: UserToken, siteID?: string): Promise<string[]> {
+ public static async getAssignedSitesCompanyIDs(tenantID: string, userToken: UserToken, siteID?: string): Promise<string[]> {
// Get the Company IDs of the assigned Sites
const sites = await SiteStorage.getSites(tenantID,
{

MODIFY
src/server/rest/v1/service/CompanyService.ts
src/server/rest/v1/service/CompanyService.ts
@@ -79,8 +79,9 @@ export default class CompanyService {
const filteredRequest = CompanySecurity.filterCompanyRequest(req.query);
// ID is mandatory
UtilsService.assertIdIsProvided(action, filteredRequest.ID, MODULE_NAME, 'handleGetCompany', req.user);
+ const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(req.tenant.id, req.user);
// Check auth
- if (!Authorizations.canReadCompany(req.user, filteredRequest.ID)) {
+ if (!Authorizations.canReadCompany(req.user, filteredRequest.ID, { companies: assignedCompanies })) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,

Update canReadCompany.