Change handleAssignUsersToSite logic
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -303,12 +303,12 @@ export default class Authorizations {
}
- public static async canAssignUsersSites(loggedUser: UserToken): Promise<boolean> {
- return Authorizations.canPerformAction(loggedUser, Entity.USERS_SITES, Action.ASSIGN);
+ public static async canAssignUsersSites(loggedUser: UserToken, authContext?: AuthorizationContext): Promise<AuthorizationResult> {
+ return Authorizations.can(loggedUser, Entity.USERS_SITES, Action.ASSIGN, authContext);
}
- public static async canUnassignUsersSites(loggedUser: UserToken): Promise<boolean> {
- return Authorizations.canPerformAction(loggedUser, Entity.USERS_SITES, Action.UNASSIGN);
+ public static async canUnassignUsersSites(loggedUser: UserToken, authContext?: AuthorizationContext): Promise<AuthorizationResult> {
+ return Authorizations.can(loggedUser, Entity.USERS_SITES, Action.UNASSIGN, authContext);
}
public static async canListUsersSites(loggedUser: UserToken, authContext?: AuthorizationContext): Promise<AuthorizationResult> {

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -91,23 +91,22 @@ export default class AuthorizationService {
public static async addSiteAuthorizations(tenant: Tenant, userToken: UserToken, site: Site, authorizationFilter: AuthorizationFilter,
filteredRequest: Record<string, any>): Promise<void> {
- // todo: remove when assign actions are in place
- // Get Site Admins
- const siteAdminIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
// Enrich
if (!site.issuer) {
site.canRead = true;
site.canUpdate = false;
site.canDelete = false;
+ site.canAssignUsers = false;
+ site.canUnassignUsers = false;
} else {
- const isSiteAdmin = siteAdminIDs.includes(site.id) || (userToken.role === UserRole.ADMIN);
filteredRequest.SiteID = site.id;
site.canRead = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.SITE, Action.READ, authorizationFilter, filteredRequest);
site.canDelete = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.SITE, Action.DELETE, authorizationFilter, filteredRequest);
site.canUpdate = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.SITE, Action.UPDATE, authorizationFilter, filteredRequest);
- // todo: change when assign actions are in place
- site.canAssignUsers = await Authorizations.canAssignUsersSites(userToken);
- site.canUnassignUsers = await Authorizations.canUnassignUsersSites(userToken) && isSiteAdmin;
+ site.canAssignUsers = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.USERS_SITES, Action.ASSIGN,
+ authorizationFilter, filteredRequest);
+ site.canUnassignUsers = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.USERS_SITES, Action.UNASSIGN,
+ authorizationFilter, filteredRequest);
}
}
@@ -180,31 +179,30 @@ export default class AuthorizationService {
filters: {},
dataSources: new Map(),
projectFields: [],
- authorized: userToken.role === UserRole.ADMIN,
+ authorized: false,
};
- // Not an Admin?
- if (userToken.role !== UserRole.ADMIN) {
- // Get Site IDs for which user is admin from db
- const siteAdminSiteIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
- // Check Site
- if (!Utils.isEmptyArray(siteAdminSiteIDs) && siteAdminSiteIDs.includes(filteredRequest.siteID)) {
- // Site Authorized, now check users
- if (!Utils.isEmptyArray(filteredRequest.userIDs)) {
- let foundInvalidUserID = false;
- // Get User IDs already assigned to the site
- const userIDs = await AuthorizationService.getAssignedUsersIDs(tenant.id, filteredRequest.siteID);
- // Check if any of the Users we want to unassign are missing
- for (const userID of filteredRequest.userIDs) {
- if (!userIDs.includes(userID)) {
- foundInvalidUserID = true;
- }
- }
- if (!foundInvalidUserID) {
- authorizationFilters.authorized = true;
- }
- }
- }
+ // Check static auth
+ const authorizationContext: AuthorizationContext = {};
+ const authResult = action === ServerAction.ADD_USERS_TO_SITE ?
+ await Authorizations.canAssignUsersSites(userToken, authorizationContext) :
+ await Authorizations.canUnassignUsersSites(userToken, authorizationContext);
+ authorizationFilters.authorized = authResult.authorized;
+ // Check
+ if (!authorizationFilters.authorized) {
+ throw new AppAuthError({
+ errorCode: HTTPAuthError.FORBIDDEN,
+ user: userToken,
+ action: action === ServerAction.ADD_USERS_TO_SITE ? Action.ASSIGN : Action.UNASSIGN,
+ entity: Entity.USERS_SITES,
+ module: MODULE_NAME, method: 'checkAndAssignUserSitesAuthorizationFilters',
+ });
}
+ // Process dynamic filters
+ await AuthorizationService.processDynamicFilters(tenant, userToken, Action.READ, Entity.SITE,
+ authorizationFilters, authorizationContext, { SiteID: filteredRequest.siteID });
+ // Filter projected fields
+ authorizationFilters.projectFields = AuthorizationService.filterProjectFields(
+ authResult.fields, filteredRequest.ProjectFields);
return authorizationFilters;
}

MODIFY
src/server/rest/v1/service/SiteService.ts
src/server/rest/v1/service/SiteService.ts
@@ -145,16 +145,6 @@ export default class SiteService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.UPDATE, Entity.SITE, MODULE_NAME, 'handleAssignUsersToSite');
- // Check static auth
- const authAction = action === ServerAction.ADD_USERS_TO_SITE ? Action.ASSIGN : Action.UNASSIGN;
- if (!await Authorizations.canAssignUsersSites(req.user)) {
- throw new AppAuthError({
- errorCode: HTTPAuthError.FORBIDDEN,
- user: req.user,
- action: authAction, entity: Entity.USERS_SITES,
- module: MODULE_NAME, method: 'handleAssignUsersToSite'
- });
- }
// Filter request
const filteredRequest = SiteSecurity.filterAssignSiteUsers(req.body);
// Check mandatory fields

MODIFY
src/server/rest/v1/service/UtilsService.ts
src/server/rest/v1/service/UtilsService.ts
@@ -269,6 +269,17 @@ export default class UtilsService {
public static async checkSiteUsersAuthorization(tenant: Tenant, userToken: UserToken, site: Site, userIDs: string[],
action: ServerAction, additionalFilters: Record<string, any>, applyProjectFields = false): Promise<User[]> {
+ // Check mandatory fields
+ UtilsService.assertIdIsProvided(action, site.id, MODULE_NAME, 'handleAssignUsersToSite', userToken);
+ if (Utils.isEmptyArray(userIDs)) {
+ throw new AppError({
+ source: Constants.CENTRAL_SERVER,
+ errorCode: HTTPError.GENERAL_ERROR,
+ message: 'The User\'s IDs must be provided',
+ module: MODULE_NAME, method: 'handleAssignUsersToSite',
+ user: userToken
+ });
+ }
// Check dynamic auth for assignment
const authorizationFilter = await AuthorizationService.checkAssignSiteUsersAuthorizationFilters(
tenant, action, userToken, { siteID: site.id, userIDs });

Change handleAssignUsersToSite logic