Add canUpdate on getSite
MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -87,7 +87,7 @@ export default class AuthorizationService {
public static async addSitesAuthorizations(tenant: Tenant, userToken: UserToken, sites: SiteDataResult): Promise<void> {
// Get Site Admins
- const { siteAdminIDs, siteOwnerIDs } = await AuthorizationService.getSiteAdminOwnerIDs(tenant, userToken);
+ const siteAdminIDs = await AuthorizationService.getSiteAdminSiteIDs(tenant.id, userToken);
// Add canCreate flag to root
sites.canCreate = Authorizations.canCreateSite(userToken);
// Enrich
@@ -502,7 +502,7 @@ export default class AuthorizationService {
return _.uniq(_.map(sites.result, 'companyID'));
}
- private static async getSiteAdminSiteIDs(tenantID: string, userToken: UserToken): Promise<string[]> {
+ public static async getSiteAdminSiteIDs(tenantID: string, userToken: UserToken): Promise<string[]> {
// Get the Sites where the user is Site Admin
const userSites = await UserStorage.getUserSites(tenantID,
{

MODIFY
src/server/rest/v1/service/SiteService.ts
src/server/rest/v1/service/SiteService.ts
@@ -15,6 +15,7 @@ import { SiteDataResult } from '../../../../types/DataResult';
import SiteSecurity from './security/SiteSecurity';
import SiteStorage from '../../../../storage/mongodb/SiteStorage';
import TenantComponents from '../../../../types/TenantComponents';
+import { UserRole } from '../../../../types/User';
import UserStorage from '../../../../storage/mongodb/UserStorage';
import Utils from '../../../../utils/Utils';
import UtilsService from './UtilsService';
@@ -426,6 +427,9 @@ export default class SiteService {
);
UtilsService.assertObjectExists(action, site, `Site with ID '${filteredRequest.ID}' does not exist`,
MODULE_NAME, 'handleGetSite', req.user);
+ // Add authorization
+ const siteAdminIDs = await AuthorizationService.getSiteAdminSiteIDs(req.tenant.id, req.user);
+ site.canUpdate = req.user.role === UserRole.ADMIN || (Authorizations.canUpdateSite(req.user) && siteAdminIDs.includes(site.id));
// Return
res.json(site);
next();

Add canUpdate on getSite