Update GetSiteArea logic.
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -524,9 +524,8 @@ export default class Authorizations {
return Authorizations.canPerformAction(loggedUser, Entity.SITE_AREAS, Action.LIST);
}
- public static canReadSiteArea(loggedUser: UserToken, siteID: string): boolean {
- return Authorizations.canPerformAction(loggedUser, Entity.SITE_AREA, Action.READ,
- { site: siteID, sites: loggedUser.sites });
+ public static canReadSiteArea(loggedUser: UserToken): boolean {
+ return Authorizations.canPerformAction(loggedUser, Entity.SITE_AREA, Action.READ);
}
public static canCreateSiteArea(loggedUser: UserToken): boolean {

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -10,8 +10,10 @@ import Company from '../../../../types/Company';
import Constants from '../../../../utils/Constants';
import { HTTPAuthError } from '../../../../types/HTTPError';
import HttpByIDRequest from '../../../../types/requests/HttpByIDRequest';
+import { HttpSiteAreaRequest } from '../../../../types/requests/HttpSiteAreaRequest';
import { ServerAction } from '../../../../types/Server';
import Site from '../../../../types/Site';
+import SiteAreaStorage from '../../../../storage/mongodb/SiteAreaStorage';
import SiteStorage from '../../../../storage/mongodb/SiteStorage';
import Tenant from '../../../../types/Tenant';
import TenantComponents from '../../../../types/TenantComponents';
@@ -19,6 +21,7 @@ import UserStorage from '../../../../storage/mongodb/UserStorage';
import UserToken from '../../../../types/UserToken';
import Utils from '../../../../utils/Utils';
import _ from 'lodash';
+import { filter } from 'bluebird';
const MODULE_NAME = 'AuthorizationService';
@@ -76,7 +79,7 @@ export default class AuthorizationService {
errorCode: HTTPAuthError.FORBIDDEN,
user: userToken,
action: Action.UPDATE, entity: Entity.SITE,
- module: MODULE_NAME, method: 'checkAndGetSiteAuthorizationFilters',
+ module: MODULE_NAME, method: 'checkAndGetUpdateSiteAuthorizationFilters',
});
} else {
authorizationFilters.authorized = true;
@@ -459,29 +462,21 @@ export default class AuthorizationService {
if (userToken.role !== UserRole.ADMIN) {
if (Utils.isTenantComponentActive(tenant, TenantComponents.ORGANIZATION)) {
const companyIDs = await AuthorizationService.getAssignedSitesCompanyIDs(tenant.id, userToken);
- if (!Utils.isEmptyArray(companyIDs)) {
- if (!companyIDs.includes(filteredRequest.ID)) {
+ if (Utils.isEmptyArray(companyIDs) || !companyIDs.includes(filteredRequest.ID)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: userToken,
- action: Action.READ, entity: Entity.SITE,
- module: MODULE_NAME, method: 'checkAndGetSiteAuthorizationFilters',
+ action: Action.READ, entity: Entity.COMPANY,
+ module: MODULE_NAME, method: 'checkAndGetCompanyAuthorizationFilters',
});
} else {
authorizationFilters.authorized = true;
}
- } else {
- throw new AppAuthError({
- errorCode: HTTPAuthError.FORBIDDEN,
- user: userToken,
- action: Action.READ, entity: Entity.SITE,
- module: MODULE_NAME, method: 'checkAndGetCompanyAuthorizationFilters',
- });
- }
} else {
authorizationFilters.authorized = true;
}
}
+
return authorizationFilters;
}
@@ -493,6 +488,38 @@ export default class AuthorizationService {
return true;
}
+ public static async checkAndGetSiteAreaAuthorizationFilters(tenant: Tenant, userToken: UserToken, filteredRequest: HttpSiteAreaRequest): Promise<AuthorizationFilter> {
+ const authorizationFilters: AuthorizationFilter = {
+ filters: {},
+ projectFields: [
+ 'id', 'name', 'issuer', 'image', 'address', 'maximumPower', 'numberOfPhases',
+ 'voltage', 'smartCharging', 'accessControl', 'connectorStats', 'siteID', 'site.name'
+ ],
+ authorized: userToken.role === UserRole.ADMIN,
+ };
+ // Check projection
+ if (!Utils.isEmptyArray(filteredRequest.ProjectFields)) {
+ authorizationFilters.projectFields = authorizationFilters.projectFields.filter((projectField) => filteredRequest.ProjectFields.includes(projectField));
+ }
+ // Not an Admin?
+ if (userToken.role !== UserRole.ADMIN) {
+ const siteAreaIDs = await AuthorizationService.getAssignedSiteAreaIDs(tenant.id, userToken);
+
+ if (Utils.isEmptyArray(siteAreaIDs) || !siteAreaIDs.includes(filteredRequest.ID)) {
+ throw new AppAuthError({
+ errorCode: HTTPAuthError.FORBIDDEN,
+ user: userToken,
+ action: Action.READ, entity: Entity.SITE_AREA,
+ module: MODULE_NAME, method: 'checkAndGetSiteAreaAuthorizationFilters',
+ });
+ } else {
+ authorizationFilters.authorized = true;
+ }
+ }
+
+ return authorizationFilters;
+ }
+
private static async getAssignedSitesCompanyIDs(tenantID: string, userToken: UserToken, siteID?: string): Promise<string[]> {
// Get the Company IDs of the assigned Sites
const sites = await SiteStorage.getSites(tenantID,
@@ -602,5 +629,17 @@ export default class AuthorizationService {
}
}
}
+
+ private static async getAssignedSiteAreaIDs(tenantID: string, userToken: UserToken, siteID?: string) {
+ // Get the SiteArea IDs from sites assigned to the user
+ const siteAreas = await SiteAreaStorage.getSiteAreas(tenantID,
+ {
+ siteIDs: Authorizations.getAuthorizedSiteIDs(userToken, siteID ? [siteID] : null),
+ issuer: true,
+ }, Constants.DB_PARAMS_MAX_LIMIT,
+ ['id']
+ );
+ return _.uniq(_.map(siteAreas.result, 'id'));
+ }
}

MODIFY
src/server/rest/v1/service/CompanyService.ts
src/server/rest/v1/service/CompanyService.ts
@@ -84,6 +84,7 @@ export default class CompanyService {
}
// Filter
const filteredRequest = CompanySecurity.filterCompanyRequest(req.query);
+ // Check mandatory fields
UtilsService.assertIdIsProvided(action, filteredRequest.ID, MODULE_NAME, 'handleGetCompany', req.user);
// Check dynamic auth
const authorizationCompanyFilters = await AuthorizationService.checkAndGetCompanyAuthorizationFilters(req.tenant, req.user, filteredRequest);

MODIFY
src/server/rest/v1/service/SiteAreaService.ts
src/server/rest/v1/service/SiteAreaService.ts
@@ -267,34 +267,35 @@ export default class SiteAreaService {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.ORGANIZATION,
Action.READ, Entity.SITE_AREA, MODULE_NAME, 'handleGetSiteArea');
- // Filter
+ // Filter request
const filteredRequest = SiteAreaSecurity.filterSiteAreaRequest(req.query);
- // ID is mandatory
+ // Check mandatory fields
UtilsService.assertIdIsProvided(action, filteredRequest.ID, MODULE_NAME, 'handleGetSiteArea', req.user);
- // Get it
+ // Check static auth
+ if (!Authorizations.canReadSiteArea(req.user)) {
+ throw new AppAuthError({
+ errorCode: HTTPAuthError.FORBIDDEN,
+ user: req.user,
+ action: Action.READ, entity: Entity.SITE_AREA,
+ module: MODULE_NAME, method: 'handleGetSiteArea',
+ value: filteredRequest.ID
+ });
+ }
+ // Check dynamic auth
+ const readSiteAreaAuthorizationFilters = await AuthorizationService.checkAndGetSiteAreaAuthorizationFilters(req.tenant, req.user, filteredRequest);
+ // Get SiteArea
const siteArea = await SiteAreaStorage.getSiteArea(req.user.tenantID, filteredRequest.ID,
{
withSite: filteredRequest.WithSite,
withChargingStations: filteredRequest.WithChargingStations,
withImage: true,
+ ...readSiteAreaAuthorizationFilters.filters
},
- [
- 'id', 'name', 'issuer', 'image', 'address', 'maximumPower', 'numberOfPhases',
- 'voltage', 'smartCharging', 'accessControl', 'connectorStats', 'siteID', 'site.name'
- ]
+ readSiteAreaAuthorizationFilters.projectFields
);
+ // Check SiteArea exists
UtilsService.assertObjectExists(action, siteArea, `Site Area with ID '${filteredRequest.ID}' does not exist`,
MODULE_NAME, 'handleGetSiteArea', req.user);
- // Check auth
- if (!Authorizations.canReadSiteArea(req.user, siteArea.siteID)) {
- throw new AppAuthError({
- errorCode: HTTPAuthError.FORBIDDEN,
- user: req.user,
- action: Action.READ, entity: Entity.SITE_AREA,
- module: MODULE_NAME, method: 'handleGetSiteArea',
- value: filteredRequest.ID
- });
- }
// Return
res.json(siteArea);
next();
@@ -349,7 +350,7 @@ export default class SiteAreaService {
withAvailableChargingStations: filteredRequest.WithAvailableChargers,
siteIDs: Authorizations.getAuthorizedSiteIDs(req.user, filteredRequest.SiteID ? filteredRequest.SiteID.split('|') : null),
locCoordinates: filteredRequest.LocCoordinates,
- locMaxDistanceMeters: filteredRequest.LocMaxDistanceMeters,
+ locMaxDistanceMeters: filteredRequest.LocMaxDistanceMeters
},
{ limit: filteredRequest.Limit, skip: filteredRequest.Skip, sort: filteredRequest.SortFields, onlyRecordCount: filteredRequest.OnlyRecordCount },
[
@@ -376,7 +377,7 @@ export default class SiteAreaService {
UtilsService.assertObjectExists(action, siteArea, `Site Area with ID '${filteredRequest.SiteAreaID}' does not exist`,
MODULE_NAME, 'handleGetSiteArea', req.user);
// Check auth
- if (!Authorizations.canReadSiteArea(req.user, siteArea.siteID)) {
+ if (!Authorizations.canReadSiteArea(req.user)) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,

Update GetSiteArea logic.