Change handleGetCarCatalogs auth concept
MODIFY
src/authorization/AuthorizationsDefinition.ts
src/authorization/AuthorizationsDefinition.ts
@@ -23,7 +23,15 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
{ resource: Entity.LOGGING, action: Action.READ, attributes: ['*'] },
{ resource: Entity.TENANTS, action: Action.LIST, attributes: ['*'] },
{ resource: Entity.TENANT, action: [Action.CREATE, Action.READ, Action.UPDATE, Action.DELETE], attributes: ['*'] },
- { resource: Entity.CAR_CATALOGS, action: Action.LIST, attributes: ['*'] },
+ {
+ resource: Entity.CAR_CATALOGS, action: Action.LIST, attributes: [
+ 'id', 'vehicleModel', 'vehicleMake', 'vehicleModelVersion', 'batteryCapacityFull', 'fastchargeChargeSpeed', 'performanceTopspeed',
+ 'performanceAcceleration', 'rangeWLTP', 'rangeReal', 'efficiencyReal', 'image',
+ 'chargeStandardPower', 'chargeStandardPhase', 'chargeStandardPhaseAmp', 'chargeAlternativePower', 'chargeOptionPower',
+ 'chargeOptionPhaseAmp', 'chargeOptionPhase', 'chargeAlternativePhaseAmp', 'chargeAlternativePhase', 'chargePlug', 'fastChargePlug',
+ 'fastChargePowerMax', 'drivetrainPowerHP'
+ ]
+ },
{ resource: Entity.CAR_CATALOGS, action: Action.SYNCHRONIZE, attributes: ['*'] },
{ resource: Entity.CAR_CATALOG, action: Action.READ, attributes: ['*'] },
]
@@ -125,7 +133,15 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
},
{ resource: Entity.CONNECTIONS, action: Action.LIST, attributes: ['*'] },
{ resource: Entity.CONNECTION, action: [Action.CREATE, Action.READ, Action.DELETE], attributes: ['*'] },
- { resource: Entity.CAR_CATALOGS, action: Action.LIST, attributes: ['*'] },
+ {
+ resource: Entity.CAR_CATALOGS, action: Action.LIST, attributes: [
+ 'id', 'vehicleModel', 'vehicleMake', 'vehicleModelVersion', 'batteryCapacityFull', 'fastchargeChargeSpeed', 'performanceTopspeed',
+ 'performanceAcceleration', 'rangeWLTP', 'rangeReal', 'efficiencyReal', 'image',
+ 'chargeStandardPower', 'chargeStandardPhase', 'chargeStandardPhaseAmp', 'chargeAlternativePower', 'chargeOptionPower',
+ 'chargeOptionPhaseAmp', 'chargeOptionPhase', 'chargeAlternativePhaseAmp', 'chargeAlternativePhase', 'chargePlug', 'fastChargePlug',
+ 'fastChargePowerMax', 'drivetrainPowerHP'
+ ]
+ },
{ resource: Entity.CAR_CATALOG, action: Action.READ, attributes: ['*'] },
{ resource: Entity.CAR, action: [Action.CREATE, Action.UPDATE, Action.DELETE], attributes: ['*'] },
{
@@ -177,7 +193,15 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
{ resource: Entity.SETTING, action: Action.READ, attributes: ['*'] },
{ resource: Entity.ASSETS, action: Action.LIST, attributes: ['*'] },
{ resource: Entity.ASSET, action: Action.READ, attributes: ['*'] },
- { resource: Entity.CAR_CATALOGS, action: Action.LIST, attributes: ['*'] },
+ {
+ resource: Entity.CAR_CATALOGS, action: Action.LIST, attributes: [
+ 'id', 'vehicleModel', 'vehicleMake', 'vehicleModelVersion', 'batteryCapacityFull', 'fastchargeChargeSpeed', 'performanceTopspeed',
+ 'performanceAcceleration', 'rangeWLTP', 'rangeReal', 'efficiencyReal', 'image',
+ 'chargeStandardPower', 'chargeStandardPhase', 'chargeStandardPhaseAmp', 'chargeAlternativePower', 'chargeOptionPower',
+ 'chargeOptionPhaseAmp', 'chargeOptionPhase', 'chargeAlternativePhaseAmp', 'chargeAlternativePhase', 'chargePlug', 'fastChargePlug',
+ 'fastChargePowerMax', 'drivetrainPowerHP'
+ ]
+ },
{ resource: Entity.CAR_CATALOG, action: Action.READ, attributes: ['*'] },
{ resource: Entity.CAR, action: [Action.CREATE, Action.UPDATE, Action.DELETE], attributes: ['*'] },
{
@@ -334,7 +358,15 @@ const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
{ resource: Entity.SETTING, action: Action.READ, attributes: ['*'] },
{ resource: Entity.ASSETS, action: Action.LIST, attributes: ['*'] },
{ resource: Entity.ASSET, action: Action.READ, attributes: ['*'] },
- { resource: Entity.CAR_CATALOGS, action: Action.LIST, attributes: ['*'] },
+ {
+ resource: Entity.CAR_CATALOGS, action: Action.LIST, attributes: [
+ 'id', 'vehicleModel', 'vehicleMake', 'vehicleModelVersion', 'batteryCapacityFull', 'fastchargeChargeSpeed', 'performanceTopspeed',
+ 'performanceAcceleration', 'rangeWLTP', 'rangeReal', 'efficiencyReal', 'image',
+ 'chargeStandardPower', 'chargeStandardPhase', 'chargeStandardPhaseAmp', 'chargeAlternativePower', 'chargeOptionPower',
+ 'chargeOptionPhaseAmp', 'chargeOptionPhase', 'chargeAlternativePhaseAmp', 'chargeAlternativePhase', 'chargePlug', 'fastChargePlug',
+ 'fastChargePowerMax', 'drivetrainPowerHP'
+ ]
+ },
{ resource: Entity.CAR_CATALOG, action: Action.READ, attributes: ['*'] },
{
resource: Entity.CAR, action: Action.READ, attributes: [

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
import { Action, AuthorizationActions, AuthorizationContext, AuthorizationFilter, Entity } from '../../../../types/Authorization';
import { CarDataResult, CompanyDataResult, SiteAreaDataResult, SiteDataResult } from '../../../../types/DataResult';
import { HttpAssignAssetsToSiteAreaRequest, HttpAssignChargingStationToSiteAreaRequest, HttpSiteAreaRequest, HttpSiteAreasRequest } from '../../../../types/requests/HttpSiteAreaRequest';
+import { HttpCarCatalogsRequest, HttpCarsRequest } from '../../../../types/requests/HttpCarRequest';
import { HttpCompaniesRequest, HttpCompanyRequest } from '../../../../types/requests/HttpCompanyRequest';
import { HttpSiteAssignUsersRequest, HttpSiteRequest, HttpSiteUsersRequest } from '../../../../types/requests/HttpSiteRequest';
import { HttpTagsRequest, HttpUserAssignSitesRequest, HttpUserRequest, HttpUserSitesRequest, HttpUsersRequest } from '../../../../types/requests/HttpUserRequest';
@@ -17,7 +18,6 @@ import DynamicAuthorizationFactory from '../../../../authorization/DynamicAuthor
import { HTTPAuthError } from '../../../../types/HTTPError';
import { HttpAssetsRequest } from '../../../../types/requests/HttpAssetRequest';
import HttpByIDRequest from '../../../../types/requests/HttpByIDRequest';
-import { HttpCarsRequest } from '../../../../types/requests/HttpCarRequest';
import { HttpChargingStationRequest } from '../../../../types/requests/HttpChargingStationRequest';
import { ServerAction } from '../../../../types/Server';
import Site from '../../../../types/Site';
@@ -721,6 +721,20 @@ export default class AuthorizationService {
}
}
+ public static async checkAndGetCarCatalogsAuthorizationFilters(tenant: Tenant, userToken: UserToken,
+ filteredRequest: HttpCarCatalogsRequest): Promise<AuthorizationFilter> {
+ const authorizationFilters: AuthorizationFilter = {
+ filters: {},
+ dataSources: new Map(),
+ projectFields: [ ],
+ authorized: false
+ };
+ // Check static & dynamic authorization
+ await this.canPerformAuthorizationAction(
+ tenant, userToken, Entity.CAR_CATALOGS, Action.LIST, authorizationFilters, filteredRequest);
+ return authorizationFilters;
+ }
+
public static async getSiteAdminSiteIDs(tenantID: string, userToken: UserToken): Promise<string[]> {
// Get the Sites where the user is Site Admin
const userSites = await UserStorage.getUserSites(tenantID,

MODIFY
src/server/rest/v1/service/CarService.ts
src/server/rest/v1/service/CarService.ts
@@ -27,22 +27,17 @@ const MODULE_NAME = 'CarService';
export default class CarService {
public static async handleGetCarCatalogs(action: ServerAction, req: Request, res: Response, next: NextFunction): Promise<void> {
- if (!Authorizations.isSuperAdmin(req.user)) {
// Check if component is active
UtilsService.assertComponentIsActiveFromToken(req.user, TenantComponents.CAR,
Action.LIST, Entity.CAR_CATALOGS, MODULE_NAME, 'handleGetCarCatalogs');
- }
- // Check auth
- if (!await Authorizations.canListCarCatalogs(req.user)) {
- throw new AppAuthError({
- errorCode: HTTPAuthError.FORBIDDEN,
- user: req.user,
- action: Action.LIST, entity: Entity.CAR_CATALOGS,
- module: MODULE_NAME, method: 'handleGetCarCatalogs'
- });
- }
// Filter
const filteredRequest = CarSecurity.filterCarCatalogsRequest(req.query);
+ // Check auth
+ const authorizationCarCatalogsFilter = await AuthorizationService.checkAndGetCarCatalogsAuthorizationFilters(req.tenant, req.user, filteredRequest);
+ if (!authorizationCarCatalogsFilter.authorized) {
+ UtilsService.sendEmptyDataResult(res, next);
+ return;
+ }
// Get the Cars
const carCatalogs = await CarStorage.getCarCatalogs(
{
@@ -50,14 +45,15 @@ export default class CarService {
carMaker: filteredRequest.CarMaker ? filteredRequest.CarMaker.split('|') : null,
withImage: true,
},
- { limit: filteredRequest.Limit, skip: filteredRequest.Skip, sort: filteredRequest.SortFields, onlyRecordCount: filteredRequest.OnlyRecordCount },
- [
- 'id', 'vehicleModel', 'vehicleMake', 'vehicleModelVersion', 'batteryCapacityFull', 'fastchargeChargeSpeed', 'performanceTopspeed',
- 'performanceAcceleration', 'rangeWLTP', 'rangeReal', 'efficiencyReal', 'image',
- 'chargeStandardPower', 'chargeStandardPhase', 'chargeStandardPhaseAmp', 'chargeAlternativePower', 'chargeOptionPower',
- 'chargeOptionPhaseAmp', 'chargeOptionPhase', 'chargeAlternativePhaseAmp', 'chargeAlternativePhase', 'chargePlug', 'fastChargePlug', 'fastChargePowerMax', 'drivetrainPowerHP'
- ]
+ {
+ limit: filteredRequest.Limit,
+ skip: filteredRequest.Skip,
+ sort: filteredRequest.SortFields,
+ onlyRecordCount: filteredRequest.OnlyRecordCount
+ },
+ authorizationCarCatalogsFilter.projectFields
);
+ // Return
res.json(carCatalogs);
next();
}

Change handleGetCarCatalogs auth concept