Align car component with ABAC
Add authorization flag in Car response
Add car pool creation action for admin only
Enforce GUI rule in backend for car pool creation
MODIFY
src/authorization/AuthorizationsDefinition.ts
src/authorization/AuthorizationsDefinition.ts
@@ -488,7 +488,7 @@ export const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
'chargeAlternativePhase', 'chargeOptionPower', 'chargeOptionPhase', 'image', 'chargeOptionPhaseAmp', 'chargeAlternativePhaseAmp'
]
},
- { resource: Entity.CAR, action: [Action.CREATE, Action.UPDATE, Action.DELETE] },
+ { resource: Entity.CAR, action: [Action.CREATE, Action.CREATE_POOL_CAR, Action.UPDATE, Action.DELETE] },
{
resource: Entity.CAR, action: Action.READ,
attributes: [
@@ -1226,7 +1226,7 @@ export const AUTHORIZATION_DEFINITION: AuthorizationDefinition = {
condition: {
Fn: 'custom:dynamicAuthorizations',
args: {
- asserts: [],
+ asserts: ['-PoolCar'],
filters: []
}
},

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -597,6 +597,9 @@ export default class AuthorizationService {
cars.metadata = authorizationFilter.metadata;
// Add Authorizations
cars.canCreate = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.CAR, Action.CREATE, authorizationFilter);
+ cars.canListUsers = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.USER, Action.LIST, authorizationFilter);
+ cars.canListCarCatalog = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.CAR_CATALOG, Action.LIST, authorizationFilter);
+ cars.canCreatePoolCar = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.CAR, Action.CREATE_POOL_CAR, authorizationFilter);
for (const car of cars.result) {
await AuthorizationService.addCarAuthorizations(tenant, userToken, car, authorizationFilter);
}
@@ -604,10 +607,10 @@ export default class AuthorizationService {
public static async addCarAuthorizations(tenant: Tenant, userToken: UserToken, car: Car, authorizationFilter: AuthorizationFilter): Promise<void> {
car.canRead = true; // Always true as it should be filtered upfront
- car.canDelete = await AuthorizationService.canPerformAuthorizationAction(
- tenant, userToken, Entity.CAR, Action.DELETE, authorizationFilter, { CarID: car.id }, car);
- car.canUpdate = await AuthorizationService.canPerformAuthorizationAction(
- tenant, userToken, Entity.CAR, Action.UPDATE, authorizationFilter, { CarID: car.id }, car);
+ car.canDelete = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.CAR, Action.DELETE, authorizationFilter, { CarID: car.id }, car);
+ car.canUpdate = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.CAR, Action.UPDATE, authorizationFilter, { CarID: car.id }, car);
+ car.canListUsers = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.USER, Action.LIST, authorizationFilter);
+ car.canCreatePoolCar = await AuthorizationService.canPerformAuthorizationAction(tenant, userToken, Entity.CAR, Action.CREATE_POOL_CAR, authorizationFilter);
// Optimize data over the net
Utils.removeCanPropertiesWithFalseValue(car);
}

MODIFY
src/types/Authorization.ts
src/types/Authorization.ts
@@ -157,6 +157,7 @@ export enum Action {
EXPORT_OCPP_PARAMS = 'ExportOCPPParams',
GENERATE_QR = 'GenerateQrCode',
MAINTAIN_PRICING_DEFINITIONS = 'MaintainPricingDefinitions',
+ CREATE_POOL_CAR = 'CreatePoolCar',
}
export interface AuthorizationContext {
@@ -187,6 +188,10 @@ export interface AuthorizationActions {
metadata?: Record<string, unknown>;
}
+export interface CarAuthorizationActions extends AuthorizationActions {
+ canCreatePoolCar?: boolean;
+}
+
export interface TagAuthorizationActions extends AuthorizationActions {
canUnassign?: boolean;
canAssign?: boolean;

MODIFY
src/types/Car.ts
src/types/Car.ts
-import { AuthorizationActions } from './Authorization';
+import { AuthorizationActions, CarAuthorizationActions } from './Authorization';
+
import CreatedUpdatedProps from './CreatedUpdatedProps';
export interface CarCatalog extends CreatedUpdatedProps, AuthorizationActions {
@@ -128,7 +129,7 @@ export enum CarType {
POOL_CAR = 'PC',
}
-export interface Car extends CreatedUpdatedProps, AuthorizationActions {
+export interface Car extends CreatedUpdatedProps, CarAuthorizationActions {
id?: string;
vin: string;
licensePlate: string;

MODIFY
src/types/DataResult.ts
src/types/DataResult.ts
@@ -52,6 +52,9 @@ export interface SiteAreaDataResult extends DataResult<SiteArea> {
export interface CarDataResult extends DataResult<Car> {
canCreate: boolean;
+ canListUsers: boolean;
+ canListCarCatalog: boolean;
+ canCreatePoolCar: boolean;
}
export interface CarCatalogDataResult extends DataResult<CarCatalog> {

Align car component with ABAC
- Add authorization flag in Car response
- Add car pool creation action for admin only
- Enforce GUI rule in backend for car pool creation