canUpdateCompany change
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -519,8 +519,9 @@ export default class Authorizations {
return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.CREATE);
}
- public static canUpdateCompany(loggedUser: UserToken): boolean {
- return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.UPDATE);
+ public static canUpdateCompany(loggedUser: UserToken, companyID: string, context?: AuthorizationContext): boolean {
+ return Authorizations.canPerformAction(loggedUser, Entity.COMPANY, Action.UPDATE,
+ { company: companyID, companies: context.companies, sitesAdmin: loggedUser.sitesAdmin, sitesOwner: loggedUser.sitesOwner });
}
public static canDeleteCompany(loggedUser: UserToken): boolean {

MODIFY
src/server/rest/v1/service/AuthorizationService.ts
src/server/rest/v1/service/AuthorizationService.ts
@@ -335,7 +335,7 @@ export default class AuthorizationService {
// Enrich
for (const company of companies) {
company.canRead = Authorizations.canReadCompany(userToken, company.id, { companies: assignedCompanies });
- company.canUpdate = Authorizations.canUpdateCompany(userToken);
+ company.canUpdate = Authorizations.canUpdateCompany(userToken, company.id, { companies: assignedCompanies });
company.canDelete = Authorizations.canDeleteCompany(userToken);
}
}

MODIFY
src/server/rest/v1/service/CompanyService.ts
src/server/rest/v1/service/CompanyService.ts
@@ -227,7 +227,8 @@ export default class CompanyService {
const filteredRequest = CompanySecurity.filterCompanyUpdateRequest(req.body);
UtilsService.assertIdIsProvided(action, filteredRequest.id, MODULE_NAME, 'handleUpdateCompany', req.user);
// Check auth
- if (!Authorizations.canUpdateCompany(req.user)) {
+ const assignedCompanies = await AuthorizationService.getAssignedSitesCompanyIDs(req.tenant.id, req.user);
+ if (!Authorizations.canUpdateCompany(req.user, filteredRequest.id, { companies: assignedCompanies })) {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,

canUpdateCompany change