mirror of https://github.com/Budibase/budibase.git
mike12345567
6 years ago
35 changed files with 547 additions and 537 deletions
@ -1,52 +0,0 @@ |
|||
const CouchDB = require("../../db") |
|||
const { |
|||
BUILTIN_LEVELS, |
|||
AccessLevel, |
|||
getAccessLevel, |
|||
} = require("../../utilities/security/accessLevels") |
|||
const { |
|||
generateAccessLevelID, |
|||
getAccessLevelParams, |
|||
} = require("../../db/utils") |
|||
|
|||
exports.fetch = async function(ctx) { |
|||
const db = new CouchDB(ctx.user.appId) |
|||
const body = await db.allDocs( |
|||
getAccessLevelParams(null, { |
|||
include_docs: true, |
|||
}) |
|||
) |
|||
const customAccessLevels = body.rows.map(row => row.doc) |
|||
|
|||
const staticAccessLevels = [BUILTIN_LEVELS.ADMIN, BUILTIN_LEVELS.POWER] |
|||
ctx.body = [...staticAccessLevels, ...customAccessLevels] |
|||
} |
|||
|
|||
exports.find = async function(ctx) { |
|||
ctx.body = await getAccessLevel(ctx.user.appId, ctx.params.levelId) |
|||
} |
|||
|
|||
exports.save = async function(ctx) { |
|||
const db = new CouchDB(ctx.user.appId) |
|||
|
|||
let id = ctx.request.body._id || generateAccessLevelID() |
|||
const level = new AccessLevel( |
|||
id, |
|||
ctx.request.body.name, |
|||
ctx.request.body.inherits |
|||
) |
|||
if (ctx.request.body._rev) { |
|||
level._rev = ctx.request.body._rev |
|||
} |
|||
const result = await db.put(level) |
|||
level._rev = result.rev |
|||
ctx.body = level |
|||
ctx.message = `Access Level '${level.name}' created successfully.` |
|||
} |
|||
|
|||
exports.destroy = async function(ctx) { |
|||
const db = new CouchDB(ctx.user.appId) |
|||
await db.remove(ctx.params.levelId, ctx.params.rev) |
|||
ctx.message = `Access Level ${ctx.params.id} deleted successfully` |
|||
ctx.status = 200 |
|||
} |
|||
@ -0,0 +1,6 @@ |
|||
const { BUILTIN_PERMISSIONS } = require("../../utilities/security/permissions") |
|||
|
|||
exports.fetch = async function(ctx) { |
|||
// TODO: need to build out custom permissions
|
|||
ctx.body = Object.values(BUILTIN_PERMISSIONS) |
|||
} |
|||
@ -0,0 +1,55 @@ |
|||
const CouchDB = require("../../db") |
|||
const { |
|||
BUILTIN_ROLES, |
|||
Role, |
|||
getRole, |
|||
} = require("../../utilities/security/roles") |
|||
const { generateRoleID, getRoleParams } = require("../../db/utils") |
|||
|
|||
exports.fetch = async function(ctx) { |
|||
const db = new CouchDB(ctx.user.appId) |
|||
const body = await db.allDocs( |
|||
getRoleParams(null, { |
|||
include_docs: true, |
|||
}) |
|||
) |
|||
const customRoles = body.rows.map(row => row.doc) |
|||
|
|||
// exclude internal roles like builder
|
|||
const staticRoles = [ |
|||
BUILTIN_ROLES.ADMIN, |
|||
BUILTIN_ROLES.POWER, |
|||
BUILTIN_ROLES.BASIC, |
|||
BUILTIN_ROLES.PUBLIC, |
|||
] |
|||
ctx.body = [...staticRoles, ...customRoles] |
|||
} |
|||
|
|||
exports.find = async function(ctx) { |
|||
ctx.body = await getRole(ctx.user.appId, ctx.params.roleId) |
|||
} |
|||
|
|||
exports.save = async function(ctx) { |
|||
const db = new CouchDB(ctx.user.appId) |
|||
let { _id, name, inherits, permissionId } = ctx.request.body |
|||
if (!_id) { |
|||
_id = generateRoleID() |
|||
} |
|||
const role = new Role(_id, name) |
|||
.addPermission(permissionId) |
|||
.addInheritance(inherits) |
|||
if (ctx.request.body._rev) { |
|||
role._rev = ctx.request.body._rev |
|||
} |
|||
const result = await db.put(role) |
|||
role._rev = result.rev |
|||
ctx.body = role |
|||
ctx.message = `Role '${role.name}' created successfully.` |
|||
} |
|||
|
|||
exports.destroy = async function(ctx) { |
|||
const db = new CouchDB(ctx.user.appId) |
|||
await db.remove(ctx.params.roleId, ctx.params.rev) |
|||
ctx.message = `Role ${ctx.params.id} deleted successfully` |
|||
ctx.status = 200 |
|||
} |
|||
@ -1,18 +0,0 @@ |
|||
const Router = require("@koa/router") |
|||
const controller = require("../controllers/accesslevel") |
|||
const authorized = require("../../middleware/authorized") |
|||
const { BUILDER } = require("../../utilities/security/permissions") |
|||
|
|||
const router = Router() |
|||
|
|||
router |
|||
.post("/api/accesslevels", authorized(BUILDER), controller.save) |
|||
.get("/api/accesslevels", authorized(BUILDER), controller.fetch) |
|||
.get("/api/accesslevels/:levelId", authorized(BUILDER), controller.find) |
|||
.delete( |
|||
"/api/accesslevels/:levelId/:rev", |
|||
authorized(BUILDER), |
|||
controller.destroy |
|||
) |
|||
|
|||
module.exports = router |
|||
@ -0,0 +1,10 @@ |
|||
const Router = require("@koa/router") |
|||
const controller = require("../controllers/permission") |
|||
const authorized = require("../../middleware/authorized") |
|||
const { BUILDER } = require("../../utilities/security/permissions") |
|||
|
|||
const router = Router() |
|||
|
|||
router.get("/api/permissions", authorized(BUILDER), controller.fetch) |
|||
|
|||
module.exports = router |
|||
@ -0,0 +1,30 @@ |
|||
const Router = require("@koa/router") |
|||
const controller = require("../controllers/role") |
|||
const authorized = require("../../middleware/authorized") |
|||
const { BUILDER } = require("../../utilities/security/permissions") |
|||
const Joi = require("joi") |
|||
const joiValidator = require("../../middleware/joi-validator") |
|||
const { |
|||
BUILTIN_PERMISSION_IDS, |
|||
} = require("../../utilities/security/permissions") |
|||
|
|||
const router = Router() |
|||
|
|||
function generateValidator() { |
|||
// prettier-ignore
|
|||
return joiValidator.body(Joi.object({ |
|||
_id: Joi.string().optional(), |
|||
_rev: Joi.string().optional(), |
|||
name: Joi.string().required(), |
|||
permissionId: Joi.string().valid(...Object.values(BUILTIN_PERMISSION_IDS)).required(), |
|||
inherits: Joi.string().optional(), |
|||
}).unknown(true)) |
|||
} |
|||
|
|||
router |
|||
.post("/api/roles", authorized(BUILDER), generateValidator(), controller.save) |
|||
.get("/api/roles", authorized(BUILDER), controller.fetch) |
|||
.get("/api/roles/:roleId", authorized(BUILDER), controller.find) |
|||
.delete("/api/roles/:roleId/:rev", authorized(BUILDER), controller.destroy) |
|||
|
|||
module.exports = router |
|||
@ -1,110 +0,0 @@ |
|||
const { |
|||
createApplication, |
|||
createTable, |
|||
createView, |
|||
supertest, |
|||
defaultHeaders |
|||
} = require("./couchTestUtils") |
|||
const { |
|||
BUILTIN_LEVEL_IDS, |
|||
} = require("../../../utilities/security/accessLevels") |
|||
|
|||
const accessLevelBody = { name: "user", inherits: BUILTIN_LEVEL_IDS.BASIC } |
|||
|
|||
describe("/accesslevels", () => { |
|||
let server |
|||
let request |
|||
let appId |
|||
let table |
|||
let view |
|||
|
|||
beforeAll(async () => { |
|||
({ request, server } = await supertest()) |
|||
}); |
|||
|
|||
afterAll(() => { |
|||
server.close() |
|||
}) |
|||
|
|||
beforeEach(async () => { |
|||
let app = await createApplication(request) |
|||
appId = app.instance._id |
|||
table = await createTable(request, appId) |
|||
view = await createView(request, appId, table._id) |
|||
}) |
|||
|
|||
describe("create", () => { |
|||
|
|||
it("returns a success message when level is successfully created", async () => { |
|||
const res = await request |
|||
.post(`/api/accesslevels`) |
|||
.send(accessLevelBody) |
|||
.set(defaultHeaders(appId)) |
|||
.expect('Content-Type', /json/) |
|||
.expect(200) |
|||
|
|||
expect(res.res.statusMessage).toEqual("Access Level 'user' created successfully.") |
|||
expect(res.body._id).toBeDefined() |
|||
expect(res.body._rev).toBeDefined() |
|||
}) |
|||
|
|||
}); |
|||
|
|||
describe("fetch", () => { |
|||
|
|||
it("should list custom levels, plus 2 default levels", async () => { |
|||
const createRes = await request |
|||
.post(`/api/accesslevels`) |
|||
.send(accessLevelBody) |
|||
.set(defaultHeaders(appId)) |
|||
.expect('Content-Type', /json/) |
|||
.expect(200) |
|||
|
|||
const customLevel = createRes.body |
|||
|
|||
const res = await request |
|||
.get(`/api/accesslevels`) |
|||
.set(defaultHeaders(appId)) |
|||
.expect('Content-Type', /json/) |
|||
.expect(200) |
|||
|
|||
expect(res.body.length).toBe(3) |
|||
|
|||
const adminLevel = res.body.find(r => r._id === BUILTIN_LEVEL_IDS.ADMIN) |
|||
expect(adminLevel.inherits).toEqual(BUILTIN_LEVEL_IDS.POWER) |
|||
expect(adminLevel).toBeDefined() |
|||
|
|||
const powerUserLevel = res.body.find(r => r._id === BUILTIN_LEVEL_IDS.POWER) |
|||
expect(powerUserLevel.inherits).toEqual(BUILTIN_LEVEL_IDS.BASIC) |
|||
expect(powerUserLevel).toBeDefined() |
|||
|
|||
const customLevelFetched = res.body.find(r => r._id === customLevel._id) |
|||
expect(customLevelFetched.inherits).toEqual(BUILTIN_LEVEL_IDS.BASIC) |
|||
expect(customLevelFetched).toBeDefined() |
|||
}) |
|||
|
|||
}); |
|||
|
|||
describe("destroy", () => { |
|||
it("should delete custom access level", async () => { |
|||
const createRes = await request |
|||
.post(`/api/accesslevels`) |
|||
.send({ name: "user" }) |
|||
.set(defaultHeaders(appId)) |
|||
.expect('Content-Type', /json/) |
|||
.expect(200) |
|||
|
|||
const customLevel = createRes.body |
|||
|
|||
await request |
|||
.delete(`/api/accesslevels/${customLevel._id}/${customLevel._rev}`) |
|||
.set(defaultHeaders(appId)) |
|||
.expect(200) |
|||
|
|||
await request |
|||
.get(`/api/accesslevels/${customLevel._id}`) |
|||
.set(defaultHeaders(appId)) |
|||
.expect(404) |
|||
}) |
|||
}) |
|||
}); |
|||
@ -0,0 +1,114 @@ |
|||
const { |
|||
createApplication, |
|||
createTable, |
|||
createView, |
|||
supertest, |
|||
defaultHeaders |
|||
} = require("./couchTestUtils") |
|||
const { |
|||
BUILTIN_ROLE_IDS, |
|||
} = require("../../../utilities/security/roles") |
|||
const { BUILTIN_PERMISSION_IDS } = require("../../../utilities/security/permissions") |
|||
|
|||
const roleBody = { name: "NewRole", inherits: BUILTIN_ROLE_IDS.BASIC, permissionId: BUILTIN_PERMISSION_IDS.READ_ONLY } |
|||
|
|||
describe("/roles", () => { |
|||
let server |
|||
let request |
|||
let appId |
|||
let table |
|||
let view |
|||
|
|||
beforeAll(async () => { |
|||
({ request, server } = await supertest()) |
|||
}); |
|||
|
|||
afterAll(() => { |
|||
server.close() |
|||
}) |
|||
|
|||
beforeEach(async () => { |
|||
let app = await createApplication(request) |
|||
appId = app.instance._id |
|||
table = await createTable(request, appId) |
|||
view = await createView(request, appId, table._id) |
|||
}) |
|||
|
|||
describe("create", () => { |
|||
|
|||
it("returns a success message when role is successfully created", async () => { |
|||
const res = await request |
|||
.post(`/api/roles`) |
|||
.send(roleBody) |
|||
.set(defaultHeaders(appId)) |
|||
.expect('Content-Type', /json/) |
|||
.expect(200) |
|||
|
|||
expect(res.res.statusMessage).toEqual("Role 'NewRole' created successfully.") |
|||
expect(res.body._id).toBeDefined() |
|||
expect(res.body._rev).toBeDefined() |
|||
}) |
|||
|
|||
}); |
|||
|
|||
describe("fetch", () => { |
|||
|
|||
it("should list custom roles, plus 2 default roles", async () => { |
|||
const createRes = await request |
|||
.post(`/api/roles`) |
|||
.send(roleBody) |
|||
.set(defaultHeaders(appId)) |
|||
.expect('Content-Type', /json/) |
|||
.expect(200) |
|||
|
|||
const customRole = createRes.body |
|||
|
|||
const res = await request |
|||
.get(`/api/roles`) |
|||
.set(defaultHeaders(appId)) |
|||
.expect('Content-Type', /json/) |
|||
.expect(200) |
|||
|
|||
expect(res.body.length).toBe(3) |
|||
|
|||
const adminRole = res.body.find(r => r._id === BUILTIN_ROLE_IDS.ADMIN) |
|||
expect(adminRole).toBeDefined() |
|||
expect(adminRole.inherits).toEqual(BUILTIN_ROLE_IDS.POWER) |
|||
expect(adminRole.permissionId).toEqual(BUILTIN_PERMISSION_IDS.ADMIN) |
|||
|
|||
const powerUserRole = res.body.find(r => r._id === BUILTIN_ROLE_IDS.POWER) |
|||
expect(powerUserRole).toBeDefined() |
|||
expect(powerUserRole.inherits).toEqual(BUILTIN_ROLE_IDS.BASIC) |
|||
expect(powerUserRole.permissionId).toEqual(BUILTIN_PERMISSION_IDS.POWER) |
|||
|
|||
const customRoleFetched = res.body.find(r => r._id === customRole._id) |
|||
expect(customRoleFetched).toBeDefined() |
|||
expect(customRoleFetched.inherits).toEqual(BUILTIN_ROLE_IDS.BASIC) |
|||
expect(customRoleFetched.permissionId).toEqual(BUILTIN_PERMISSION_IDS.READ_ONLY) |
|||
}) |
|||
|
|||
}); |
|||
|
|||
describe("destroy", () => { |
|||
it("should delete custom roles", async () => { |
|||
const createRes = await request |
|||
.post(`/api/roles`) |
|||
.send({ name: "user", permissionId: BUILTIN_PERMISSION_IDS.READ_ONLY }) |
|||
.set(defaultHeaders(appId)) |
|||
.expect('Content-Type', /json/) |
|||
.expect(200) |
|||
|
|||
const customRole = createRes.body |
|||
|
|||
await request |
|||
.delete(`/api/roles/${customRole._id}/${customRole._rev}`) |
|||
.set(defaultHeaders(appId)) |
|||
.expect(200) |
|||
|
|||
await request |
|||
.get(`/api/roles/${customRole._id}`) |
|||
.set(defaultHeaders(appId)) |
|||
.expect(404) |
|||
}) |
|||
}) |
|||
}); |
|||
@ -1,150 +0,0 @@ |
|||
const CouchDB = require("../../db") |
|||
const { cloneDeep } = require("lodash/fp") |
|||
|
|||
const BUILTIN_IDS = { |
|||
ADMIN: "ADMIN", |
|||
POWER: "POWER_USER", |
|||
BASIC: "BASIC", |
|||
PUBLIC: "PUBLIC", |
|||
BUILDER: "BUILDER", |
|||
} |
|||
|
|||
function AccessLevel(id, name, inherits) { |
|||
this._id = id |
|||
this.name = name |
|||
if (inherits) { |
|||
this.inherits = inherits |
|||
} |
|||
} |
|||
|
|||
exports.BUILTIN_LEVELS = { |
|||
ADMIN: new AccessLevel(BUILTIN_IDS.ADMIN, "Admin", BUILTIN_IDS.POWER), |
|||
POWER: new AccessLevel(BUILTIN_IDS.POWER, "Power", BUILTIN_IDS.BASIC), |
|||
BASIC: new AccessLevel(BUILTIN_IDS.BASIC, "Basic", BUILTIN_IDS.PUBLIC), |
|||
PUBLIC: new AccessLevel(BUILTIN_IDS.PUBLIC, "Public"), |
|||
BUILDER: new AccessLevel(BUILTIN_IDS.BUILDER, "Builder"), |
|||
} |
|||
|
|||
exports.BUILTIN_LEVEL_ID_ARRAY = Object.values(exports.BUILTIN_LEVELS).map( |
|||
level => level._id |
|||
) |
|||
|
|||
exports.BUILTIN_LEVEL_NAME_ARRAY = Object.values(exports.BUILTIN_LEVELS).map( |
|||
level => level.name |
|||
) |
|||
|
|||
function isBuiltin(accessLevel) { |
|||
return exports.BUILTIN_LEVEL_ID_ARRAY.indexOf(accessLevel) !== -1 |
|||
} |
|||
|
|||
/** |
|||
* Gets the access level object, this is mainly useful for two purposes, to check if the level exists and |
|||
* to check if the access level inherits any others. |
|||
* @param {string} appId The app in which to look for the access level. |
|||
* @param {string|null} accessLevelId The level ID to lookup. |
|||
* @returns {Promise<AccessLevel|object|null>} The access level object, which may contain an "inherits" property. |
|||
*/ |
|||
exports.getAccessLevel = async (appId, accessLevelId) => { |
|||
if (!accessLevelId) { |
|||
return null |
|||
} |
|||
let accessLevel |
|||
if (isBuiltin(accessLevelId)) { |
|||
accessLevel = cloneDeep( |
|||
Object.values(exports.BUILTIN_LEVELS).find( |
|||
level => level._id === accessLevelId |
|||
) |
|||
) |
|||
} else { |
|||
const db = new CouchDB(appId) |
|||
accessLevel = await db.get(accessLevelId) |
|||
} |
|||
return accessLevel |
|||
} |
|||
|
|||
/** |
|||
* Returns an ordered array of the user's inherited access level IDs, this can be used |
|||
* to determine if a user can access something that requires a specific access level. |
|||
* @param {string} appId The ID of the application from which access levels should be obtained. |
|||
* @param {string} userAccessLevelId The user's access level, this can be found in their access token. |
|||
* @returns {Promise<string[]>} returns an ordered array of the access levels, with the first being their |
|||
* highest level of access and the last being the lowest level. |
|||
*/ |
|||
exports.getUserAccessLevelHierarchy = async (appId, userAccessLevelId) => { |
|||
// special case, if they don't have a level then they are a public user
|
|||
if (!userAccessLevelId) { |
|||
return [BUILTIN_IDS.PUBLIC] |
|||
} |
|||
let accessLevelIds = [userAccessLevelId] |
|||
let userAccess = await exports.getAccessLevel(appId, userAccessLevelId) |
|||
// check if inherited makes it possible
|
|||
while ( |
|||
userAccess && |
|||
userAccess.inherits && |
|||
accessLevelIds.indexOf(userAccess.inherits) === -1 |
|||
) { |
|||
accessLevelIds.push(userAccess.inherits) |
|||
// go to get the inherited incase it inherits anything
|
|||
userAccess = await exports.getAccessLevel(appId, userAccess.inherits) |
|||
} |
|||
// add the user's actual level at the end (not at start as that stops iteration
|
|||
return accessLevelIds |
|||
} |
|||
|
|||
class AccessController { |
|||
constructor(appId) { |
|||
this.appId = appId |
|||
this.userHierarchies = {} |
|||
} |
|||
|
|||
async hasAccess(tryingAccessLevelId, userAccessLevelId) { |
|||
// special cases, the screen has no access level, the access levels are the same or the user
|
|||
// is currently in the builder
|
|||
if ( |
|||
tryingAccessLevelId == null || |
|||
tryingAccessLevelId === "" || |
|||
tryingAccessLevelId === userAccessLevelId || |
|||
userAccessLevelId === BUILTIN_IDS.BUILDER |
|||
) { |
|||
return true |
|||
} |
|||
let accessLevelIds = this.userHierarchies[userAccessLevelId] |
|||
if (!accessLevelIds) { |
|||
accessLevelIds = await exports.getUserAccessLevelHierarchy( |
|||
this.appId, |
|||
userAccessLevelId |
|||
) |
|||
this.userHierarchies[userAccessLevelId] = userAccessLevelId |
|||
} |
|||
|
|||
return accessLevelIds.indexOf(tryingAccessLevelId) !== -1 |
|||
} |
|||
|
|||
async checkScreensAccess(screens, userAccessLevelId) { |
|||
let accessibleScreens = [] |
|||
// don't want to handle this with Promise.all as this would mean all custom access levels would be
|
|||
// retrieved at same time, it is likely a custom levels will be re-used and therefore want
|
|||
// to work in sync for performance save
|
|||
for (let screen of screens) { |
|||
const accessible = await this.checkScreenAccess(screen, userAccessLevelId) |
|||
if (accessible) { |
|||
accessibleScreens.push(accessible) |
|||
} |
|||
} |
|||
return accessibleScreens |
|||
} |
|||
|
|||
async checkScreenAccess(screen, userAccessLevelId) { |
|||
const accessLevelId = |
|||
screen && screen.routing ? screen.routing.accessLevelId : null |
|||
if (await this.hasAccess(accessLevelId, userAccessLevelId)) { |
|||
return screen |
|||
} |
|||
return null |
|||
} |
|||
} |
|||
|
|||
exports.AccessController = AccessController |
|||
exports.BUILTIN_LEVEL_IDS = BUILTIN_IDS |
|||
exports.isBuiltin = isBuiltin |
|||
exports.AccessLevel = AccessLevel |
|||
@ -0,0 +1,183 @@ |
|||
const CouchDB = require("../../db") |
|||
const { cloneDeep } = require("lodash/fp") |
|||
const { BUILTIN_PERMISSION_IDS } = require("./permissions") |
|||
|
|||
const BUILTIN_IDS = { |
|||
ADMIN: "ADMIN", |
|||
POWER: "POWER_USER", |
|||
BASIC: "BASIC", |
|||
PUBLIC: "PUBLIC", |
|||
BUILDER: "BUILDER", |
|||
} |
|||
|
|||
function Role(id, name) { |
|||
this._id = id |
|||
this.name = name |
|||
} |
|||
|
|||
Role.prototype.addPermission = function(permissionId) { |
|||
this.permissionId = permissionId |
|||
return this |
|||
} |
|||
|
|||
Role.prototype.addInheritance = function(inherits) { |
|||
this.inherits = inherits |
|||
return this |
|||
} |
|||
|
|||
exports.BUILTIN_ROLES = { |
|||
ADMIN: new Role(BUILTIN_IDS.ADMIN, "Admin") |
|||
.addPermission(BUILTIN_PERMISSION_IDS.ADMIN) |
|||
.addInheritance(BUILTIN_IDS.POWER), |
|||
POWER: new Role(BUILTIN_IDS.POWER, "Power") |
|||
.addPermission(BUILTIN_PERMISSION_IDS.POWER) |
|||
.addInheritance(BUILTIN_IDS.BASIC), |
|||
BASIC: new Role(BUILTIN_IDS.BASIC, "Basic") |
|||
.addPermission(BUILTIN_PERMISSION_IDS.WRITE) |
|||
.addInheritance(BUILTIN_IDS.PUBLIC), |
|||
PUBLIC: new Role(BUILTIN_IDS.PUBLIC, "Public").addPermission( |
|||
BUILTIN_PERMISSION_IDS.READ_ONLY |
|||
), |
|||
BUILDER: new Role(BUILTIN_IDS.BUILDER, "Builder").addPermission( |
|||
BUILTIN_PERMISSION_IDS.ADMIN |
|||
), |
|||
} |
|||
|
|||
exports.BUILTIN_ROLE_ID_ARRAY = Object.values(exports.BUILTIN_ROLES).map( |
|||
level => level._id |
|||
) |
|||
|
|||
exports.BUILTIN_ROLE_NAME_ARRAY = Object.values(exports.BUILTIN_ROLES).map( |
|||
level => level.name |
|||
) |
|||
|
|||
function isBuiltin(role) { |
|||
return exports.BUILTIN_ROLE_ID_ARRAY.indexOf(role) !== -1 |
|||
} |
|||
|
|||
/** |
|||
* Gets the role object, this is mainly useful for two purposes, to check if the level exists and |
|||
* to check if the role inherits any others. |
|||
* @param {string} appId The app in which to look for the role. |
|||
* @param {string|null} roleId The level ID to lookup. |
|||
* @returns {Promise<Role|object|null>} The role object, which may contain an "inherits" property. |
|||
*/ |
|||
exports.getRole = async (appId, roleId) => { |
|||
if (!roleId) { |
|||
return null |
|||
} |
|||
let role |
|||
if (isBuiltin(roleId)) { |
|||
role = cloneDeep( |
|||
Object.values(exports.BUILTIN_ROLES).find(role => role._id === roleId) |
|||
) |
|||
} else { |
|||
const db = new CouchDB(appId) |
|||
role = await db.get(roleId) |
|||
} |
|||
return role |
|||
} |
|||
|
|||
/** |
|||
* Simple function to get all the roles based on the top level user role ID. |
|||
*/ |
|||
async function getAllUserRoles(appId, userRoleId) { |
|||
if (!userRoleId) { |
|||
return [BUILTIN_IDS.PUBLIC] |
|||
} |
|||
let currentRole = await exports.getRole(appId, userRoleId) |
|||
let roles = currentRole ? [currentRole] : [] |
|||
let roleIds = [userRoleId] |
|||
// get all the inherited roles
|
|||
while ( |
|||
currentRole && |
|||
currentRole.inherits && |
|||
roleIds.indexOf(currentRole.inherits) === -1 |
|||
) { |
|||
roleIds.push(currentRole.inherits) |
|||
currentRole = await exports.getRole(appId, currentRole.inherits) |
|||
roles.push(currentRole) |
|||
} |
|||
return roles |
|||
} |
|||
|
|||
/** |
|||
* Returns an ordered array of the user's inherited role IDs, this can be used |
|||
* to determine if a user can access something that requires a specific role. |
|||
* @param {string} appId The ID of the application from which roles should be obtained. |
|||
* @param {string} userRoleId The user's role ID, this can be found in their access token. |
|||
* @returns {Promise<string[]>} returns an ordered array of the roles, with the first being their |
|||
* highest level of access and the last being the lowest level. |
|||
*/ |
|||
exports.getUserRoleHierarchy = async (appId, userRoleId) => { |
|||
// special case, if they don't have a role then they are a public user
|
|||
return (await getAllUserRoles(appId, userRoleId)).map(role => role._id) |
|||
} |
|||
|
|||
/** |
|||
* Get all of the user permissions which could be found across the role hierarchy |
|||
* @param appId The ID of the application from which roles should be obtained. |
|||
* @param userRoleId The user's role ID, this can be found in their access token. |
|||
* @returns {Promise<string[]>} A list of permission IDs these should all be unique. |
|||
*/ |
|||
exports.getUserPermissionIds = async (appId, userRoleId) => { |
|||
return [ |
|||
...new Set( |
|||
(await getAllUserRoles(appId, userRoleId)).map(role => role.permissionId) |
|||
), |
|||
] |
|||
} |
|||
|
|||
class AccessController { |
|||
constructor(appId) { |
|||
this.appId = appId |
|||
this.userHierarchies = {} |
|||
} |
|||
|
|||
async hasAccess(tryingRoleId, userRoleId) { |
|||
// special cases, the screen has no role, the roles are the same or the user
|
|||
// is currently in the builder
|
|||
if ( |
|||
tryingRoleId == null || |
|||
tryingRoleId === "" || |
|||
tryingRoleId === userRoleId || |
|||
tryingRoleId === BUILTIN_IDS.BUILDER |
|||
) { |
|||
return true |
|||
} |
|||
let roleIds = this.userHierarchies[userRoleId] |
|||
if (!roleIds) { |
|||
roleIds = await exports.getUserRoleHierarchy(this.appId, userRoleId) |
|||
this.userHierarchies[userRoleId] = userRoleId |
|||
} |
|||
|
|||
return roleIds.indexOf(tryingRoleId) !== -1 |
|||
} |
|||
|
|||
async checkScreensAccess(screens, userRoleId) { |
|||
let accessibleScreens = [] |
|||
// don't want to handle this with Promise.all as this would mean all custom roles would be
|
|||
// retrieved at same time, it is likely a custom role will be re-used and therefore want
|
|||
// to work in sync for performance save
|
|||
for (let screen of screens) { |
|||
const accessible = await this.checkScreenAccess(screen, userRoleId) |
|||
if (accessible) { |
|||
accessibleScreens.push(accessible) |
|||
} |
|||
} |
|||
return accessibleScreens |
|||
} |
|||
|
|||
async checkScreenAccess(screen, userRoleId) { |
|||
const roleId = screen && screen.routing ? screen.routing.roleId : null |
|||
if (await this.hasAccess(roleId, userRoleId)) { |
|||
return screen |
|||
} |
|||
return null |
|||
} |
|||
} |
|||
|
|||
exports.AccessController = AccessController |
|||
exports.BUILTIN_ROLE_IDS = BUILTIN_IDS |
|||
exports.isBuiltin = isBuiltin |
|||
exports.Role = Role |
|||
Loading…
Reference in new issue