forked from tsai/budibase
Michael Shanks
6 years ago
34 changed files with 1274 additions and 205 deletions
@ -0,0 +1,108 @@ |
|||||
|
const CouchDB = require("../../db") |
||||
|
const newid = require("../../db/newid") |
||||
|
const { |
||||
|
generateAdminPermissions, |
||||
|
generatePowerUserPermissions, |
||||
|
POWERUSER_LEVEL_ID, |
||||
|
ADMIN_LEVEL_ID, |
||||
|
} = require("../../utilities/accessLevels") |
||||
|
|
||||
|
exports.fetch = async function(ctx) { |
||||
|
const db = new CouchDB(ctx.params.instanceId) |
||||
|
const body = await db.query("database/by_type", { |
||||
|
include_docs: true, |
||||
|
key: ["accesslevel"], |
||||
|
}) |
||||
|
const customAccessLevels = body.rows.map(row => row.doc) |
||||
|
|
||||
|
const staticAccessLevels = [ |
||||
|
{ |
||||
|
_id: ADMIN_LEVEL_ID, |
||||
|
name: "Admin", |
||||
|
permissions: await generateAdminPermissions(ctx.params.instanceId), |
||||
|
}, |
||||
|
{ |
||||
|
_id: POWERUSER_LEVEL_ID, |
||||
|
name: "Power User", |
||||
|
permissions: await generatePowerUserPermissions(ctx.params.instanceId), |
||||
|
}, |
||||
|
] |
||||
|
|
||||
|
ctx.body = [...staticAccessLevels, ...customAccessLevels] |
||||
|
} |
||||
|
|
||||
|
exports.find = async function(ctx) { |
||||
|
const db = new CouchDB(ctx.params.instanceId) |
||||
|
ctx.body = await db.get(ctx.params.levelId) |
||||
|
} |
||||
|
|
||||
|
exports.update = async function(ctx) { |
||||
|
const db = new CouchDB(ctx.params.instanceId) |
||||
|
const level = await db.get(ctx.params.levelId) |
||||
|
level.name = ctx.body.name |
||||
|
level.permissions = ctx.request.body.permissions |
||||
|
const result = await db.put(level) |
||||
|
level._rev = result.rev |
||||
|
ctx.body = level |
||||
|
ctx.message = `Level ${level.name} updated successfully.` |
||||
|
} |
||||
|
|
||||
|
exports.patch = async function(ctx) { |
||||
|
const db = new CouchDB(ctx.params.instanceId) |
||||
|
const level = await db.get(ctx.params.levelId) |
||||
|
const { removedPermissions, addedPermissions, _rev } = ctx.request.body |
||||
|
|
||||
|
if (!_rev) throw new Error("Must supply a _rev to update an access level") |
||||
|
|
||||
|
level._rev = _rev |
||||
|
|
||||
|
if (removedPermissions) { |
||||
|
level.permissions = level.permissions.filter( |
||||
|
p => |
||||
|
!removedPermissions.some( |
||||
|
rem => rem.name === p.name && rem.itemId === p.itemId |
||||
|
) |
||||
|
) |
||||
|
} |
||||
|
|
||||
|
if (addedPermissions) { |
||||
|
level.permissions = [ |
||||
|
...level.permissions.filter( |
||||
|
p => |
||||
|
!addedPermissions.some( |
||||
|
add => add.name === p.name && add.itemId === p.itemId |
||||
|
) |
||||
|
), |
||||
|
...addedPermissions, |
||||
|
] |
||||
|
} |
||||
|
|
||||
|
const result = await db.put(level) |
||||
|
level._rev = result.rev |
||||
|
ctx.body = level |
||||
|
ctx.message = `Access Level ${level.name} updated successfully.` |
||||
|
} |
||||
|
|
||||
|
exports.create = async function(ctx) { |
||||
|
const db = new CouchDB(ctx.params.instanceId) |
||||
|
|
||||
|
const level = { |
||||
|
name: ctx.request.body.name, |
||||
|
_rev: ctx.request.body._rev, |
||||
|
permissions: ctx.request.body.permissions || [], |
||||
|
_id: newid(), |
||||
|
type: "accesslevel", |
||||
|
} |
||||
|
|
||||
|
const result = await db.put(level) |
||||
|
level._rev = result.rev |
||||
|
ctx.body = level |
||||
|
ctx.message = `Access Level '${level.name}' created successfully.` |
||||
|
} |
||||
|
|
||||
|
exports.destroy = async function(ctx) { |
||||
|
const db = new CouchDB(ctx.params.instanceId) |
||||
|
await db.remove(ctx.params.levelId, ctx.params.rev) |
||||
|
ctx.message = `Access Level ${ctx.params.id} deleted successfully` |
||||
|
ctx.status = 200 |
||||
|
} |
||||
@ -0,0 +1,14 @@ |
|||||
|
const Router = require("@koa/router") |
||||
|
const controller = require("../controllers/accesslevel") |
||||
|
|
||||
|
const router = Router() |
||||
|
|
||||
|
router |
||||
|
.post("/api/:instanceId/accesslevels", controller.create) |
||||
|
.put("/api/:instanceId/accesslevels", controller.update) |
||||
|
.get("/api/:instanceId/accesslevels", controller.fetch) |
||||
|
.get("/api/:instanceId/accesslevels/:levelId", controller.find) |
||||
|
.delete("/api/:instanceId/accesslevels/:levelId/:rev", controller.destroy) |
||||
|
.patch("/api/:instanceId/accesslevels/:levelId", controller.patch) |
||||
|
|
||||
|
module.exports = router |
||||
@ -1,11 +1,17 @@ |
|||||
const Router = require("@koa/router") |
const Router = require("@koa/router") |
||||
const controller = require("../controllers/application") |
const controller = require("../controllers/application") |
||||
|
const authorized = require("../../middleware/authorized") |
||||
|
const { BUILDER } = require("../../utilities/accessLevels") |
||||
|
|
||||
const router = Router() |
const router = Router() |
||||
|
|
||||
router |
router |
||||
.get("/api/applications", controller.fetch) |
.get("/api/applications", authorized(BUILDER), controller.fetch) |
||||
.get("/api/:applicationId/appPackage", controller.fetchAppPackage) |
.get( |
||||
.post("/api/applications", controller.create) |
"/api/:applicationId/appPackage", |
||||
|
authorized(BUILDER), |
||||
|
controller.fetchAppPackage |
||||
|
) |
||||
|
.post("/api/applications", authorized(BUILDER), controller.create) |
||||
|
|
||||
module.exports = router |
module.exports = router |
||||
|
|||||
@ -1,8 +1,10 @@ |
|||||
const Router = require("@koa/router") |
const Router = require("@koa/router") |
||||
const controller = require("../controllers/client") |
const controller = require("../controllers/client") |
||||
|
const authorized = require("../../middleware/authorized") |
||||
|
const { BUILDER } = require("../../utilities/accessLevels") |
||||
|
|
||||
const router = Router() |
const router = Router() |
||||
|
|
||||
router.get("/api/client/id", controller.getClientId) |
router.get("/api/client/id", authorized(BUILDER), controller.getClientId) |
||||
|
|
||||
module.exports = router |
module.exports = router |
||||
|
|||||
@ -1,10 +1,12 @@ |
|||||
const Router = require("@koa/router") |
const Router = require("@koa/router") |
||||
const controller = require("../controllers/instance") |
const controller = require("../controllers/instance") |
||||
|
const authorized = require("../../middleware/authorized") |
||||
|
const { BUILDER } = require("../../utilities/accessLevels") |
||||
|
|
||||
const router = Router() |
const router = Router() |
||||
|
|
||||
router |
router |
||||
.post("/api/:applicationId/instances", controller.create) |
.post("/api/:applicationId/instances", authorized(BUILDER), controller.create) |
||||
.delete("/api/instances/:instanceId", controller.destroy) |
.delete("/api/instances/:instanceId", authorized(BUILDER), controller.destroy) |
||||
|
|
||||
module.exports = router |
module.exports = router |
||||
|
|||||
@ -1,12 +1,49 @@ |
|||||
const Router = require("@koa/router") |
const Router = require("@koa/router") |
||||
const controller = require("../controllers/model") |
const modelController = require("../controllers/model") |
||||
|
const recordController = require("../controllers/record") |
||||
|
const authorized = require("../../middleware/authorized") |
||||
|
const { |
||||
|
READ_MODEL, |
||||
|
WRITE_MODEL, |
||||
|
BUILDER, |
||||
|
} = require("../../utilities/accessLevels") |
||||
|
|
||||
const router = Router() |
const router = Router() |
||||
|
|
||||
|
// records
|
||||
|
|
||||
|
router |
||||
|
.get( |
||||
|
"/api/:instanceId/:modelId/records", |
||||
|
authorized(READ_MODEL, ctx => ctx.params.modelId), |
||||
|
recordController.fetchModel |
||||
|
) |
||||
|
.get( |
||||
|
"/api/:instanceId/:modelId/records/:recordId", |
||||
|
authorized(READ_MODEL, ctx => ctx.params.modelId), |
||||
|
recordController.find |
||||
|
) |
||||
|
.post( |
||||
|
"/api/:instanceId/:modelId/records", |
||||
|
authorized(WRITE_MODEL, ctx => ctx.params.modelId), |
||||
|
recordController.save |
||||
|
) |
||||
|
.delete( |
||||
|
"/api/:instanceId/:modelId/records/:recordId/:revId", |
||||
|
authorized(WRITE_MODEL, ctx => ctx.params.modelId), |
||||
|
recordController.destroy |
||||
|
) |
||||
|
|
||||
|
// models
|
||||
|
|
||||
router |
router |
||||
.get("/api/:instanceId/models", controller.fetch) |
.get("/api/:instanceId/models", authorized(BUILDER), modelController.fetch) |
||||
.post("/api/:instanceId/models", controller.create) |
.post("/api/:instanceId/models", authorized(BUILDER), modelController.create) |
||||
// .patch("/api/:instanceId/models", controller.update)
|
// .patch("/api/:instanceId/models", controller.update)
|
||||
.delete("/api/:instanceId/models/:modelId/:revId", controller.destroy) |
.delete( |
||||
|
"/api/:instanceId/models/:modelId/:revId", |
||||
|
authorized(BUILDER), |
||||
|
modelController.destroy |
||||
|
) |
||||
|
|
||||
module.exports = router |
module.exports = router |
||||
|
|||||
@ -1,12 +0,0 @@ |
|||||
const Router = require("@koa/router") |
|
||||
const controller = require("../controllers/record") |
|
||||
|
|
||||
const router = Router() |
|
||||
|
|
||||
router |
|
||||
.get("/api/:instanceId/:viewName/records", controller.fetch) |
|
||||
.get("/api/:instanceId/records/:recordId", controller.find) |
|
||||
.post("/api/:instanceId/records", controller.save) |
|
||||
.delete("/api/:instanceId/records/:recordId/:revId", controller.destroy) |
|
||||
|
|
||||
module.exports = router |
|
||||
@ -1,11 +1,17 @@ |
|||||
const Router = require("@koa/router") |
const Router = require("@koa/router") |
||||
const controller = require("../controllers/screen") |
const controller = require("../controllers/screen") |
||||
|
const authorized = require("../../middleware/authorized") |
||||
|
const { BUILDER } = require("../../utilities/accessLevels") |
||||
|
|
||||
const router = Router() |
const router = Router() |
||||
|
|
||||
router |
router |
||||
.get("/api/:instanceId/screens", controller.fetch) |
.get("/api/:instanceId/screens", authorized(BUILDER), controller.fetch) |
||||
.post("/api/:instanceId/screens", controller.save) |
.post("/api/:instanceId/screens", authorized(BUILDER), controller.save) |
||||
.delete("/api/:instanceId/:screenId/:revId", controller.destroy) |
.delete( |
||||
|
"/api/:instanceId/:screenId/:revId", |
||||
|
authorized(BUILDER), |
||||
|
controller.destroy |
||||
|
) |
||||
|
|
||||
module.exports = router |
module.exports = router |
||||
|
|||||
@ -0,0 +1,184 @@ |
|||||
|
const { |
||||
|
createInstance, |
||||
|
createClientDatabase, |
||||
|
createApplication, |
||||
|
createModel, |
||||
|
createView, |
||||
|
supertest, |
||||
|
defaultHeaders |
||||
|
} = require("./couchTestUtils") |
||||
|
const { |
||||
|
generateAdminPermissions, |
||||
|
generatePowerUserPermissions, |
||||
|
POWERUSER_LEVEL_ID, |
||||
|
ADMIN_LEVEL_ID, |
||||
|
READ_MODEL, |
||||
|
WRITE_MODEL, |
||||
|
} = require("../../../utilities/accessLevels") |
||||
|
|
||||
|
describe("/accesslevels", () => { |
||||
|
let appId |
||||
|
let server |
||||
|
let request |
||||
|
let instanceId |
||||
|
let model |
||||
|
let view |
||||
|
|
||||
|
beforeAll(async () => { |
||||
|
({ request, server } = await supertest()) |
||||
|
await createClientDatabase(request); |
||||
|
appId = (await createApplication(request))._id |
||||
|
}); |
||||
|
|
||||
|
afterAll(async () => { |
||||
|
server.close(); |
||||
|
}) |
||||
|
|
||||
|
beforeEach(async () => { |
||||
|
instanceId = (await createInstance(request, appId))._id |
||||
|
model = await createModel(request, instanceId) |
||||
|
view = await createView(request, instanceId) |
||||
|
}) |
||||
|
|
||||
|
describe("create", () => { |
||||
|
|
||||
|
it("returns a success message when level is successfully created", async () => { |
||||
|
const res = await request |
||||
|
.post(`/api/${instanceId}/accesslevels`) |
||||
|
.send({ name: "user" }) |
||||
|
.set(defaultHeaders) |
||||
|
.expect('Content-Type', /json/) |
||||
|
.expect(200) |
||||
|
|
||||
|
expect(res.res.statusMessage).toEqual("Access Level 'user' created successfully.") |
||||
|
expect(res.body._id).toBeDefined() |
||||
|
expect(res.body._rev).toBeDefined() |
||||
|
expect(res.body.permissions).toEqual([]) |
||||
|
}) |
||||
|
|
||||
|
}); |
||||
|
|
||||
|
describe("fetch", () => { |
||||
|
|
||||
|
it("should list custom levels, plus 2 default levels", async () => { |
||||
|
const createRes = await request |
||||
|
.post(`/api/${instanceId}/accesslevels`) |
||||
|
.send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL }] }) |
||||
|
.set(defaultHeaders) |
||||
|
.expect('Content-Type', /json/) |
||||
|
.expect(200) |
||||
|
|
||||
|
const customLevel = createRes.body |
||||
|
|
||||
|
const res = await request |
||||
|
.get(`/api/${instanceId}/accesslevels`) |
||||
|
.set(defaultHeaders) |
||||
|
.expect('Content-Type', /json/) |
||||
|
.expect(200) |
||||
|
|
||||
|
expect(res.body.length).toBe(3) |
||||
|
|
||||
|
const adminLevel = res.body.find(r => r._id === ADMIN_LEVEL_ID) |
||||
|
expect(adminLevel).toBeDefined() |
||||
|
expect(adminLevel.permissions).toEqual(await generateAdminPermissions(instanceId)) |
||||
|
|
||||
|
const powerUserLevel = res.body.find(r => r._id === POWERUSER_LEVEL_ID) |
||||
|
expect(powerUserLevel).toBeDefined() |
||||
|
expect(powerUserLevel.permissions).toEqual(await generatePowerUserPermissions(instanceId)) |
||||
|
|
||||
|
const customLevelFetched = res.body.find(r => r._id === customLevel._id) |
||||
|
expect(customLevelFetched.permissions).toEqual(customLevel.permissions) |
||||
|
}) |
||||
|
|
||||
|
}); |
||||
|
|
||||
|
describe("destroy", () => { |
||||
|
it("should delete custom access level", async () => { |
||||
|
const createRes = await request |
||||
|
.post(`/api/${instanceId}/accesslevels`) |
||||
|
.send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL } ] }) |
||||
|
.set(defaultHeaders) |
||||
|
.expect('Content-Type', /json/) |
||||
|
.expect(200) |
||||
|
|
||||
|
const customLevel = createRes.body |
||||
|
|
||||
|
await request |
||||
|
.delete(`/api/${instanceId}/accesslevels/${customLevel._id}/${customLevel._rev}`) |
||||
|
.set(defaultHeaders) |
||||
|
.expect(200) |
||||
|
|
||||
|
await request |
||||
|
.get(`/api/${instanceId}/accesslevels/${customLevel._id}`) |
||||
|
.set(defaultHeaders) |
||||
|
.expect(404) |
||||
|
}) |
||||
|
}) |
||||
|
|
||||
|
describe("patch", () => { |
||||
|
it("should add given permissions", async () => { |
||||
|
const createRes = await request |
||||
|
.post(`/api/${instanceId}/accesslevels`) |
||||
|
.send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL }] }) |
||||
|
.set(defaultHeaders) |
||||
|
.expect('Content-Type', /json/) |
||||
|
.expect(200) |
||||
|
|
||||
|
const customLevel = createRes.body |
||||
|
|
||||
|
await request |
||||
|
.patch(`/api/${instanceId}/accesslevels/${customLevel._id}`) |
||||
|
.send({ |
||||
|
_rev: customLevel._rev, |
||||
|
addedPermissions: [ { itemId: model._id, name: WRITE_MODEL } ] |
||||
|
}) |
||||
|
.set(defaultHeaders) |
||||
|
.expect('Content-Type', /json/) |
||||
|
.expect(200) |
||||
|
|
||||
|
const finalRes = await request |
||||
|
.get(`/api/${instanceId}/accesslevels/${customLevel._id}`) |
||||
|
.set(defaultHeaders) |
||||
|
.expect(200) |
||||
|
|
||||
|
expect(finalRes.body.permissions.length).toBe(2) |
||||
|
expect(finalRes.body.permissions.some(p => p.name === WRITE_MODEL)).toBe(true) |
||||
|
expect(finalRes.body.permissions.some(p => p.name === READ_MODEL)).toBe(true) |
||||
|
}) |
||||
|
|
||||
|
it("should remove given permissions", async () => { |
||||
|
const createRes = await request |
||||
|
.post(`/api/${instanceId}/accesslevels`) |
||||
|
.send({ |
||||
|
name: "user", |
||||
|
permissions: [ |
||||
|
{ itemId: model._id, name: READ_MODEL }, |
||||
|
{ itemId: model._id, name: WRITE_MODEL }, |
||||
|
] |
||||
|
}) |
||||
|
.set(defaultHeaders) |
||||
|
.expect('Content-Type', /json/) |
||||
|
.expect(200) |
||||
|
|
||||
|
const customLevel = createRes.body |
||||
|
|
||||
|
await request |
||||
|
.patch(`/api/${instanceId}/accesslevels/${customLevel._id}`) |
||||
|
.send({ |
||||
|
_rev: customLevel._rev, |
||||
|
removedPermissions: [ { itemId: model._id, name: WRITE_MODEL }] |
||||
|
}) |
||||
|
.set(defaultHeaders) |
||||
|
.expect('Content-Type', /json/) |
||||
|
.expect(200) |
||||
|
|
||||
|
const finalRes = await request |
||||
|
.get(`/api/${instanceId}/accesslevels/${customLevel._id}`) |
||||
|
.set(defaultHeaders) |
||||
|
.expect(200) |
||||
|
|
||||
|
expect(finalRes.body.permissions.length).toBe(1) |
||||
|
expect(finalRes.body.permissions.some(p => p.name === READ_MODEL)).toBe(true) |
||||
|
}) |
||||
|
}) |
||||
|
}); |
||||
@ -1,12 +1,26 @@ |
|||||
const Router = require("@koa/router") |
const Router = require("@koa/router") |
||||
const controller = require("../controllers/user") |
const controller = require("../controllers/user") |
||||
|
const authorized = require("../../middleware/authorized") |
||||
|
const { USER_MANAGEMENT, LIST_USERS } = require("../../utilities/accessLevels") |
||||
|
|
||||
const router = Router() |
const router = Router() |
||||
|
|
||||
router |
router |
||||
.get("/api/:instanceId/users", controller.fetch) |
.get("/api/:instanceId/users", authorized(LIST_USERS), controller.fetch) |
||||
.get("/api/:instanceId/users/:username", controller.find) |
.get( |
||||
.post("/api/:instanceId/users", controller.create) |
"/api/:instanceId/users/:username", |
||||
.delete("/api/:instanceId/users/:username", controller.destroy) |
authorized(USER_MANAGEMENT), |
||||
|
controller.find |
||||
|
) |
||||
|
.post( |
||||
|
"/api/:instanceId/users", |
||||
|
authorized(USER_MANAGEMENT), |
||||
|
controller.create |
||||
|
) |
||||
|
.delete( |
||||
|
"/api/:instanceId/users/:username", |
||||
|
authorized(USER_MANAGEMENT), |
||||
|
controller.destroy |
||||
|
) |
||||
|
|
||||
module.exports = router |
module.exports = router |
||||
|
|||||
@ -1,12 +1,20 @@ |
|||||
const Router = require("@koa/router") |
const Router = require("@koa/router") |
||||
const controller = require("../controllers/view") |
const viewController = require("../controllers/view") |
||||
|
const recordController = require("../controllers/record") |
||||
|
const authorized = require("../../middleware/authorized") |
||||
|
const { BUILDER, READ_VIEW } = require("../../utilities/accessLevels") |
||||
|
|
||||
const router = Router() |
const router = Router() |
||||
|
|
||||
router |
router |
||||
.get("/api/:instanceId/views", controller.fetch) |
.get( |
||||
|
"/api/:instanceId/views/:viewName", |
||||
|
authorized(READ_VIEW, ctx => ctx.params.viewName), |
||||
|
recordController.fetchView |
||||
|
) |
||||
|
.get("/api/:instanceId/views", authorized(BUILDER), viewController.fetch) |
||||
// .patch("/api/:databaseId/views", controller.update);
|
// .patch("/api/:databaseId/views", controller.update);
|
||||
// .delete("/api/:instanceId/views/:viewId/:revId", controller.destroy);
|
// .delete("/api/:instanceId/views/:viewId/:revId", controller.destroy);
|
||||
.post("/api/:instanceId/views", controller.create) |
.post("/api/:instanceId/views", authorized(BUILDER), viewController.create) |
||||
|
|
||||
module.exports = router |
module.exports = router |
||||
|
|||||
@ -1,15 +1,28 @@ |
|||||
const Router = require("@koa/router") |
const Router = require("@koa/router") |
||||
const controller = require("../controllers/workflow") |
const controller = require("../controllers/workflow") |
||||
|
const authorized = require("../../middleware/authorized") |
||||
|
const { BUILDER } = require("../../utilities/accessLevels") |
||||
|
|
||||
const router = Router() |
const router = Router() |
||||
|
|
||||
router |
router |
||||
.get("/api/:instanceId/workflows", controller.fetch) |
.get("/api/:instanceId/workflows", authorized(BUILDER), controller.fetch) |
||||
.get("/api/:instanceId/workflows/:id", controller.find) |
.get("/api/:instanceId/workflows/:id", authorized(BUILDER), controller.find) |
||||
.get("/api/:instanceId/workflows/:id/:action", controller.fetchActionScript) |
.get( |
||||
.post("/api/:instanceId/workflows", controller.create) |
"/api/:instanceId/workflows/:id/:action", |
||||
.post("/api/:instanceId/workflows/action", controller.executeAction) |
authorized(BUILDER), |
||||
.put("/api/:instanceId/workflows", controller.update) |
controller.fetchActionScript |
||||
.delete("/api/:instanceId/workflows/:id/:rev", controller.destroy) |
) |
||||
|
.put("/api/:instanceId/workflows", authorized(BUILDER), controller.update) |
||||
|
.post( |
||||
|
"/api/:instanceId/workflows/action", |
||||
|
authorized(BUILDER), |
||||
|
controller.executeAction |
||||
|
) |
||||
|
.delete( |
||||
|
"/api/:instanceId/workflows/:id", |
||||
|
authorized(BUILDER), |
||||
|
controller.destroy |
||||
|
) |
||||
|
|
||||
module.exports = router |
module.exports = router |
||||
|
|||||
@ -0,0 +1,58 @@ |
|||||
|
const { |
||||
|
adminPermissions, |
||||
|
ADMIN_LEVEL_ID, |
||||
|
POWERUSER_LEVEL_ID, |
||||
|
BUILDER, |
||||
|
} = require("../utilities/accessLevels") |
||||
|
|
||||
|
module.exports = (permName, getItemId) => async (ctx, next) => { |
||||
|
if (!ctx.isAuthenticated) { |
||||
|
ctx.throw(403, "Session not authenticated") |
||||
|
} |
||||
|
|
||||
|
if (ctx.isBuilder) { |
||||
|
await next() |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
if (permName === BUILDER) { |
||||
|
ctx.throw(403, "Not Authorized") |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
if (!ctx.user) { |
||||
|
ctx.throw(403, "User not found") |
||||
|
} |
||||
|
|
||||
|
const permissionId = ({ name, itemId }) => name + (itemId ? `-${itemId}` : "") |
||||
|
|
||||
|
if (ctx.user.accessLevel._id === ADMIN_LEVEL_ID) { |
||||
|
await next() |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
const thisPermissionId = permissionId({ |
||||
|
name: permName, |
||||
|
itemId: getItemId && getItemId(ctx), |
||||
|
}) |
||||
|
|
||||
|
// power user has everything, except the admin specific perms
|
||||
|
if ( |
||||
|
ctx.user.accessLevel._id === POWERUSER_LEVEL_ID && |
||||
|
!adminPermissions.map(permissionId).includes(thisPermissionId) |
||||
|
) { |
||||
|
await next() |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
if ( |
||||
|
ctx.user.accessLevel.permissions |
||||
|
.map(permissionId) |
||||
|
.includes(thisPermissionId) |
||||
|
) { |
||||
|
await next() |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
ctx.throw(403, "Not Authorized") |
||||
|
} |
||||
@ -0,0 +1,79 @@ |
|||||
|
const viewController = require("../api/controllers/view") |
||||
|
const modelController = require("../api/controllers/model") |
||||
|
const workflowController = require("../api/controllers/workflow") |
||||
|
|
||||
|
exports.ADMIN_LEVEL_ID = "ADMIN" |
||||
|
exports.POWERUSER_LEVEL_ID = "POWER_USER" |
||||
|
|
||||
|
exports.READ_MODEL = "read-model" |
||||
|
exports.WRITE_MODEL = "write-model" |
||||
|
exports.READ_VIEW = "read-view" |
||||
|
exports.EXECUTE_WORKFLOW = "execute-workflow" |
||||
|
exports.USER_MANAGEMENT = "user-management" |
||||
|
exports.BUILDER = "builder" |
||||
|
exports.LIST_USERS = "list-users" |
||||
|
|
||||
|
exports.adminPermissions = [ |
||||
|
{ |
||||
|
name: exports.USER_MANAGEMENT, |
||||
|
}, |
||||
|
] |
||||
|
|
||||
|
exports.generateAdminPermissions = async instanceId => [ |
||||
|
...exports.adminPermissions, |
||||
|
...(await exports.generatePowerUserPermissions(instanceId)), |
||||
|
] |
||||
|
|
||||
|
exports.generatePowerUserPermissions = async instanceId => { |
||||
|
const fetchModelsCtx = { |
||||
|
params: { |
||||
|
instanceId, |
||||
|
}, |
||||
|
} |
||||
|
await modelController.fetch(fetchModelsCtx) |
||||
|
const models = fetchModelsCtx.body |
||||
|
|
||||
|
const fetchViewsCtx = { |
||||
|
params: { |
||||
|
instanceId, |
||||
|
}, |
||||
|
} |
||||
|
await viewController.fetch(fetchViewsCtx) |
||||
|
const views = fetchViewsCtx.body |
||||
|
|
||||
|
const fetchWorkflowsCtx = { |
||||
|
params: { |
||||
|
instanceId, |
||||
|
}, |
||||
|
} |
||||
|
await workflowController.fetch(fetchWorkflowsCtx) |
||||
|
const workflows = fetchWorkflowsCtx.body |
||||
|
|
||||
|
const readModelPermissions = models.map(m => ({ |
||||
|
itemId: m._id, |
||||
|
name: exports.READ_MODEL, |
||||
|
})) |
||||
|
|
||||
|
const writeModelPermissions = models.map(m => ({ |
||||
|
itemId: m._id, |
||||
|
name: exports.WRITE_MODEL, |
||||
|
})) |
||||
|
|
||||
|
const viewPermissions = views.map(v => ({ |
||||
|
itemId: v.name, |
||||
|
name: exports.READ_VIEW, |
||||
|
})) |
||||
|
|
||||
|
const executeWorkflowPermissions = workflows.map(w => ({ |
||||
|
itemId: w._id, |
||||
|
name: exports.EXECUTE_WORKFLOW, |
||||
|
})) |
||||
|
|
||||
|
return [ |
||||
|
...readModelPermissions, |
||||
|
...writeModelPermissions, |
||||
|
...viewPermissions, |
||||
|
...executeWorkflowPermissions, |
||||
|
{ name: exports.LIST_USERS }, |
||||
|
] |
||||
|
} |
||||
Loading…
Reference in new issue