@adminforth/crud-approve-plugin 1.0.17 → 1.0.18

package/build.log

@@ -0,0 +1,15 @@
+
+> @adminforth/crud-approve-plugin@1.0.0 build
+> tsc && rsync -av --exclude 'node_modules' custom dist/
+
+sending incremental file list
+custom/
+custom/ListPageDiffView.vue
+custom/ShowPageDiffView.vue
+custom/package-lock.json
+custom/package.json
+custom/pnpm-lock.yaml
+custom/tsconfig.json
+
+sent 32,578 bytes  received 134 bytes  65,424.00 bytes/sec
+total size is 32,075  speedup is 0.98

package/dist/custom/ListPageDiffView.vue

@@ -20,16 +20,10 @@ const diffFile = ref();
 
 
 async function sendApproveRequest(approved) {
-  let code = '123456'
-  if (approved) {
-    code = await (window).adminforthTwoFaModal?.get2FaConfirmationResult?.("Approve Action Confirmation");
-  }
-  
   const data = await callAdminForthApi({
     path: `/plugin/crud-approve/update-status`,
     method: 'POST',
     body: {
-      meta: { confirmationResult: code },
       connectorId: props.resource.connectorId,
       resourceId: props.resource.resourceId,
       action: props.record[props.meta.resourceColumns.actionColumnName],

package/dist/custom/ShowPageDiffView.vue

@@ -22,16 +22,10 @@ const newContent = JSON.stringify(props.record[props.meta.resourceColumns.dataCo
 const diffFile = ref();
 
 async function sendApproveRequest(approved) {
-    let code = '123456'
-    if (approved) {
-      code = await (window).adminforthTwoFaModal?.get2FaConfirmationResult?.("Approve Action Confirmation");
-    }
-
   const data = await callAdminForthApi({
     path: `/plugin/crud-approve/update-status`,
     method: 'POST',
     body: {
-      meta: { confirmationResult: code },
       connectorId: props.resource.connectorId,
       resourceId: props.resource.resourceId,
       action: props.record[props.meta.resourceColumns.actionColumnName],

package/dist/index.js

@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { ActionCheckSource, AdminForthPlugin, AdminForthSortDirections, Filters } from "adminforth";
+import { ActionCheckSource, AdminForthPlugin, AdminForthSortDirections, Filters, interpretResource } from "adminforth";
 import { AdminForthDataTypes, AllowedActionsEnum } from "adminforth";
 import { AllowedForReviewActionsEnum, ApprovalStatusEnum } from './types.js';
 import dayjs from "dayjs";
@@ -179,19 +179,6 @@ export default class CRUDApprovePlugin extends AdminForthPlugin {
                 }
             }
         });
-        this.verifyAuth = (cookies) => __awaiter(this, void 0, void 0, function* () {
-            let authCookie;
-            for (const i in cookies) {
-                if (cookies[i].key === `adminforth_${this.adminforth.config.customization.brandNameSlug}_jwt`) {
-                    authCookie = cookies[i].value;
-                }
-            }
-            const authRes = yield this.adminforth.auth.verify(authCookie, 'auth', true);
-            if ('error' in authRes) {
-                return { error: authRes.error, authRes: null };
-            }
-            return { error: null, authRes: authRes };
-        });
         this.createRecord = (resource, diffData, adminUser) => __awaiter(this, void 0, void 0, function* () {
             const connector = this.adminforth.connectors[resource.dataSource];
             //@ts-ignore
@@ -289,16 +276,8 @@ export default class CRUDApprovePlugin extends AdminForthPlugin {
         server.endpoint({
             method: 'POST',
             path: `/plugin/crud-approve/update-status`,
-            noAuth: true,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies }) {
-                const authRes = yield this.verifyAuth(cookies);
-                if (authRes.error) {
-                    //@ts-ignore
-                    response.status = 403;
-                    return { error: authRes.error };
-                }
-                const adminUser = authRes.authRes;
-                const { resourceId, diffId, recordId, action, approved, code } = body;
+            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, adminUser }) {
+                const { diffId, approved, code } = body;
                 const diffRecord = yield this.adminforth.resource(this.diffResource.resourceId).get(Filters.EQ(this.options.resourceColumns.idColumnName, diffId));
                 if (!diffRecord) {
                     //@ts-ignore
@@ -310,9 +289,40 @@ export default class CRUDApprovePlugin extends AdminForthPlugin {
                     response.status = 400;
                     return { error: 'Diff record is not pending' };
                 }
+                const action = diffRecord[this.options.resourceColumns.actionColumnName];
+                const recordId = diffRecord[this.options.resourceColumns.recordIdColumnName];
+                const targetResource = this.adminforth.config.resources.find((res) => res.resourceId == diffRecord[this.options.resourceColumns.resourceIdColumnName]);
+                const diffResource = this.adminforth.config.resources.find((res) => res.resourceId === this.diffResource.resourceId);
+                const { allowedActions } = yield interpretResource(adminUser, diffResource, { requestBody: body, pk: diffId, record: diffRecord }, ActionCheckSource.ShowRequest, this.adminforth);
+                const showAllowed = allowedActions[AllowedActionsEnum.show];
+                if (showAllowed !== true) {
+                    //@ts-ignore
+                    response.status = 403;
+                    return {
+                        error: typeof showAllowed === 'string'
+                            ? showAllowed
+                            : 'You do not have permission to approve or reject this change request'
+                    };
+                }
+                // separation of duties: author of the request is not a valid reviewer for it
+                const requesterId = diffRecord[this.options.resourceColumns.userIdColumnName];
+                if (!this.options.allowSelfApproval
+                    && requesterId !== undefined && requesterId !== null
+                    && `${requesterId}` === `${adminUser.pk}`) {
+                    //@ts-ignore
+                    response.status = 403;
+                    return { error: 'You can not approve or reject your own change request' };
+                }
                 let beforeSaveResp;
                 if (approved === true) {
-                    const resource = this.adminforth.config.resources.find((res) => res.resourceId == diffRecord[this.options.resourceColumns.resourceIdColumnName]);
+                    if (!targetResource) {
+                        //@ts-ignore
+                        response.status = 404;
+                        return {
+                            error: `Resource ${diffRecord[this.options.resourceColumns.resourceIdColumnName]} not found`
+                        };
+                    }
+                    const resource = targetResource;
                     const diffData = diffRecord[this.options.resourceColumns.dataColumnName];
                     const extra = diffRecord[this.options.resourceColumns.extraColumnName] || {};
                     extra.body = body;
@@ -377,7 +387,7 @@ export default class CRUDApprovePlugin extends AdminForthPlugin {
                     adminUser: adminUser, oldRecord: diffRecord,
                     updates: {
                         [this.options.resourceColumns.statusColumnName]: approved ? ApprovalStatusEnum.approved : ApprovalStatusEnum.rejected,
-                        [this.options.resourceColumns.responserIdColumnName]: authRes.authRes.pk,
+                        [this.options.resourceColumns.responserIdColumnName]: adminUser.pk,
                     },
                     extra: {
                         //@ts-ignore

package/index.ts

@@ -1,4 +1,4 @@
-import { ActionCheckSource, AdminForthPlugin, AdminForthSortDirections, Filters, IAdminForthDataSourceConnectorBase, IHttpServer } from "adminforth";
+import { ActionCheckSource, AdminForthPlugin, AdminForthSortDirections, Filters, IAdminForthDataSourceConnectorBase, IHttpServer, interpretResource } from "adminforth";
 import { IAdminForth, AdminForthDataTypes, AdminForthResource, AllowedActionsEnum, HttpExtra, AdminUser } from "adminforth";
 import { AllowedForReviewActionsEnum, ApprovalStatusEnum, type PluginOptions } from './types.js';
 
@@ -250,21 +250,7 @@ export default class CRUDApprovePlugin extends AdminForthPlugin {
       }
     }
   }
-
-  verifyAuth = async (cookies: Array<{key: string, value: string}>) => {
-    let authCookie;
-    for (const i in cookies) {
-      if (cookies[i].key === `adminforth_${this.adminforth.config.customization.brandNameSlug}_jwt`) {
-        authCookie = cookies[i].value;
-      }
-    }
-    const authRes = await this.adminforth.auth.verify(authCookie, 'auth', true);
-    if ('error' in authRes) {
-      return { error: authRes.error, authRes: null };
-    }
-    return { error: null, authRes: authRes };
-  }
-
+ 
   createRecord = async (resource: AdminForthResource, diffData: any, adminUser: AdminUser) => {
     const connector = this.adminforth.connectors[resource.dataSource];
     //@ts-ignore
@@ -325,17 +311,9 @@ export default class CRUDApprovePlugin extends AdminForthPlugin {
     server.endpoint({
       method: 'POST',
       path: `/plugin/crud-approve/update-status`,
-      noAuth: true,
-      handler: async ({ body, response, cookies }) => {
-        const authRes = await this.verifyAuth(cookies);
-        if (authRes.error) {
-          //@ts-ignore
-          response.status = 403;
-          return { error: authRes.error };
-        }
-        const adminUser = authRes.authRes;
+      handler: async ({ body, response, cookies, adminUser }) => {
 
-        const { resourceId, diffId, recordId, action, approved, code } = body;
+        const { diffId, approved, code } = body;
         const diffRecord = await this.adminforth.resource(this.diffResource.resourceId).get(
           Filters.EQ(this.options.resourceColumns.idColumnName, diffId),
         )
@@ -350,11 +328,54 @@ export default class CRUDApprovePlugin extends AdminForthPlugin {
           response.status = 400;
           return { error: 'Diff record is not pending' };
         }
+
+        const action = diffRecord[this.options.resourceColumns.actionColumnName];
+        const recordId = diffRecord[this.options.resourceColumns.recordIdColumnName];
+        const targetResource = this.adminforth.config.resources.find(
+          (res) => res.resourceId == diffRecord[this.options.resourceColumns.resourceIdColumnName]
+        );
+
+        const diffResource = this.adminforth.config.resources.find(
+          (res) => res.resourceId === this.diffResource.resourceId
+        );
+        const { allowedActions } = await interpretResource(
+          adminUser,
+          diffResource,
+          { requestBody: body, pk: diffId, record: diffRecord },
+          ActionCheckSource.ShowRequest,
+          this.adminforth
+        );
+        const showAllowed = allowedActions[AllowedActionsEnum.show] as boolean | string | undefined;
+        if (showAllowed !== true) {
+          //@ts-ignore
+          response.status = 403;
+          return {
+            error: typeof showAllowed === 'string'
+              ? showAllowed
+              : 'You do not have permission to approve or reject this change request'
+          };
+        }
+
+        // separation of duties: author of the request is not a valid reviewer for it
+        const requesterId = diffRecord[this.options.resourceColumns.userIdColumnName];
+        if (!this.options.allowSelfApproval
+            && requesterId !== undefined && requesterId !== null
+            && `${requesterId}` === `${adminUser.pk}`) {
+          //@ts-ignore
+          response.status = 403;
+          return { error: 'You can not approve or reject your own change request' };
+        }
+
         let beforeSaveResp;
         if (approved === true) {
-          const resource = this.adminforth.config.resources.find(
-            (res) => res.resourceId == diffRecord[this.options.resourceColumns.resourceIdColumnName]
-          );
+          if (!targetResource) {
+            //@ts-ignore
+            response.status = 404;
+            return {
+              error: `Resource ${diffRecord[this.options.resourceColumns.resourceIdColumnName]} not found`
+            };
+          }
+          const resource = targetResource;
           const diffData = diffRecord[this.options.resourceColumns.dataColumnName];
           const extra = diffRecord[this.options.resourceColumns.extraColumnName] || {};
           extra.body = body;
@@ -439,7 +460,7 @@ export default class CRUDApprovePlugin extends AdminForthPlugin {
           adminUser: adminUser, oldRecord: diffRecord,
           updates: {
             [this.options.resourceColumns.statusColumnName]: approved ? ApprovalStatusEnum.approved : ApprovalStatusEnum.rejected,
-            [this.options.resourceColumns.responserIdColumnName]: authRes.authRes.pk,
+            [this.options.resourceColumns.responserIdColumnName]: adminUser.pk,
           },
           extra: {
             //@ts-ignore

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/crud-approve-plugin",
-  "version": "1.0.17",
+  "version": "1.0.18",
   "publishConfig": {
     "access": "public"
   },

package/types.ts

@@ -16,6 +16,12 @@ export interface PluginOptions {
         createdAtColumnName: string;
         extraColumnName: string;
     }
+
+    /**
+     * By default the user who created the approval request can't approve or reject it himself
+     * (separation of duties / four-eyes principle). Set to true to disable this check.
+     */
+    allowSelfApproval?: boolean;
 }
 
 export enum AllowedForReviewActionsEnum {