@cocreate/authorize 1.7.6 → 1.8.0

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+# [1.8.0](https://github.com/CoCreate-app/CoCreate-authorize/compare/v1.7.6...v1.8.0) (2023-11-03)
+
+
+### Bug Fixes
+
+* if organization_id does not exist error ([5dbdd8f](https://github.com/CoCreate-app/CoCreate-authorize/commit/5dbdd8f285418618575efc8a1e525dbde6ea81a1))
+* improve authorization promise handling ([df00618](https://github.com/CoCreate-app/CoCreate-authorize/commit/df00618c03c129b20abb5878f73d6522dbec5401))
+* Improve conditions ([689e6fa](https://github.com/CoCreate-app/CoCreate-authorize/commit/689e6fa95d8378f2d7bed22c1e2a2f29bc5c7be0))
+* request.request param removed ([06a656d](https://github.com/CoCreate-app/CoCreate-authorize/commit/06a656d8b2a354ff473e8de1cfa5b44abc81bd89))
+* update dependencies to the lates versions ([0a19463](https://github.com/CoCreate-app/CoCreate-authorize/commit/0a1946353c787a5dee1f54324e1fb2290c4b7a0f))
+
+
+### Features
+
+* check if authoriztion keys has a query operator and apply query ([e2dfa5c](https://github.com/CoCreate-app/CoCreate-authorize/commit/e2dfa5c02bbb537454e2f5d9a9b07444dd60c3a6))
+* support adding querires for  crud methods ([9b68d24](https://github.com/CoCreate-app/CoCreate-authorize/commit/9b68d244982fe08f680043cd7f1a1b06cc6be301))
+
 ## [1.7.6](https://github.com/CoCreate-app/CoCreate-authorize/compare/v1.7.5...v1.7.6) (2023-10-26)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocreate/authorize",
-  "version": "1.7.6",
+  "version": "1.8.0",
   "description": "A simple authorize component in vanilla javascript. Easily configured using HTML5 data-attributes and/or JavaScript API.",
   "keywords": [
     "authorize",
@@ -45,7 +45,7 @@
   },
   "main": "./src/index.js",
   "dependencies": {
-    "@cocreate/crud-client": "^1.28.10",
-    "@cocreate/utils": "^1.26.1"
+    "@cocreate/crud-client": "^1.28.12",
+    "@cocreate/utils": "^1.26.2"
   }
 }

package/src/index.js

@@ -15,7 +15,7 @@
     }
 }(typeof self !== 'undefined' ? self : this, function (isBrowser, crud, { getValueFromObject, dotNotationToObject }) {
 
-    const authorizations = new Map()
+    const organizations = {}
 
     if (isBrowser) {
         crud.listen('update.object', function (data) {
@@ -36,9 +36,9 @@
 
         if (array === 'keys' && object) {
             let authorization = object[0]
-            if (authorization && authorization.key && hasAuthorization(authorization.key)) {
+            if (authorization && authorization.key && organizations[organization_id] && organizations[organization_id][authorization.key]) {
                 let newAuthorization = await readAuthorization(authorization.key, organization_id)
-                setAuthorization(authorization.key, newAuthorization)
+                organizations[organization_id][authorization.key] = newAuthorization
             }
         }
     }
@@ -48,44 +48,21 @@
 
         if (array === 'keys' && object) {
             let authorization = object[0]
-            if (authorization && authorization.key && hasAuthorization(authorization.key)) {
-                authorizations.delete(authorization.key)
+            if (authorization && authorization.key && organizations[organization_id] && organizations[organization_id][authorization.key]) {
+                delete organizations[organization_id][authorization.key]
             }
         }
     }
 
-    function setAuthorization(key, authorization) {
-        authorizations.set(key, authorization)
-    }
-
-    function hasAuthorization(key) {
-        return authorizations.has(key)
-    }
-
     async function getAuthorization(key, organization_id) {
-        // Check if there is a value orpending promise for this key
-        if (key && authorizations.has(key)) {
-            // Return the value or pending promise
-            return await authorizations.get(key);
-        }
-
-        // Create a new promise and store it
-        const authorizationPromise = readAuthorization(key, organization_id);
-        authorizations.set(key, authorizationPromise);
-
-        try {
-            // Wait for the authorization to be resolved
-            const authorization = await authorizationPromise;
+        if (!organizations[organization_id])
+            organizations[organization_id] = {}
 
-            // Once resolved, store the resolved authorization in the map
-            authorizations.set(key, authorization);
+        if (!organizations[organization_id][key])
+            organizations[organization_id][key] = readAuthorization(key, organization_id);
 
-            return authorization;
-        } catch (error) {
-            // Handle errors if necessary
-            authorizations.delete(key);
-            throw error;
-        }
+        organizations[organization_id][key] = await organizations[organization_id][key]
+        return organizations[organization_id][key]
     }
 
     async function readAuthorization(key, organization_id) {
@@ -94,10 +71,10 @@
                 return { error: 'An organization_id is required' };
 
             let request = {
-                method: 'read.object',
+                method: 'object.read',
+                database: organization_id,
                 array: 'keys',
                 organization_id,
-                object: {},
                 $filter: {
                     query: []
                 }
@@ -124,20 +101,19 @@
                             role_ids.push({ _id })
                     })
 
-                    delete request.object.$filter
-                    delete request.request
+                    delete request.$filter
+                    delete request.isFilter
+
                     request.object = role_ids
 
                     let roles = await crud.send(request)
                     roles = roles.object
 
-                    authorization = createAuthorization(authorization, roles)
+                    authorization = await createAuthorization(authorization, roles)
                 }
-
-            }
-
-            return authorization;
-
+                return authorization;
+            } else
+                return {}
         } catch (error) {
             console.log("authorization Error", error)
             return { error };
@@ -198,171 +174,111 @@
     }
 
     async function checkAuthorization({ key, data }) {
-        // let method = data.method
-        let { method, organization_id, endPoint } = data
-        if (!organization_id)
-            return { error: '' };
+        if (!data.organization_id)
+            return { error: 'organization_id is required' };
+        if (!data.method)
+            return { error: 'method is required' };
 
-        let authorized = await getAuthorization(key, organization_id)
+        let authorized = await getAuthorization(key, data.organization_id)
         if (!authorized || authorized.error)
             return authorized
-        if (authorized.organization_id !== organization_id)
+        if (authorized.organization_id !== data.organization_id)
             return false;
         if (authorized.host && authorized.host.length) {
             if (!authorized.host || (!authorized.host.includes(data.host) && !authorized.host.includes("*")))
                 return false;
-
         }
-        if (authorized.admin == 'true' || authorized.admin === true)
+        if (authorized.admin === 'true' || authorized.admin === true)
             return true;
 
-        let status = await checkMethod(authorized.actions, method, endPoint, data)
+        let status = await checkMethod(data, authorized.actions, data.method)
+
+        // console.log(data.method, status)
 
-        if (!status)
+        if (!status) {
             return false
+        }
 
         return { authorized: data };
     }
 
-    async function checkMethod(autorized, method, endPoint, data) {
-        if (!autorized || !method || !autorized[method] || autorized[method] == 'false') return false;
-        if (autorized[method] === true || autorized[method] == 'true' || autorized[method] == '*') return true;
-
-        let authorized = autorized[method].authorize
-        if (authorized) {
-            let status = await checkAthorized(authorized, method, endPoint, data)
-            if (!status)
-                return false
-            else {
-                let unauthorized = autorized[method].unauthorize
-                if (unauthorized) {
-                    let status = await checkAthorized(unauthorized, method, endPoint, data, true)
-                    if (status)
-                        return false
-                }
-                return true
+    async function checkMethod(data, authorized, method) {
+        if (authorized[method]) {
+            return await checkMethodMatch(data, authorized[method], method)
+        } else if (method.includes('.')) {
+            let match = ''
+            let splitMethod = method.split('.')
+            for (let i = 0; i < splitMethod.length; i++) {
+                if (!match)
+                    match = splitMethod[i]
+                else
+                    match += '.' + splitMethod[i]
+                if (authorized[match]) {
+                    return await checkMethodMatch(data, authorized[match], match)
+                } else if (i === splitMethod.length - 1)
+                    return false
             }
         } else
-            return false
+            return false;
     }
 
-    async function checkAthorized(authorized, method, endPoint, data, unauthorize) {
-        if (!Array.isArray(authorized))
-            authorized = [authorized]
-
-        let status = false
-        for (let i = 0; i < authorized.length; i++) {
-            // if authorized[i] is a booleaan
-            if (authorized[i] === true)
+    async function checkMethodMatch(data, authorized, match) {
+        if (typeof authorized === 'boolean') {
+            return authorized
+        } else if (typeof authorized === 'string') {
+            if (authorized === 'false')
+                return false
+            else if (authorized === 'true')
                 return true
-
-            // if authorized[i] is a string or an array
-            if (typeof authorized[i] === "string" || Array.isArray(authorized[i])) {
-                if (authorized[i].includes(true) || authorized[i].includes('true') || authorized[i].includes('*'))
-                    return true
-                else if (endPoint)
-                    return authorized.includes(endPoint)
-                else
-                    return false
-            }
-
-            // if authorized[i] is an object
-            for (const key of Object.keys(authorized[i])) {
-                status = await checkAthorizedKey(authorized[i], method, endPoint, data, key, unauthorize)
+            else if (authorized === match)
+                return true // check string for match or mutate data
+            else
+                return true // check string for match or mutate data
+        } else if (typeof authorized === 'number') {
+            return !!authorized
+        } else {
+            let status = false
+            let newmatch = data.method.replace(match, '')
+
+            if (Array.isArray(authorized)) {
+                for (let i = 0; i < authorized.length; i++) {
+                    status = await checkMethodMatch(data, authorized[i], newmatch)
+                }
+            } else if (typeof authorized === 'object') {
+                let keys = Object.keys(authorized);
+
+                for (const key of keys) {
+                    if (key.includes('$'))
+                        status = await checkMethodOperators(data, key, authorized[key])
+                    else if (newmatch && (authorized[newmatch] || authorized['*'])) {
+                        status = await checkMethodMatch(data, authorized[newmatch] || authorized['*'], newmatch)
+                    }
+                }
             }
-
+            return status
         }
-
-        return status
-
     }
 
-    async function checkAthorizedKey(authorized, method, endPoint, data, key, unauthorize) {
-        let status = false;
-        let keyStatus = false;
-
-        // if authorized[key] is a booleaan
-        if (authorized[key] === true)
-            keyStatus = true
-
-        // if authorized[key] is a string or number
-        else if (typeof authorized[key] === "string" || typeof authorized[key] === "number") {
-            if (authorized[key] === true || authorized[key] === 'true' || authorized[key] === '*')
-                keyStatus = true
-            else if (data[key]) {
-                keyStatus = await checkArray(authorized, data, key, unauthorize)
-                if (await checkFilter(authorized, data, key, unauthorize))
-                    status = true
-            }
-        }
-
-        // if authorized[key] is an array
-        else if (Array.isArray(authorized[key])) {
-            if (authorized[key].includes(true) || authorized[key].includes('true') || authorized[key].includes('*'))
-                keyStatus = true
-            else if (data[key]) {
-                keyStatus = await checkArray(authorized, data, key, unauthorize)
-                if (await checkFilter(authorized, data, key, unauthorize))
-                    status = true
-            }
-        }
-
-        // if authorized[key] is an object
-        else if (typeof authorized[key] === "object") {
-            console.log('authorized[key] is an object', authorized[key])
-        } else
-            delete data[key]
-
-        // if key status is false for unauthorized case
-        if (!keyStatus || keyStatus && unauthorize) {
-            if (!data.unauthorized || !data.unauthorized[method])
-                data.unauthorized = { [method]: { [key]: [data[key]] } }
-            else if (!data.unauthorized[method][key])
-                data.unauthorized[method][key] = [data[key]]
+    async function checkMethodOperators(data, key, value) {
+        if (value === 'this.userId' && data.socket)
+            value = data.socket.user_id
+
+        let keys = key.split('.')
+        if (['$eq', '$ne', '$lt', '$lte', '$gt', '$gte', '$in', '$nin', '$or', '$and', '$not', '$nor', '$exists', '$type', '$mod', '$regex', '$text', '$where', '$all', '$elemMatch', '$size'].includes(keys[0])) {
+            // let keys = key.split('.')
+            let query = { key: keys[1], value, operator: keys[0] }
+            if (!data.$filter)
+                data.$filter = { query: [query] }
+            else if (!data.$filter.query)
+                data.$filter.query = [query]
             else
-                data.unauthorized[method][key].push(data[key])
-        } else
-            status = true
-        return status
-    }
+                data.$filter.query.push(query)
 
-    async function checkArray(authorized, data, key, unauthorize) {
-        let keyStatus = false
-        let authorizedValue = getValueFromObject(authorized, key);
-        let dataValue = getValueFromObject(data, key);
-
-        if (!authorizedValue && !unauthorize) {
-            data = deleteKey(data, key)
-        } else if (typeof dataValue == "string") {
-            if (unauthorize && authorizedValue.includes(dataValue))
-                data = deleteKey(data, key)
-            else {
-                if (!authorizedValue.includes(dataValue))
-                    data = deleteKey(data, key)
-                else
-                    keyStatus = true
-            }
-        } else if (Array.isArray(dataValue)) {
-            for (let i = 0; i < dataValue.length; i++) {
-                keyStatus = await checkArray(authorized, data, `${key}[${i}]`, unauthorize)
-            }
-        } else if (typeof dataValue === "object") {
-            let checkKeys = true
-            if (dataValue['_id']) {
-                if (authorized.object.includes(dataValue['_id']))
-                    checkKeys = true
-            }
-            if (checkKeys) {
-                if (authorizedValue['*'] || authorizedValue['*'] == '')
-                    keyStatus = true
-                else
-                    for (const k of Object.keys(dataValue)) {
-                        keyStatus = await checkArray(authorized, data, `${key}.${k}`, unauthorize)
-                    }
-            }
+        } else {
+            // TODO: sanitize data by removing items user does not have access to.
+            // console.log('key is a query operator', key)            
         }
-
-        return keyStatus
+        return true
     }
 
     async function checkFilter(authorized, data, apikey, unauthorize) {
@@ -387,6 +303,7 @@
         }
     }
 
+
     function deleteKey(data, path) {
         if (!data || !path) return
         if (path.includes('._id'))