@data-fair/lib-common-types 1.2.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@data-fair/lib-common-types",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Shared schemas and built type definitions in the data-fair stack.",
   "main": "index.js",
   "scripts": {

package/session/index.d.ts

@@ -5,7 +5,11 @@ export * from './.type/index.js';
 export declare function isAuthenticated(sessionState: SessionState): sessionState is SessionStateAuthenticated;
 export declare function assertAuthenticated(sessionState: SessionState): asserts sessionState is SessionStateAuthenticated;
 export declare function assertAdminMode(sessionState: SessionState): asserts sessionState is SessionStateAuthenticated;
-export declare function getAccountRole(sessionState: SessionState, account: AccountKeys, onlyActiveAccount?: boolean): string | null;
-export declare function assertAccountRole(sessionState: SessionState, account: AccountKeys, role: string, onlyActiveAccount?: boolean): void;
+type AssertRoleOptions = {
+    allAccounts?: boolean;
+    acceptDepAsRoot?: boolean;
+};
+export declare function getAccountRole(sessionState: SessionState, account: AccountKeys, options?: AssertRoleOptions): string | null;
+export declare function assertAccountRole(sessionState: SessionState, account: AccountKeys, roles: string | string[], options?: AssertRoleOptions): void;
 export declare function isValidAccountType(type: string): type is 'user' | 'organization';
 export declare function assertValidAccountType(type: string): asserts type is 'user' | 'organization';

package/session/index.js

@@ -11,28 +11,31 @@ export function assertAdminMode (sessionState) {
   // TODO: use sessionState.locale to internationalize error message
   if (!sessionState.user.adminMode) { throw httpError(403, 'super admin only') }
 }
-function matchAccount (userAccount, resourceAccount) {
+function matchAccount (userAccount, resourceAccount, acceptDepAsRoot = false) {
   if (userAccount.type !== resourceAccount.type) { return false }
   if (userAccount.id !== resourceAccount.id) { return false }
-  if (userAccount.department && userAccount.department !== resourceAccount.department) { return false }
+  if (!acceptDepAsRoot) {
+    if (userAccount.department && userAccount.department !== resourceAccount.department) { return false }
+  }
   return true
 }
-export function getAccountRole (sessionState, account, onlyActiveAccount = true) {
+export function getAccountRole (sessionState, account, options = {}) {
   if (!isAuthenticated(sessionState)) { return null }
   if (sessionState.user.adminMode) { return 'admin' }
-  if (onlyActiveAccount) {
-    if (matchAccount(sessionState.account, account)) { return sessionState.accountRole }
-  } else {
+  if (options.allAccounts) {
     if (account.type === 'user' && sessionState.user.id === account.id) { return 'admin' }
     for (const org of sessionState.user.organizations) {
-      if (matchAccount({ type: 'organization', id: org.id, department: org.department }, account)) { return org.role }
+      if (matchAccount({ type: 'organization', id: org.id, department: org.department }, account, options.acceptDepAsRoot)) { return org.role }
     }
+  } else {
+    if (matchAccount(sessionState.account, account, options.acceptDepAsRoot)) { return sessionState.accountRole }
   }
   return null
 }
-export function assertAccountRole (sessionState, account, role, onlyActiveAccount = true) {
-  const accountRole = getAccountRole(sessionState, account, onlyActiveAccount)
-  if (accountRole !== role) { throw httpError(403, `requires ${role} role`) }
+export function assertAccountRole (sessionState, account, roles, options = {}) {
+  if (typeof roles === 'string') { roles = [roles] }
+  const accountRole = getAccountRole(sessionState, account, options)
+  if (!accountRole || !roles.includes(accountRole)) { throw httpError(403, `requires ${roles.join(', ')} role(s)`) }
 }
 export function isValidAccountType (type) {
   return ['user', 'organization'].includes(type)