@iobroker/db-objects-redis 4.0.21 → 4.1.0-alpha.0-20220819-74ceeddc

package/build/lib/objects/objectsUtils.js

@@ -0,0 +1,637 @@
+/**
+ *      Common functions between client and server
+ *
+ *      Copyright 2013-2022 bluefox <dogafox@gmail.com>
+ *
+ *      MIT License
+ *
+ */
+'use strict';
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkObjectRights = exports.checkObject = exports.sanitizePath = exports.getUserGroup = exports.checkFileRights = exports.checkFile = exports.insert = exports.WMStrm = exports.getMimeType = exports.REG_CHECK_ID = exports.ERRORS = exports.CONSTS = void 0;
+const stream_1 = require("stream");
+const path_1 = __importDefault(require("path"));
+const deep_clone_1 = __importDefault(require("deep-clone"));
+const db_base_1 = require("@iobroker/db-base");
+const CONSTS = __importStar(require("./constants"));
+exports.CONSTS = __importStar(require("./constants"));
+exports.ERRORS = CONSTS.ERRORS;
+exports.REG_CHECK_ID = CONSTS.REG_CHECK_ID;
+const USER_STARTS_WITH = CONSTS.USER_STARTS_WITH;
+const GROUP_STARTS_WITH = CONSTS.GROUP_STARTS_WITH;
+const memStore = {};
+const mimeTypes = {
+    '.css': { type: 'text/css', binary: false },
+    '.bmp': { type: 'image/bmp', binary: true },
+    '.png': { type: 'image/png', binary: true },
+    '.jpg': { type: 'image/jpeg', binary: true },
+    '.jpeg': { type: 'image/jpeg', binary: true },
+    '.gif': { type: 'image/gif', binary: true },
+    '.ico': { type: 'image/x-icon', binary: true },
+    '.webp': { type: 'image/webp', binary: true },
+    '.wbmp': { type: 'image/vnd.wap.wbmp', binary: true },
+    '.tif': { type: 'image/tiff', binary: true },
+    '.js': { type: 'application/javascript', binary: false },
+    '.html': { type: 'text/html', binary: false },
+    '.htm': { type: 'text/html', binary: false },
+    '.json': { type: 'application/json', binary: false },
+    '.md': { type: 'text/markdown', binary: false },
+    '.xml': { type: 'text/xml', binary: false },
+    '.svg': { type: 'image/svg+xml', binary: false },
+    '.eot': { type: 'application/vnd.ms-fontobject', binary: true },
+    '.ttf': { type: 'application/font-sfnt', binary: true },
+    '.cur': { type: 'application/x-win-bitmap', binary: true },
+    '.woff': { type: 'application/font-woff', binary: true },
+    '.wav': { type: 'audio/wav', binary: true },
+    '.mp3': { type: 'audio/mpeg3', binary: true },
+    '.avi': { type: 'video/avi', binary: true },
+    '.qt': { type: 'video/quicktime', binary: true },
+    '.ppt': { type: 'application/vnd.ms-powerpoint', binary: true },
+    '.pptx': { type: 'application/vnd.ms-powerpoint', binary: true },
+    '.doc': { type: 'application/msword', binary: true },
+    '.docx': { type: 'application/msword', binary: true },
+    '.xls': { type: 'application/vnd.ms-excel', binary: true },
+    '.xlsx': { type: 'application/vnd.ms-excel', binary: true },
+    '.mp4': { type: 'video/mp4', binary: true },
+    '.mkv': { type: 'video/mkv', binary: true },
+    '.zip': { type: 'application/zip', binary: true },
+    '.ogg': { type: 'audio/ogg', binary: true },
+    '.manifest': { type: 'text/cache-manifest', binary: false },
+    '.pdf': { type: 'application/pdf', binary: true },
+    '.gz': { type: 'application/gzip', binary: true },
+    '.gzip': { type: 'application/gzip', binary: true }
+};
+function isKnownMimeType(ext) {
+    return ext in mimeTypes;
+}
+// For objects
+const defaultAcl = {
+    groups: [],
+    acl: {
+        file: {
+            list: false,
+            read: false,
+            write: false,
+            create: false,
+            delete: false
+        },
+        object: {
+            list: false,
+            read: false,
+            write: false,
+            create: false,
+            delete: false
+        },
+        state: {
+            list: false,
+            read: false,
+            write: false,
+            create: false,
+            delete: false
+        },
+        users: {
+            list: false,
+            read: false,
+            write: false,
+            create: false,
+            delete: false
+        }
+    }
+};
+// FIXME: This should have better types. Probably Record<string, {acl: ioBroker.ObjectPermissions, [x: string | number | symbol]: any}>
+let users = {};
+let groups = [];
+function getMimeType(ext) {
+    if (!ext) {
+        return { mimeType: 'text/html', isBinary: false };
+    }
+    if (ext instanceof Array) {
+        ext = ext[0];
+    }
+    ext = ext.toLowerCase();
+    let mimeType = 'text/javascript';
+    let isBinary = false;
+    if (isKnownMimeType(ext)) {
+        mimeType = mimeTypes[ext].type;
+        isBinary = mimeTypes[ext].binary;
+    }
+    return { mimeType, isBinary };
+}
+exports.getMimeType = getMimeType;
+/**
+ * Writable memory stream
+ */
+class WMStrm extends stream_1.Writable {
+    constructor(key, options) {
+        super(options); // init super
+        this.key = key; // save key
+        memStore[key] = Buffer.alloc(0); // empty
+    }
+    _write(chunk, enc, cb) {
+        if (chunk) {
+            // our memory store stores things in buffers
+            const buffer = Buffer.isBuffer(chunk)
+                ? chunk // already is Buffer use it
+                : Buffer.from(chunk, enc); // string, convert
+            // concatenate to the buffer already there
+            if (!memStore[this.key]) {
+                memStore[this.key] = Buffer.alloc(0);
+                console.log(`memstore for ${this.key} is null`);
+            }
+            memStore[this.key] = Buffer.concat([memStore[this.key], buffer]);
+        }
+        if (!cb) {
+            throw new Error('Callback is empty');
+        }
+        cb();
+    }
+}
+exports.WMStrm = WMStrm;
+function insert(objects, id, attName, _ignore, options, _obj, callback) {
+    if (typeof options === 'string') {
+        options = { mimeType: options };
+    }
+    // return pipe for write into redis
+    const strm = new WMStrm(`${id}/${attName}`, {});
+    strm.on('finish', () => {
+        let error = null;
+        if (!memStore[id + '/' + attName]) {
+            error = `File ${id} / ${attName} is empty`;
+        }
+        objects.writeFile(id, attName, memStore[id + '/' + attName] || '', options, () => {
+            if (memStore[id + '/' + attName] !== undefined) {
+                delete memStore[id + '/' + attName];
+            }
+            return db_base_1.tools.maybeCallbackWithError(callback, error, null);
+        });
+    });
+    return strm;
+}
+exports.insert = insert;
+function checkFile(fileOptions, options, flag, defaultNewAcl) {
+    if (typeof fileOptions.acl !== 'object') {
+        fileOptions = {};
+        fileOptions.mimeType = (0, deep_clone_1.default)(fileOptions);
+        fileOptions.acl = {
+            owner: (defaultNewAcl && defaultNewAcl.owner) || CONSTS.SYSTEM_ADMIN_USER,
+            ownerGroup: (defaultNewAcl && defaultNewAcl.ownerGroup) || CONSTS.SYSTEM_ADMIN_GROUP,
+            permissions: (defaultNewAcl && defaultNewAcl.file) ||
+                CONSTS.ACCESS_USER_RW | CONSTS.ACCESS_GROUP_READ | CONSTS.ACCESS_EVERY_READ // '0644'
+        };
+    }
+    // Set default owner group
+    fileOptions.acl.ownerGroup =
+        fileOptions.acl.ownerGroup || (defaultNewAcl && defaultNewAcl.ownerGroup) || CONSTS.SYSTEM_ADMIN_GROUP;
+    fileOptions.acl.owner = fileOptions.acl.owner || (defaultNewAcl && defaultNewAcl.owner) || CONSTS.SYSTEM_ADMIN_USER;
+    fileOptions.acl.permissions =
+        fileOptions.acl.permissions ||
+            (defaultNewAcl && defaultNewAcl.file) ||
+            CONSTS.ACCESS_USER_RW | CONSTS.ACCESS_GROUP_READ | CONSTS.ACCESS_EVERY_READ; // '0644'
+    if (options.user !== CONSTS.SYSTEM_ADMIN_USER &&
+        options.groups.indexOf(CONSTS.SYSTEM_ADMIN_GROUP) === -1 &&
+        fileOptions.acl) {
+        if (fileOptions.acl.owner !== options.user) {
+            // Check if the user is in the group
+            if (options.groups.indexOf(fileOptions.acl.ownerGroup) !== -1) {
+                // Check group rights
+                if (!(fileOptions.acl.permissions & (flag << 4))) {
+                    return false;
+                }
+            }
+            else {
+                // everybody
+                if (!(fileOptions.acl.permissions & flag)) {
+                    return false;
+                }
+            }
+        }
+        else {
+            // Check user rights
+            if (!(fileOptions.acl.permissions & (flag << 8))) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+exports.checkFile = checkFile;
+function checkFileRights(objects, id, name, options, flag, callback) {
+    const _options = options || {};
+    if (!_options.user) {
+        // Before files converted, lets think: if no options it is admin
+        _options.user = 'system.user.admin';
+        _options.params = _options;
+        _options.group = 'system.group.administrator';
+    }
+    if (!_options.acl) {
+        objects.getUserGroup(_options.user, (_user, groups, acl) => {
+            _options.acl = acl || {};
+            _options.groups = groups;
+            _options.group = groups ? groups[0] : null;
+            checkFileRights(objects, id, name, _options, flag, callback);
+        });
+        return;
+    }
+    // If user may write
+    if (flag === CONSTS.ACCESS_WRITE && !_options.acl.file.write) {
+        // write
+        return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, _options);
+    }
+    // If user may read
+    if (flag === CONSTS.ACCESS_READ && !_options.acl.file.read) {
+        // read
+        return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, _options);
+    }
+    _options.checked = true;
+    objects.checkFile(id, name, _options, flag, (err, options, opt) => {
+        if (err) {
+            return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+        }
+        else {
+            return db_base_1.tools.maybeCallbackWithError(callback, null, options, opt);
+        }
+    });
+}
+exports.checkFileRights = checkFileRights;
+// For users and groups
+function getDefaultAdminRights(acl, _isState) {
+    return {
+        ...acl,
+        file: {
+            list: true,
+            read: true,
+            write: true,
+            create: true,
+            delete: true
+        },
+        object: {
+            create: true,
+            list: true,
+            read: true,
+            write: true,
+            delete: true
+        },
+        users: {
+            create: true,
+            list: true,
+            read: true,
+            write: true,
+            delete: true
+        },
+        state: {
+            read: true,
+            write: true,
+            delete: true,
+            create: true,
+            list: true
+        },
+        other: {
+            execute: false,
+            http: false,
+            sendto: false
+        }
+    };
+}
+function getUserGroup(objects, user, callback) {
+    if (!user || typeof user !== 'string' || !user.startsWith(USER_STARTS_WITH)) {
+        console.log(`invalid user name: ${user}`);
+        user = JSON.stringify(user);
+        // deep copy
+        return db_base_1.tools.maybeCallbackWithError(callback, `invalid user name: ${user}`, user, [], (0, deep_clone_1.default)(defaultAcl.acl));
+    }
+    if (users[user]) {
+        return db_base_1.tools.maybeCallbackWithError(callback, null, user, users[user].groups, users[user].acl);
+    }
+    let error;
+    // Read all groups
+    objects.getObjectList({ startkey: 'system.group.', endkey: 'system.group.\u9999' }, { checked: true }, (err, arr) => {
+        if (err) {
+            error = err;
+        }
+        groups = [];
+        if (arr) {
+            // Read all groups
+            for (const g in arr.rows) {
+                const val = arr.rows[g].value;
+                if (!val) {
+                    continue;
+                }
+                groups[g] = val;
+                if (groups[g]._id === CONSTS.SYSTEM_ADMIN_GROUP) {
+                    groups[g].common.acl = getDefaultAdminRights(groups[g].common.acl);
+                }
+            }
+        }
+        objects.getObjectList({ startkey: 'system.user.', endkey: 'system.user.\u9999' }, { checked: true }, (err, arr) => {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+            if (err) {
+                error = err;
+            }
+            users = {};
+            if (arr) {
+                for (const row of arr.rows) {
+                    // cannot use here Object.assign, because required deep copy
+                    users[row.value._id] = (0, deep_clone_1.default)(defaultAcl);
+                }
+            }
+            users[CONSTS.SYSTEM_ADMIN_USER] = users[CONSTS.SYSTEM_ADMIN_USER] || (0, deep_clone_1.default)(defaultAcl);
+            users[CONSTS.SYSTEM_ADMIN_USER].acl = getDefaultAdminRights(users[CONSTS.SYSTEM_ADMIN_USER].acl);
+            for (let g = 0; g < groups.length; g++) {
+                if (!groups[g] || !groups[g].common || !groups[g].common.members) {
+                    continue;
+                }
+                for (let m = 0; m < groups[g].common.members.length; m++) {
+                    const u = groups[g].common.members[m];
+                    if (!users[u]) {
+                        error =
+                            error ||
+                                `Unknown user in group "${groups[g]._id.replace('system.group.', '')}": ${u}`;
+                        continue;
+                    }
+                    users[u].groups.push(groups[g]._id);
+                    if (groups[g].common.acl && groups[g].common.acl.file) {
+                        if (!users[u].acl || !users[u].acl.file) {
+                            users[u].acl = users[u].acl || {};
+                            users[u].acl.file = users[u].acl.file || {};
+                            users[u].acl.file.create = groups[g].common.acl.file.create;
+                            users[u].acl.file.read = groups[g].common.acl.file.read;
+                            users[u].acl.file.write = groups[g].common.acl.file.write;
+                            users[u].acl.file.delete = groups[g].common.acl.file.delete;
+                            users[u].acl.file.list = groups[g].common.acl.file.list;
+                        }
+                        else {
+                            users[u].acl.file.create =
+                                users[u].acl.file.create || groups[g].common.acl.file.create;
+                            users[u].acl.file.read = users[u].acl.file.read || groups[g].common.acl.file.read;
+                            users[u].acl.file.write =
+                                users[u].acl.file.write || groups[g].common.acl.file.write;
+                            users[u].acl.file.delete =
+                                users[u].acl.file.delete || groups[g].common.acl.file.delete;
+                            users[u].acl.file.list = users[u].acl.file.list || groups[g].common.acl.file.list;
+                        }
+                    }
+                    if (groups[g].common.acl && groups[g].common.acl.object) {
+                        if (!users[u].acl || !users[u].acl.object) {
+                            users[u].acl = users[u].acl || {};
+                            users[u].acl.object = users[u].acl.object || {};
+                            users[u].acl.object.create = groups[g].common.acl.object.create;
+                            users[u].acl.object.read = groups[g].common.acl.object.read;
+                            users[u].acl.object.write = groups[g].common.acl.object.write;
+                            users[u].acl.object.delete = groups[g].common.acl.object.delete;
+                            users[u].acl.object.list = groups[g].common.acl.object.list;
+                        }
+                        else {
+                            users[u].acl.object.create =
+                                users[u].acl.object.create || groups[g].common.acl.object.create;
+                            users[u].acl.object.read =
+                                users[u].acl.object.read || groups[g].common.acl.object.read;
+                            users[u].acl.object.write =
+                                users[u].acl.object.write || groups[g].common.acl.object.write;
+                            users[u].acl.object.delete =
+                                users[u].acl.object.delete || groups[g].common.acl.object.delete;
+                            users[u].acl.object.list =
+                                users[u].acl.object.list || groups[g].common.acl.object.list;
+                        }
+                    }
+                    if (groups[g].common.acl && groups[g].common.acl.users) {
+                        if (!users[u].acl || !users[u].acl.users) {
+                            users[u].acl = users[u].acl || {};
+                            users[u].acl.users = users[u].acl.users || {};
+                            users[u].acl.users.create = groups[g].common.acl.users.create;
+                            users[u].acl.users.read = groups[g].common.acl.users.read;
+                            users[u].acl.users.write = groups[g].common.acl.users.write;
+                            users[u].acl.users.delete = groups[g].common.acl.users.delete;
+                            users[u].acl.users.list = groups[g].common.acl.users.list;
+                        }
+                        else {
+                            users[u].acl.users.create =
+                                users[u].acl.users.create || groups[g].common.acl.users.create;
+                            users[u].acl.users.read =
+                                users[u].acl.users.read || groups[g].common.acl.users.read;
+                            users[u].acl.users.write =
+                                users[u].acl.users.write || groups[g].common.acl.users.write;
+                            users[u].acl.users.delete =
+                                users[u].acl.users.delete || groups[g].common.acl.users.delete;
+                            users[u].acl.users.list =
+                                users[u].acl.users.list || groups[g].common.acl.users.list;
+                        }
+                    }
+                    if (groups[g].common.acl && groups[g].common.acl.state) {
+                        if (!users[u].acl || !users[u].acl.state) {
+                            users[u].acl = users[u].acl || {};
+                            users[u].acl.state = users[u].acl.state || {};
+                            users[u].acl.state.create = (_a = groups[g].common.acl.state) === null || _a === void 0 ? void 0 : _a.create;
+                            users[u].acl.state.read = (_b = groups[g].common.acl.state) === null || _b === void 0 ? void 0 : _b.read;
+                            users[u].acl.state.write = (_c = groups[g].common.acl.state) === null || _c === void 0 ? void 0 : _c.write;
+                            users[u].acl.state.delete = (_d = groups[g].common.acl.state) === null || _d === void 0 ? void 0 : _d.delete;
+                            users[u].acl.state.list = (_e = groups[g].common.acl.state) === null || _e === void 0 ? void 0 : _e.list;
+                        }
+                        else {
+                            users[u].acl.state.create =
+                                users[u].acl.state.create || ((_f = groups[g].common.acl.state) === null || _f === void 0 ? void 0 : _f.create);
+                            users[u].acl.state.read =
+                                users[u].acl.state.read || ((_g = groups[g].common.acl.state) === null || _g === void 0 ? void 0 : _g.read);
+                            users[u].acl.state.write =
+                                users[u].acl.state.write || ((_h = groups[g].common.acl.state) === null || _h === void 0 ? void 0 : _h.write);
+                            users[u].acl.state.delete =
+                                users[u].acl.state.delete || ((_j = groups[g].common.acl.state) === null || _j === void 0 ? void 0 : _j.delete);
+                            users[u].acl.state.list =
+                                users[u].acl.state.list || ((_k = groups[g].common.acl.state) === null || _k === void 0 ? void 0 : _k.list);
+                        }
+                    }
+                }
+            }
+            return db_base_1.tools.maybeCallbackWithError(callback, error, user, users[user] ? users[user].groups : [], users[user] ? users[user].acl : (0, deep_clone_1.default)(defaultAcl.acl));
+        });
+    });
+}
+exports.getUserGroup = getUserGroup;
+function sanitizePath(id, name) {
+    if (!name) {
+        name = '';
+    }
+    if (name[0] === '/') {
+        name = name.substring(1);
+    }
+    if (!id) {
+        throw new Error('Empty ID');
+    }
+    id = id.replace(/[\][*,;'"`<>\\?/]/g, ''); // remove all invalid characters from states plus slashes
+    id = id.replace(/\.\./g, ''); // do not allow to write in parent directories
+    if (name.includes('..')) {
+        name = path_1.default.normalize('/' + name);
+    }
+    if (name.includes('..')) {
+        // Also after normalization we still have .. in it - should not happen if normalize worked correctly
+        name = name.replace(/\.\./g, '');
+        name = path_1.default.normalize('/' + name);
+    }
+    name = name.replace(/\\/g, '/'); // replace win path backslashes
+    if (name[0] === '/') {
+        name = name.substring(1);
+    } // do not allow absolute paths
+    return { id: id, name: name };
+}
+exports.sanitizePath = sanitizePath;
+function checkObject(obj, options, flag) {
+    // read rights of object
+    if (!obj || !('common' in obj) || !obj.acl || flag === CONSTS.ACCESS_LIST) {
+        return true;
+    }
+    if (options.user === CONSTS.SYSTEM_ADMIN_USER) {
+        return true;
+    }
+    // admins may always see everything
+    if (options.group === CONSTS.SYSTEM_ADMIN_GROUP || options.groups.includes(CONSTS.SYSTEM_ADMIN_GROUP)) {
+        return true;
+    }
+    // FIXME: what if flag is ACCESS_DELETE or ACCESS_CREATE? currently it will end in false
+    if (flag === CONSTS.ACCESS_DELETE || flag === CONSTS.ACCESS_CREATE) {
+        return false;
+    }
+    // checkObject always called after checkObjectRights and admin is checked there
+    if (obj.acl.owner !== options.user) {
+        // Check if the user is in the group
+        if ((options.group && options.group === obj.acl.ownerGroup) ||
+            (options.groups && options.groups.includes(obj.acl.ownerGroup))) {
+            // Check group rights
+            if (!(obj.acl.object & (flag << 4))) {
+                return false;
+            }
+        }
+        else {
+            // everybody
+            if (!(obj.acl.object & flag)) {
+                return false;
+            }
+        }
+    }
+    else {
+        // Check group rights
+        if (!(obj.acl.object & (flag << 8))) {
+            return false;
+        }
+    }
+    return true; // ALL OK
+}
+exports.checkObject = checkObject;
+function checkObjectRights(objects, id, object, options, flag, callback) {
+    options = options || {};
+    if (!options.user) {
+        // Before files converted, lets think: if no options it is admin
+        options = {
+            user: CONSTS.SYSTEM_ADMIN_USER,
+            params: options,
+            group: CONSTS.SYSTEM_ADMIN_GROUP,
+            groups: [CONSTS.SYSTEM_ADMIN_GROUP],
+            acl: getDefaultAdminRights()
+        };
+    }
+    if (!options.acl) {
+        return objects.getUserGroup(options.user, (_user, groups, acl) => {
+            // TODO: ts needs it because we are doing async call before
+            options = options || {};
+            options.acl = acl || {};
+            options.groups = groups;
+            options.group = groups ? groups[0] : null;
+            checkObjectRights(objects, id, object, options, flag, callback);
+        });
+    }
+    // now options are filled and we can go
+    if (options.user === CONSTS.SYSTEM_ADMIN_USER ||
+        options.group === CONSTS.SYSTEM_ADMIN_GROUP ||
+        (options.groups && options.groups.includes(CONSTS.SYSTEM_ADMIN_GROUP))) {
+        return db_base_1.tools.maybeCallbackWithError(callback, null, options);
+    }
+    // if user or group objects
+    if (typeof id === 'string' && (id.startsWith(USER_STARTS_WITH) || id.startsWith(GROUP_STARTS_WITH))) {
+        // If user may write
+        if (flag === CONSTS.ACCESS_WRITE && !options.acl.users.write) {
+            // write
+            return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+        }
+        // If user may read
+        if (flag === CONSTS.ACCESS_READ && !options.acl.users.read) {
+            // read
+            return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+        }
+        // If user may delete
+        if (flag === CONSTS.ACCESS_DELETE && !options.acl.users.delete) {
+            // delete
+            return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+        }
+        // If user may list
+        if (flag === CONSTS.ACCESS_LIST && !options.acl.users.list) {
+            // list
+            return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+        }
+        // If user may create
+        if (flag === CONSTS.ACCESS_CREATE && !options.acl.users.create) {
+            // create
+            return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+        }
+        // If user may write
+        if (flag === CONSTS.ACCESS_DELETE) {
+            // he may delete
+            flag = CONSTS.ACCESS_WRITE;
+        }
+    }
+    // If user may write
+    if (flag === CONSTS.ACCESS_WRITE && !options.acl.object.write) {
+        // write
+        db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+    }
+    // If user may read
+    if (flag === CONSTS.ACCESS_READ && !options.acl.object.read) {
+        // read
+        return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+    }
+    // If user may delete
+    if (flag === CONSTS.ACCESS_DELETE && !options.acl.object.delete) {
+        // delete
+        return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+    }
+    // If user may list
+    if (flag === CONSTS.ACCESS_LIST && !options.acl.object.list) {
+        // list
+        return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+    }
+    if (flag === CONSTS.ACCESS_DELETE) {
+        // write
+        flag = CONSTS.ACCESS_WRITE;
+    }
+    if (id && !checkObject(object, options, flag)) {
+        return db_base_1.tools.maybeCallbackWithError(callback, exports.ERRORS.ERROR_PERMISSION, options);
+    }
+    else {
+        return db_base_1.tools.maybeCallbackWithError(callback, null, options);
+    }
+}
+exports.checkObjectRights = checkObjectRights;
+//# sourceMappingURL=objectsUtils.js.map