@iobroker/db-objects-redis 7.2.3 → 8.0.0-alpha.1-20260921-e5941ca8a

package/build/esm/lib/objects/objectsUtils.js

@@ -1,16 +1,17 @@
 /**
  *      Common functions between client and server
  *
- *      Copyright 2013-2024 bluefox <dogafox@gmail.com>
+ *      Copyright 2013-2026 bluefox <dogafox@gmail.com>
  *
  *      MIT License
  *
  */
 import path from 'node:path';
 import deepClone from 'deep-clone';
+import mime from 'mime-types';
 import { tools } from '@iobroker/db-base';
 import * as CONSTS from '../../lib/objects/constants.js';
-import mime from 'mime-types';
+import { SYSTEM_ADMIN_GROUP, SYSTEM_ADMIN_USER } from '../../lib/objects/constants.js';
 export * as CONSTS from '../../lib/objects/constants.js';
 export const ERRORS = CONSTS.ERRORS;
 export const REG_CHECK_ID = CONSTS.REG_CHECK_ID;
@@ -88,31 +89,36 @@ export function getMimeType(ext, isTextData) {
     }
     return { mimeType: isTextData ? 'text/plain' : 'application/octet-stream', isBinary: !isTextData };
 }
-export function checkFile(fileOptions, options, flag, defaultNewAcl) {
-    if (typeof fileOptions.acl !== 'object') {
-        fileOptions = {};
-        fileOptions.mimeType = deepClone(fileOptions);
-        fileOptions.acl = {
-            owner: (defaultNewAcl && defaultNewAcl.owner) || CONSTS.SYSTEM_ADMIN_USER,
-            ownerGroup: (defaultNewAcl && defaultNewAcl.ownerGroup) || CONSTS.SYSTEM_ADMIN_GROUP,
-            permissions: (defaultNewAcl && defaultNewAcl.file) ||
-                CONSTS.ACCESS_USER_RW | CONSTS.ACCESS_GROUP_READ | CONSTS.ACCESS_EVERY_READ, // '0644'
-        };
-    }
+/**
+ * Check if the given options have the required rights on a file according to its ACL
+ *
+ * @param fileOptions The stored file options including its ACL
+ * @param fileOptions.mimeType The mime type of the file
+ * @param fileOptions.notExists Whether the file does not exist yet
+ * @param fileOptions.acl The access control list stored for the file
+ * @param userContext The current request options including the user and group
+ * @param flag The access flag(s) to check for
+ * @param defaultNewAcl The default ACL to use if the file has none yet
+ */
+export function checkFile(fileOptions, userContext, flag, defaultNewAcl) {
+    // convert string to structure
+    fileOptions ||= {};
+    fileOptions.acl ||= {
+        owner: defaultNewAcl?.owner || CONSTS.SYSTEM_ADMIN_USER,
+        ownerGroup: defaultNewAcl?.ownerGroup || CONSTS.SYSTEM_ADMIN_GROUP,
+        permissions: defaultNewAcl?.file || CONSTS.ACCESS_USER_RW | CONSTS.ACCESS_GROUP_READ | CONSTS.ACCESS_EVERY_READ, // '0644'
+    };
     // Set default owner group
-    fileOptions.acl.ownerGroup =
-        fileOptions.acl.ownerGroup || (defaultNewAcl && defaultNewAcl.ownerGroup) || CONSTS.SYSTEM_ADMIN_GROUP;
-    fileOptions.acl.owner = fileOptions.acl.owner || (defaultNewAcl && defaultNewAcl.owner) || CONSTS.SYSTEM_ADMIN_USER;
-    fileOptions.acl.permissions =
-        fileOptions.acl.permissions ||
-            (defaultNewAcl && defaultNewAcl.file) ||
-            CONSTS.ACCESS_USER_RW | CONSTS.ACCESS_GROUP_READ | CONSTS.ACCESS_EVERY_READ; // '0644'
-    if (options.user !== CONSTS.SYSTEM_ADMIN_USER &&
-        options.groups.indexOf(CONSTS.SYSTEM_ADMIN_GROUP) === -1 &&
+    fileOptions.acl.owner ||= defaultNewAcl?.owner || CONSTS.SYSTEM_ADMIN_USER;
+    fileOptions.acl.ownerGroup ||= defaultNewAcl?.ownerGroup || CONSTS.SYSTEM_ADMIN_GROUP;
+    fileOptions.acl.permissions ||=
+        defaultNewAcl?.file || CONSTS.ACCESS_USER_RW | CONSTS.ACCESS_GROUP_READ | CONSTS.ACCESS_EVERY_READ; // '0644'
+    if (userContext.user !== CONSTS.SYSTEM_ADMIN_USER &&
+        !userContext.groups.includes(CONSTS.SYSTEM_ADMIN_GROUP) &&
         fileOptions.acl) {
-        if (fileOptions.acl.owner !== options.user) {
+        if (fileOptions.acl.owner !== userContext.user) {
             // Check if the user is in the group
-            if (options.groups.indexOf(fileOptions.acl.ownerGroup) !== -1) {
+            if (userContext.groups.includes(fileOptions.acl.ownerGroup)) {
                 // Check group rights
                 if (!(fileOptions.acl.permissions & (flag << 4))) {
                     return false;
@@ -134,40 +140,50 @@ export function checkFile(fileOptions, options, flag, defaultNewAcl) {
     }
     return true;
 }
-export function checkFileRights(objects, id, name, options, flag, callback) {
-    const _options = options || {};
-    if (!_options.user) {
+/**
+ * Check whether the given user is allowed to access a file and call back with the effective options
+ *
+ * @param objects The objects database client
+ * @param id The id of the object owning the file
+ * @param name The file name, or null for the whole namespace
+ * @param options The current request options including the user
+ * @param flag The access flag(s) to check for
+ */
+export async function checkFileRightsAsync(objects, id, name, options, flag) {
+    let userContext;
+    if (!options?.user) {
         // Before files converted, lets think: if no options it is admin
-        _options.user = 'system.user.admin';
-        _options.params = _options;
-        _options.group = 'system.group.administrator';
-    }
-    if (!_options.acl) {
-        objects.getUserGroup(_options.user, (_user, groups, acl) => {
-            _options.acl = acl || {};
-            _options.groups = groups;
-            _options.group = groups ? groups[0] : null;
-            checkFileRights(objects, id, name, _options, flag, callback);
-        });
-        return;
+        userContext = {
+            user: SYSTEM_ADMIN_USER,
+            group: SYSTEM_ADMIN_GROUP,
+            groups: [SYSTEM_ADMIN_GROUP],
+            acl: getDefaultAdminRights(),
+        };
     }
-    // If user may write
-    if (flag === CONSTS.ACCESS_WRITE && !_options.acl.file.write) {
-        // write
-        return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, _options);
+    else {
+        const [, groups, acl] = await getUserGroupAsync(objects, options.user);
+        userContext = {
+            user: options.user,
+            group: groups?.[0] || null,
+            groups,
+            acl,
+        };
+    }
+    if (flag === CONSTS.ACCESS_WRITE && !userContext.acl.file.write) {
+        // If user may write
+        throw new Error(ERRORS.ERROR_PERMISSION);
     }
     // If user may read
-    if (flag === CONSTS.ACCESS_READ && !_options.acl.file.read) {
+    if (flag === CONSTS.ACCESS_READ && !userContext.acl.file.read) {
         // read
-        return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, _options);
+        throw new Error(ERRORS.ERROR_PERMISSION);
     }
-    _options.checked = true;
-    objects.checkFile(id, name, _options, flag, (err, options, opt) => {
-        if (err) {
-            return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
-        }
-        return tools.maybeCallbackWithError(callback, null, options, opt);
-    });
+    userContext.checked = true;
+    const fileOptions = await objects.checkFileAsync(id, name, userContext, flag);
+    if (!fileOptions) {
+        throw new Error(ERRORS.ERROR_PERMISSION);
+    }
+    return { fileOptions, userContext };
 }
 // For users and groups
 function getDefaultAdminRights(acl, _isState) {
@@ -208,156 +224,157 @@ function getDefaultAdminRights(acl, _isState) {
         },
     };
 }
+/**
+ * Determine the groups and effective ACL of the given user
+ *
+ * @param objects The objects database client
+ * @param user The id of the user to look up
+ * @param callback Called with the user, its groups and the effective ACL
+ */
 export function getUserGroup(objects, user, callback) {
+    try {
+        getUserGroupAsync(objects, user)
+            .then(result => tools.maybeCallbackWithError(callback, null, result[0], result[1], result[2]))
+            .catch(err => tools.maybeCallbackWithError(callback, err, deepClone(user), [], deepClone(defaultAcl.acl)));
+    }
+    catch (err) {
+        return tools.maybeCallbackWithError(callback, err, deepClone(user), [], deepClone(defaultAcl.acl));
+    }
+}
+/**
+ * Determine the groups and effective ACL of the given user
+ *
+ * @param objects The objects database client
+ * @param user The id of the user to look up
+ */
+export async function getUserGroupAsync(objects, user) {
     if (!user || typeof user !== 'string' || !user.startsWith(USER_STARTS_WITH)) {
         console.log(`invalid user name: ${user}`);
-        return tools.maybeCallbackWithError(callback, `invalid user name: ${user}`, deepClone(user), [], deepClone(defaultAcl.acl));
+        throw new Error(`invalid user name: ${user}`);
     }
     if (users[user]) {
-        return tools.maybeCallbackWithError(callback, null, user, users[user].groups, users[user].acl);
+        return [user, users[user].groups, users[user].acl];
     }
     let error;
+    groups = [];
     // Read all groups
-    objects.getObjectList({ startkey: 'system.group.', endkey: 'system.group.\u9999' }, { checked: true }, (err, arr) => {
-        if (err) {
-            error = err;
+    const groupList = await objects.getObjectListAsync({ startkey: 'system.group.', endkey: 'system.group.\u9999' }, { checked: true });
+    if (groupList) {
+        // Read all groups
+        for (let g = 0; g < groupList.rows.length; g++) {
+            const val = groupList.rows[g].value;
+            if (!val) {
+                continue;
+            }
+            groups[g] = val;
+            if (groups[g]._id === CONSTS.SYSTEM_ADMIN_GROUP) {
+                groups[g].common.acl = getDefaultAdminRights(groups[g].common.acl);
+            }
+        }
+    }
+    users = {};
+    const userList = await objects.getObjectListAsync({ startkey: 'system.user.', endkey: 'system.user.\u9999' }, { checked: true });
+    if (userList) {
+        for (const row of userList.rows) {
+            // cannot use here Object.assign, because required deep copy
+            users[row.value._id] = deepClone(defaultAcl);
         }
-        groups = [];
-        if (arr) {
-            // Read all groups
-            for (const g in arr.rows) {
-                const val = arr.rows[g].value;
-                if (!val) {
-                    continue;
+    }
+    users[CONSTS.SYSTEM_ADMIN_USER] ||= deepClone(defaultAcl);
+    users[CONSTS.SYSTEM_ADMIN_USER].acl = getDefaultAdminRights(users[CONSTS.SYSTEM_ADMIN_USER].acl);
+    for (let g = 0; g < groups.length; g++) {
+        if (!groups[g]?.common?.members) {
+            continue;
+        }
+        for (let m = 0; m < groups[g].common.members.length; m++) {
+            const u = groups[g].common.members[m];
+            if (!users[u]) {
+                error ||= `Unknown user in group "${groups[g]._id.replace('system.group.', '')}": ${u}`;
+                continue;
+            }
+            users[u].groups.push(groups[g]._id);
+            if (groups[g].common.acl?.file) {
+                if (!users[u].acl?.file) {
+                    users[u].acl ||= {};
+                    users[u].acl.file ||= {};
+                    users[u].acl.file.create = groups[g].common.acl.file.create;
+                    users[u].acl.file.read = groups[g].common.acl.file.read;
+                    users[u].acl.file.write = groups[g].common.acl.file.write;
+                    users[u].acl.file.delete = groups[g].common.acl.file.delete;
+                    users[u].acl.file.list = groups[g].common.acl.file.list;
                 }
-                groups[g] = val;
-                if (groups[g]._id === CONSTS.SYSTEM_ADMIN_GROUP) {
-                    groups[g].common.acl = getDefaultAdminRights(groups[g].common.acl);
+                else {
+                    users[u].acl.file.create ||= groups[g].common.acl.file.create;
+                    users[u].acl.file.read ||= groups[g].common.acl.file.read;
+                    users[u].acl.file.write ||= groups[g].common.acl.file.write;
+                    users[u].acl.file.delete ||= groups[g].common.acl.file.delete;
+                    users[u].acl.file.list ||= groups[g].common.acl.file.list;
                 }
             }
-        }
-        objects.getObjectList({ startkey: 'system.user.', endkey: 'system.user.\u9999' }, { checked: true }, (err, arr) => {
-            if (err) {
-                error = err;
+            if (groups[g].common.acl?.object) {
+                if (!users[u].acl?.object) {
+                    users[u].acl ||= {};
+                    users[u].acl.object ||= {};
+                    users[u].acl.object.create = groups[g].common.acl.object.create;
+                    users[u].acl.object.read = groups[g].common.acl.object.read;
+                    users[u].acl.object.write = groups[g].common.acl.object.write;
+                    users[u].acl.object.delete = groups[g].common.acl.object.delete;
+                    users[u].acl.object.list = groups[g].common.acl.object.list;
+                }
+                else {
+                    users[u].acl.object.create ||= groups[g].common.acl.object.create;
+                    users[u].acl.object.read ||= groups[g].common.acl.object.read;
+                    users[u].acl.object.write ||= groups[g].common.acl.object.write;
+                    users[u].acl.object.delete ||= groups[g].common.acl.object.delete;
+                    users[u].acl.object.list ||= groups[g].common.acl.object.list;
+                }
             }
-            users = {};
-            if (arr) {
-                for (const row of arr.rows) {
-                    // cannot use here Object.assign, because required deep copy
-                    users[row.value._id] = deepClone(defaultAcl);
+            if (groups[g].common.acl?.users) {
+                if (!users[u].acl?.users) {
+                    users[u].acl ||= {};
+                    users[u].acl.users ||= {};
+                    users[u].acl.users.create = groups[g].common.acl.users.create;
+                    users[u].acl.users.read = groups[g].common.acl.users.read;
+                    users[u].acl.users.write = groups[g].common.acl.users.write;
+                    users[u].acl.users.delete = groups[g].common.acl.users.delete;
+                    users[u].acl.users.list = groups[g].common.acl.users.list;
+                }
+                else {
+                    users[u].acl.users.create ||= groups[g].common.acl.users.create;
+                    users[u].acl.users.read ||= groups[g].common.acl.users.read;
+                    users[u].acl.users.write ||= groups[g].common.acl.users.write;
+                    users[u].acl.users.delete ||= groups[g].common.acl.users.delete;
+                    users[u].acl.users.list ||= groups[g].common.acl.users.list;
                 }
             }
-            users[CONSTS.SYSTEM_ADMIN_USER] = users[CONSTS.SYSTEM_ADMIN_USER] || deepClone(defaultAcl);
-            users[CONSTS.SYSTEM_ADMIN_USER].acl = getDefaultAdminRights(users[CONSTS.SYSTEM_ADMIN_USER].acl);
-            for (let g = 0; g < groups.length; g++) {
-                if (!groups[g] || !groups[g].common || !groups[g].common.members) {
-                    continue;
+            if (groups[g].common.acl?.state) {
+                if (!users[u].acl?.state) {
+                    users[u].acl ||= {};
+                    users[u].acl.state ||= {};
+                    users[u].acl.state.create = groups[g].common.acl.state.create;
+                    users[u].acl.state.read = groups[g].common.acl.state.read;
+                    users[u].acl.state.write = groups[g].common.acl.state.write;
+                    users[u].acl.state.delete = groups[g].common.acl.state.delete;
+                    users[u].acl.state.list = groups[g].common.acl.state.list;
                 }
-                for (let m = 0; m < groups[g].common.members.length; m++) {
-                    const u = groups[g].common.members[m];
-                    if (!users[u]) {
-                        error =
-                            error ||
-                                `Unknown user in group "${groups[g]._id.replace('system.group.', '')}": ${u}`;
-                        continue;
-                    }
-                    users[u].groups.push(groups[g]._id);
-                    if (groups[g].common.acl && groups[g].common.acl.file) {
-                        if (!users[u].acl || !users[u].acl.file) {
-                            users[u].acl = users[u].acl || {};
-                            users[u].acl.file = users[u].acl.file || {};
-                            users[u].acl.file.create = groups[g].common.acl.file.create;
-                            users[u].acl.file.read = groups[g].common.acl.file.read;
-                            users[u].acl.file.write = groups[g].common.acl.file.write;
-                            users[u].acl.file.delete = groups[g].common.acl.file.delete;
-                            users[u].acl.file.list = groups[g].common.acl.file.list;
-                        }
-                        else {
-                            users[u].acl.file.create =
-                                users[u].acl.file.create || groups[g].common.acl.file.create;
-                            users[u].acl.file.read = users[u].acl.file.read || groups[g].common.acl.file.read;
-                            users[u].acl.file.write =
-                                users[u].acl.file.write || groups[g].common.acl.file.write;
-                            users[u].acl.file.delete =
-                                users[u].acl.file.delete || groups[g].common.acl.file.delete;
-                            users[u].acl.file.list = users[u].acl.file.list || groups[g].common.acl.file.list;
-                        }
-                    }
-                    if (groups[g].common.acl && groups[g].common.acl.object) {
-                        if (!users[u].acl || !users[u].acl.object) {
-                            users[u].acl = users[u].acl || {};
-                            users[u].acl.object = users[u].acl.object || {};
-                            users[u].acl.object.create = groups[g].common.acl.object.create;
-                            users[u].acl.object.read = groups[g].common.acl.object.read;
-                            users[u].acl.object.write = groups[g].common.acl.object.write;
-                            users[u].acl.object.delete = groups[g].common.acl.object.delete;
-                            users[u].acl.object.list = groups[g].common.acl.object.list;
-                        }
-                        else {
-                            users[u].acl.object.create =
-                                users[u].acl.object.create || groups[g].common.acl.object.create;
-                            users[u].acl.object.read =
-                                users[u].acl.object.read || groups[g].common.acl.object.read;
-                            users[u].acl.object.write =
-                                users[u].acl.object.write || groups[g].common.acl.object.write;
-                            users[u].acl.object.delete =
-                                users[u].acl.object.delete || groups[g].common.acl.object.delete;
-                            users[u].acl.object.list =
-                                users[u].acl.object.list || groups[g].common.acl.object.list;
-                        }
-                    }
-                    if (groups[g].common.acl && groups[g].common.acl.users) {
-                        if (!users[u].acl || !users[u].acl.users) {
-                            users[u].acl = users[u].acl || {};
-                            users[u].acl.users = users[u].acl.users || {};
-                            users[u].acl.users.create = groups[g].common.acl.users.create;
-                            users[u].acl.users.read = groups[g].common.acl.users.read;
-                            users[u].acl.users.write = groups[g].common.acl.users.write;
-                            users[u].acl.users.delete = groups[g].common.acl.users.delete;
-                            users[u].acl.users.list = groups[g].common.acl.users.list;
-                        }
-                        else {
-                            users[u].acl.users.create =
-                                users[u].acl.users.create || groups[g].common.acl.users.create;
-                            users[u].acl.users.read =
-                                users[u].acl.users.read || groups[g].common.acl.users.read;
-                            users[u].acl.users.write =
-                                users[u].acl.users.write || groups[g].common.acl.users.write;
-                            users[u].acl.users.delete =
-                                users[u].acl.users.delete || groups[g].common.acl.users.delete;
-                            users[u].acl.users.list =
-                                users[u].acl.users.list || groups[g].common.acl.users.list;
-                        }
-                    }
-                    if (groups[g].common.acl && groups[g].common.acl.state) {
-                        if (!users[u].acl || !users[u].acl.state) {
-                            users[u].acl = users[u].acl || {};
-                            users[u].acl.state = users[u].acl.state || {};
-                            users[u].acl.state.create = groups[g].common.acl.state?.create;
-                            users[u].acl.state.read = groups[g].common.acl.state?.read;
-                            users[u].acl.state.write = groups[g].common.acl.state?.write;
-                            users[u].acl.state.delete = groups[g].common.acl.state?.delete;
-                            users[u].acl.state.list = groups[g].common.acl.state?.list;
-                        }
-                        else {
-                            users[u].acl.state.create =
-                                users[u].acl.state.create || groups[g].common.acl.state?.create;
-                            users[u].acl.state.read =
-                                users[u].acl.state.read || groups[g].common.acl.state?.read;
-                            users[u].acl.state.write =
-                                users[u].acl.state.write || groups[g].common.acl.state?.write;
-                            users[u].acl.state.delete =
-                                users[u].acl.state.delete || groups[g].common.acl.state?.delete;
-                            users[u].acl.state.list =
-                                users[u].acl.state.list || groups[g].common.acl.state?.list;
-                        }
-                    }
+                else {
+                    users[u].acl.state.create ||= groups[g].common.acl.state.create;
+                    users[u].acl.state.read ||= groups[g].common.acl.state.read;
+                    users[u].acl.state.write ||= groups[g].common.acl.state.write;
+                    users[u].acl.state.delete ||= groups[g].common.acl.state.delete;
+                    users[u].acl.state.list ||= groups[g].common.acl.state.list;
                 }
             }
-            return tools.maybeCallbackWithError(callback, error, user, users[user] ? users[user].groups : [], users[user] ? users[user].acl : deepClone(defaultAcl.acl));
-        });
-    });
+        }
+    }
+    return [user, users[user]?.groups || [], users[user]?.acl || deepClone(defaultAcl.acl)];
 }
+/**
+ * Sanitize an object id and file name so they cannot escape the intended directory
+ *
+ * @param id The object id owning the file
+ * @param name The file name to sanitize
+ */
 export function sanitizePath(id, name) {
     if (!name) {
         name = '';
@@ -384,6 +401,13 @@ export function sanitizePath(id, name) {
     } // do not allow absolute paths
     return { id: id, name: name };
 }
+/**
+ * Check if the given options have the required rights on an object according to its ACL
+ *
+ * @param obj The object (or file object) to check, or null
+ * @param options The current request options including the user and group
+ * @param flag The access flag(s) to check for
+ */
 export function checkObject(obj, options, flag) {
     // read rights of object
     if (!obj || !('common' in obj) || !obj.acl || flag === CONSTS.ACCESS_LIST) {
@@ -425,60 +449,88 @@ export function checkObject(obj, options, flag) {
     }
     return true; // ALL OK
 }
+/**
+ * Check whether the given user is allowed to access an object and call back with the effective options
+ *
+ * @param objects The objects database client
+ * @param id The id of the object, or null
+ * @param object The object to check, or null
+ * @param options The current request options including the user
+ * @param flag The access flag(s) to check for
+ * @param callback Called with the effective options once the rights have been checked
+ */
 export function checkObjectRights(objects, id, object, options, flag, callback) {
-    options = options || {};
-    if (!options.user) {
+    try {
+        checkObjectRightsAsync(objects, id, object, options, flag)
+            .then(userContext => tools.maybeCallbackWithError(callback, null, userContext))
+            .catch(error => tools.maybeCallbackWithError(callback, error));
+    }
+    catch (error) {
+        tools.maybeCallbackWithError(callback, error);
+    }
+}
+/**
+ * Check whether the given user is allowed to access an object and call back with the effective options
+ *
+ * @param objects The objects database client
+ * @param id The id of the object, or null
+ * @param object The object to check, or null
+ * @param options The current request options including the user
+ * @param flag The access flag(s) to check for
+ */
+export async function checkObjectRightsAsync(objects, id, object, options, flag) {
+    let userContext;
+    options ||= {};
+    if (!options?.user) {
         // Before files converted, lets think: if no options it is admin
-        options = {
+        userContext = {
             user: CONSTS.SYSTEM_ADMIN_USER,
-            params: options,
             group: CONSTS.SYSTEM_ADMIN_GROUP,
             groups: [CONSTS.SYSTEM_ADMIN_GROUP],
             acl: getDefaultAdminRights(),
         };
     }
-    if (!options.acl) {
-        return objects.getUserGroup(options.user, (_user, groups, acl) => {
-            // TODO: ts needs it because we are doing async call before
-            options = options || {};
-            options.acl = acl || {};
-            options.groups = groups;
-            options.group = groups ? groups[0] : null;
-            checkObjectRights(objects, id, object, options, flag, callback);
-        });
+    else {
+        const [, groups, acl] = await getUserGroupAsync(objects, options.user);
+        userContext = {
+            user: options.user,
+            groups,
+            acl: acl || {},
+            group: groups?.[0] || null,
+        };
     }
     // now options are filled and we can go
-    if (options.user === CONSTS.SYSTEM_ADMIN_USER ||
-        options.group === CONSTS.SYSTEM_ADMIN_GROUP ||
-        (options.groups && options.groups.includes(CONSTS.SYSTEM_ADMIN_GROUP))) {
-        return tools.maybeCallbackWithError(callback, null, options);
+    if (userContext.user === CONSTS.SYSTEM_ADMIN_USER ||
+        userContext.group === CONSTS.SYSTEM_ADMIN_GROUP ||
+        userContext.groups?.includes(CONSTS.SYSTEM_ADMIN_GROUP)) {
+        return userContext;
     }
     // if user or group objects
     if (typeof id === 'string' && (id.startsWith(USER_STARTS_WITH) || id.startsWith(GROUP_STARTS_WITH))) {
         // If user may write
-        if (flag === CONSTS.ACCESS_WRITE && !options.acl.users.write) {
+        if (flag === CONSTS.ACCESS_WRITE && !userContext.acl.users.write) {
             // write
-            return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
+            throw new Error(ERRORS.ERROR_PERMISSION);
         }
         // If user may read
-        if (flag === CONSTS.ACCESS_READ && !options.acl.users.read) {
+        if (flag === CONSTS.ACCESS_READ && !userContext.acl.users.read) {
             // read
-            return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
+            throw new Error(ERRORS.ERROR_PERMISSION);
         }
         // If user may delete
-        if (flag === CONSTS.ACCESS_DELETE && !options.acl.users.delete) {
+        if (flag === CONSTS.ACCESS_DELETE && !userContext.acl.users.delete) {
             // delete
-            return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
+            throw new Error(ERRORS.ERROR_PERMISSION);
         }
         // If user may list
-        if (flag === CONSTS.ACCESS_LIST && !options.acl.users.list) {
+        if (flag === CONSTS.ACCESS_LIST && !userContext.acl.users.list) {
             // list
-            return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
+            throw new Error(ERRORS.ERROR_PERMISSION);
         }
         // If user may create
-        if (flag === CONSTS.ACCESS_CREATE && !options.acl.users.create) {
+        if (flag === CONSTS.ACCESS_CREATE && !userContext.acl.users.create) {
             // create
-            return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
+            throw new Error(ERRORS.ERROR_PERMISSION);
         }
         // If user may write
         if (flag === CONSTS.ACCESS_DELETE) {
@@ -487,32 +539,32 @@ export function checkObjectRights(objects, id, object, options, flag, callback)
         }
     }
     // If user may write
-    if (flag === CONSTS.ACCESS_WRITE && !options.acl.object.write) {
+    if (flag === CONSTS.ACCESS_WRITE && !userContext.acl.object.write) {
         // write
-        tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
+        throw new Error(ERRORS.ERROR_PERMISSION);
     }
     // If user may read
-    if (flag === CONSTS.ACCESS_READ && !options.acl.object.read) {
+    if (flag === CONSTS.ACCESS_READ && !userContext.acl.object.read) {
         // read
-        return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
+        throw new Error(ERRORS.ERROR_PERMISSION);
     }
     // If user may delete
-    if (flag === CONSTS.ACCESS_DELETE && !options.acl.object.delete) {
+    if (flag === CONSTS.ACCESS_DELETE && !userContext.acl.object.delete) {
         // delete
-        return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
+        throw new Error(ERRORS.ERROR_PERMISSION);
     }
     // If user may list
-    if (flag === CONSTS.ACCESS_LIST && !options.acl.object.list) {
+    if (flag === CONSTS.ACCESS_LIST && !userContext.acl.object.list) {
         // list
-        return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
+        throw new Error(ERRORS.ERROR_PERMISSION);
     }
     if (flag === CONSTS.ACCESS_DELETE) {
         // write
         flag = CONSTS.ACCESS_WRITE;
     }
-    if (id && !checkObject(object, options, flag)) {
-        return tools.maybeCallbackWithError(callback, ERRORS.ERROR_PERMISSION, options);
+    if (id && !checkObject(object, userContext, flag)) {
+        throw new Error(ERRORS.ERROR_PERMISSION);
     }
-    return tools.maybeCallbackWithError(callback, null, options);
+    return userContext;
 }
 //# sourceMappingURL=objectsUtils.js.map