@kalisio/kdk 1.3.5 → 1.4.2

package/lib/core/api/hooks/hooks.authorisations.js

@@ -3,10 +3,148 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.removeOrganisationTagsAuthorisations = undefined;
+exports.removeOrganisationTagsAuthorisations = exports.removeOrganisationGroupsAuthorisations = exports.authorise = undefined;
+
+let authorise = exports.authorise = (() => {
+  var _ref2 = _asyncToGenerator(function* (hook) {
+    if (hook.type !== 'before') {
+      throw new Error('The \'authorise\' hook should only be used as a \'before\' hook.');
+    }
+    const operation = hook.method;
+    const resourceType = hook.service.name;
+    debug('Provider is', hook.params.provider);
+    if (hook.params.user) debug('User is', hook.params.user);
+    debug('Operation is', operation);
+    if (resourceType) debug('Resource type is', resourceType);
+
+    // If called internally we skip authorisation
+    let checkAuthorisation = _lodash2.default.has(hook.params, 'provider');
+    debug('Access check ' + (checkAuthorisation ? 'enabled' : 'disabled') + ' for provider');
+    // If already checked we skip authorisation
+    if (hook.params.authorised) {
+      debug('Access already granted');
+      checkAuthorisation = false;
+    }
+    // We also skip authorisation for built-in Feathers services like authentication
+    if (typeof hook.service.getPath !== 'function') {
+      debug('Access disabled on built-in services');
+      checkAuthorisation = false;
+    }
+    // If explicitely asked to perform/skip, override defaults
+    if (_lodash2.default.has(hook.params, 'checkAuthorisation')) {
+      checkAuthorisation = _lodash2.default.get(hook.params, 'checkAuthorisation');
+      // Bypass authorisation for next hooks otherwise we will loop infinitely
+      delete hook.params.checkAuthorisation;
+      debug('Access check ' + (checkAuthorisation ? 'forced' : 'unforced'));
+    }
+
+    const context = hook.service.context;
+    if (checkAuthorisation) {
+      // Build ability for user
+      const authorisationService = hook.app.getService('authorisations');
+      const abilities = yield authorisationService.getAbilities(hook.params.user);
+      hook.params.abilities = abilities;
+      debug('User abilities are', abilities.rules);
+
+      // Check for access to service fisrt
+      if (!(0, _permissions.hasServiceAbilities)(abilities, hook.service)) {
+        debug('Service access not granted');
+        throw new _errors.Forbidden(`You are not allowed to access service ${hook.service.getPath()}`);
+      }
+
+      if (!hook.id) {
+        // In this specific case there is no query to be run,
+        // simply check against the object we'd like to create
+        if (operation === 'create') {
+          const resource = hook.data;
+          debug('Target resource is ', resource);
+          if (!(0, _permissions.hasResourceAbilities)(abilities, operation, resourceType, context, resource)) {
+            debug('Resource access not granted');
+            throw new _errors.Forbidden(`You are not allowed to perform ${operation} operation on ${resourceType}`);
+          }
+        } else {
+          // When we find/update/patch/remove multiple items this ensures that
+          // only the ones authorised by constraints on the resources will be fetched
+          // This avoid fetching all first then check it one by one
+          const dbQuery = (0, _db.objectifyIDs)((0, _permissions.getQueryForAbilities)(abilities, operation, resourceType));
+          if (dbQuery) {
+            hook.params.query = _lodash2.default.transform(hook.params.query, function (result, value, key) {
+              if (key === '$or') result.$and = [{ $or: value }];else result[key] = value;
+            }, {});
+            _lodash2.default.merge(hook.params.query, dbQuery);
+          } else {
+            hook.result = { total: 0, skip: 0, data: [] };
+          }
+        }
+        debug('Resource access granted');
+        // Some specific services might not expose a get function, in this case we cannot check for authorisation
+        // this has to be implemented by the service itself
+      } else if (typeof hook.service.get === 'function') {
+        // In this case (single get/update/patch/remove) we need to fetch the item first
+        const resource = yield hook.service.get(hook.id, Object.assign({ checkAuthorisation: false }, hook.params));
+        debug('Target resource is', resource);
+        // Then check against the object we'd like to manage
+        if (!(0, _permissions.hasResourceAbilities)(abilities, operation, resourceType, context, resource)) {
+          debug('Resource access not granted');
+          throw new _errors.Forbidden(`You are not allowed to perform ${operation} operation on ${resourceType}`);
+        }
+        // Avoid fetching again the object in this case
+        if (operation === 'get') {
+          hook.result = resource;
+        }
+        hook.params.authorised = true;
+        debug('Resource access granted');
+        return hook;
+      }
+    } else {
+      debug('Authorisation check skipped, access granted');
+    }
+
+    hook.params.authorised = true;
+    return hook;
+  });
+
+  return function authorise(_x2) {
+    return _ref2.apply(this, arguments);
+  };
+})();
+
+let removeOrganisationGroupsAuthorisations = exports.removeOrganisationGroupsAuthorisations = (() => {
+  var _ref5 = _asyncToGenerator(function* (hook) {
+    const app = hook.app;
+    const authorisationService = app.getService('authorisations');
+    const org = hook.params.resource;
+    const user = hook.params.user;
+    // Unset membership for the all org groups
+    const orgGroupService = app.getService('groups', org);
+    const groups = yield orgGroupService.find({ paginate: false });
+    yield Promise.all(groups.map(function (group) {
+      // Unset membership on group for the all org users
+      return authorisationService.remove(group._id.toString(), {
+        query: {
+          scope: 'groups'
+        },
+        user,
+        force: hook.params.force,
+        // Because we already have resource set it as objects to avoid populating
+        // Moreover used as an after hook the resource might not already exist anymore
+        subjects: hook.params.subjects,
+        subjectsService: hook.params.subjectsService,
+        resource: group,
+        resourcesService: orgGroupService
+      });
+    }));
+    debug('Authorisations unset on groups for organisation ' + org._id);
+    return hook;
+  });
+
+  return function removeOrganisationGroupsAuthorisations(_x5) {
+    return _ref5.apply(this, arguments);
+  };
+})();
 
 let removeOrganisationTagsAuthorisations = exports.removeOrganisationTagsAuthorisations = (() => {
-  var _ref4 = _asyncToGenerator(function* (hook) {
+  var _ref6 = _asyncToGenerator(function* (hook) {
     const app = hook.app;
     const org = hook.params.resource;
     const subjectService = hook.params.subjectsService;
@@ -33,8 +171,8 @@ let removeOrganisationTagsAuthorisations = exports.removeOrganisationTagsAuthori
     return hook;
   });
 
-  return function removeOrganisationTagsAuthorisations(_x4) {
-    return _ref4.apply(this, arguments);
+  return function removeOrganisationTagsAuthorisations(_x6) {
+    return _ref6.apply(this, arguments);
   };
 })();
 
@@ -44,10 +182,8 @@ exports.unpopulateSubjects = unpopulateSubjects;
 exports.populateResource = populateResource;
 exports.unpopulateResource = unpopulateResource;
 exports.preventEscalation = preventEscalation;
-exports.authorise = authorise;
 exports.updateAbilities = updateAbilities;
 exports.preventRemovingLastOwner = preventRemovingLastOwner;
-exports.removeOrganisationGroupsAuthorisations = removeOrganisationGroupsAuthorisations;
 
 var _lodash = require('lodash');
 
@@ -215,106 +351,9 @@ function preventEscalation(hook) {
   return hook;
 }
 
-function authorise(hook) {
-  if (hook.type !== 'before') {
-    throw new Error('The \'authorise\' hook should only be used as a \'before\' hook.');
-  }
-  const operation = hook.method;
-  const resourceType = hook.service.name;
-  debug('Provider is', hook.params.provider);
-  if (hook.params.user) debug('User is', hook.params.user);
-  debug('Operation is', operation);
-  if (resourceType) debug('Resource type is', resourceType);
-
-  // If called internally we skip authorisation
-  let checkAuthorisation = _lodash2.default.has(hook.params, 'provider');
-  debug('Access check ' + (checkAuthorisation ? 'enabled' : 'disabled') + ' for provider');
-  // If already checked we skip authorisation
-  if (hook.params.authorised) {
-    debug('Access already granted');
-    checkAuthorisation = false;
-  }
-  // We also skip authorisation for built-in Feathers services like authentication
-  if (typeof hook.service.getPath !== 'function') {
-    debug('Access disabled on built-in services');
-    checkAuthorisation = false;
-  }
-  // If explicitely asked to perform/skip, override defaults
-  if (_lodash2.default.has(hook.params, 'checkAuthorisation')) {
-    checkAuthorisation = _lodash2.default.get(hook.params, 'checkAuthorisation');
-    // Bypass authorisation for next hooks otherwise we will loop infinitely
-    delete hook.params.checkAuthorisation;
-    debug('Access check ' + (checkAuthorisation ? 'forced' : 'unforced'));
-  }
-
-  const context = hook.service.context;
-  if (checkAuthorisation) {
-    // Build ability for user
-    const authorisationService = hook.app.getService('authorisations');
-    const abilities = authorisationService.getAbilities(hook.params.user);
-    hook.params.abilities = abilities;
-    debug('User abilities are', abilities.rules);
-
-    // Check for access to service fisrt
-    if (!(0, _permissions.hasServiceAbilities)(abilities, hook.service)) {
-      debug('Service access not granted');
-      throw new _errors.Forbidden(`You are not allowed to access service ${hook.service.getPath()}`);
-    }
-
-    if (!hook.id) {
-      // In this specific case there is no query to be run,
-      // simply check against the object we'd like to create
-      if (operation === 'create') {
-        const resource = hook.data;
-        debug('Target resource is ', resource);
-        if (!(0, _permissions.hasResourceAbilities)(abilities, operation, resourceType, context, resource)) {
-          debug('Resource access not granted');
-          throw new _errors.Forbidden(`You are not allowed to perform ${operation} operation on ${resourceType}`);
-        }
-      } else {
-        // When we find/update/patch/remove multiple items this ensures that
-        // only the ones authorised by constraints on the resources will be fetched
-        // This avoid fetching all first then check it one by one
-        const dbQuery = (0, _db.objectifyIDs)((0, _permissions.getQueryForAbilities)(abilities, operation, resourceType));
-        if (dbQuery) {
-          debug('Target resource conditions are ', dbQuery);
-          _lodash2.default.merge(hook.params.query, dbQuery);
-        } else {
-          hook.result = { total: 0, skip: 0, data: [] };
-        }
-      }
-      debug('Resource access granted');
-      // Some specific services might not expose a get function, in this case we cannot check for authorisation
-      // this has to be implemented by the service itself
-    } else if (typeof hook.service.get === 'function') {
-      // In this case (single get/update/patch/remove) we need to fetch the item first
-      return hook.service.get(hook.id, Object.assign({ checkAuthorisation: false }, hook.params)).then(resource => {
-        debug('Target resource is', resource);
-        // Then check against the object we'd like to manage
-        if (!(0, _permissions.hasResourceAbilities)(abilities, operation, resourceType, context, resource)) {
-          debug('Resource access not granted');
-          throw new _errors.Forbidden(`You are not allowed to perform ${operation} operation on ${resourceType}`);
-        }
-        // Avoid fetching again the object in this case
-        if (operation === 'get') {
-          hook.result = resource;
-        }
-        hook.params.authorised = true;
-        debug('Resource access granted');
-        return hook;
-      });
-    }
-  } else {
-    debug('Authorisation check skipped, access granted');
-  }
-
-  hook.params.authorised = true;
-  return Promise.resolve(hook);
-}
-
 function updateAbilities(options = {}) {
   return (() => {
-    var _ref2 = _asyncToGenerator(function* (hook) {
+    var _ref3 = _asyncToGenerator(function* (hook) {
       const app = hook.app;
       const params = hook.params;
       const authorisationService = app.getService('authorisations');
@@ -324,20 +363,20 @@ function updateAbilities(options = {}) {
       if (options.fetchSubject) {
         subject = yield hook.service.get(subject._id.toString());
       }
-      const abilities = authorisationService.updateAbilities(subject);
+      const abilities = yield authorisationService.updateAbilities(subject);
       debug('Abilities updated on subject', subject, abilities.rules);
       return hook;
     });
 
-    return function (_x2) {
-      return _ref2.apply(this, arguments);
+    return function (_x3) {
+      return _ref3.apply(this, arguments);
     };
   })();
 }
 
 function preventRemovingLastOwner(resourceScope) {
   return (() => {
-    var _ref3 = _asyncToGenerator(function* (hook) {
+    var _ref4 = _asyncToGenerator(function* (hook) {
       // By pass check ?
       if (hook.params.force) return hook;
       const params = hook.params;
@@ -376,39 +415,9 @@ function preventRemovingLastOwner(resourceScope) {
       return hook;
     });
 
-    return function (_x3) {
-      return _ref3.apply(this, arguments);
+    return function (_x4) {
+      return _ref4.apply(this, arguments);
     };
   })();
 }
-
-function removeOrganisationGroupsAuthorisations(hook) {
-  const app = hook.app;
-  const authorisationService = app.getService('authorisations');
-  const org = hook.params.resource;
-  const user = hook.params.user;
-  // Unset membership for the all org groups
-  const orgGroupService = app.getService('groups', org);
-  return orgGroupService.find({ paginate: false }).then(groups => {
-    return Promise.all(groups.map(group => {
-      // Unset membership on group for the all org users
-      return authorisationService.remove(group._id.toString(), {
-        query: {
-          scope: 'groups'
-        },
-        user,
-        force: hook.params.force,
-        // Because we already have resource set it as objects to avoid populating
-        // Moreover used as an after hook the resource might not already exist anymore
-        subjects: hook.params.subjects,
-        subjectsService: hook.params.subjectsService,
-        resource: group,
-        resourcesService: orgGroupService
-      });
-    }));
-  }).then(groups => {
-    debug('Authorisations unset on groups for organisation ' + org._id);
-    return hook;
-  });
-}
 //# sourceMappingURL=hooks.authorisations.js.map

package/lib/core/api/hooks/hooks.authorisations.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../core/api/hooks/hooks.authorisations.js"],"names":["hook","app","org","params","resource","subjectService","subjectsService","orgTagsService","getService","subjects","length","orgTags","find","paginate","promises","forEach","tags","subject","fromOrg","_","intersectionWith","isTagEqual","notFromOrg","differenceWith","push","patch","_id","toString","devices","Promise","all","debug","removeOrganisationTagsAuthorisations","createJWT","populateSubjects","unpopulateSubjects","populateResource","unpopulateResource","preventEscalation","authorise","updateAbilities","preventRemovingLastOwner","removeOrganisationGroupsAuthorisations","options","defaults","get","user","items","isArray","Array","accessTokens","map","passport","payload","merge","jwt","item","index","set","name","type","Error","serviceField","idField","throwOnNotFound","checkEscalation","has","data","query","scopeName","scope","permissions","undefined","role","Roles","isUndefined","Forbidden","filter","subjectScope","subjectResource","subjectPermissions","subjectRole","hasRole","method","authorisationRole","operation","resourceType","service","provider","checkAuthorisation","authorised","getPath","context","authorisationService","abilities","getAbilities","rules","id","dbQuery","result","total","skip","Object","assign","then","resolve","subjectAsItem","fetchSubject","resourceScope","force","grantedPermissions","grantedRole","owner","owners","removedOwners","reduce","count","resources","ownedResource","RoleNames","resourceName","translation","key","orgGroupService","groups","group","remove","resourcesService"],"mappings":";;;;;;;;gCA0UO,WAAqDA,IAArD,EAA2D;AAChE,UAAMC,MAAMD,KAAKC,GAAjB;AACA,UAAMC,MAAMF,KAAKG,MAAL,CAAYC,QAAxB;AACA,UAAMC,iBAAiBL,KAAKG,MAAL,CAAYG,eAAnC;AACA,UAAMC,iBAAiBN,IAAIO,UAAJ,CAAe,MAAf,EAAuBN,GAAvB,CAAvB;AACA,UAAMO,WAAWT,KAAKG,MAAL,CAAYM,QAAZ,IAAwB,EAAzC;AACA,QAAIA,SAASC,MAAT,KAAoB,CAAxB,EAA2B,OAAOV,IAAP;AAC3B;AACA,UAAMW,UAAU,MAAMJ,eAAeK,IAAf,CAAoB,EAAEC,UAAU,KAAZ,EAApB,CAAtB;AACA,UAAMC,WAAW,EAAjB;AACAL,aAASM,OAAT,CAAiB,mBAAW;AAC1B,YAAMC,OAAOC,QAAQD,IAAR,IAAgB,EAA7B;AACA;AACA,YAAME,UAAUC,iBAAEC,gBAAF,CAAmBJ,IAAnB,EAAyBL,OAAzB,EAAkCU,kBAAlC,CAAhB;AACA;AACA,YAAMC,aAAaH,iBAAEI,cAAF,CAAiBP,IAAjB,EAAuBL,OAAvB,EAAgCU,kBAAhC,CAAnB;AACA;AACA,UAAIH,QAAQR,MAAR,GAAiB,CAArB,EAAwB;AACtBI,iBAASU,IAAT,CAAcnB,eAAeoB,KAAf,CAAqBR,QAAQS,GAAR,CAAYC,QAAZ,EAArB,EAA6C,EAAEX,MAAMM,UAAR,EAAoBM,SAASX,QAAQW,OAArC,EAA7C,CAAd;AACD;AACF,KAVD;AAWA;AACA,UAAMC,QAAQC,GAAR,CAAYhB,QAAZ,CAAN;AACAiB,UAAO,iBAAgBjB,SAASJ,MAAO,6BAAjC,GAAgER,IAAIwB,GAA1E;AACA,WAAO1B,IAAP;AACD,G;;kBAzBqBgC,oC;;;;;QA/TNC,S,GAAAA,S;QAsBAC,gB,GAAAA,gB;QAQAC,kB,GAAAA,kB;QAQAC,gB,GAAAA,gB;QAQAC,kB,GAAAA,kB;QAQAC,iB,GAAAA,iB;QA6EAC,S,GAAAA,S;QAkGAC,e,GAAAA,e;QAiBAC,wB,GAAAA,wB;QAyCAC,sC,GAAAA,sC;;AA1ShB;;;;AACA;;;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;;;;;AAEA,MAAMX,QAAQ,qBAAU,+BAAV,CAAd;;AAEO,SAASE,SAAT,CAAoBU,UAAU,EAA9B,EAAkC;AACvC;AAAA,iCAAO,WAAgB3C,IAAhB,EAAsB;AAC3B,YAAM4C,WAAW5C,KAAKC,GAAL,CAAS4C,GAAT,CAAa,gBAAb,KAAkC7C,KAAKC,GAAL,CAAS4C,GAAT,CAAa,MAAb,CAAnD;AACA,YAAMC,OAAO3B,iBAAE0B,GAAF,CAAM7C,IAAN,EAAY,aAAZ,CAAb;AACA,UAAI+C,QAAQ,mCAAS/C,IAAT,CAAZ;AACA,YAAMgD,UAAUC,MAAMD,OAAN,CAAcD,KAAd,CAAhB;AACAA,cAASC,UAAUD,KAAV,GAAkB,CAACA,KAAD,CAA3B;AACA;AACA,YAAMG,eAAe,MAAMrB,QAAQC,GAAR,CAAYiB,MAAMI,GAAN,CAAU;AAAA,eAAQnD,KAAKC,GAAL,CAASmD,QAAT,CAAkBnB,SAAlB;AACvD;AACC,eAAOU,QAAQU,OAAf,KAA2B,UAA3B,GAAwCV,QAAQU,OAAR,CAAgBP,IAAhB,CAAxC,GAAgE,EAFV;AAGvD;AACA;AACA3B,yBAAEmC,KAAF,CAAQ,EAAR,EAAYV,QAAZ,EAAuB,OAAOD,QAAQY,GAAf,KAAuB,UAAvB,GAAoC,EAAEA,KAAKZ,QAAQY,GAAR,CAAYT,IAAZ,CAAP,EAApC,GAAiEH,OAAxF,CALuD,CAAR;AAAA,OAAV,CAAZ,CAA3B;AAOA;AACAI,YAAMhC,OAAN,CAAc,UAACyC,IAAD,EAAOC,KAAP;AAAA,eAAiBtC,iBAAEuC,GAAF,CAAMF,IAAN,EAAYb,QAAQgB,IAAR,IAAgB,aAA5B,EAA2CT,aAAaO,KAAb,CAA3C,CAAjB;AAAA,OAAd;AACA,6CAAazD,IAAb,EAAmBgD,UAAUD,KAAV,GAAkBA,MAAM,CAAN,CAArC;AACA,aAAO/C,IAAP;AACD,KAlBD;;AAAA;AAAA;AAAA;AAAA;AAmBD;;AAEM,SAASkC,gBAAT,CAA2BlC,IAA3B,EAAiC;AACtC,MAAIA,KAAK4D,IAAL,KAAc,QAAlB,EAA4B;AAC1B,UAAM,IAAIC,KAAJ,CAAU,yEAAV,CAAN;AACD;;AAED,SAAO,4BAAgB,EAAEC,cAAc,iBAAhB,EAAmCC,SAAS,UAA5C,EAAwDC,iBAAiB,IAAzE,EAAhB,EAAiGhE,IAAjG,CAAP;AACD;;AAEM,SAASmC,kBAAT,CAA6BnC,IAA7B,EAAmC;AACxC,MAAIA,KAAK4D,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,0EAAV,CAAN;AACD;;AAED,SAAO,8BAAkB,EAAEC,cAAc,iBAAhB,EAAmCC,SAAS,UAA5C,EAAlB,EAA4E/D,IAA5E,CAAP;AACD;;AAEM,SAASoC,gBAAT,CAA2BpC,IAA3B,EAAiC;AACtC,MAAIA,KAAK4D,IAAL,KAAc,QAAlB,EAA4B;AAC1B,UAAM,IAAIC,KAAJ,CAAU,yEAAV,CAAN;AACD;;AAED,SAAO,2BAAe,EAAEC,cAAc,kBAAhB,EAAoCC,SAAS,UAA7C,EAAyDC,iBAAiB,IAA1E,EAAf,EAAiGhE,IAAjG,CAAP;AACD;;AAEM,SAASqC,kBAAT,CAA6BrC,IAA7B,EAAmC;AACxC,MAAIA,KAAK4D,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,0EAAV,CAAN;AACD;;AAED,SAAO,6BAAiB,EAAEC,cAAc,kBAAhB,EAAoCC,SAAS,UAA7C,EAAjB,EAA4E/D,IAA5E,CAAP;AACD;;AAEM,SAASsC,iBAAT,CAA4BtC,IAA5B,EAAkC;AACvC,MAAIA,KAAK4D,IAAL,KAAc,QAAlB,EAA4B;AAC1B,UAAM,IAAIC,KAAJ,CAAU,0EAAV,CAAN;AACD;;AAED,QAAM1D,SAASH,KAAKG,MAApB;AACA;AACA,MAAI8D,kBAAkB9C,iBAAE+C,GAAF,CAAM/D,MAAN,EAAc,UAAd,CAAtB;AACA4B,QAAM,uBAAuBkC,kBAAkB,SAAlB,GAA8B,UAArD,IAAmE,eAAzE;AACA;AACA,MAAI9C,iBAAE+C,GAAF,CAAM/D,MAAN,EAAc,iBAAd,CAAJ,EAAsC;AACpC8D,sBAAkB9D,OAAO8D,eAAzB;AACAlC,UAAM,uBAAuBkC,kBAAkB,QAAlB,GAA6B,UAApD,CAAN;AACD;;AAED,MAAIA,eAAJ,EAAqB;AACnB,UAAMnB,OAAO3C,OAAO2C,IAApB;AACA;AACA,UAAMqB,OAAOnE,KAAKmE,IAAL,IAAa,EAA1B;AACA;AACA,UAAMC,QAAQjE,OAAOiE,KAAP,IAAgB,EAA9B;AACA,UAAMC,YAAYF,KAAKG,KAAL,IAAcF,MAAME,KAAtC,CANmB,CAMyB;AAC5C;AACA,UAAMA,QAAQnD,iBAAE0B,GAAF,CAAMC,IAAN,EAAYuB,SAAZ,EAAuB,EAAvB,CAAd;AACA;AACA,UAAMjE,WAAWe,iBAAEP,IAAF,CAAO0D,KAAP,EAAclE,YAAYA,SAASsB,GAAT,IAAiBtB,SAASsB,GAAT,CAAaC,QAAb,OAA4BxB,OAAOC,QAAP,CAAgBsB,GAAhB,CAAoBC,QAApB,EAAvE,CAAjB;AACA;AACA,UAAM4C,cAAenE,WAAWA,SAASmE,WAApB,GAAkCC,SAAvD;AACA,UAAMC,OAAQF,cAAcG,mBAAMH,WAAN,CAAd,GAAmCC,SAAjD;AACA,QAAIrD,iBAAEwD,WAAF,CAAcF,IAAd,CAAJ,EAAyB;AACvB1C,YAAM,wDAAwDsC,SAA9D;AACA,YAAM,IAAIO,iBAAJ,CAAc,yDAAd,CAAN;AACD;;AAED;;AAEA;AACA;AACA;AACA;AACA;AACA,UAAMnE,WAAWN,OAAOM,QAAP,CAAgBoE,MAAhB,CAAuB5D,WAAW;AACjD,YAAM6D,eAAe3D,iBAAE0B,GAAF,CAAM5B,OAAN,EAAeoD,SAAf,EAA0B,EAA1B,CAArB;AACA,YAAMU,kBAAkB5D,iBAAEP,IAAF,CAAOkE,YAAP,EAAqB1E,YAAYA,SAASsB,GAAT,IAAiBtB,SAASsB,GAAT,CAAaC,QAAb,OAA4BxB,OAAOC,QAAP,CAAgBsB,GAAhB,CAAoBC,QAApB,EAA9E,CAAxB;AACA,YAAMqD,qBAAsBD,kBAAkBA,gBAAgBR,WAAlC,GAAgDC,SAA5E;AACA,YAAMS,cAAeD,qBAAqBN,mBAAMM,kBAAN,CAArB,GAAiDR,SAAtE;AACA,YAAMU,UAAU,CAAC/D,iBAAEwD,WAAF,CAAcM,WAAd,CAAjB;AACA,UAAIjF,KAAKmF,MAAL,KAAgB,QAApB,EAA8B;AAC5B,eAAQ,CAACD,OAAD,IAAaD,eAAeR,IAApC,CAD4B,CACe;AAC5C,OAFD,MAEO;AACL,eAAQS,WAAYD,eAAeR,IAAnC,CADK,CACqC;AAC3C;AACF,KAXgB,CAAjB;AAYA,QAAIhE,SAASC,MAAT,GAAkBP,OAAOM,QAAP,CAAgBC,MAAtC,EAA8C;AAC5CqB,YAAO,GAAG5B,OAAOM,QAAP,CAAgBC,MAAhB,GAAyBD,SAASC,MAAQ,2DAA0D2D,SAAU,EAAxH;AACA,YAAM,IAAIO,iBAAJ,CAAc,2DAAd,CAAN;AACD;AACD;AACA;AACA;AACA,QAAIQ,iBAAJ;AACA,QAAIjB,KAAKI,WAAT,EAAsB;AACpBa,0BAAoBV,mBAAMP,KAAKI,WAAX,CAApB;AACD,KAFD,MAEO,IAAIH,MAAMG,WAAV,EAAuB;AAC5Ba,0BAAoBV,mBAAMN,MAAMG,WAAZ,CAApB;AACD;AACD,QAAI,CAACpD,iBAAEwD,WAAF,CAAcS,iBAAd,CAAL,EAAuC;AACrC,UAAIA,oBAAoBX,IAAxB,EAA8B;AAC5B1C,cAAM,6DAA6DsC,SAAnE;AACA,cAAM,IAAIO,iBAAJ,CAAc,yDAAd,CAAN;AACD;AACF;AACF;;AAED,SAAO5E,IAAP;AACD;;AAEM,SAASuC,SAAT,CAAoBvC,IAApB,EAA0B;AAC/B,MAAIA,KAAK4D,IAAL,KAAc,QAAlB,EAA4B;AAC1B,UAAM,IAAIC,KAAJ,CAAU,kEAAV,CAAN;AACD;AACD,QAAMwB,YAAYrF,KAAKmF,MAAvB;AACA,QAAMG,eAAetF,KAAKuF,OAAL,CAAa5B,IAAlC;AACA5B,QAAM,aAAN,EAAqB/B,KAAKG,MAAL,CAAYqF,QAAjC;AACA,MAAIxF,KAAKG,MAAL,CAAY2C,IAAhB,EAAsBf,MAAM,SAAN,EAAiB/B,KAAKG,MAAL,CAAY2C,IAA7B;AACtBf,QAAM,cAAN,EAAsBsD,SAAtB;AACA,MAAIC,YAAJ,EAAkBvD,MAAM,kBAAN,EAA0BuD,YAA1B;;AAElB;AACA,MAAIG,qBAAqBtE,iBAAE+C,GAAF,CAAMlE,KAAKG,MAAX,EAAmB,UAAnB,CAAzB;AACA4B,QAAM,mBAAmB0D,qBAAqB,SAArB,GAAiC,UAApD,IAAkE,eAAxE;AACA;AACA,MAAIzF,KAAKG,MAAL,CAAYuF,UAAhB,EAA4B;AAC1B3D,UAAM,wBAAN;AACA0D,yBAAqB,KAArB;AACD;AACD;AACA,MAAI,OAAOzF,KAAKuF,OAAL,CAAaI,OAApB,KAAgC,UAApC,EAAgD;AAC9C5D,UAAM,sCAAN;AACA0D,yBAAqB,KAArB;AACD;AACD;AACA,MAAItE,iBAAE+C,GAAF,CAAMlE,KAAKG,MAAX,EAAmB,oBAAnB,CAAJ,EAA8C;AAC5CsF,yBAAqBtE,iBAAE0B,GAAF,CAAM7C,KAAKG,MAAX,EAAmB,oBAAnB,CAArB;AACA;AACA,WAAOH,KAAKG,MAAL,CAAYsF,kBAAnB;AACA1D,UAAM,mBAAmB0D,qBAAqB,QAArB,GAAgC,UAAnD,CAAN;AACD;;AAED,QAAMG,UAAU5F,KAAKuF,OAAL,CAAaK,OAA7B;AACA,MAAIH,kBAAJ,EAAwB;AACtB;AACA,UAAMI,uBAAuB7F,KAAKC,GAAL,CAASO,UAAT,CAAoB,gBAApB,CAA7B;AACA,UAAMsF,YAAYD,qBAAqBE,YAArB,CAAkC/F,KAAKG,MAAL,CAAY2C,IAA9C,CAAlB;AACA9C,SAAKG,MAAL,CAAY2F,SAAZ,GAAwBA,SAAxB;AACA/D,UAAM,oBAAN,EAA4B+D,UAAUE,KAAtC;;AAEA;AACA,QAAI,CAAC,sCAAoBF,SAApB,EAA+B9F,KAAKuF,OAApC,CAAL,EAAmD;AACjDxD,YAAM,4BAAN;AACA,YAAM,IAAI6C,iBAAJ,CAAe,yCAAwC5E,KAAKuF,OAAL,CAAaI,OAAb,EAAuB,EAA9E,CAAN;AACD;;AAED,QAAI,CAAC3F,KAAKiG,EAAV,EAAc;AACZ;AACA;AACA,UAAIZ,cAAc,QAAlB,EAA4B;AAC1B,cAAMjF,WAAWJ,KAAKmE,IAAtB;AACApC,cAAM,qBAAN,EAA6B3B,QAA7B;AACA,YAAI,CAAC,uCAAqB0F,SAArB,EAAgCT,SAAhC,EAA2CC,YAA3C,EAAyDM,OAAzD,EAAkExF,QAAlE,CAAL,EAAkF;AAChF2B,gBAAM,6BAAN;AACA,gBAAM,IAAI6C,iBAAJ,CAAe,kCAAiCS,SAAU,iBAAgBC,YAAa,EAAvF,CAAN;AACD;AACF,OAPD,MAOO;AACL;AACA;AACA;AACA,cAAMY,UAAU,sBAAa,uCAAqBJ,SAArB,EAAgCT,SAAhC,EAA2CC,YAA3C,CAAb,CAAhB;AACA,YAAIY,OAAJ,EAAa;AACXnE,gBAAM,iCAAN,EAAyCmE,OAAzC;AACA/E,2BAAEmC,KAAF,CAAQtD,KAAKG,MAAL,CAAYiE,KAApB,EAA2B8B,OAA3B;AACD,SAHD,MAGO;AACLlG,eAAKmG,MAAL,GAAc,EAAEC,OAAO,CAAT,EAAYC,MAAM,CAAlB,EAAqBlC,MAAM,EAA3B,EAAd;AACD;AACF;AACDpC,YAAM,yBAAN;AACF;AACA;AACC,KAzBD,MAyBO,IAAI,OAAO/B,KAAKuF,OAAL,CAAa1C,GAApB,KAA4B,UAAhC,EAA4C;AACjD;AACA,aAAO7C,KAAKuF,OAAL,CAAa1C,GAAb,CAAiB7C,KAAKiG,EAAtB,EAA0BK,OAAOC,MAAP,CAAc,EAAEd,oBAAoB,KAAtB,EAAd,EAA6CzF,KAAKG,MAAlD,CAA1B,EACJqG,IADI,CACCpG,YAAY;AAChB2B,cAAM,oBAAN,EAA4B3B,QAA5B;AACA;AACA,YAAI,CAAC,uCAAqB0F,SAArB,EAAgCT,SAAhC,EAA2CC,YAA3C,EAAyDM,OAAzD,EAAkExF,QAAlE,CAAL,EAAkF;AAChF2B,gBAAM,6BAAN;AACA,gBAAM,IAAI6C,iBAAJ,CAAe,kCAAiCS,SAAU,iBAAgBC,YAAa,EAAvF,CAAN;AACD;AACD;AACA,YAAID,cAAc,KAAlB,EAAyB;AACvBrF,eAAKmG,MAAL,GAAc/F,QAAd;AACD;AACDJ,aAAKG,MAAL,CAAYuF,UAAZ,GAAyB,IAAzB;AACA3D,cAAM,yBAAN;AACA,eAAO/B,IAAP;AACD,OAfI,CAAP;AAgBD;AACF,GAzDD,MAyDO;AACL+B,UAAM,6CAAN;AACD;;AAED/B,OAAKG,MAAL,CAAYuF,UAAZ,GAAyB,IAAzB;AACA,SAAO7D,QAAQ4E,OAAR,CAAgBzG,IAAhB,CAAP;AACD;;AAEM,SAASwC,eAAT,CAA0BG,UAAU,EAApC,EAAwC;AAC7C;AAAA,kCAAO,WAAgB3C,IAAhB,EAAsB;AAC3B,YAAMC,MAAMD,KAAKC,GAAjB;AACA,YAAME,SAASH,KAAKG,MAApB;AACA,YAAM0F,uBAAuB5F,IAAIO,UAAJ,CAAe,gBAAf,CAA7B;AACA,UAAIS,UAAW0B,QAAQ+D,aAAR,GAAwB,mCAAS1G,IAAT,CAAxB,GAAyCG,OAAO2C,IAA/D;AACA;AACA;AACA,UAAIH,QAAQgE,YAAZ,EAA0B;AACxB1F,kBAAU,MAAMjB,KAAKuF,OAAL,CAAa1C,GAAb,CAAiB5B,QAAQS,GAAR,CAAYC,QAAZ,EAAjB,CAAhB;AACD;AACD,YAAMmE,YAAYD,qBAAqBrD,eAArB,CAAqCvB,OAArC,CAAlB;AACAc,YAAM,8BAAN,EAAsCd,OAAtC,EAA+C6E,UAAUE,KAAzD;AACA,aAAOhG,IAAP;AACD,KAbD;;AAAA;AAAA;AAAA;AAAA;AAcD;;AAEM,SAASyC,wBAAT,CAAmCmE,aAAnC,EAAkD;AACvD;AAAA,kCAAO,WAAgB5G,IAAhB,EAAsB;AAC3B;AACA,UAAIA,KAAKG,MAAL,CAAY0G,KAAhB,EAAuB,OAAO7G,IAAP;AACvB,YAAMG,SAASH,KAAKG,MAApB;AACA,YAAMgE,OAAOnE,KAAKmE,IAAL,IAAa,EAA1B;AACA,YAAMC,QAAQjE,OAAOiE,KAAP,IAAgB,EAA9B;AACA,YAAME,QAAQH,KAAKG,KAAL,IAAcF,MAAME,KAAlC;AACA,YAAMwC,qBAAqB3C,KAAKI,WAAL,IAAoBH,MAAMG,WAArD;AACA,YAAMwC,cAAeD,qBAAqBpC,mBAAMoC,kBAAN,CAArB,GAAiDtC,SAAtE;AACA,YAAMpE,WAAWJ,KAAKG,MAAL,CAAYC,QAA7B;AACA,YAAMK,WAAWT,KAAKG,MAAL,CAAYM,QAA7B;AACA,YAAMJ,iBAAiBL,KAAKG,MAAL,CAAYG,eAAnC;AACA;AACA,UAAI,CAACa,iBAAEwD,WAAF,CAAcoC,WAAd,CAAD,IAAgCA,gBAAgBrC,mBAAMsC,KAA1D,EAAkE,OAAOhH,IAAP;;AAElE,UAAKsE,UAAUsC,aAAX,IAA6BxG,QAA7B,IAAyCA,SAASsB,GAAtD,EAA2D;AACzD;AACA,cAAMuF,SAAS,MAAM,2CAAyB5G,cAAzB,EAAyCuG,aAAzC,EAAwDxG,SAASsB,GAAjE,EAAsEgD,mBAAMsC,KAA5E,CAArB;AACA;AACA,cAAME,gBAAgBzG,SAAS0G,MAAT,CAAgB,UAACC,KAAD,EAAQnG,OAAR,EAAoB;AACxD,gBAAMoG,YAAYlG,iBAAE0B,GAAF,CAAM5B,OAAN,EAAe2F,aAAf,EAA8B,EAA9B,CAAlB;AACA,gBAAMU,gBAAgBnG,iBAAEP,IAAF,CAAOyG,SAAP,EAAkB,EAAE3F,KAAKtB,SAASsB,GAAhB,EAAqB6C,aAAagD,uBAAU7C,mBAAMsC,KAAhB,CAAlC,EAAlB,CAAtB;AACA,iBAAQM,gBAAgBF,QAAQ,CAAxB,GAA4BA,KAApC;AACD,SAJqB,EAInB,CAJmB,CAAtB;AAKA;AACA,YAAIF,iBAAiBD,OAAOb,KAA5B,EAAmC;AACjCrE,gBAAM,2CAAN,EAAmD3B,QAAnD;AACA,gBAAMoH,eAAepH,SAASuD,IAAT,GAAgBvD,SAASuD,IAAzB,GAAgCvD,SAASsB,GAAT,CAAaC,QAAb,EAArD;AACA,gBAAM,IAAIiD,iBAAJ,CAAc,8DAA8D4C,YAA5E,EAA0F;AAC9FC,yBAAa;AACXC,mBAAK,0BADM;AAEXvH,sBAAQ,EAAEC,UAAUoH,YAAZ;AAFG;AADiF,WAA1F,CAAN;AAMD;AACF;AACD,aAAOxH,IAAP;AACD,KArCD;;AAAA;AAAA;AAAA;AAAA;AAsCD;;AAEM,SAAS0C,sCAAT,CAAiD1C,IAAjD,EAAuD;AAC5D,QAAMC,MAAMD,KAAKC,GAAjB;AACA,QAAM4F,uBAAuB5F,IAAIO,UAAJ,CAAe,gBAAf,CAA7B;AACA,QAAMN,MAAMF,KAAKG,MAAL,CAAYC,QAAxB;AACA,QAAM0C,OAAO9C,KAAKG,MAAL,CAAY2C,IAAzB;AACA;AACA,QAAM6E,kBAAkB1H,IAAIO,UAAJ,CAAe,QAAf,EAAyBN,GAAzB,CAAxB;AACA,SAAOyH,gBAAgB/G,IAAhB,CAAqB,EAAEC,UAAU,KAAZ,EAArB,EACJ2F,IADI,CACCoB,UAAU;AACd,WAAO/F,QAAQC,GAAR,CAAY8F,OAAOzE,GAAP,CAAW0E,SAAS;AACvC;AACE,aAAOhC,qBAAqBiC,MAArB,CAA4BD,MAAMnG,GAAN,CAAUC,QAAV,EAA5B,EAAkD;AACvDyC,eAAO;AACLE,iBAAO;AADF,SADgD;AAIvDxB,YAJuD;AAKvD+D,eAAO7G,KAAKG,MAAL,CAAY0G,KALoC;AAMvD;AACA;AACApG,kBAAUT,KAAKG,MAAL,CAAYM,QARiC;AASvDH,yBAAiBN,KAAKG,MAAL,CAAYG,eAT0B;AAUvDF,kBAAUyH,KAV6C;AAWvDE,0BAAkBJ;AAXqC,OAAlD,CAAP;AAaD,KAfkB,CAAZ,CAAP;AAgBD,GAlBI,EAmBJnB,IAnBI,CAmBCoB,UAAU;AACd7F,UAAM,qDAAqD7B,IAAIwB,GAA/D;AACA,WAAO1B,IAAP;AACD,GAtBI,CAAP;AAuBD","file":"hooks.authorisations.js","sourcesContent":["import _ from 'lodash'\r\nimport makeDebug from 'debug'\r\nimport { getItems, replaceItems } from 'feathers-hooks-common'\r\nimport { Forbidden } from '@feathersjs/errors'\r\nimport { populateObject, unpopulateObject, populateObjects, unpopulateObjects } from './hooks.query'\r\nimport { objectifyIDs } from '../db'\r\nimport { hasServiceAbilities, hasResourceAbilities, getQueryForAbilities, Roles, RoleNames, countSubjectsForResource } from '../../common/permissions'\r\nimport { isTagEqual } from './hooks.tags'\r\n\r\nconst debug = makeDebug('kdk:core:authorisations:hooks')\r\n\r\nexport function createJWT (options = {}) {\r\n  return async function (hook) {\r\n    const defaults = hook.app.get('authentication') || hook.app.get('auth')\r\n    const user = _.get(hook, 'params.user')\r\n    let items = getItems(hook)\r\n    const isArray = Array.isArray(items)\r\n    items = (isArray ? items : [items])\r\n    // Generate access tokens for all items\r\n    const accessTokens = await Promise.all(items.map(item => hook.app.passport.createJWT(\r\n      // Provided function can be used to pick or omit properties in JWT payload\r\n      (typeof options.payload === 'function' ? options.payload(user) : {}),\r\n      // Provided function can be used for custom options cdepending on the user,\r\n      // then we merge with default auth options for global properties like aud, iss, etc.\r\n      _.merge({}, defaults, (typeof options.jwt === 'function' ? { jwt: options.jwt(user) } : options)))\r\n    ))\r\n    // Store access token on items\r\n    items.forEach((item, index) => _.set(item, options.name || 'accessToken', accessTokens[index]))\r\n    replaceItems(hook, isArray ? items : items[0])\r\n    return hook\r\n  }\r\n}\r\n\r\nexport function populateSubjects (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'populateSubjects\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n\r\n  return populateObjects({ serviceField: 'subjectsService', idField: 'subjects', throwOnNotFound: true })(hook)\r\n}\r\n\r\nexport function unpopulateSubjects (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'unpopulateSubjects\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  return unpopulateObjects({ serviceField: 'subjectsService', idField: 'subjects' })(hook)\r\n}\r\n\r\nexport function populateResource (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'populateResource\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n\r\n  return populateObject({ serviceField: 'resourcesService', idField: 'resource', throwOnNotFound: true })(hook)\r\n}\r\n\r\nexport function unpopulateResource (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'unpopulateResource\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  return unpopulateObject({ serviceField: 'resourcesService', idField: 'resource' })(hook)\r\n}\r\n\r\nexport function preventEscalation (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'preventEscalation\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n\r\n  const params = hook.params\r\n  // If called internally we skip authorisation\r\n  let checkEscalation = _.has(params, 'provider')\r\n  debug('Escalation check ' + (checkEscalation ? 'enabled' : 'disabled') + ' for provider')\r\n  // If explicitely asked to perform/skip, override defaults\r\n  if (_.has(params, 'checkEscalation')) {\r\n    checkEscalation = params.checkEscalation\r\n    debug('Escalation check ' + (checkEscalation ? 'forced' : 'unforced'))\r\n  }\r\n\r\n  if (checkEscalation) {\r\n    const user = params.user\r\n    // Make hook usable on remove as well\r\n    const data = hook.data || {}\r\n    // Make hook usable with query params as well\r\n    const query = params.query || {}\r\n    const scopeName = data.scope || query.scope // Get scope name first\r\n    // Retrieve the right scope on the user\r\n    const scope = _.get(user, scopeName, [])\r\n    // Then the target resource\r\n    const resource = _.find(scope, resource => resource._id && (resource._id.toString() === params.resource._id.toString()))\r\n    // Then user permission level\r\n    const permissions = (resource ? resource.permissions : undefined)\r\n    const role = (permissions ? Roles[permissions] : undefined)\r\n    if (_.isUndefined(role)) {\r\n      debug('Role for authorisation not found on user for scope ' + scopeName)\r\n      throw new Forbidden('You are not allowed to change authorisation on resource')\r\n    }\r\n\r\n    // Check if privilege escalation might occur, if so clamp to user permission level\r\n\r\n    // Input subjects need to be checked:\r\n    // - on create you should not be able to change permissions on others having higher permissions than yourself\r\n    // (e.g. cannot change a owner into a manager when you are a manager)\r\n    // - on remove you should not be able to remove permissions on others having higher permissions than yourself\r\n    // (e.g. cannot remove a owner when you are a manager)\r\n    const subjects = params.subjects.filter(subject => {\r\n      const subjectScope = _.get(subject, scopeName, [])\r\n      const subjectResource = _.find(subjectScope, resource => resource._id && (resource._id.toString() === params.resource._id.toString()))\r\n      const subjectPermissions = (subjectResource ? subjectResource.permissions : undefined)\r\n      const subjectRole = (subjectPermissions ? Roles[subjectPermissions] : undefined)\r\n      const hasRole = !_.isUndefined(subjectRole)\r\n      if (hook.method === 'create') {\r\n        return (!hasRole || (subjectRole <= role)) // The first time no authorisation can be found\r\n      } else {\r\n        return (hasRole && (subjectRole <= role)) // Authorisation must be found on remove\r\n      }\r\n    })\r\n    if (subjects.length < params.subjects.length) {\r\n      debug(`${(params.subjects.length - subjects.length)} subjects with higher permissions level found for scope ${scopeName}`)\r\n      throw new Forbidden('You are not allowed to change authorisation on subject(s)')\r\n    }\r\n    // Input permissions needs to be checked since:\r\n    // - you should not be able to give higher permissions than your own ones to others\r\n    // (e.g. cannot create a owner when you are a manager)\r\n    let authorisationRole\r\n    if (data.permissions) {\r\n      authorisationRole = Roles[data.permissions]\r\n    } else if (query.permissions) {\r\n      authorisationRole = Roles[query.permissions]\r\n    }\r\n    if (!_.isUndefined(authorisationRole)) {\r\n      if (authorisationRole > role) {\r\n        debug('Cannot escalate with higher permissions level for scope ' + scopeName)\r\n        throw new Forbidden('You are not allowed to change authorisation on resource')\r\n      }\r\n    }\r\n  }\r\n\r\n  return hook\r\n}\r\n\r\nexport function authorise (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'authorise\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n  const operation = hook.method\r\n  const resourceType = hook.service.name\r\n  debug('Provider is', hook.params.provider)\r\n  if (hook.params.user) debug('User is', hook.params.user)\r\n  debug('Operation is', operation)\r\n  if (resourceType) debug('Resource type is', resourceType)\r\n\r\n  // If called internally we skip authorisation\r\n  let checkAuthorisation = _.has(hook.params, 'provider')\r\n  debug('Access check ' + (checkAuthorisation ? 'enabled' : 'disabled') + ' for provider')\r\n  // If already checked we skip authorisation\r\n  if (hook.params.authorised) {\r\n    debug('Access already granted')\r\n    checkAuthorisation = false\r\n  }\r\n  // We also skip authorisation for built-in Feathers services like authentication\r\n  if (typeof hook.service.getPath !== 'function') {\r\n    debug('Access disabled on built-in services')\r\n    checkAuthorisation = false\r\n  }\r\n  // If explicitely asked to perform/skip, override defaults\r\n  if (_.has(hook.params, 'checkAuthorisation')) {\r\n    checkAuthorisation = _.get(hook.params, 'checkAuthorisation')\r\n    // Bypass authorisation for next hooks otherwise we will loop infinitely\r\n    delete hook.params.checkAuthorisation\r\n    debug('Access check ' + (checkAuthorisation ? 'forced' : 'unforced'))\r\n  }\r\n\r\n  const context = hook.service.context\r\n  if (checkAuthorisation) {\r\n    // Build ability for user\r\n    const authorisationService = hook.app.getService('authorisations')\r\n    const abilities = authorisationService.getAbilities(hook.params.user)\r\n    hook.params.abilities = abilities\r\n    debug('User abilities are', abilities.rules)\r\n\r\n    // Check for access to service fisrt\r\n    if (!hasServiceAbilities(abilities, hook.service)) {\r\n      debug('Service access not granted')\r\n      throw new Forbidden(`You are not allowed to access service ${hook.service.getPath()}`)\r\n    }\r\n\r\n    if (!hook.id) {\r\n      // In this specific case there is no query to be run,\r\n      // simply check against the object we'd like to create\r\n      if (operation === 'create') {\r\n        const resource = hook.data\r\n        debug('Target resource is ', resource)\r\n        if (!hasResourceAbilities(abilities, operation, resourceType, context, resource)) {\r\n          debug('Resource access not granted')\r\n          throw new Forbidden(`You are not allowed to perform ${operation} operation on ${resourceType}`)\r\n        }\r\n      } else {\r\n        // When we find/update/patch/remove multiple items this ensures that\r\n        // only the ones authorised by constraints on the resources will be fetched\r\n        // This avoid fetching all first then check it one by one\r\n        const dbQuery = objectifyIDs(getQueryForAbilities(abilities, operation, resourceType))\r\n        if (dbQuery) {\r\n          debug('Target resource conditions are ', dbQuery)\r\n          _.merge(hook.params.query, dbQuery)\r\n        } else {\r\n          hook.result = { total: 0, skip: 0, data: [] }\r\n        }\r\n      }\r\n      debug('Resource access granted')\r\n    // Some specific services might not expose a get function, in this case we cannot check for authorisation\r\n    // this has to be implemented by the service itself\r\n    } else if (typeof hook.service.get === 'function') {\r\n      // In this case (single get/update/patch/remove) we need to fetch the item first\r\n      return hook.service.get(hook.id, Object.assign({ checkAuthorisation: false }, hook.params))\r\n        .then(resource => {\r\n          debug('Target resource is', resource)\r\n          // Then check against the object we'd like to manage\r\n          if (!hasResourceAbilities(abilities, operation, resourceType, context, resource)) {\r\n            debug('Resource access not granted')\r\n            throw new Forbidden(`You are not allowed to perform ${operation} operation on ${resourceType}`)\r\n          }\r\n          // Avoid fetching again the object in this case\r\n          if (operation === 'get') {\r\n            hook.result = resource\r\n          }\r\n          hook.params.authorised = true\r\n          debug('Resource access granted')\r\n          return hook\r\n        })\r\n    }\r\n  } else {\r\n    debug('Authorisation check skipped, access granted')\r\n  }\r\n\r\n  hook.params.authorised = true\r\n  return Promise.resolve(hook)\r\n}\r\n\r\nexport function updateAbilities (options = {}) {\r\n  return async function (hook) {\r\n    const app = hook.app\r\n    const params = hook.params\r\n    const authorisationService = app.getService('authorisations')\r\n    let subject = (options.subjectAsItem ? getItems(hook) : params.user)\r\n    // We might not have all information required eg on patch to compute new abilities,\r\n    // in this case we have to fetch the whole subject\r\n    if (options.fetchSubject) {\r\n      subject = await hook.service.get(subject._id.toString())\r\n    }\r\n    const abilities = authorisationService.updateAbilities(subject)\r\n    debug('Abilities updated on subject', subject, abilities.rules)\r\n    return hook\r\n  }\r\n}\r\n\r\nexport function preventRemovingLastOwner (resourceScope) {\r\n  return async function (hook) {\r\n    // By pass check ?\r\n    if (hook.params.force) return hook\r\n    const params = hook.params\r\n    const data = hook.data || {}\r\n    const query = params.query || {}\r\n    const scope = data.scope || query.scope\r\n    const grantedPermissions = data.permissions || query.permissions\r\n    const grantedRole = (grantedPermissions ? Roles[grantedPermissions] : undefined)\r\n    const resource = hook.params.resource\r\n    const subjects = hook.params.subjects\r\n    const subjectService = hook.params.subjectsService\r\n    // On create check if we try to downgrade permissions otherwise let pass through\r\n    if (!_.isUndefined(grantedRole) && (grantedRole === Roles.owner)) return hook\r\n\r\n    if ((scope === resourceScope) && resource && resource._id) {\r\n      // Count existing owners\r\n      const owners = await countSubjectsForResource(subjectService, resourceScope, resource._id, Roles.owner)\r\n      // Now count owners we change/remove permissions on\r\n      const removedOwners = subjects.reduce((count, subject) => {\r\n        const resources = _.get(subject, resourceScope, [])\r\n        const ownedResource = _.find(resources, { _id: resource._id, permissions: RoleNames[Roles.owner] })\r\n        return (ownedResource ? count + 1 : count)\r\n      }, 0)\r\n      // If none remains stop\r\n      if (removedOwners >= owners.total) {\r\n        debug('Cannot remove the last owner of resource ', resource)\r\n        const resourceName = resource.name ? resource.name : resource._id.toString()\r\n        throw new Forbidden('You are not allowed to remove the last owner of resource ' + resourceName, {\r\n          translation: {\r\n            key: 'CANNOT_REMOVE_LAST_OWNER',\r\n            params: { resource: resourceName }\r\n          }\r\n        })\r\n      }\r\n    }\r\n    return hook\r\n  }\r\n}\r\n\r\nexport function removeOrganisationGroupsAuthorisations (hook) {\r\n  const app = hook.app\r\n  const authorisationService = app.getService('authorisations')\r\n  const org = hook.params.resource\r\n  const user = hook.params.user\r\n  // Unset membership for the all org groups\r\n  const orgGroupService = app.getService('groups', org)\r\n  return orgGroupService.find({ paginate: false })\r\n    .then(groups => {\r\n      return Promise.all(groups.map(group => {\r\n      // Unset membership on group for the all org users\r\n        return authorisationService.remove(group._id.toString(), {\r\n          query: {\r\n            scope: 'groups'\r\n          },\r\n          user,\r\n          force: hook.params.force,\r\n          // Because we already have resource set it as objects to avoid populating\r\n          // Moreover used as an after hook the resource might not already exist anymore\r\n          subjects: hook.params.subjects,\r\n          subjectsService: hook.params.subjectsService,\r\n          resource: group,\r\n          resourcesService: orgGroupService\r\n        })\r\n      }))\r\n    })\r\n    .then(groups => {\r\n      debug('Authorisations unset on groups for organisation ' + org._id)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport async function removeOrganisationTagsAuthorisations (hook) {\r\n  const app = hook.app\r\n  const org = hook.params.resource\r\n  const subjectService = hook.params.subjectsService\r\n  const orgTagsService = app.getService('tags', org)\r\n  const subjects = hook.params.subjects || []\r\n  if (subjects.length === 0) return hook\r\n  // Retrieve org tags\r\n  const orgTags = await orgTagsService.find({ paginate: false })\r\n  const promises = []\r\n  subjects.forEach(subject => {\r\n    const tags = subject.tags || []\r\n    // Find tags from org\r\n    const fromOrg = _.intersectionWith(tags, orgTags, isTagEqual)\r\n    // Clear removed tags\r\n    const notFromOrg = _.differenceWith(tags, orgTags, isTagEqual)\r\n    // Update subject if required\r\n    if (fromOrg.length > 0) {\r\n      promises.push(subjectService.patch(subject._id.toString(), { tags: notFromOrg, devices: subject.devices }))\r\n    }\r\n  })\r\n  // Perform subject updates in parallel\r\n  await Promise.all(promises)\r\n  debug(`Tags unset on ${promises.length} subjects for organisation ` + org._id)\r\n  return hook\r\n}\r\n"]}
+{"version":3,"sources":["../../../../core/api/hooks/hooks.authorisations.js"],"names":["hook","type","Error","operation","method","resourceType","service","name","debug","params","provider","user","checkAuthorisation","_","has","authorised","getPath","get","context","authorisationService","app","getService","abilities","getAbilities","rules","Forbidden","id","resource","data","dbQuery","query","transform","result","value","key","$and","$or","merge","total","skip","Object","assign","authorise","org","orgGroupService","groups","find","paginate","Promise","all","map","remove","group","_id","toString","scope","force","subjects","subjectsService","resourcesService","removeOrganisationGroupsAuthorisations","subjectService","orgTagsService","length","orgTags","promises","forEach","tags","subject","fromOrg","intersectionWith","isTagEqual","notFromOrg","differenceWith","push","patch","devices","removeOrganisationTagsAuthorisations","createJWT","populateSubjects","unpopulateSubjects","populateResource","unpopulateResource","preventEscalation","updateAbilities","preventRemovingLastOwner","options","defaults","items","isArray","Array","accessTokens","passport","payload","jwt","item","index","set","serviceField","idField","throwOnNotFound","checkEscalation","scopeName","permissions","undefined","role","Roles","isUndefined","filter","subjectScope","subjectResource","subjectPermissions","subjectRole","hasRole","authorisationRole","subjectAsItem","fetchSubject","resourceScope","grantedPermissions","grantedRole","owner","owners","removedOwners","reduce","count","resources","ownedResource","RoleNames","resourceName","translation"],"mappings":";;;;;;;;gCA8IO,WAA0BA,IAA1B,EAAgC;AACrC,QAAIA,KAAKC,IAAL,KAAc,QAAlB,EAA4B;AAC1B,YAAM,IAAIC,KAAJ,CAAU,kEAAV,CAAN;AACD;AACD,UAAMC,YAAYH,KAAKI,MAAvB;AACA,UAAMC,eAAeL,KAAKM,OAAL,CAAaC,IAAlC;AACAC,UAAM,aAAN,EAAqBR,KAAKS,MAAL,CAAYC,QAAjC;AACA,QAAIV,KAAKS,MAAL,CAAYE,IAAhB,EAAsBH,MAAM,SAAN,EAAiBR,KAAKS,MAAL,CAAYE,IAA7B;AACtBH,UAAM,cAAN,EAAsBL,SAAtB;AACA,QAAIE,YAAJ,EAAkBG,MAAM,kBAAN,EAA0BH,YAA1B;;AAElB;AACA,QAAIO,qBAAqBC,iBAAEC,GAAF,CAAMd,KAAKS,MAAX,EAAmB,UAAnB,CAAzB;AACAD,UAAM,mBAAmBI,qBAAqB,SAArB,GAAiC,UAApD,IAAkE,eAAxE;AACA;AACA,QAAIZ,KAAKS,MAAL,CAAYM,UAAhB,EAA4B;AAC1BP,YAAM,wBAAN;AACAI,2BAAqB,KAArB;AACD;AACD;AACA,QAAI,OAAOZ,KAAKM,OAAL,CAAaU,OAApB,KAAgC,UAApC,EAAgD;AAC9CR,YAAM,sCAAN;AACAI,2BAAqB,KAArB;AACD;AACD;AACA,QAAIC,iBAAEC,GAAF,CAAMd,KAAKS,MAAX,EAAmB,oBAAnB,CAAJ,EAA8C;AAC5CG,2BAAqBC,iBAAEI,GAAF,CAAMjB,KAAKS,MAAX,EAAmB,oBAAnB,CAArB;AACA;AACA,aAAOT,KAAKS,MAAL,CAAYG,kBAAnB;AACAJ,YAAM,mBAAmBI,qBAAqB,QAArB,GAAgC,UAAnD,CAAN;AACD;;AAED,UAAMM,UAAUlB,KAAKM,OAAL,CAAaY,OAA7B;AACA,QAAIN,kBAAJ,EAAwB;AACtB;AACA,YAAMO,uBAAuBnB,KAAKoB,GAAL,CAASC,UAAT,CAAoB,gBAApB,CAA7B;AACA,YAAMC,YAAY,MAAMH,qBAAqBI,YAArB,CAAkCvB,KAAKS,MAAL,CAAYE,IAA9C,CAAxB;AACAX,WAAKS,MAAL,CAAYa,SAAZ,GAAwBA,SAAxB;AACAd,YAAM,oBAAN,EAA4Bc,UAAUE,KAAtC;;AAEA;AACA,UAAI,CAAC,sCAAoBF,SAApB,EAA+BtB,KAAKM,OAApC,CAAL,EAAmD;AACjDE,cAAM,4BAAN;AACA,cAAM,IAAIiB,iBAAJ,CAAe,yCAAwCzB,KAAKM,OAAL,CAAaU,OAAb,EAAuB,EAA9E,CAAN;AACD;;AAED,UAAI,CAAChB,KAAK0B,EAAV,EAAc;AACZ;AACA;AACA,YAAIvB,cAAc,QAAlB,EAA4B;AAC1B,gBAAMwB,WAAW3B,KAAK4B,IAAtB;AACApB,gBAAM,qBAAN,EAA6BmB,QAA7B;AACA,cAAI,CAAC,uCAAqBL,SAArB,EAAgCnB,SAAhC,EAA2CE,YAA3C,EAAyDa,OAAzD,EAAkES,QAAlE,CAAL,EAAkF;AAChFnB,kBAAM,6BAAN;AACA,kBAAM,IAAIiB,iBAAJ,CAAe,kCAAiCtB,SAAU,iBAAgBE,YAAa,EAAvF,CAAN;AACD;AACF,SAPD,MAOO;AACL;AACA;AACA;AACA,gBAAMwB,UAAU,sBAAa,uCAAqBP,SAArB,EAAgCnB,SAAhC,EAA2CE,YAA3C,CAAb,CAAhB;AACA,cAAIwB,OAAJ,EAAa;AACX7B,iBAAKS,MAAL,CAAYqB,KAAZ,GAAoBjB,iBAAEkB,SAAF,CAAY/B,KAAKS,MAAL,CAAYqB,KAAxB,EAA+B,UAACE,MAAD,EAASC,KAAT,EAAgBC,GAAhB,EAAwB;AACzE,kBAAIA,QAAQ,KAAZ,EAAmBF,OAAOG,IAAP,GAAc,CAAC,EAAEC,KAAKH,KAAP,EAAD,CAAd,CAAnB,KACKD,OAAOE,GAAP,IAAcD,KAAd;AACN,aAHmB,EAGjB,EAHiB,CAApB;AAIApB,6BAAEwB,KAAF,CAAQrC,KAAKS,MAAL,CAAYqB,KAApB,EAA2BD,OAA3B;AACD,WAND,MAMO;AACL7B,iBAAKgC,MAAL,GAAc,EAAEM,OAAO,CAAT,EAAYC,MAAM,CAAlB,EAAqBX,MAAM,EAA3B,EAAd;AACD;AACF;AACDpB,cAAM,yBAAN;AACF;AACA;AACC,OA5BD,MA4BO,IAAI,OAAOR,KAAKM,OAAL,CAAaW,GAApB,KAA4B,UAAhC,EAA4C;AACjD;AACA,cAAMU,WAAW,MAAM3B,KAAKM,OAAL,CAAaW,GAAb,CAAiBjB,KAAK0B,EAAtB,EAA0Bc,OAAOC,MAAP,CAAc,EAAE7B,oBAAoB,KAAtB,EAAd,EAA6CZ,KAAKS,MAAlD,CAA1B,CAAvB;AACAD,cAAM,oBAAN,EAA4BmB,QAA5B;AACA;AACA,YAAI,CAAC,uCAAqBL,SAArB,EAAgCnB,SAAhC,EAA2CE,YAA3C,EAAyDa,OAAzD,EAAkES,QAAlE,CAAL,EAAkF;AAChFnB,gBAAM,6BAAN;AACA,gBAAM,IAAIiB,iBAAJ,CAAe,kCAAiCtB,SAAU,iBAAgBE,YAAa,EAAvF,CAAN;AACD;AACD;AACA,YAAIF,cAAc,KAAlB,EAAyB;AACvBH,eAAKgC,MAAL,GAAcL,QAAd;AACD;AACD3B,aAAKS,MAAL,CAAYM,UAAZ,GAAyB,IAAzB;AACAP,cAAM,yBAAN;AACA,eAAOR,IAAP;AACD;AACF,KA1DD,MA0DO;AACLQ,YAAM,6CAAN;AACD;;AAEDR,SAAKS,MAAL,CAAYM,UAAZ,GAAyB,IAAzB;AACA,WAAOf,IAAP;AACD,G;;kBAjGqB0C,S;;;;;;gCA6Jf,WAAuD1C,IAAvD,EAA6D;AAClE,UAAMoB,MAAMpB,KAAKoB,GAAjB;AACA,UAAMD,uBAAuBC,IAAIC,UAAJ,CAAe,gBAAf,CAA7B;AACA,UAAMsB,MAAM3C,KAAKS,MAAL,CAAYkB,QAAxB;AACA,UAAMhB,OAAOX,KAAKS,MAAL,CAAYE,IAAzB;AACA;AACA,UAAMiC,kBAAkBxB,IAAIC,UAAJ,CAAe,QAAf,EAAyBsB,GAAzB,CAAxB;AACA,UAAME,SAAS,MAAMD,gBAAgBE,IAAhB,CAAqB,EAAEC,UAAU,KAAZ,EAArB,CAArB;AACA,UAAMC,QAAQC,GAAR,CAAYJ,OAAOK,GAAP,CAAW,iBAAS;AACtC;AACE,aAAO/B,qBAAqBgC,MAArB,CAA4BC,MAAMC,GAAN,CAAUC,QAAV,EAA5B,EAAkD;AACvDxB,eAAO;AACLyB,iBAAO;AADF,SADgD;AAIvD5C,YAJuD;AAKvD6C,eAAOxD,KAAKS,MAAL,CAAY+C,KALoC;AAMvD;AACA;AACAC,kBAAUzD,KAAKS,MAAL,CAAYgD,QARiC;AASvDC,yBAAiB1D,KAAKS,MAAL,CAAYiD,eAT0B;AAUvD/B,kBAAUyB,KAV6C;AAWvDO,0BAAkBf;AAXqC,OAAlD,CAAP;AAaD,KAfiB,CAAZ,CAAN;AAgBApC,UAAM,qDAAqDmC,IAAIU,GAA/D;AACA,WAAOrD,IAAP;AACD,G;;kBA1BqB4D,sC;;;;;;gCA4Bf,WAAqD5D,IAArD,EAA2D;AAChE,UAAMoB,MAAMpB,KAAKoB,GAAjB;AACA,UAAMuB,MAAM3C,KAAKS,MAAL,CAAYkB,QAAxB;AACA,UAAMkC,iBAAiB7D,KAAKS,MAAL,CAAYiD,eAAnC;AACA,UAAMI,iBAAiB1C,IAAIC,UAAJ,CAAe,MAAf,EAAuBsB,GAAvB,CAAvB;AACA,UAAMc,WAAWzD,KAAKS,MAAL,CAAYgD,QAAZ,IAAwB,EAAzC;AACA,QAAIA,SAASM,MAAT,KAAoB,CAAxB,EAA2B,OAAO/D,IAAP;AAC3B;AACA,UAAMgE,UAAU,MAAMF,eAAehB,IAAf,CAAoB,EAAEC,UAAU,KAAZ,EAApB,CAAtB;AACA,UAAMkB,WAAW,EAAjB;AACAR,aAASS,OAAT,CAAiB,mBAAW;AAC1B,YAAMC,OAAOC,QAAQD,IAAR,IAAgB,EAA7B;AACA;AACA,YAAME,UAAUxD,iBAAEyD,gBAAF,CAAmBH,IAAnB,EAAyBH,OAAzB,EAAkCO,kBAAlC,CAAhB;AACA;AACA,YAAMC,aAAa3D,iBAAE4D,cAAF,CAAiBN,IAAjB,EAAuBH,OAAvB,EAAgCO,kBAAhC,CAAnB;AACA;AACA,UAAIF,QAAQN,MAAR,GAAiB,CAArB,EAAwB;AACtBE,iBAASS,IAAT,CAAcb,eAAec,KAAf,CAAqBP,QAAQf,GAAR,CAAYC,QAAZ,EAArB,EAA6C,EAAEa,MAAMK,UAAR,EAAoBI,SAASR,QAAQQ,OAArC,EAA7C,CAAd;AACD;AACF,KAVD;AAWA;AACA,UAAM5B,QAAQC,GAAR,CAAYgB,QAAZ,CAAN;AACAzD,UAAO,iBAAgByD,SAASF,MAAO,6BAAjC,GAAgEpB,IAAIU,GAA1E;AACA,WAAOrD,IAAP;AACD,G;;kBAzBqB6E,oC;;;;;QA5TNC,S,GAAAA,S;QAsBAC,gB,GAAAA,gB;QAQAC,kB,GAAAA,kB;QAQAC,gB,GAAAA,gB;QAQAC,kB,GAAAA,kB;QAQAC,iB,GAAAA,iB;QAgLAC,e,GAAAA,e;QAiBAC,wB,GAAAA,wB;;AAlQhB;;;;AACA;;;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;;;;;AAEA,MAAM7E,QAAQ,qBAAU,+BAAV,CAAd;;AAEO,SAASsE,SAAT,CAAoBQ,UAAU,EAA9B,EAAkC;AACvC;AAAA,iCAAO,WAAgBtF,IAAhB,EAAsB;AAC3B,YAAMuF,WAAWvF,KAAKoB,GAAL,CAASH,GAAT,CAAa,gBAAb,KAAkCjB,KAAKoB,GAAL,CAASH,GAAT,CAAa,MAAb,CAAnD;AACA,YAAMN,OAAOE,iBAAEI,GAAF,CAAMjB,IAAN,EAAY,aAAZ,CAAb;AACA,UAAIwF,QAAQ,mCAASxF,IAAT,CAAZ;AACA,YAAMyF,UAAUC,MAAMD,OAAN,CAAcD,KAAd,CAAhB;AACAA,cAASC,UAAUD,KAAV,GAAkB,CAACA,KAAD,CAA3B;AACA;AACA,YAAMG,eAAe,MAAM3C,QAAQC,GAAR,CAAYuC,MAAMtC,GAAN,CAAU;AAAA,eAAQlD,KAAKoB,GAAL,CAASwE,QAAT,CAAkBd,SAAlB;AACvD;AACC,eAAOQ,QAAQO,OAAf,KAA2B,UAA3B,GAAwCP,QAAQO,OAAR,CAAgBlF,IAAhB,CAAxC,GAAgE,EAFV;AAGvD;AACA;AACAE,yBAAEwB,KAAF,CAAQ,EAAR,EAAYkD,QAAZ,EAAuB,OAAOD,QAAQQ,GAAf,KAAuB,UAAvB,GAAoC,EAAEA,KAAKR,QAAQQ,GAAR,CAAYnF,IAAZ,CAAP,EAApC,GAAiE2E,OAAxF,CALuD,CAAR;AAAA,OAAV,CAAZ,CAA3B;AAOA;AACAE,YAAMtB,OAAN,CAAc,UAAC6B,IAAD,EAAOC,KAAP;AAAA,eAAiBnF,iBAAEoF,GAAF,CAAMF,IAAN,EAAYT,QAAQ/E,IAAR,IAAgB,aAA5B,EAA2CoF,aAAaK,KAAb,CAA3C,CAAjB;AAAA,OAAd;AACA,6CAAahG,IAAb,EAAmByF,UAAUD,KAAV,GAAkBA,MAAM,CAAN,CAArC;AACA,aAAOxF,IAAP;AACD,KAlBD;;AAAA;AAAA;AAAA;AAAA;AAmBD;;AAEM,SAAS+E,gBAAT,CAA2B/E,IAA3B,EAAiC;AACtC,MAAIA,KAAKC,IAAL,KAAc,QAAlB,EAA4B;AAC1B,UAAM,IAAIC,KAAJ,CAAU,yEAAV,CAAN;AACD;;AAED,SAAO,4BAAgB,EAAEgG,cAAc,iBAAhB,EAAmCC,SAAS,UAA5C,EAAwDC,iBAAiB,IAAzE,EAAhB,EAAiGpG,IAAjG,CAAP;AACD;;AAEM,SAASgF,kBAAT,CAA6BhF,IAA7B,EAAmC;AACxC,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,0EAAV,CAAN;AACD;;AAED,SAAO,8BAAkB,EAAEgG,cAAc,iBAAhB,EAAmCC,SAAS,UAA5C,EAAlB,EAA4EnG,IAA5E,CAAP;AACD;;AAEM,SAASiF,gBAAT,CAA2BjF,IAA3B,EAAiC;AACtC,MAAIA,KAAKC,IAAL,KAAc,QAAlB,EAA4B;AAC1B,UAAM,IAAIC,KAAJ,CAAU,yEAAV,CAAN;AACD;;AAED,SAAO,2BAAe,EAAEgG,cAAc,kBAAhB,EAAoCC,SAAS,UAA7C,EAAyDC,iBAAiB,IAA1E,EAAf,EAAiGpG,IAAjG,CAAP;AACD;;AAEM,SAASkF,kBAAT,CAA6BlF,IAA7B,EAAmC;AACxC,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,0EAAV,CAAN;AACD;;AAED,SAAO,6BAAiB,EAAEgG,cAAc,kBAAhB,EAAoCC,SAAS,UAA7C,EAAjB,EAA4EnG,IAA5E,CAAP;AACD;;AAEM,SAASmF,iBAAT,CAA4BnF,IAA5B,EAAkC;AACvC,MAAIA,KAAKC,IAAL,KAAc,QAAlB,EAA4B;AAC1B,UAAM,IAAIC,KAAJ,CAAU,0EAAV,CAAN;AACD;;AAED,QAAMO,SAAST,KAAKS,MAApB;AACA;AACA,MAAI4F,kBAAkBxF,iBAAEC,GAAF,CAAML,MAAN,EAAc,UAAd,CAAtB;AACAD,QAAM,uBAAuB6F,kBAAkB,SAAlB,GAA8B,UAArD,IAAmE,eAAzE;AACA;AACA,MAAIxF,iBAAEC,GAAF,CAAML,MAAN,EAAc,iBAAd,CAAJ,EAAsC;AACpC4F,sBAAkB5F,OAAO4F,eAAzB;AACA7F,UAAM,uBAAuB6F,kBAAkB,QAAlB,GAA6B,UAApD,CAAN;AACD;;AAED,MAAIA,eAAJ,EAAqB;AACnB,UAAM1F,OAAOF,OAAOE,IAApB;AACA;AACA,UAAMiB,OAAO5B,KAAK4B,IAAL,IAAa,EAA1B;AACA;AACA,UAAME,QAAQrB,OAAOqB,KAAP,IAAgB,EAA9B;AACA,UAAMwE,YAAY1E,KAAK2B,KAAL,IAAczB,MAAMyB,KAAtC,CANmB,CAMyB;AAC5C;AACA,UAAMA,QAAQ1C,iBAAEI,GAAF,CAAMN,IAAN,EAAY2F,SAAZ,EAAuB,EAAvB,CAAd;AACA;AACA,UAAM3E,WAAWd,iBAAEiC,IAAF,CAAOS,KAAP,EAAc5B,YAAYA,SAAS0B,GAAT,IAAiB1B,SAAS0B,GAAT,CAAaC,QAAb,OAA4B7C,OAAOkB,QAAP,CAAgB0B,GAAhB,CAAoBC,QAApB,EAAvE,CAAjB;AACA;AACA,UAAMiD,cAAe5E,WAAWA,SAAS4E,WAApB,GAAkCC,SAAvD;AACA,UAAMC,OAAQF,cAAcG,mBAAMH,WAAN,CAAd,GAAmCC,SAAjD;AACA,QAAI3F,iBAAE8F,WAAF,CAAcF,IAAd,CAAJ,EAAyB;AACvBjG,YAAM,wDAAwD8F,SAA9D;AACA,YAAM,IAAI7E,iBAAJ,CAAc,yDAAd,CAAN;AACD;;AAED;;AAEA;AACA;AACA;AACA;AACA;AACA,UAAMgC,WAAWhD,OAAOgD,QAAP,CAAgBmD,MAAhB,CAAuBxC,WAAW;AACjD,YAAMyC,eAAehG,iBAAEI,GAAF,CAAMmD,OAAN,EAAekC,SAAf,EAA0B,EAA1B,CAArB;AACA,YAAMQ,kBAAkBjG,iBAAEiC,IAAF,CAAO+D,YAAP,EAAqBlF,YAAYA,SAAS0B,GAAT,IAAiB1B,SAAS0B,GAAT,CAAaC,QAAb,OAA4B7C,OAAOkB,QAAP,CAAgB0B,GAAhB,CAAoBC,QAApB,EAA9E,CAAxB;AACA,YAAMyD,qBAAsBD,kBAAkBA,gBAAgBP,WAAlC,GAAgDC,SAA5E;AACA,YAAMQ,cAAeD,qBAAqBL,mBAAMK,kBAAN,CAArB,GAAiDP,SAAtE;AACA,YAAMS,UAAU,CAACpG,iBAAE8F,WAAF,CAAcK,WAAd,CAAjB;AACA,UAAIhH,KAAKI,MAAL,KAAgB,QAApB,EAA8B;AAC5B,eAAQ,CAAC6G,OAAD,IAAaD,eAAeP,IAApC,CAD4B,CACe;AAC5C,OAFD,MAEO;AACL,eAAQQ,WAAYD,eAAeP,IAAnC,CADK,CACqC;AAC3C;AACF,KAXgB,CAAjB;AAYA,QAAIhD,SAASM,MAAT,GAAkBtD,OAAOgD,QAAP,CAAgBM,MAAtC,EAA8C;AAC5CvD,YAAO,GAAGC,OAAOgD,QAAP,CAAgBM,MAAhB,GAAyBN,SAASM,MAAQ,2DAA0DuC,SAAU,EAAxH;AACA,YAAM,IAAI7E,iBAAJ,CAAc,2DAAd,CAAN;AACD;AACD;AACA;AACA;AACA,QAAIyF,iBAAJ;AACA,QAAItF,KAAK2E,WAAT,EAAsB;AACpBW,0BAAoBR,mBAAM9E,KAAK2E,WAAX,CAApB;AACD,KAFD,MAEO,IAAIzE,MAAMyE,WAAV,EAAuB;AAC5BW,0BAAoBR,mBAAM5E,MAAMyE,WAAZ,CAApB;AACD;AACD,QAAI,CAAC1F,iBAAE8F,WAAF,CAAcO,iBAAd,CAAL,EAAuC;AACrC,UAAIA,oBAAoBT,IAAxB,EAA8B;AAC5BjG,cAAM,6DAA6D8F,SAAnE;AACA,cAAM,IAAI7E,iBAAJ,CAAc,yDAAd,CAAN;AACD;AACF;AACF;;AAED,SAAOzB,IAAP;AACD;;AAqGM,SAASoF,eAAT,CAA0BE,UAAU,EAApC,EAAwC;AAC7C;AAAA,kCAAO,WAAgBtF,IAAhB,EAAsB;AAC3B,YAAMoB,MAAMpB,KAAKoB,GAAjB;AACA,YAAMX,SAAST,KAAKS,MAApB;AACA,YAAMU,uBAAuBC,IAAIC,UAAJ,CAAe,gBAAf,CAA7B;AACA,UAAI+C,UAAWkB,QAAQ6B,aAAR,GAAwB,mCAASnH,IAAT,CAAxB,GAAyCS,OAAOE,IAA/D;AACA;AACA;AACA,UAAI2E,QAAQ8B,YAAZ,EAA0B;AACxBhD,kBAAU,MAAMpE,KAAKM,OAAL,CAAaW,GAAb,CAAiBmD,QAAQf,GAAR,CAAYC,QAAZ,EAAjB,CAAhB;AACD;AACD,YAAMhC,YAAY,MAAMH,qBAAqBiE,eAArB,CAAqChB,OAArC,CAAxB;AACA5D,YAAM,8BAAN,EAAsC4D,OAAtC,EAA+C9C,UAAUE,KAAzD;AACA,aAAOxB,IAAP;AACD,KAbD;;AAAA;AAAA;AAAA;AAAA;AAcD;;AAEM,SAASqF,wBAAT,CAAmCgC,aAAnC,EAAkD;AACvD;AAAA,kCAAO,WAAgBrH,IAAhB,EAAsB;AAC3B;AACA,UAAIA,KAAKS,MAAL,CAAY+C,KAAhB,EAAuB,OAAOxD,IAAP;AACvB,YAAMS,SAAST,KAAKS,MAApB;AACA,YAAMmB,OAAO5B,KAAK4B,IAAL,IAAa,EAA1B;AACA,YAAME,QAAQrB,OAAOqB,KAAP,IAAgB,EAA9B;AACA,YAAMyB,QAAQ3B,KAAK2B,KAAL,IAAczB,MAAMyB,KAAlC;AACA,YAAM+D,qBAAqB1F,KAAK2E,WAAL,IAAoBzE,MAAMyE,WAArD;AACA,YAAMgB,cAAeD,qBAAqBZ,mBAAMY,kBAAN,CAArB,GAAiDd,SAAtE;AACA,YAAM7E,WAAW3B,KAAKS,MAAL,CAAYkB,QAA7B;AACA,YAAM8B,WAAWzD,KAAKS,MAAL,CAAYgD,QAA7B;AACA,YAAMI,iBAAiB7D,KAAKS,MAAL,CAAYiD,eAAnC;AACA;AACA,UAAI,CAAC7C,iBAAE8F,WAAF,CAAcY,WAAd,CAAD,IAAgCA,gBAAgBb,mBAAMc,KAA1D,EAAkE,OAAOxH,IAAP;;AAElE,UAAKuD,UAAU8D,aAAX,IAA6B1F,QAA7B,IAAyCA,SAAS0B,GAAtD,EAA2D;AACzD;AACA,cAAMoE,SAAS,MAAM,2CAAyB5D,cAAzB,EAAyCwD,aAAzC,EAAwD1F,SAAS0B,GAAjE,EAAsEqD,mBAAMc,KAA5E,CAArB;AACA;AACA,cAAME,gBAAgBjE,SAASkE,MAAT,CAAgB,UAACC,KAAD,EAAQxD,OAAR,EAAoB;AACxD,gBAAMyD,YAAYhH,iBAAEI,GAAF,CAAMmD,OAAN,EAAeiD,aAAf,EAA8B,EAA9B,CAAlB;AACA,gBAAMS,gBAAgBjH,iBAAEiC,IAAF,CAAO+E,SAAP,EAAkB,EAAExE,KAAK1B,SAAS0B,GAAhB,EAAqBkD,aAAawB,uBAAUrB,mBAAMc,KAAhB,CAAlC,EAAlB,CAAtB;AACA,iBAAQM,gBAAgBF,QAAQ,CAAxB,GAA4BA,KAApC;AACD,SAJqB,EAInB,CAJmB,CAAtB;AAKA;AACA,YAAIF,iBAAiBD,OAAOnF,KAA5B,EAAmC;AACjC9B,gBAAM,2CAAN,EAAmDmB,QAAnD;AACA,gBAAMqG,eAAerG,SAASpB,IAAT,GAAgBoB,SAASpB,IAAzB,GAAgCoB,SAAS0B,GAAT,CAAaC,QAAb,EAArD;AACA,gBAAM,IAAI7B,iBAAJ,CAAc,8DAA8DuG,YAA5E,EAA0F;AAC9FC,yBAAa;AACX/F,mBAAK,0BADM;AAEXzB,sBAAQ,EAAEkB,UAAUqG,YAAZ;AAFG;AADiF,WAA1F,CAAN;AAMD;AACF;AACD,aAAOhI,IAAP;AACD,KArCD;;AAAA;AAAA;AAAA;AAAA;AAsCD","file":"hooks.authorisations.js","sourcesContent":["import _ from 'lodash'\r\nimport makeDebug from 'debug'\r\nimport { getItems, replaceItems } from 'feathers-hooks-common'\r\nimport { Forbidden } from '@feathersjs/errors'\r\nimport { populateObject, unpopulateObject, populateObjects, unpopulateObjects } from './hooks.query'\r\nimport { objectifyIDs } from '../db'\r\nimport { hasServiceAbilities, hasResourceAbilities, getQueryForAbilities, Roles, RoleNames, countSubjectsForResource } from '../../common/permissions'\r\nimport { isTagEqual } from './hooks.tags'\r\n\r\nconst debug = makeDebug('kdk:core:authorisations:hooks')\r\n\r\nexport function createJWT (options = {}) {\r\n  return async function (hook) {\r\n    const defaults = hook.app.get('authentication') || hook.app.get('auth')\r\n    const user = _.get(hook, 'params.user')\r\n    let items = getItems(hook)\r\n    const isArray = Array.isArray(items)\r\n    items = (isArray ? items : [items])\r\n    // Generate access tokens for all items\r\n    const accessTokens = await Promise.all(items.map(item => hook.app.passport.createJWT(\r\n      // Provided function can be used to pick or omit properties in JWT payload\r\n      (typeof options.payload === 'function' ? options.payload(user) : {}),\r\n      // Provided function can be used for custom options cdepending on the user,\r\n      // then we merge with default auth options for global properties like aud, iss, etc.\r\n      _.merge({}, defaults, (typeof options.jwt === 'function' ? { jwt: options.jwt(user) } : options)))\r\n    ))\r\n    // Store access token on items\r\n    items.forEach((item, index) => _.set(item, options.name || 'accessToken', accessTokens[index]))\r\n    replaceItems(hook, isArray ? items : items[0])\r\n    return hook\r\n  }\r\n}\r\n\r\nexport function populateSubjects (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'populateSubjects\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n\r\n  return populateObjects({ serviceField: 'subjectsService', idField: 'subjects', throwOnNotFound: true })(hook)\r\n}\r\n\r\nexport function unpopulateSubjects (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'unpopulateSubjects\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  return unpopulateObjects({ serviceField: 'subjectsService', idField: 'subjects' })(hook)\r\n}\r\n\r\nexport function populateResource (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'populateResource\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n\r\n  return populateObject({ serviceField: 'resourcesService', idField: 'resource', throwOnNotFound: true })(hook)\r\n}\r\n\r\nexport function unpopulateResource (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'unpopulateResource\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  return unpopulateObject({ serviceField: 'resourcesService', idField: 'resource' })(hook)\r\n}\r\n\r\nexport function preventEscalation (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'preventEscalation\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n\r\n  const params = hook.params\r\n  // If called internally we skip authorisation\r\n  let checkEscalation = _.has(params, 'provider')\r\n  debug('Escalation check ' + (checkEscalation ? 'enabled' : 'disabled') + ' for provider')\r\n  // If explicitely asked to perform/skip, override defaults\r\n  if (_.has(params, 'checkEscalation')) {\r\n    checkEscalation = params.checkEscalation\r\n    debug('Escalation check ' + (checkEscalation ? 'forced' : 'unforced'))\r\n  }\r\n\r\n  if (checkEscalation) {\r\n    const user = params.user\r\n    // Make hook usable on remove as well\r\n    const data = hook.data || {}\r\n    // Make hook usable with query params as well\r\n    const query = params.query || {}\r\n    const scopeName = data.scope || query.scope // Get scope name first\r\n    // Retrieve the right scope on the user\r\n    const scope = _.get(user, scopeName, [])\r\n    // Then the target resource\r\n    const resource = _.find(scope, resource => resource._id && (resource._id.toString() === params.resource._id.toString()))\r\n    // Then user permission level\r\n    const permissions = (resource ? resource.permissions : undefined)\r\n    const role = (permissions ? Roles[permissions] : undefined)\r\n    if (_.isUndefined(role)) {\r\n      debug('Role for authorisation not found on user for scope ' + scopeName)\r\n      throw new Forbidden('You are not allowed to change authorisation on resource')\r\n    }\r\n\r\n    // Check if privilege escalation might occur, if so clamp to user permission level\r\n\r\n    // Input subjects need to be checked:\r\n    // - on create you should not be able to change permissions on others having higher permissions than yourself\r\n    // (e.g. cannot change a owner into a manager when you are a manager)\r\n    // - on remove you should not be able to remove permissions on others having higher permissions than yourself\r\n    // (e.g. cannot remove a owner when you are a manager)\r\n    const subjects = params.subjects.filter(subject => {\r\n      const subjectScope = _.get(subject, scopeName, [])\r\n      const subjectResource = _.find(subjectScope, resource => resource._id && (resource._id.toString() === params.resource._id.toString()))\r\n      const subjectPermissions = (subjectResource ? subjectResource.permissions : undefined)\r\n      const subjectRole = (subjectPermissions ? Roles[subjectPermissions] : undefined)\r\n      const hasRole = !_.isUndefined(subjectRole)\r\n      if (hook.method === 'create') {\r\n        return (!hasRole || (subjectRole <= role)) // The first time no authorisation can be found\r\n      } else {\r\n        return (hasRole && (subjectRole <= role)) // Authorisation must be found on remove\r\n      }\r\n    })\r\n    if (subjects.length < params.subjects.length) {\r\n      debug(`${(params.subjects.length - subjects.length)} subjects with higher permissions level found for scope ${scopeName}`)\r\n      throw new Forbidden('You are not allowed to change authorisation on subject(s)')\r\n    }\r\n    // Input permissions needs to be checked since:\r\n    // - you should not be able to give higher permissions than your own ones to others\r\n    // (e.g. cannot create a owner when you are a manager)\r\n    let authorisationRole\r\n    if (data.permissions) {\r\n      authorisationRole = Roles[data.permissions]\r\n    } else if (query.permissions) {\r\n      authorisationRole = Roles[query.permissions]\r\n    }\r\n    if (!_.isUndefined(authorisationRole)) {\r\n      if (authorisationRole > role) {\r\n        debug('Cannot escalate with higher permissions level for scope ' + scopeName)\r\n        throw new Forbidden('You are not allowed to change authorisation on resource')\r\n      }\r\n    }\r\n  }\r\n\r\n  return hook\r\n}\r\n\r\nexport async function authorise (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'authorise\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n  const operation = hook.method\r\n  const resourceType = hook.service.name\r\n  debug('Provider is', hook.params.provider)\r\n  if (hook.params.user) debug('User is', hook.params.user)\r\n  debug('Operation is', operation)\r\n  if (resourceType) debug('Resource type is', resourceType)\r\n\r\n  // If called internally we skip authorisation\r\n  let checkAuthorisation = _.has(hook.params, 'provider')\r\n  debug('Access check ' + (checkAuthorisation ? 'enabled' : 'disabled') + ' for provider')\r\n  // If already checked we skip authorisation\r\n  if (hook.params.authorised) {\r\n    debug('Access already granted')\r\n    checkAuthorisation = false\r\n  }\r\n  // We also skip authorisation for built-in Feathers services like authentication\r\n  if (typeof hook.service.getPath !== 'function') {\r\n    debug('Access disabled on built-in services')\r\n    checkAuthorisation = false\r\n  }\r\n  // If explicitely asked to perform/skip, override defaults\r\n  if (_.has(hook.params, 'checkAuthorisation')) {\r\n    checkAuthorisation = _.get(hook.params, 'checkAuthorisation')\r\n    // Bypass authorisation for next hooks otherwise we will loop infinitely\r\n    delete hook.params.checkAuthorisation\r\n    debug('Access check ' + (checkAuthorisation ? 'forced' : 'unforced'))\r\n  }\r\n\r\n  const context = hook.service.context\r\n  if (checkAuthorisation) {\r\n    // Build ability for user\r\n    const authorisationService = hook.app.getService('authorisations')\r\n    const abilities = await authorisationService.getAbilities(hook.params.user)\r\n    hook.params.abilities = abilities\r\n    debug('User abilities are', abilities.rules)\r\n\r\n    // Check for access to service fisrt\r\n    if (!hasServiceAbilities(abilities, hook.service)) {\r\n      debug('Service access not granted')\r\n      throw new Forbidden(`You are not allowed to access service ${hook.service.getPath()}`)\r\n    }\r\n\r\n    if (!hook.id) {\r\n      // In this specific case there is no query to be run,\r\n      // simply check against the object we'd like to create\r\n      if (operation === 'create') {\r\n        const resource = hook.data\r\n        debug('Target resource is ', resource)\r\n        if (!hasResourceAbilities(abilities, operation, resourceType, context, resource)) {\r\n          debug('Resource access not granted')\r\n          throw new Forbidden(`You are not allowed to perform ${operation} operation on ${resourceType}`)\r\n        }\r\n      } else {\r\n        // When we find/update/patch/remove multiple items this ensures that\r\n        // only the ones authorised by constraints on the resources will be fetched\r\n        // This avoid fetching all first then check it one by one\r\n        const dbQuery = objectifyIDs(getQueryForAbilities(abilities, operation, resourceType))\r\n        if (dbQuery) {\r\n          hook.params.query = _.transform(hook.params.query, (result, value, key) => {\r\n            if (key === '$or') result.$and = [{ $or: value }]\r\n            else result[key] = value\r\n          }, {})\r\n          _.merge(hook.params.query, dbQuery)\r\n        } else {\r\n          hook.result = { total: 0, skip: 0, data: [] }\r\n        }\r\n      }\r\n      debug('Resource access granted')\r\n    // Some specific services might not expose a get function, in this case we cannot check for authorisation\r\n    // this has to be implemented by the service itself\r\n    } else if (typeof hook.service.get === 'function') {\r\n      // In this case (single get/update/patch/remove) we need to fetch the item first\r\n      const resource = await hook.service.get(hook.id, Object.assign({ checkAuthorisation: false }, hook.params))\r\n      debug('Target resource is', resource)\r\n      // Then check against the object we'd like to manage\r\n      if (!hasResourceAbilities(abilities, operation, resourceType, context, resource)) {\r\n        debug('Resource access not granted')\r\n        throw new Forbidden(`You are not allowed to perform ${operation} operation on ${resourceType}`)\r\n      }\r\n      // Avoid fetching again the object in this case\r\n      if (operation === 'get') {\r\n        hook.result = resource\r\n      }\r\n      hook.params.authorised = true\r\n      debug('Resource access granted')\r\n      return hook\r\n    }\r\n  } else {\r\n    debug('Authorisation check skipped, access granted')\r\n  }\r\n\r\n  hook.params.authorised = true\r\n  return hook\r\n}\r\n\r\nexport function updateAbilities (options = {}) {\r\n  return async function (hook) {\r\n    const app = hook.app\r\n    const params = hook.params\r\n    const authorisationService = app.getService('authorisations')\r\n    let subject = (options.subjectAsItem ? getItems(hook) : params.user)\r\n    // We might not have all information required eg on patch to compute new abilities,\r\n    // in this case we have to fetch the whole subject\r\n    if (options.fetchSubject) {\r\n      subject = await hook.service.get(subject._id.toString())\r\n    }\r\n    const abilities = await authorisationService.updateAbilities(subject)\r\n    debug('Abilities updated on subject', subject, abilities.rules)\r\n    return hook\r\n  }\r\n}\r\n\r\nexport function preventRemovingLastOwner (resourceScope) {\r\n  return async function (hook) {\r\n    // By pass check ?\r\n    if (hook.params.force) return hook\r\n    const params = hook.params\r\n    const data = hook.data || {}\r\n    const query = params.query || {}\r\n    const scope = data.scope || query.scope\r\n    const grantedPermissions = data.permissions || query.permissions\r\n    const grantedRole = (grantedPermissions ? Roles[grantedPermissions] : undefined)\r\n    const resource = hook.params.resource\r\n    const subjects = hook.params.subjects\r\n    const subjectService = hook.params.subjectsService\r\n    // On create check if we try to downgrade permissions otherwise let pass through\r\n    if (!_.isUndefined(grantedRole) && (grantedRole === Roles.owner)) return hook\r\n\r\n    if ((scope === resourceScope) && resource && resource._id) {\r\n      // Count existing owners\r\n      const owners = await countSubjectsForResource(subjectService, resourceScope, resource._id, Roles.owner)\r\n      // Now count owners we change/remove permissions on\r\n      const removedOwners = subjects.reduce((count, subject) => {\r\n        const resources = _.get(subject, resourceScope, [])\r\n        const ownedResource = _.find(resources, { _id: resource._id, permissions: RoleNames[Roles.owner] })\r\n        return (ownedResource ? count + 1 : count)\r\n      }, 0)\r\n      // If none remains stop\r\n      if (removedOwners >= owners.total) {\r\n        debug('Cannot remove the last owner of resource ', resource)\r\n        const resourceName = resource.name ? resource.name : resource._id.toString()\r\n        throw new Forbidden('You are not allowed to remove the last owner of resource ' + resourceName, {\r\n          translation: {\r\n            key: 'CANNOT_REMOVE_LAST_OWNER',\r\n            params: { resource: resourceName }\r\n          }\r\n        })\r\n      }\r\n    }\r\n    return hook\r\n  }\r\n}\r\n\r\nexport async function removeOrganisationGroupsAuthorisations (hook) {\r\n  const app = hook.app\r\n  const authorisationService = app.getService('authorisations')\r\n  const org = hook.params.resource\r\n  const user = hook.params.user\r\n  // Unset membership for the all org groups\r\n  const orgGroupService = app.getService('groups', org)\r\n  const groups = await orgGroupService.find({ paginate: false })\r\n  await Promise.all(groups.map(group => {\r\n  // Unset membership on group for the all org users\r\n    return authorisationService.remove(group._id.toString(), {\r\n      query: {\r\n        scope: 'groups'\r\n      },\r\n      user,\r\n      force: hook.params.force,\r\n      // Because we already have resource set it as objects to avoid populating\r\n      // Moreover used as an after hook the resource might not already exist anymore\r\n      subjects: hook.params.subjects,\r\n      subjectsService: hook.params.subjectsService,\r\n      resource: group,\r\n      resourcesService: orgGroupService\r\n    })\r\n  }))\r\n  debug('Authorisations unset on groups for organisation ' + org._id)\r\n  return hook\r\n}\r\n\r\nexport async function removeOrganisationTagsAuthorisations (hook) {\r\n  const app = hook.app\r\n  const org = hook.params.resource\r\n  const subjectService = hook.params.subjectsService\r\n  const orgTagsService = app.getService('tags', org)\r\n  const subjects = hook.params.subjects || []\r\n  if (subjects.length === 0) return hook\r\n  // Retrieve org tags\r\n  const orgTags = await orgTagsService.find({ paginate: false })\r\n  const promises = []\r\n  subjects.forEach(subject => {\r\n    const tags = subject.tags || []\r\n    // Find tags from org\r\n    const fromOrg = _.intersectionWith(tags, orgTags, isTagEqual)\r\n    // Clear removed tags\r\n    const notFromOrg = _.differenceWith(tags, orgTags, isTagEqual)\r\n    // Update subject if required\r\n    if (fromOrg.length > 0) {\r\n      promises.push(subjectService.patch(subject._id.toString(), { tags: notFromOrg, devices: subject.devices }))\r\n    }\r\n  })\r\n  // Perform subject updates in parallel\r\n  await Promise.all(promises)\r\n  debug(`Tags unset on ${promises.length} subjects for organisation ` + org._id)\r\n  return hook\r\n}\r\n"]}

package/lib/core/api/hooks/hooks.organisations.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.createSubscribersGroup = exports.preventRemoveOrganisation = exports.removeOrganisationTags = undefined;
+exports.preventRemoveOrganisation = exports.removeOrganisationTags = undefined;
 
 let removeOrganisationTags = exports.removeOrganisationTags = (() => {
   var _ref2 = _asyncToGenerator(function* (hook) {
@@ -62,28 +62,6 @@ let preventRemoveOrganisation = exports.preventRemoveOrganisation = (() => {
   };
 })();
 
-let createSubscribersGroup = exports.createSubscribersGroup = (() => {
-  var _ref4 = _asyncToGenerator(function* (hook) {
-    if (hook.type !== 'after') {
-      throw new Error('The \'createSubscribersGroup\' hook should only be used as a \'after\' hook.');
-    }
-
-    const app = hook.app;
-    const orgId = hook.result._id;
-    const orgGroupService = app.getService('groups', orgId);
-    yield orgGroupService.create({
-      name: 'KGroup.SUBSCRIBERS_GROUP_NAME',
-      description: 'KGroup.SUBSCRIBERS_GROUP_DESCRIPTION',
-      system: true
-    }, hook.params);
-    return hook;
-  });
-
-  return function createSubscribersGroup(_x4) {
-    return _ref4.apply(this, arguments);
-  };
-})();
-
 exports.addOrganisationPlan = addOrganisationPlan;
 exports.createOrganisationServices = createOrganisationServices;
 exports.removeOrganisationServices = removeOrganisationServices;

package/lib/core/api/hooks/hooks.organisations.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../core/api/hooks/hooks.organisations.js"],"names":["hook","type","Error","app","orgTagsService","getService","result","tags","find","paginate","orgMembersService","members","i","member","filteredTagsMember","_","filter","tag","findIndex","_id","patch","debug","removeOrganisationTags","params","force","orgGroupService","id","$limit","total","Forbidden","translation","key","preventRemoveOrganisation","orgId","create","name","description","system","createSubscribersGroup","addOrganisationPlan","createOrganisationServices","removeOrganisationServices","createOrganisationAuthorisations","removeOrganisationAuthorisations","updateOrganisationResource","removeOrganisationGroups","createPrivateOrganisation","removePrivateOrganisation","plans","keys","get","plan","data","length","set","organisationService","service","databaseService","toString","user","then","db","client","remove","authorisationService","userService","scope","permissions","subjects","subjectsService","resource","resourcesService","authorisation","query","resourceScope","getContextId","$elemMatch","Promise","all","map","resources","Object","assign","resolve","groups","group","profile","org"],"mappings":";;;;;;;;gCAuKO,WAAuCA,IAAvC,EAA6C;AAClD,QAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,YAAM,IAAIC,KAAJ,CAAU,8EAAV,CAAN;AACD;;AAED,UAAMC,MAAMH,KAAKG,GAAjB;AACA;AACA,UAAMC,iBAAiBD,IAAIE,UAAJ,CAAe,MAAf,EAAuBL,KAAKM,MAA5B,CAAvB;AACA,UAAMC,OAAO,MAAMH,eAAeI,IAAf,CAAoB,EAAEC,UAAU,KAAZ,EAApB,CAAnB;AACA;AACA,UAAMC,oBAAoBP,IAAIE,UAAJ,CAAe,SAAf,EAA0BL,KAAKM,MAA/B,CAA1B;AACA,UAAMK,UAAU,MAAMD,kBAAkBF,IAAlB,CAAuB,EAAEC,UAAU,KAAZ,EAAvB,CAAtB;AACA;AACA,SAAK,MAAMG,CAAX,IAAgBD,OAAhB,EAAyB;AACvB,YAAME,SAASF,QAAQC,CAAR,CAAf;AACA,UAAIC,OAAON,IAAX,EAAiB;AACf,cAAMO,qBAAqBC,iBAAEC,MAAF,CAASH,OAAON,IAAhB,EAAsB,UAACU,GAAD,EAAS;AACxD,iBAAOF,iBAAEG,SAAF,CAAYX,IAAZ,EAAkB,EAAEY,KAAKF,IAAIE,GAAX,EAAlB,MAAwC,CAAC,CAAhD;AACD,SAF0B,CAA3B;AAGA,cAAMT,kBAAkBU,KAAlB,CAAwBP,OAAOM,GAA/B,EAAoC,EAAEZ,MAAMO,kBAAR,EAApC,CAAN;AACD;AACF;;AAEDO,UAAM,oCAAoCrB,KAAKM,MAAL,CAAYa,GAAtD;AACA,WAAOnB,IAAP;AACD,G;;kBAzBqBsB,sB;;;;;;gCA8Df,WAA0CtB,IAA1C,EAAgD;AACrD,QAAIA,KAAKC,IAAL,KAAc,QAAlB,EAA4B;AAC1B,YAAM,IAAIC,KAAJ,CAAU,mFAAV,CAAN;AACD;;AAED;AACA,QAAIF,KAAKuB,MAAL,CAAYC,KAAhB,EAAuB,OAAOxB,IAAP;AACvB,UAAMG,MAAMH,KAAKG,GAAjB;AACA,UAAMsB,kBAAkBtB,IAAIE,UAAJ,CAAe,QAAf,EAAyBL,KAAK0B,EAA9B,CAAxB;AACA,UAAMpB,SAAS,MAAMmB,gBAAgBjB,IAAhB,CAAqB,EAAEmB,QAAQ,CAAV,EAArB,CAArB;AACA,QAAIrB,OAAOsB,KAAP,GAAe,CAAnB,EAAsB;AACpB,YAAM,IAAIC,iBAAJ,CAAc,gDAAd,EAAgE;AACpEC,qBAAa,EAAEC,KAAK,4BAAP;AADuD,OAAhE,CAAN;AAGD;AACD,WAAO/B,IAAP;AACD,G;;kBAhBqBgC,yB;;;;;;gCAkBf,WAAuChC,IAAvC,EAA6C;AAClD,QAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,YAAM,IAAIC,KAAJ,CAAU,8EAAV,CAAN;AACD;;AAED,UAAMC,MAAMH,KAAKG,GAAjB;AACA,UAAM8B,QAAQjC,KAAKM,MAAL,CAAYa,GAA1B;AACA,UAAMM,kBAAkBtB,IAAIE,UAAJ,CAAe,QAAf,EAAyB4B,KAAzB,CAAxB;AACA,UAAMR,gBAAgBS,MAAhB,CAAuB;AAC3BC,YAAM,+BADqB;AAE3BC,mBAAa,sCAFc;AAG3BC,cAAQ;AAHmB,KAAvB,EAIHrC,KAAKuB,MAJF,CAAN;AAKA,WAAOvB,IAAP;AACD,G;;kBAdqBsC,sB;;;;;QAlPNC,mB,GAAAA,mB;QAeAC,0B,GAAAA,0B;QAwBAC,0B,GAAAA,0B;QAoBAC,gC,GAAAA,gC;QA0BAC,gC,GAAAA,gC;QA0BAC,0B,GAAAA,0B;QA8BAC,wB,GAAAA,wB;QAgDAC,yB,GAAAA,yB;QAmBAC,yB,GAAAA,yB;;AArNhB;;;;AACA;;;;AACA;;;;;;AACA,MAAM1B,QAAQ,qBAAU,8BAAV,CAAd;;AAEO,SAASkB,mBAAT,CAA8BvC,IAA9B,EAAoC;AACzC,MAAIA,KAAKC,IAAL,KAAc,QAAlB,EAA4B;AAC1B,UAAM,IAAIC,KAAJ,CAAU,4EAAV,CAAN;AACD;;AAED,QAAM8C,QAAQjC,iBAAEkC,IAAF,CAAOjD,KAAKG,GAAL,CAAS+C,GAAT,CAAa,OAAb,KAAyB,EAAhC,CAAd;AACA,QAAMC,OAAOpC,iBAAEmC,GAAF,CAAMlD,KAAKoD,IAAX,EAAiB,cAAjB,CAAb;AACA,MAAI,CAACD,IAAD,IAAUH,MAAMK,MAAN,GAAe,CAA7B,EAAiC;AAC/B;AACAtC,qBAAEuC,GAAF,CAAMtD,KAAKoD,IAAX,EAAiB,cAAjB,EAAiCJ,MAAM,CAAN,CAAjC;AACA3B,UAAM,sCAAN,EAA8CrB,KAAKoD,IAAnD;AACD;AACD,SAAOpD,IAAP;AACD;;AAEM,SAASwC,0BAAT,CAAqCxC,IAArC,EAA2C;AAChD,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,kFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAMoD,sBAAsBvD,KAAKwD,OAAjC;AACA,QAAMC,kBAAkBtD,IAAIE,UAAJ,CAAe,WAAf,CAAxB;;AAEA;AACA,SAAOoD,gBAAgBvB,MAAhB,CAAuB;AAC5BC,UAAMnC,KAAKM,MAAL,CAAYa,GAAZ,CAAgBuC,QAAhB;AADsB,GAAvB,EAEJ;AACDC,UAAM3D,KAAKuB,MAAL,CAAYoC;AADjB,GAFI,EAKJC,IALI,CAKCC,MAAM;AACVxC,UAAM,iCAAiCrB,KAAKM,MAAL,CAAY6B,IAAnD;AACA;AACA0B,SAAK1D,IAAI0D,EAAJ,CAAOC,MAAP,CAAcD,EAAd,CAAiB7D,KAAKM,MAAL,CAAYa,GAAZ,CAAgBuC,QAAhB,EAAjB,CAAL;AACAH,wBAAoBf,0BAApB,CAA+CxC,KAAKM,MAApD,EAA4DuD,EAA5D;AACA,WAAO7D,IAAP;AACD,GAXI,CAAP;AAYD;;AAEM,SAASyC,0BAAT,CAAqCzC,IAArC,EAA2C;AAChD,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,kFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAMoD,sBAAsBvD,KAAKwD,OAAjC;AACA,QAAMC,kBAAkBtD,IAAIE,UAAJ,CAAe,WAAf,CAAxB;;AAEA;AACA,SAAOoD,gBAAgBM,MAAhB,CAAuB/D,KAAKM,MAAL,CAAYa,GAAZ,CAAgBuC,QAAhB,EAAvB,EAAmD;AACxDC,UAAM3D,KAAKuB,MAAL,CAAYoC;AADsC,GAAnD,EAGJC,IAHI,CAGCC,MAAM;AACVxC,UAAM,iCAAiCrB,KAAKM,MAAL,CAAY6B,IAAnD;AACAoB,wBAAoBd,0BAApB,CAA+CzC,KAAKM,MAApD;AACA,WAAON,IAAP;AACD,GAPI,CAAP;AAQD;;AAEM,SAAS0C,gCAAT,CAA2C1C,IAA3C,EAAiD;AACtD,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,wFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAM6D,uBAAuB7D,IAAIE,UAAJ,CAAe,gBAAf,CAA7B;AACA,QAAM4D,cAAc9D,IAAIE,UAAJ,CAAe,OAAf,CAApB;AACA;AACA,SAAO2D,qBAAqB9B,MAArB,CAA4B;AACjCgC,WAAO,eAD0B;AAEjCC,iBAAa,OAFoB,CAEZ;AAFY,GAA5B,EAGJ;AACDR,UAAM3D,KAAKuB,MAAL,CAAYoC,IADjB;AAED;AACAS,cAAU,CAACpE,KAAKuB,MAAL,CAAYoC,IAAb,CAHT;AAIDU,qBAAiBJ,WAJhB;AAKDK,cAAUtE,KAAKM,MALd;AAMDiE,sBAAkBvE,KAAKwD;AANtB,GAHI,EAWJI,IAXI,CAWCY,iBAAiB;AACrBnD,UAAM,yCAAyCrB,KAAKM,MAAL,CAAYa,GAA3D;AACA,WAAOnB,IAAP;AACD,GAdI,CAAP;AAeD;;AAEM,SAAS2C,gCAAT,CAA2C3C,IAA3C,EAAiD;AACtD,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,wFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAM6D,uBAAuB7D,IAAIE,UAAJ,CAAe,gBAAf,CAA7B;;AAEA;AACA,SAAO2D,qBAAqBD,MAArB,CAA4B/D,KAAKM,MAAL,CAAYa,GAAZ,CAAgBuC,QAAhB,EAA5B,EAAwD;AAC7De,WAAO;AACLJ,uBAAiBrE,KAAKM,MAAL,CAAYa,GAAZ,CAAgBuC,QAAhB,KAA6B,UADzC;AAELQ,aAAO;AAFF,KADsD;AAK7DP,UAAM3D,KAAKuB,MAAL,CAAYoC,IAL2C;AAM7D;AACA;AACAW,cAAUtE,KAAKM,MAR8C;AAS7DiE,sBAAkBvE,KAAKwD;AATsC,GAAxD,EAWJI,IAXI,CAWCY,iBAAiB;AACrBnD,UAAM,2CAA2CrB,KAAKM,MAAL,CAAYa,GAA7D;AACA,WAAOnB,IAAP;AACD,GAdI,CAAP;AAeD;;AAEM,SAAS4C,0BAAT,CAAqC8B,aAArC,EAAoD;AACzD;AAAA,iCAAO,WAAgB1E,IAAhB,EAAsB;AAC3B,UAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,cAAM,IAAIC,KAAJ,CAAU,kFAAV,CAAN;AACD;;AAED,YAAMC,MAAMH,KAAKG,GAAjB;AACA;AACA,YAAMO,oBAAoBP,IAAIE,UAAJ,CAAe,SAAf,EAA0BL,KAAKwD,OAAL,CAAamB,YAAb,EAA1B,CAA1B;AACA,YAAMhE,UAAU,MAAMD,kBAAkBF,IAAlB,CAAuB;AAC3CiE,eAAO,EAAE,CAACC,aAAD,GAAiB,EAAEE,YAAY,EAAEzD,KAAKnB,KAAKM,MAAL,CAAYa,GAAnB,EAAd,EAAnB,EADoC;AAE3CV,kBAAU;AAFiC,OAAvB,CAAtB;AAIA;AACA,YAAMoE,QAAQC,GAAR,CAAYnE,QAAQoE,GAAR,CAAY,kBAAU;AACtC,cAAMC,YAAYjE,iBAAEmC,GAAF,CAAMrC,MAAN,EAAc6D,aAAd,EAA6B,EAA7B,CAAlB;AACA,cAAMJ,WAAWvD,iBAAEP,IAAF,CAAOwE,SAAP,EAAkB,EAAE7D,KAAKnB,KAAKM,MAAL,CAAYa,GAAnB,EAAlB,CAAjB;AACA,YAAImD,QAAJ,EAAc;AACZW,iBAAOC,MAAP,CAAcZ,QAAd,EAAwBtE,KAAKM,MAA7B;AACA,iBAAOI,kBAAkBU,KAAlB,CAAwBP,OAAOM,GAA/B,EAAoC,EAAE,CAACuD,aAAD,GAAiBM,SAAnB,EAApC,CAAP;AACD,SAHD,MAGO;AACL,iBAAOH,QAAQM,OAAR,EAAP;AACD;AACF,OATiB,CAAZ,CAAN;;AAWA9D,YAAO,oBAAmBrB,KAAKM,MAAL,CAAYa,GAAI,aAAYuD,aAAc,+BAA9D,GAA+F1E,KAAKM,MAAL,CAAYa,GAAjH;AACA,aAAOnB,IAAP;AACD,KA1BD;;AAAA;AAAA;AAAA;AAAA;AA2BD;;AAEM,SAAS6C,wBAAT,CAAmC7C,IAAnC,EAAyC;AAC9C,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,gFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAMsB,kBAAkBtB,IAAIE,UAAJ,CAAe,QAAf,EAAyBL,KAAKM,MAA9B,CAAxB;AACA,SAAOmB,gBAAgBjB,IAAhB,CAAqB,EAAEC,UAAU,KAAZ,EAArB,EACJmD,IADI,CACCwB,UAAU;AACd,WAAOP,QAAQC,GAAR,CAAYM,OAAOL,GAAP,CAAWM,SAAS;AACrC,aAAO5D,gBAAgBsC,MAAhB,CAAuBsB,MAAMlE,GAAN,CAAUuC,QAAV,EAAvB,EAA6C;AAClDC,cAAM3D,KAAKuB,MAAL,CAAYoC;AADgC,OAA7C,CAAP;AAGD,KAJkB,CAAZ,CAAP;AAKD,GAPI,EAQJC,IARI,CAQCwB,UAAU;AACd/D,UAAM,qCAAqCrB,KAAKM,MAAL,CAAYa,GAAvD;AACA,WAAOnB,IAAP;AACD,GAXI,CAAP;AAYD;;AA6BM,SAAS8C,yBAAT,CAAoC9C,IAApC,EAA0C;AAC/C,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,iFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAMoD,sBAAsBpD,IAAIE,UAAJ,CAAe,eAAf,CAA5B;AACA;AACA,SAAOkD,oBAAoBrB,MAApB,CAA2B;AAChCf,SAAKnB,KAAKM,MAAL,CAAYa,GADe,EACV;AACtBgB,UAAMnC,KAAKM,MAAL,CAAYgF,OAAZ,CAAoBnD,IAFM,CAED;AAFC,GAA3B,EAGJ;AACDwB,UAAM3D,KAAKM;AADV,GAHI,EAMJsD,IANI,CAMC2B,OAAO;AACXlE,UAAM,2CAA2CrB,KAAKM,MAAL,CAAYa,GAA7D;AACD,GARI,CAAP;AASD;;AAEM,SAAS4B,yBAAT,CAAoC/C,IAApC,EAA0C;AAC/C,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,iFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAMoD,sBAAsBpD,IAAIE,UAAJ,CAAe,eAAf,CAA5B;AACA;AACA,SAAOkD,oBAAoBQ,MAApB,CAA2B/D,KAAKM,MAAL,CAAYa,GAAZ,CAAgBuC,QAAhB,EAA3B,EAAuD;AAC5DC,UAAM3D,KAAKM;AADiD,GAAvD,EAGJsD,IAHI,CAGC2B,OAAO;AACXlE,UAAM,2CAA2CrB,KAAKM,MAAL,CAAYa,GAA7D;AACD,GALI,CAAP;AAMD","file":"hooks.organisations.js","sourcesContent":["import _ from 'lodash'\r\nimport makeDebug from 'debug'\r\nimport { Forbidden } from '@feathersjs/errors'\r\nconst debug = makeDebug('kdk:core:organisations:hooks')\r\n\r\nexport function addOrganisationPlan (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'addOrganisationPlan\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n\r\n  const plans = _.keys(hook.app.get('plans') || {})\r\n  const plan = _.get(hook.data, 'billing.plan')\r\n  if (!plan && (plans.length > 0)) {\r\n    // Add defaul plan\r\n    _.set(hook.data, 'billing.plan', plans[0])\r\n    debug('Added default plan to organisation: ', hook.data)\r\n  }\r\n  return hook\r\n}\r\n\r\nexport function createOrganisationServices (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'createOrganisationServices\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const organisationService = hook.service\r\n  const databaseService = app.getService('databases')\r\n\r\n  // First we create the organisation DB\r\n  return databaseService.create({\r\n    name: hook.result._id.toString()\r\n  }, {\r\n    user: hook.params.user\r\n  })\r\n    .then(db => {\r\n      debug('DB created for organisation ' + hook.result.name)\r\n      // Jump from infos/stats to real DB object\r\n      db = app.db.client.db(hook.result._id.toString())\r\n      organisationService.createOrganisationServices(hook.result, db)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport function removeOrganisationServices (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'removeOrganisationServices\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const organisationService = hook.service\r\n  const databaseService = app.getService('databases')\r\n\r\n  // Then we remove the organisation DB\r\n  return databaseService.remove(hook.result._id.toString(), {\r\n    user: hook.params.user\r\n  })\r\n    .then(db => {\r\n      debug('DB removed for organisation ' + hook.result.name)\r\n      organisationService.removeOrganisationServices(hook.result)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport function createOrganisationAuthorisations (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'createOrganisationAuthorisations\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const authorisationService = app.getService('authorisations')\r\n  const userService = app.getService('users')\r\n  // Set membership for the owner\r\n  return authorisationService.create({\r\n    scope: 'organisations',\r\n    permissions: 'owner' // Owner by default\r\n  }, {\r\n    user: hook.params.user,\r\n    // Because we already have subject/resource set it as objects to avoid populating\r\n    subjects: [hook.params.user],\r\n    subjectsService: userService,\r\n    resource: hook.result,\r\n    resourcesService: hook.service\r\n  })\r\n    .then(authorisation => {\r\n      debug('Organisation ownership set for user ' + hook.result._id)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport function removeOrganisationAuthorisations (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'removeOrganisationAuthorisations\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const authorisationService = app.getService('authorisations')\r\n\r\n  // Unset membership for the all org users\r\n  return authorisationService.remove(hook.result._id.toString(), {\r\n    query: {\r\n      subjectsService: hook.result._id.toString() + '/members',\r\n      scope: 'organisations'\r\n    },\r\n    user: hook.params.user,\r\n    // Because we already have resource set it as objects to avoid populating\r\n    // Moreover used as an after hook the resource might not already exist anymore\r\n    resource: hook.result,\r\n    resourcesService: hook.service\r\n  })\r\n    .then(authorisation => {\r\n      debug('Authorisations unset for organisation ' + hook.result._id)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport function updateOrganisationResource (resourceScope) {\r\n  return async function (hook) {\r\n    if (hook.type !== 'after') {\r\n      throw new Error('The \\'updateOrganisationResource\\' hook should only be used as a \\'after\\' hook.')\r\n    }\r\n\r\n    const app = hook.app\r\n    // Retrieve the list of members\r\n    const orgMembersService = app.getService('members', hook.service.getContextId())\r\n    const members = await orgMembersService.find({\r\n      query: { [resourceScope]: { $elemMatch: { _id: hook.result._id } } },\r\n      paginate: false\r\n    })\r\n    // Update each members\r\n    await Promise.all(members.map(member => {\r\n      const resources = _.get(member, resourceScope, [])\r\n      const resource = _.find(resources, { _id: hook.result._id })\r\n      if (resource) {\r\n        Object.assign(resource, hook.result)\r\n        return orgMembersService.patch(member._id, { [resourceScope]: resources })\r\n      } else {\r\n        return Promise.resolve()\r\n      }\r\n    }))\r\n\r\n    debug(`Updated resource ${hook.result._id} on scope ${resourceScope} for members of organisation ` + hook.result._id)\r\n    return hook\r\n  }\r\n}\r\n\r\nexport function removeOrganisationGroups (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'removeOrganisationGroups\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const orgGroupService = app.getService('groups', hook.result)\r\n  return orgGroupService.find({ paginate: false })\r\n    .then(groups => {\r\n      return Promise.all(groups.map(group => {\r\n        return orgGroupService.remove(group._id.toString(), {\r\n          user: hook.params.user\r\n        })\r\n      }))\r\n    })\r\n    .then(groups => {\r\n      debug('Removed groups for organisation ' + hook.result._id)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport async function removeOrganisationTags (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'removeOrganisationTags\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  // Retrieve the list of tags\r\n  const orgTagsService = app.getService('tags', hook.result)\r\n  const tags = await orgTagsService.find({ paginate: false })\r\n  // Retrieve the list of members\r\n  const orgMembersService = app.getService('members', hook.result)\r\n  const members = await orgMembersService.find({ paginate: false })\r\n  // Update each members\r\n  for (const i in members) {\r\n    const member = members[i]\r\n    if (member.tags) {\r\n      const filteredTagsMember = _.filter(member.tags, (tag) => {\r\n        return _.findIndex(tags, { _id: tag._id }) === -1\r\n      })\r\n      await orgMembersService.patch(member._id, { tags: filteredTagsMember })\r\n    }\r\n  }\r\n\r\n  debug('Removed tags from organisation ' + hook.result._id)\r\n  return hook\r\n}\r\n\r\nexport function createPrivateOrganisation (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'createPrivateOrganisation\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const organisationService = app.getService('organisations')\r\n  // Create a private organisation for the user\r\n  return organisationService.create({\r\n    _id: hook.result._id, // Same ID as user, fine because in another service\r\n    name: hook.result.profile.name // Same name as user\r\n  }, {\r\n    user: hook.result\r\n  })\r\n    .then(org => {\r\n      debug('Private organisation created for user ' + hook.result._id)\r\n    })\r\n}\r\n\r\nexport function removePrivateOrganisation (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'removePrivateOrganisation\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const organisationService = app.getService('organisations')\r\n  // Remove the private user's organisation\r\n  return organisationService.remove(hook.result._id.toString(), {\r\n    user: hook.result\r\n  })\r\n    .then(org => {\r\n      debug('Private organisation removed for user ' + hook.result._id)\r\n    })\r\n}\r\n\r\nexport async function preventRemoveOrganisation (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'preventRemoveOrganisations\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n\r\n  // By pass check ?\r\n  if (hook.params.force) return hook\r\n  const app = hook.app\r\n  const orgGroupService = app.getService('groups', hook.id)\r\n  const result = await orgGroupService.find({ $limit: 0 })\r\n  if (result.total > 0) {\r\n    throw new Forbidden('You are not allowed to delete the organisation', {\r\n      translation: { key: 'CANNOT_REMOVE_ORGANISATION' }\r\n    })\r\n  }\r\n  return hook\r\n}\r\n\r\nexport async function createSubscribersGroup (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'createSubscribersGroup\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const orgId = hook.result._id\r\n  const orgGroupService = app.getService('groups', orgId)\r\n  await orgGroupService.create({\r\n    name: 'KGroup.SUBSCRIBERS_GROUP_NAME',\r\n    description: 'KGroup.SUBSCRIBERS_GROUP_DESCRIPTION',\r\n    system: true\r\n  }, hook.params)\r\n  return hook\r\n}\r\n"]}
+{"version":3,"sources":["../../../../core/api/hooks/hooks.organisations.js"],"names":["hook","type","Error","app","orgTagsService","getService","result","tags","find","paginate","orgMembersService","members","i","member","filteredTagsMember","_","filter","tag","findIndex","_id","patch","debug","removeOrganisationTags","params","force","orgGroupService","id","$limit","total","Forbidden","translation","key","preventRemoveOrganisation","addOrganisationPlan","createOrganisationServices","removeOrganisationServices","createOrganisationAuthorisations","removeOrganisationAuthorisations","updateOrganisationResource","removeOrganisationGroups","createPrivateOrganisation","removePrivateOrganisation","plans","keys","get","plan","data","length","set","organisationService","service","databaseService","create","name","toString","user","then","db","client","remove","authorisationService","userService","scope","permissions","subjects","subjectsService","resource","resourcesService","authorisation","query","resourceScope","getContextId","$elemMatch","Promise","all","map","resources","Object","assign","resolve","groups","group","profile","org"],"mappings":";;;;;;;;gCAuKO,WAAuCA,IAAvC,EAA6C;AAClD,QAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,YAAM,IAAIC,KAAJ,CAAU,8EAAV,CAAN;AACD;;AAED,UAAMC,MAAMH,KAAKG,GAAjB;AACA;AACA,UAAMC,iBAAiBD,IAAIE,UAAJ,CAAe,MAAf,EAAuBL,KAAKM,MAA5B,CAAvB;AACA,UAAMC,OAAO,MAAMH,eAAeI,IAAf,CAAoB,EAAEC,UAAU,KAAZ,EAApB,CAAnB;AACA;AACA,UAAMC,oBAAoBP,IAAIE,UAAJ,CAAe,SAAf,EAA0BL,KAAKM,MAA/B,CAA1B;AACA,UAAMK,UAAU,MAAMD,kBAAkBF,IAAlB,CAAuB,EAAEC,UAAU,KAAZ,EAAvB,CAAtB;AACA;AACA,SAAK,MAAMG,CAAX,IAAgBD,OAAhB,EAAyB;AACvB,YAAME,SAASF,QAAQC,CAAR,CAAf;AACA,UAAIC,OAAON,IAAX,EAAiB;AACf,cAAMO,qBAAqBC,iBAAEC,MAAF,CAASH,OAAON,IAAhB,EAAsB,UAACU,GAAD,EAAS;AACxD,iBAAOF,iBAAEG,SAAF,CAAYX,IAAZ,EAAkB,EAAEY,KAAKF,IAAIE,GAAX,EAAlB,MAAwC,CAAC,CAAhD;AACD,SAF0B,CAA3B;AAGA,cAAMT,kBAAkBU,KAAlB,CAAwBP,OAAOM,GAA/B,EAAoC,EAAEZ,MAAMO,kBAAR,EAApC,CAAN;AACD;AACF;;AAEDO,UAAM,oCAAoCrB,KAAKM,MAAL,CAAYa,GAAtD;AACA,WAAOnB,IAAP;AACD,G;;kBAzBqBsB,sB;;;;;;gCA8Df,WAA0CtB,IAA1C,EAAgD;AACrD,QAAIA,KAAKC,IAAL,KAAc,QAAlB,EAA4B;AAC1B,YAAM,IAAIC,KAAJ,CAAU,mFAAV,CAAN;AACD;;AAED;AACA,QAAIF,KAAKuB,MAAL,CAAYC,KAAhB,EAAuB,OAAOxB,IAAP;AACvB,UAAMG,MAAMH,KAAKG,GAAjB;AACA,UAAMsB,kBAAkBtB,IAAIE,UAAJ,CAAe,QAAf,EAAyBL,KAAK0B,EAA9B,CAAxB;AACA,UAAMpB,SAAS,MAAMmB,gBAAgBjB,IAAhB,CAAqB,EAAEmB,QAAQ,CAAV,EAArB,CAArB;AACA,QAAIrB,OAAOsB,KAAP,GAAe,CAAnB,EAAsB;AACpB,YAAM,IAAIC,iBAAJ,CAAc,gDAAd,EAAgE;AACpEC,qBAAa,EAAEC,KAAK,4BAAP;AADuD,OAAhE,CAAN;AAGD;AACD,WAAO/B,IAAP;AACD,G;;kBAhBqBgC,yB;;;;;QAhONC,mB,GAAAA,mB;QAeAC,0B,GAAAA,0B;QAwBAC,0B,GAAAA,0B;QAoBAC,gC,GAAAA,gC;QA0BAC,gC,GAAAA,gC;QA0BAC,0B,GAAAA,0B;QA8BAC,wB,GAAAA,wB;QAgDAC,yB,GAAAA,yB;QAmBAC,yB,GAAAA,yB;;AArNhB;;;;AACA;;;;AACA;;;;;;AACA,MAAMpB,QAAQ,qBAAU,8BAAV,CAAd;;AAEO,SAASY,mBAAT,CAA8BjC,IAA9B,EAAoC;AACzC,MAAIA,KAAKC,IAAL,KAAc,QAAlB,EAA4B;AAC1B,UAAM,IAAIC,KAAJ,CAAU,4EAAV,CAAN;AACD;;AAED,QAAMwC,QAAQ3B,iBAAE4B,IAAF,CAAO3C,KAAKG,GAAL,CAASyC,GAAT,CAAa,OAAb,KAAyB,EAAhC,CAAd;AACA,QAAMC,OAAO9B,iBAAE6B,GAAF,CAAM5C,KAAK8C,IAAX,EAAiB,cAAjB,CAAb;AACA,MAAI,CAACD,IAAD,IAAUH,MAAMK,MAAN,GAAe,CAA7B,EAAiC;AAC/B;AACAhC,qBAAEiC,GAAF,CAAMhD,KAAK8C,IAAX,EAAiB,cAAjB,EAAiCJ,MAAM,CAAN,CAAjC;AACArB,UAAM,sCAAN,EAA8CrB,KAAK8C,IAAnD;AACD;AACD,SAAO9C,IAAP;AACD;;AAEM,SAASkC,0BAAT,CAAqClC,IAArC,EAA2C;AAChD,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,kFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAM8C,sBAAsBjD,KAAKkD,OAAjC;AACA,QAAMC,kBAAkBhD,IAAIE,UAAJ,CAAe,WAAf,CAAxB;;AAEA;AACA,SAAO8C,gBAAgBC,MAAhB,CAAuB;AAC5BC,UAAMrD,KAAKM,MAAL,CAAYa,GAAZ,CAAgBmC,QAAhB;AADsB,GAAvB,EAEJ;AACDC,UAAMvD,KAAKuB,MAAL,CAAYgC;AADjB,GAFI,EAKJC,IALI,CAKCC,MAAM;AACVpC,UAAM,iCAAiCrB,KAAKM,MAAL,CAAY+C,IAAnD;AACA;AACAI,SAAKtD,IAAIsD,EAAJ,CAAOC,MAAP,CAAcD,EAAd,CAAiBzD,KAAKM,MAAL,CAAYa,GAAZ,CAAgBmC,QAAhB,EAAjB,CAAL;AACAL,wBAAoBf,0BAApB,CAA+ClC,KAAKM,MAApD,EAA4DmD,EAA5D;AACA,WAAOzD,IAAP;AACD,GAXI,CAAP;AAYD;;AAEM,SAASmC,0BAAT,CAAqCnC,IAArC,EAA2C;AAChD,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,kFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAM8C,sBAAsBjD,KAAKkD,OAAjC;AACA,QAAMC,kBAAkBhD,IAAIE,UAAJ,CAAe,WAAf,CAAxB;;AAEA;AACA,SAAO8C,gBAAgBQ,MAAhB,CAAuB3D,KAAKM,MAAL,CAAYa,GAAZ,CAAgBmC,QAAhB,EAAvB,EAAmD;AACxDC,UAAMvD,KAAKuB,MAAL,CAAYgC;AADsC,GAAnD,EAGJC,IAHI,CAGCC,MAAM;AACVpC,UAAM,iCAAiCrB,KAAKM,MAAL,CAAY+C,IAAnD;AACAJ,wBAAoBd,0BAApB,CAA+CnC,KAAKM,MAApD;AACA,WAAON,IAAP;AACD,GAPI,CAAP;AAQD;;AAEM,SAASoC,gCAAT,CAA2CpC,IAA3C,EAAiD;AACtD,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,wFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAMyD,uBAAuBzD,IAAIE,UAAJ,CAAe,gBAAf,CAA7B;AACA,QAAMwD,cAAc1D,IAAIE,UAAJ,CAAe,OAAf,CAApB;AACA;AACA,SAAOuD,qBAAqBR,MAArB,CAA4B;AACjCU,WAAO,eAD0B;AAEjCC,iBAAa,OAFoB,CAEZ;AAFY,GAA5B,EAGJ;AACDR,UAAMvD,KAAKuB,MAAL,CAAYgC,IADjB;AAED;AACAS,cAAU,CAAChE,KAAKuB,MAAL,CAAYgC,IAAb,CAHT;AAIDU,qBAAiBJ,WAJhB;AAKDK,cAAUlE,KAAKM,MALd;AAMD6D,sBAAkBnE,KAAKkD;AANtB,GAHI,EAWJM,IAXI,CAWCY,iBAAiB;AACrB/C,UAAM,yCAAyCrB,KAAKM,MAAL,CAAYa,GAA3D;AACA,WAAOnB,IAAP;AACD,GAdI,CAAP;AAeD;;AAEM,SAASqC,gCAAT,CAA2CrC,IAA3C,EAAiD;AACtD,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,wFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAMyD,uBAAuBzD,IAAIE,UAAJ,CAAe,gBAAf,CAA7B;;AAEA;AACA,SAAOuD,qBAAqBD,MAArB,CAA4B3D,KAAKM,MAAL,CAAYa,GAAZ,CAAgBmC,QAAhB,EAA5B,EAAwD;AAC7De,WAAO;AACLJ,uBAAiBjE,KAAKM,MAAL,CAAYa,GAAZ,CAAgBmC,QAAhB,KAA6B,UADzC;AAELQ,aAAO;AAFF,KADsD;AAK7DP,UAAMvD,KAAKuB,MAAL,CAAYgC,IAL2C;AAM7D;AACA;AACAW,cAAUlE,KAAKM,MAR8C;AAS7D6D,sBAAkBnE,KAAKkD;AATsC,GAAxD,EAWJM,IAXI,CAWCY,iBAAiB;AACrB/C,UAAM,2CAA2CrB,KAAKM,MAAL,CAAYa,GAA7D;AACA,WAAOnB,IAAP;AACD,GAdI,CAAP;AAeD;;AAEM,SAASsC,0BAAT,CAAqCgC,aAArC,EAAoD;AACzD;AAAA,iCAAO,WAAgBtE,IAAhB,EAAsB;AAC3B,UAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,cAAM,IAAIC,KAAJ,CAAU,kFAAV,CAAN;AACD;;AAED,YAAMC,MAAMH,KAAKG,GAAjB;AACA;AACA,YAAMO,oBAAoBP,IAAIE,UAAJ,CAAe,SAAf,EAA0BL,KAAKkD,OAAL,CAAaqB,YAAb,EAA1B,CAA1B;AACA,YAAM5D,UAAU,MAAMD,kBAAkBF,IAAlB,CAAuB;AAC3C6D,eAAO,EAAE,CAACC,aAAD,GAAiB,EAAEE,YAAY,EAAErD,KAAKnB,KAAKM,MAAL,CAAYa,GAAnB,EAAd,EAAnB,EADoC;AAE3CV,kBAAU;AAFiC,OAAvB,CAAtB;AAIA;AACA,YAAMgE,QAAQC,GAAR,CAAY/D,QAAQgE,GAAR,CAAY,kBAAU;AACtC,cAAMC,YAAY7D,iBAAE6B,GAAF,CAAM/B,MAAN,EAAcyD,aAAd,EAA6B,EAA7B,CAAlB;AACA,cAAMJ,WAAWnD,iBAAEP,IAAF,CAAOoE,SAAP,EAAkB,EAAEzD,KAAKnB,KAAKM,MAAL,CAAYa,GAAnB,EAAlB,CAAjB;AACA,YAAI+C,QAAJ,EAAc;AACZW,iBAAOC,MAAP,CAAcZ,QAAd,EAAwBlE,KAAKM,MAA7B;AACA,iBAAOI,kBAAkBU,KAAlB,CAAwBP,OAAOM,GAA/B,EAAoC,EAAE,CAACmD,aAAD,GAAiBM,SAAnB,EAApC,CAAP;AACD,SAHD,MAGO;AACL,iBAAOH,QAAQM,OAAR,EAAP;AACD;AACF,OATiB,CAAZ,CAAN;;AAWA1D,YAAO,oBAAmBrB,KAAKM,MAAL,CAAYa,GAAI,aAAYmD,aAAc,+BAA9D,GAA+FtE,KAAKM,MAAL,CAAYa,GAAjH;AACA,aAAOnB,IAAP;AACD,KA1BD;;AAAA;AAAA;AAAA;AAAA;AA2BD;;AAEM,SAASuC,wBAAT,CAAmCvC,IAAnC,EAAyC;AAC9C,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,gFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAMsB,kBAAkBtB,IAAIE,UAAJ,CAAe,QAAf,EAAyBL,KAAKM,MAA9B,CAAxB;AACA,SAAOmB,gBAAgBjB,IAAhB,CAAqB,EAAEC,UAAU,KAAZ,EAArB,EACJ+C,IADI,CACCwB,UAAU;AACd,WAAOP,QAAQC,GAAR,CAAYM,OAAOL,GAAP,CAAWM,SAAS;AACrC,aAAOxD,gBAAgBkC,MAAhB,CAAuBsB,MAAM9D,GAAN,CAAUmC,QAAV,EAAvB,EAA6C;AAClDC,cAAMvD,KAAKuB,MAAL,CAAYgC;AADgC,OAA7C,CAAP;AAGD,KAJkB,CAAZ,CAAP;AAKD,GAPI,EAQJC,IARI,CAQCwB,UAAU;AACd3D,UAAM,qCAAqCrB,KAAKM,MAAL,CAAYa,GAAvD;AACA,WAAOnB,IAAP;AACD,GAXI,CAAP;AAYD;;AA6BM,SAASwC,yBAAT,CAAoCxC,IAApC,EAA0C;AAC/C,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,iFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAM8C,sBAAsB9C,IAAIE,UAAJ,CAAe,eAAf,CAA5B;AACA;AACA,SAAO4C,oBAAoBG,MAApB,CAA2B;AAChCjC,SAAKnB,KAAKM,MAAL,CAAYa,GADe,EACV;AACtBkC,UAAMrD,KAAKM,MAAL,CAAY4E,OAAZ,CAAoB7B,IAFM,CAED;AAFC,GAA3B,EAGJ;AACDE,UAAMvD,KAAKM;AADV,GAHI,EAMJkD,IANI,CAMC2B,OAAO;AACX9D,UAAM,2CAA2CrB,KAAKM,MAAL,CAAYa,GAA7D;AACD,GARI,CAAP;AASD;;AAEM,SAASsB,yBAAT,CAAoCzC,IAApC,EAA0C;AAC/C,MAAIA,KAAKC,IAAL,KAAc,OAAlB,EAA2B;AACzB,UAAM,IAAIC,KAAJ,CAAU,iFAAV,CAAN;AACD;;AAED,QAAMC,MAAMH,KAAKG,GAAjB;AACA,QAAM8C,sBAAsB9C,IAAIE,UAAJ,CAAe,eAAf,CAA5B;AACA;AACA,SAAO4C,oBAAoBU,MAApB,CAA2B3D,KAAKM,MAAL,CAAYa,GAAZ,CAAgBmC,QAAhB,EAA3B,EAAuD;AAC5DC,UAAMvD,KAAKM;AADiD,GAAvD,EAGJkD,IAHI,CAGC2B,OAAO;AACX9D,UAAM,2CAA2CrB,KAAKM,MAAL,CAAYa,GAA7D;AACD,GALI,CAAP;AAMD","file":"hooks.organisations.js","sourcesContent":["import _ from 'lodash'\r\nimport makeDebug from 'debug'\r\nimport { Forbidden } from '@feathersjs/errors'\r\nconst debug = makeDebug('kdk:core:organisations:hooks')\r\n\r\nexport function addOrganisationPlan (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'addOrganisationPlan\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n\r\n  const plans = _.keys(hook.app.get('plans') || {})\r\n  const plan = _.get(hook.data, 'billing.plan')\r\n  if (!plan && (plans.length > 0)) {\r\n    // Add defaul plan\r\n    _.set(hook.data, 'billing.plan', plans[0])\r\n    debug('Added default plan to organisation: ', hook.data)\r\n  }\r\n  return hook\r\n}\r\n\r\nexport function createOrganisationServices (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'createOrganisationServices\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const organisationService = hook.service\r\n  const databaseService = app.getService('databases')\r\n\r\n  // First we create the organisation DB\r\n  return databaseService.create({\r\n    name: hook.result._id.toString()\r\n  }, {\r\n    user: hook.params.user\r\n  })\r\n    .then(db => {\r\n      debug('DB created for organisation ' + hook.result.name)\r\n      // Jump from infos/stats to real DB object\r\n      db = app.db.client.db(hook.result._id.toString())\r\n      organisationService.createOrganisationServices(hook.result, db)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport function removeOrganisationServices (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'removeOrganisationServices\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const organisationService = hook.service\r\n  const databaseService = app.getService('databases')\r\n\r\n  // Then we remove the organisation DB\r\n  return databaseService.remove(hook.result._id.toString(), {\r\n    user: hook.params.user\r\n  })\r\n    .then(db => {\r\n      debug('DB removed for organisation ' + hook.result.name)\r\n      organisationService.removeOrganisationServices(hook.result)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport function createOrganisationAuthorisations (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'createOrganisationAuthorisations\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const authorisationService = app.getService('authorisations')\r\n  const userService = app.getService('users')\r\n  // Set membership for the owner\r\n  return authorisationService.create({\r\n    scope: 'organisations',\r\n    permissions: 'owner' // Owner by default\r\n  }, {\r\n    user: hook.params.user,\r\n    // Because we already have subject/resource set it as objects to avoid populating\r\n    subjects: [hook.params.user],\r\n    subjectsService: userService,\r\n    resource: hook.result,\r\n    resourcesService: hook.service\r\n  })\r\n    .then(authorisation => {\r\n      debug('Organisation ownership set for user ' + hook.result._id)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport function removeOrganisationAuthorisations (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'removeOrganisationAuthorisations\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const authorisationService = app.getService('authorisations')\r\n\r\n  // Unset membership for the all org users\r\n  return authorisationService.remove(hook.result._id.toString(), {\r\n    query: {\r\n      subjectsService: hook.result._id.toString() + '/members',\r\n      scope: 'organisations'\r\n    },\r\n    user: hook.params.user,\r\n    // Because we already have resource set it as objects to avoid populating\r\n    // Moreover used as an after hook the resource might not already exist anymore\r\n    resource: hook.result,\r\n    resourcesService: hook.service\r\n  })\r\n    .then(authorisation => {\r\n      debug('Authorisations unset for organisation ' + hook.result._id)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport function updateOrganisationResource (resourceScope) {\r\n  return async function (hook) {\r\n    if (hook.type !== 'after') {\r\n      throw new Error('The \\'updateOrganisationResource\\' hook should only be used as a \\'after\\' hook.')\r\n    }\r\n\r\n    const app = hook.app\r\n    // Retrieve the list of members\r\n    const orgMembersService = app.getService('members', hook.service.getContextId())\r\n    const members = await orgMembersService.find({\r\n      query: { [resourceScope]: { $elemMatch: { _id: hook.result._id } } },\r\n      paginate: false\r\n    })\r\n    // Update each members\r\n    await Promise.all(members.map(member => {\r\n      const resources = _.get(member, resourceScope, [])\r\n      const resource = _.find(resources, { _id: hook.result._id })\r\n      if (resource) {\r\n        Object.assign(resource, hook.result)\r\n        return orgMembersService.patch(member._id, { [resourceScope]: resources })\r\n      } else {\r\n        return Promise.resolve()\r\n      }\r\n    }))\r\n\r\n    debug(`Updated resource ${hook.result._id} on scope ${resourceScope} for members of organisation ` + hook.result._id)\r\n    return hook\r\n  }\r\n}\r\n\r\nexport function removeOrganisationGroups (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'removeOrganisationGroups\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const orgGroupService = app.getService('groups', hook.result)\r\n  return orgGroupService.find({ paginate: false })\r\n    .then(groups => {\r\n      return Promise.all(groups.map(group => {\r\n        return orgGroupService.remove(group._id.toString(), {\r\n          user: hook.params.user\r\n        })\r\n      }))\r\n    })\r\n    .then(groups => {\r\n      debug('Removed groups for organisation ' + hook.result._id)\r\n      return hook\r\n    })\r\n}\r\n\r\nexport async function removeOrganisationTags (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'removeOrganisationTags\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  // Retrieve the list of tags\r\n  const orgTagsService = app.getService('tags', hook.result)\r\n  const tags = await orgTagsService.find({ paginate: false })\r\n  // Retrieve the list of members\r\n  const orgMembersService = app.getService('members', hook.result)\r\n  const members = await orgMembersService.find({ paginate: false })\r\n  // Update each members\r\n  for (const i in members) {\r\n    const member = members[i]\r\n    if (member.tags) {\r\n      const filteredTagsMember = _.filter(member.tags, (tag) => {\r\n        return _.findIndex(tags, { _id: tag._id }) === -1\r\n      })\r\n      await orgMembersService.patch(member._id, { tags: filteredTagsMember })\r\n    }\r\n  }\r\n\r\n  debug('Removed tags from organisation ' + hook.result._id)\r\n  return hook\r\n}\r\n\r\nexport function createPrivateOrganisation (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'createPrivateOrganisation\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const organisationService = app.getService('organisations')\r\n  // Create a private organisation for the user\r\n  return organisationService.create({\r\n    _id: hook.result._id, // Same ID as user, fine because in another service\r\n    name: hook.result.profile.name // Same name as user\r\n  }, {\r\n    user: hook.result\r\n  })\r\n    .then(org => {\r\n      debug('Private organisation created for user ' + hook.result._id)\r\n    })\r\n}\r\n\r\nexport function removePrivateOrganisation (hook) {\r\n  if (hook.type !== 'after') {\r\n    throw new Error('The \\'removePrivateOrganisation\\' hook should only be used as a \\'after\\' hook.')\r\n  }\r\n\r\n  const app = hook.app\r\n  const organisationService = app.getService('organisations')\r\n  // Remove the private user's organisation\r\n  return organisationService.remove(hook.result._id.toString(), {\r\n    user: hook.result\r\n  })\r\n    .then(org => {\r\n      debug('Private organisation removed for user ' + hook.result._id)\r\n    })\r\n}\r\n\r\nexport async function preventRemoveOrganisation (hook) {\r\n  if (hook.type !== 'before') {\r\n    throw new Error('The \\'preventRemoveOrganisations\\' hook should only be used as a \\'before\\' hook.')\r\n  }\r\n\r\n  // By pass check ?\r\n  if (hook.params.force) return hook\r\n  const app = hook.app\r\n  const orgGroupService = app.getService('groups', hook.id)\r\n  const result = await orgGroupService.find({ $limit: 0 })\r\n  if (result.total > 0) {\r\n    throw new Forbidden('You are not allowed to delete the organisation', {\r\n      translation: { key: 'CANNOT_REMOVE_ORGANISATION' }\r\n    })\r\n  }\r\n  return hook\r\n}\r\n"]}