@kalisio/kdk 1.3.5 → 1.4.2

package/lib/core/common/permissions.js

@@ -3,10 +3,47 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.RESOURCE_TYPE_KEY = exports.RESOURCE_TYPE = exports.RoleNames = exports.Roles = undefined;
+exports.defineAbilities = exports.RESOURCE_TYPE_KEY = exports.RESOURCE_TYPE = exports.RoleNames = exports.Roles = undefined;
+
+// Compute abilities for a given user
+let defineAbilities = exports.defineAbilities = (() => {
+  var _ref = _asyncToGenerator(function* (subject, ...args) {
+    const { rules, can, cannot } = _umd.AbilityBuilder.extract();
+
+    // Run registered hooks providing any additional arguments used to handle complex use cases
+    yield Promise.all(hooks.map((() => {
+      var _ref2 = _asyncToGenerator(function* (hook) {
+        yield hook(subject, can, cannot, ...args);
+      });
+
+      return function (_x2) {
+        return _ref2.apply(this, arguments);
+      };
+    })()));
+
+    // CASL cannot infer the object type from the object itself so we need
+    // to tell it how he can find the object type, i.e. service name.
+    return new _umd.Ability(rules, {
+      subjectName: function (resource) {
+        if (!resource || typeof resource === 'string') {
+          return resource;
+        }
+        return resource[RESOURCE_TYPE_KEY];
+      }
+    });
+  });
+
+  return function defineAbilities(_x) {
+    return _ref.apply(this, arguments);
+  };
+})();
+
+exports.isSeniorRole = isSeniorRole;
+exports.isJuniorRole = isJuniorRole;
+exports.getSeniorRoles = getSeniorRoles;
+exports.getJuniorRoles = getJuniorRoles;
 exports.defineResourceRules = defineResourceRules;
 exports.defineUserAbilities = defineUserAbilities;
-exports.defineAbilities = defineAbilities;
 exports.hasServiceAbilities = hasServiceAbilities;
 exports.hasResourceAbilities = hasResourceAbilities;
 exports.removeContext = removeContext;
@@ -31,6 +68,8 @@ var _umd = require('casl/dist/umd');
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
+function _asyncToGenerator(fn) { return function () { var gen = fn.apply(this, arguments); return new Promise(function (resolve, reject) { function step(key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { return Promise.resolve(value).then(function (value) { step("next", value); }, function (err) { step("throw", err); }); } } return step("next"); }); }; }
+
 // Define some alias to simplify ability definitions
 _umd.Ability.addAlias('update', 'patch');
 _umd.Ability.addAlias('read', ['get', 'find']);
@@ -45,6 +84,30 @@ const Roles = exports.Roles = {
 
 const RoleNames = exports.RoleNames = ['member', 'manager', 'owner'];
 
+function isSeniorRole(roleName, juniorName) {
+  return Roles[roleName] >= Roles[juniorName];
+}
+
+function isJuniorRole(roleName, seniorName) {
+  return Roles[roleName] < Roles[seniorName];
+}
+
+function getSeniorRoles(roleName) {
+  const seniorRoles = [];
+  _lodash2.default.forEach(Roles, role => {
+    if (Roles[roleName] < role) seniorRoles.push(RoleNames[role]);
+  });
+  return seniorRoles;
+}
+
+function getJuniorRoles(roleName) {
+  const juniorRoles = [];
+  _lodash2.default.forEach(Roles, role => {
+    if (Roles[roleName] >= role) juniorRoles.push(RoleNames[role]);
+  });
+  return juniorRoles;
+}
+
 // Hooks that can be added to customize abilities computation
 let hooks = [];
 
@@ -105,25 +168,6 @@ function defineUserAbilities(subject, can, cannot) {
   }
 }
 
-// Compute abilities for a given user
-function defineAbilities(subject) {
-  const { rules, can, cannot } = _umd.AbilityBuilder.extract();
-
-  // Run registered hooks
-  hooks.forEach(hook => hook(subject, can, cannot));
-
-  // CASL cannot infer the object type from the object itself so we need
-  // to tell it how he can find the object type, i.e. service name.
-  return new _umd.Ability(rules, {
-    subjectName: resource => {
-      if (!resource || typeof resource === 'string') {
-        return resource;
-      }
-      return resource[RESOURCE_TYPE_KEY];
-    }
-  });
-}
-
 defineAbilities.registerHook = function (hook) {
   if (!hooks.includes(hook)) {
     hooks.push(hook);
@@ -240,8 +284,6 @@ function defineOrganisationAbilities(subject, can, cannot) {
             can(['read', 'create', 'remove'], 'storage', { context: organisation._id });
           }
           if (role >= Roles.manager) {
-            // The unique identifier of a service is its path not its name.
-            // Indeed we have for instance a 'groups' service in each organisation.
             can('update', 'members', { context: organisation._id });
             can('update', 'tags', { context: organisation._id });
             can('create', 'groups', { context: organisation._id });

package/lib/core/common/permissions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../core/common/permissions.js"],"names":["defineResourceRules","defineUserAbilities","defineAbilities","hasServiceAbilities","hasResourceAbilities","removeContext","getQueryForAbilities","findSubjectsForResource","countSubjectsForResource","defineOrganisationAbilities","defineGroupAbilities","findMembersOfOrganisation","countMembersOfOrganisation","findMembersOfGroup","countMembersOfGroup","getRoleForOrganisation","getRoleForGroup","findGroupsWithRole","Ability","addAlias","Roles","member","manager","owner","RoleNames","hooks","RESOURCE_TYPE","RESOURCE_TYPE_KEY","Symbol","for","subject","resource","resourceService","can","role","permissions","_id","cannot","id","toString","$regex","rules","AbilityBuilder","extract","forEach","hook","subjectName","registerHook","includes","push","unregisterHook","filter","registeredHook","abilities","service","path","getPath","_","replace","operation","resourceType","context","object","Object","assign","result","query","forOwn","value","key","Array","isArray","item","isEmpty","rulesFor","cloneDeep","buildSubjectsQueryForResource","resourceScope","resourceId","$elemMatch","set","subjectService","find","$limit","organisations","organisation","groups","group","usersService","organisationId","membersService","groupId","user","isUndefined","undefined"],"mappings":";;;;;;QA4BgBA,mB,GAAAA,mB;QAgBAC,mB,GAAAA,mB;QAsCAC,e,GAAAA,e;QA4BAC,mB,GAAAA,mB;QASAC,oB,GAAAA,oB;QAcAC,a,GAAAA,a;QAuBAC,oB,GAAAA,oB;QAkBAC,uB,GAAAA,uB;QAOAC,wB,GAAAA,wB;QAUAC,2B,GAAAA,2B;QAyCAC,oB,GAAAA,oB;QAeAC,yB,GAAAA,yB;QAIAC,0B,GAAAA,0B;QAKAC,kB,GAAAA,kB;QAIAC,mB,GAAAA,mB;QAIAC,sB,GAAAA,sB;QAMAC,e,GAAAA,e;QAMAC,kB,GAAAA,kB;;AApRhB;;;;AACA;;;;AAEA;AACAC,aAAQC,QAAR,CAAiB,QAAjB,EAA2B,OAA3B;AACAD,aAAQC,QAAR,CAAiB,MAAjB,EAAyB,CAAC,KAAD,EAAQ,MAAR,CAAzB;AACAD,aAAQC,QAAR,CAAiB,QAAjB,EAA2B,QAA3B;AACAD,aAAQC,QAAR,CAAiB,KAAjB,EAAwB,CAAC,MAAD,EAAS,QAAT,EAAmB,QAAnB,EAA6B,QAA7B,CAAxB;;AAEO,MAAMC,wBAAQ;AACnBC,UAAQ,CADW;AAEnBC,WAAS,CAFU;AAGnBC,SAAO;AAHY,CAAd;;AAMA,MAAMC,gCAAY,CACvB,QADuB,EAEvB,SAFuB,EAGvB,OAHuB,CAAlB;;AAMP;AACA,IAAIC,QAAQ,EAAZ;;AAEA;AACO,MAAMC,wCAAgB,MAAtB;AACA,MAAMC,gDAAoBC,OAAOC,GAAP,CAAWH,aAAX,CAA1B;;AAEA,SAAS1B,mBAAT,CAA8B8B,OAA9B,EAAuCC,QAAvC,EAAiDC,eAAjD,EAAkEC,GAAlE,EAAuE;AAC5E,QAAMC,OAAOd,MAAMW,SAASI,WAAf,CAAb;;AAEA,MAAID,QAAQd,MAAMC,MAAlB,EAA0B;AACxBY,QAAI,MAAJ,EAAYD,eAAZ,EAA6B,EAAEI,KAAKL,SAASK,GAAhB,EAA7B;AACD;AACD,MAAIF,QAAQd,MAAME,OAAlB,EAA2B;AACzBW,QAAI,QAAJ,EAAcD,eAAd,EAA+B,EAAEI,KAAKL,SAASK,GAAhB,EAA/B;AACAH,QAAI,CAAC,QAAD,EAAW,QAAX,CAAJ,EAA0B,gBAA1B,EAA4C,EAAEF,UAAUA,SAASK,GAArB,EAA5C;AACD;AACD,MAAIF,QAAQd,MAAMG,KAAlB,EAAyB;AACvBU,QAAI,QAAJ,EAAcD,eAAd,EAA+B,EAAEI,KAAKL,SAASK,GAAhB,EAA/B;AACD;AACF;;AAED;AACO,SAASnC,mBAAT,CAA8B6B,OAA9B,EAAuCG,GAAvC,EAA4CI,MAA5C,EAAoD;AACzD;AACAJ,MAAI,SAAJ,EAAe,OAAf;AACAA,MAAI,QAAJ,EAAc,OAAd;AACA;AACAA,MAAI,SAAJ,EAAe,SAAf;AACAA,MAAI,QAAJ,EAAc,SAAd;AACAA,MAAI,SAAJ,EAAe,SAAf;AACAA,MAAI,QAAJ,EAAc,SAAd;AACAA,MAAI,QAAJ,EAAc,SAAd;;AAEA,MAAIH,WAAWA,QAAQM,GAAvB,EAA4B;AAC1B;AACAH,QAAI,MAAJ,EAAY,OAAZ;AACA;AACAA,QAAI,CAAC,QAAD,EAAW,QAAX,CAAJ,EAA0B,OAA1B,EAAmC,EAAEG,KAAKN,QAAQM,GAAf,EAAnC;AACA;AACAH,QAAI,SAAJ,EAAe,gBAAf;AACA;AACAA,QAAI,SAAJ,EAAe,SAAf;AACA;AACA;AACAA,QAAI,QAAJ,EAAc,SAAd,EAAyB,EAAEK,IAAI,aAAaR,QAAQM,GAAR,CAAYG,QAAZ,EAAnB,EAAzB;AACAN,QAAI,QAAJ,EAAc,SAAd,EAAyB,EAAEK,IAAI,aAAaR,QAAQM,GAAR,CAAYG,QAAZ,EAAb,GAAsC,YAA5C,EAAzB;AACAN,QAAI,QAAJ,EAAc,SAAd,EAAyB,EAAEG,KAAK,aAAaN,QAAQM,GAAR,CAAYG,QAAZ,EAApB,EAAzB;AACAN,QAAI,QAAJ,EAAc,SAAd,EAAyB,EAAEG,KAAK,aAAaN,QAAQM,GAAR,CAAYG,QAAZ,EAAb,GAAsC,YAA7C,EAAzB;AACA;AACAN,QAAI,MAAJ,EAAY,SAAZ,EAAuB,EAAEG,KAAK,EAAEI,QAAQ,YAAV,EAAP,EAAvB;AACA;AACAP,QAAI,SAAJ,EAAe,SAAf;AACAA,QAAI,QAAJ,EAAc,SAAd;AACAA,QAAI,SAAJ,EAAe,SAAf;AACAA,QAAI,QAAJ,EAAc,SAAd;AACAA,QAAI,QAAJ,EAAc,SAAd;AACD;AACF;;AAED;AACO,SAAS/B,eAAT,CAA0B4B,OAA1B,EAAmC;AACxC,QAAM,EAAEW,KAAF,EAASR,GAAT,EAAcI,MAAd,KAAyBK,oBAAeC,OAAf,EAA/B;;AAEA;AACAlB,QAAMmB,OAAN,CAAcC,QAAQA,KAAKf,OAAL,EAAcG,GAAd,EAAmBI,MAAnB,CAAtB;;AAEA;AACA;AACA,SAAO,IAAInB,YAAJ,CAAYuB,KAAZ,EAAmB;AACxBK,iBAAaf,YAAY;AACvB,UAAI,CAACA,QAAD,IAAa,OAAOA,QAAP,KAAoB,QAArC,EAA+C;AAC7C,eAAOA,QAAP;AACD;AACD,aAAOA,SAASJ,iBAAT,CAAP;AACD;AANuB,GAAnB,CAAP;AAQD;;AAEDzB,gBAAgB6C,YAAhB,GAA+B,UAAUF,IAAV,EAAgB;AAC7C,MAAI,CAACpB,MAAMuB,QAAN,CAAeH,IAAf,CAAL,EAA2B;AACzBpB,UAAMwB,IAAN,CAAWJ,IAAX;AACD;AACF,CAJD;;AAMA3C,gBAAgBgD,cAAhB,GAAiC,UAAUL,IAAV,EAAgB;AAC/CpB,UAAQA,MAAM0B,MAAN,CAAaC,kBAAkBA,mBAAmBP,IAAlD,CAAR;AACD,CAFD;;AAIO,SAAS1C,mBAAT,CAA8BkD,SAA9B,EAAyCC,OAAzC,EAAkD;AACvD,MAAI,CAACD,SAAL,EAAgB,OAAO,KAAP;AAChB;AACA;AACA;AACA,QAAME,OAAO,OAAOD,OAAP,KAAmB,QAAnB,GAA8BA,OAA9B,GAAwCA,QAAQE,OAAR,EAArD;AACA,SAAOH,UAAUpB,GAAV,CAAc,SAAd,EAAyBsB,IAAzB,KAAkCF,UAAUpB,GAAV,CAAc,SAAd,EAAyBwB,iBAAEC,OAAF,CAAUH,IAAV,EAAgB,OAAhB,EAAyB,IAAzB,CAAzB,CAAzC;AACD;;AAEM,SAASnD,oBAAT,CAA+BiD,SAA/B,EAA0CM,SAA1C,EAAqDC,YAArD,EAAmEC,OAAnE,EAA4E9B,QAA5E,EAAsF;AAC3F,MAAI,CAACsB,SAAL,EAAgB,OAAO,KAAP;AAChB;AACA,QAAMS,SAASC,OAAOC,MAAP,CAAc,EAAd,EAAkBjC,QAAlB,CAAf;AACA+B,SAAOnC,iBAAP,IAA4BiC,YAA5B;AACA;AACA,MAAIC,OAAJ,EAAaC,OAAOD,OAAP,GAAkB,OAAOA,OAAP,KAAmB,QAAnB,GAA8BA,QAAQzB,GAAR,CAAYG,QAAZ,EAA9B,GAAuDsB,QAAQtB,QAAR,EAAzE;;AAEb,QAAM0B,SAASZ,UAAUpB,GAAV,CAAc0B,SAAd,EAAyBG,MAAzB,CAAf;;AAEA,SAAOG,MAAP;AACD;;AAED;AACO,SAAS5D,aAAT,CAAwB6D,KAAxB,EAA+B;AACpCT,mBAAEU,MAAF,CAASD,KAAT,EAAgB,CAACE,KAAD,EAAQC,GAAR,KAAgB;AAC9B;AACA;AACA,QAAIA,QAAQ,SAAZ,EAAuB;AACrB,aAAOH,MAAML,OAAb;AACD,KAFD,MAEO,IAAIS,MAAMC,OAAN,CAAcH,KAAd,CAAJ,EAA0B;AAC/BA,YAAMxB,OAAN,CAAc4B,QAAQnE,cAAcmE,IAAd,CAAtB;AACA;AACA;AACA;AACA,UAAIf,iBAAEgB,OAAF,CAAUL,KAAV,CAAJ,EAAsB,OAAOF,MAAMG,GAAN,CAAP;AACvB,KANM,MAMA,IAAI,OAAOD,KAAP,KAAiB,QAArB,EAA+B;AACpC/D,oBAAc+D,KAAd;AACA;AACA,UAAIX,iBAAEgB,OAAF,CAAUL,KAAV,CAAJ,EAAsB,OAAOF,MAAMG,GAAN,CAAP;AACvB;AACF,GAhBD;AAiBA,SAAOH,KAAP;AACD;;AAED;AACA;AACO,SAAS5D,oBAAT,CAA+B+C,SAA/B,EAA0CM,SAA1C,EAAqDC,YAArD,EAAmE;AACxE,MAAI,CAACP,SAAL,EAAgB,OAAO,IAAP;;AAEhB,QAAMZ,QAAQY,UAAUqB,QAAV,CAAmBf,SAAnB,EAA8BC,YAA9B,CAAd;AACA,QAAMM,QAAQ,uBAAazB,KAAb,CAAd;AACA;AACA;AACA,SAAQyB,QAAQ7D,cAAcoD,iBAAEkB,SAAF,CAAYT,KAAZ,CAAd,CAAR,GAA4C,IAApD;AACD;;AAED,SAASU,6BAAT,CAAwCC,aAAxC,EAAuDC,UAAvD,EAAmE5C,IAAnE,EAAyE;AACvE,QAAMgC,QAAQ,EAAE,CAACW,aAAD,GAAiB,EAAEE,YAAY,EAAE3C,KAAK0C,UAAP,EAAd,EAAnB,EAAd;AACA,MAAI5C,IAAJ,EAAU;AACRuB,qBAAEuB,GAAF,CAAMd,MAAMW,aAAN,CAAN,EAA4B,wBAA5B,EAAuD,OAAO3C,IAAP,KAAgB,QAAhB,GAA2BA,IAA3B,GAAkCV,UAAUU,IAAV,CAAzF;AACD;AACD,SAAOgC,KAAP;AACD;;AAEM,SAAS3D,uBAAT,CAAkC0E,cAAlC,EAAkDJ,aAAlD,EAAiEC,UAAjE,EAA6E5C,IAA7E,EAAmF;AACxF;AACA,QAAMgC,QAAQU,8BAA8BC,aAA9B,EAA6CC,UAA7C,EAAyD5C,IAAzD,CAAd;AACA;AACA,SAAO+C,eAAeC,IAAf,CAAoB,EAAEhB,KAAF,EAApB,CAAP;AACD;;AAEM,SAAS1D,wBAAT,CAAmCyE,cAAnC,EAAmDJ,aAAnD,EAAkEC,UAAlE,EAA8E5C,IAA9E,EAAoF;AACzF;AACA,QAAMgC,QAAQU,8BAA8BC,aAA9B,EAA6CC,UAA7C,EAAyD5C,IAAzD,CAAd;AACA;AACAgC,QAAMiB,MAAN,GAAe,CAAf;AACA;AACA,SAAOF,eAAeC,IAAf,CAAoB,EAAEhB,KAAF,EAApB,CAAP;AACD;;AAED;AACO,SAASzD,2BAAT,CAAsCqB,OAAtC,EAA+CG,GAA/C,EAAoDI,MAApD,EAA4D;AACjE,MAAIP,OAAJ,EAAa;AACX;AACAG,QAAI,SAAJ,EAAe,eAAf;AACAA,QAAI,QAAJ,EAAc,eAAd;;AAEA,QAAIH,QAAQsD,aAAZ,EAA2B;AACzBtD,cAAQsD,aAAR,CAAsBxC,OAAtB,CAA8ByC,gBAAgB;AAC5C,YAAIA,aAAajD,GAAjB,EAAsB;AACpB;AACApC,8BAAoB8B,OAApB,EAA6BuD,YAA7B,EAA2C,eAA3C,EAA4DpD,GAA5D;AACA;AACA,gBAAMC,OAAOd,MAAMiE,aAAalD,WAAnB,CAAb;AACA,cAAID,QAAQd,MAAMC,MAAlB,EAA0B;AACxB;AACA;AACAY,gBAAI,SAAJ,EAAeoD,aAAajD,GAAb,CAAiBG,QAAjB,KAA8B,UAA7C;AACAN,gBAAI,MAAJ,EAAY,SAAZ,EAAuB,EAAE4B,SAASwB,aAAajD,GAAxB,EAAvB;AACAH,gBAAI,SAAJ,EAAeoD,aAAajD,GAAb,CAAiBG,QAAjB,KAA8B,OAA7C;AACAN,gBAAI,MAAJ,EAAY,MAAZ,EAAoB,EAAE4B,SAASwB,aAAajD,GAAxB,EAApB;AACAH,gBAAI,SAAJ,EAAeoD,aAAajD,GAAb,CAAiBG,QAAjB,KAA8B,SAA7C;AACAN,gBAAI,SAAJ,EAAeoD,aAAajD,GAAb,CAAiBG,QAAjB,KAA8B,UAA7C;AACAN,gBAAI,CAAC,MAAD,EAAS,QAAT,EAAmB,QAAnB,CAAJ,EAAkC,SAAlC,EAA6C,EAAE4B,SAASwB,aAAajD,GAAxB,EAA7C;AACD;AACD,cAAIF,QAAQd,MAAME,OAAlB,EAA2B;AACzB;AACA;AACAW,gBAAI,QAAJ,EAAc,SAAd,EAAyB,EAAE4B,SAASwB,aAAajD,GAAxB,EAAzB;AACAH,gBAAI,QAAJ,EAAc,MAAd,EAAsB,EAAE4B,SAASwB,aAAajD,GAAxB,EAAtB;AACAH,gBAAI,QAAJ,EAAc,QAAd,EAAwB,EAAE4B,SAASwB,aAAajD,GAAxB,EAAxB;AACAH,gBAAI,CAAC,QAAD,EAAW,QAAX,CAAJ,EAA0B,MAA1B,EAAkC,EAAE4B,SAASwB,aAAajD,GAAxB,EAAlC;AACA;AACAH,gBAAI,CAAC,QAAD,CAAJ,EAAgB,OAAhB,EAAyB,EAAE,0BAA0BoD,aAAajD,GAAzC,EAAzB;AACD;AACF;AACF,OA5BD;AA6BD;AACF;AACF;;AAED;AACO,SAAS1B,oBAAT,CAA+BoB,OAA/B,EAAwCG,GAAxC,EAA6CI,MAA7C,EAAqD;AAC1D,MAAIP,OAAJ,EAAa;AACX,QAAIA,QAAQwD,MAAZ,EAAoB;AAClBxD,cAAQwD,MAAR,CAAe1C,OAAf,CAAuB2C,SAAS;AAC9B,YAAIA,MAAMnD,GAAV,EAAe;AACb;AACApC,8BAAoB8B,OAApB,EAA6ByD,KAA7B,EAAoC,QAApC,EAA8CtD,GAA9C;AACA;AACD;AACF,OAND;AAOD;AACF;AACF;;AAED;AACO,SAAStB,yBAAT,CAAoC6E,YAApC,EAAkDC,cAAlD,EAAkEvD,IAAlE,EAAwE;AAC7E,SAAO3B,wBAAwBiF,YAAxB,EAAsC,eAAtC,EAAuDC,cAAvD,EAAuEvD,IAAvE,CAAP;AACD;;AAEM,SAAStB,0BAAT,CAAqC4E,YAArC,EAAmDC,cAAnD,EAAmEvD,IAAnE,EAAyE;AAC9E,SAAO1B,yBAAyBgF,YAAzB,EAAuC,eAAvC,EAAwDC,cAAxD,EAAwEvD,IAAxE,CAAP;AACD;;AAED;AACO,SAASrB,kBAAT,CAA6B6E,cAA7B,EAA6CC,OAA7C,EAAsDzD,IAAtD,EAA4D;AACjE,SAAO3B,wBAAwBmF,cAAxB,EAAwC,QAAxC,EAAkDC,OAAlD,EAA2DzD,IAA3D,CAAP;AACD;;AAEM,SAASpB,mBAAT,CAA8B4E,cAA9B,EAA8CC,OAA9C,EAAuDzD,IAAvD,EAA6D;AAClE,SAAO1B,yBAAyBkF,cAAzB,EAAyC,QAAzC,EAAmDC,OAAnD,EAA4DzD,IAA5D,CAAP;AACD;;AAEM,SAASnB,sBAAT,CAAiC6E,IAAjC,EAAuCH,cAAvC,EAAuD;AAC5D,QAAMxB,SAASR,iBAAEyB,IAAF,CAAOU,KAAKR,aAAZ,EAA2B,EAAEhD,KAAKqD,cAAP,EAA3B,CAAf;AACA,MAAI,CAAChC,iBAAEoC,WAAF,CAAc5B,MAAd,CAAL,EAA4B,OAAOA,OAAO9B,WAAd;AAC5B,SAAO2D,SAAP;AACD;;AAEM,SAAS9E,eAAT,CAA0B4E,IAA1B,EAAgCH,cAAhC,EAAgDE,OAAhD,EAAyD;AAC9D,QAAM1B,SAASR,iBAAEyB,IAAF,CAAOU,KAAKN,MAAZ,EAAoB,EAAEzB,SAAS4B,cAAX,EAA2BrD,KAAKuD,OAAhC,EAApB,CAAf;AACA,MAAI,CAAClC,iBAAEoC,WAAF,CAAc5B,MAAd,CAAL,EAA4B,OAAOA,OAAO9B,WAAd;AAC5B,SAAO2D,SAAP;AACD;;AAEM,SAAS7E,kBAAT,CAA6B2E,IAA7B,EAAmCH,cAAnC,EAAmDvD,IAAnD,EAAyD;AAC9D,SAAOuB,iBAAEN,MAAF,CAASyC,KAAKN,MAAL,IAAe,EAAxB,EAA4B,EAAEzB,SAAS4B,cAAX,EAA2BtD,aAAc,OAAOD,IAAP,KAAgB,QAAhB,GAA2BA,IAA3B,GAAkCV,UAAUU,IAAV,CAA3E,EAA5B,CAAP;AACD","file":"permissions.js","sourcesContent":["import _ from 'lodash'\r\nimport { Ability, AbilityBuilder, toMongoQuery } from 'casl/dist/umd'\r\n\r\n// Define some alias to simplify ability definitions\r\nAbility.addAlias('update', 'patch')\r\nAbility.addAlias('read', ['get', 'find'])\r\nAbility.addAlias('remove', 'delete')\r\nAbility.addAlias('all', ['read', 'create', 'update', 'remove'])\r\n\r\nexport const Roles = {\r\n  member: 0,\r\n  manager: 1,\r\n  owner: 2\r\n}\r\n\r\nexport const RoleNames = [\r\n  'member',\r\n  'manager',\r\n  'owner'\r\n]\r\n\r\n// Hooks that can be added to customize abilities computation\r\nlet hooks = []\r\n\r\n// Get the unique global symbol to store resource type / context on a resource object\r\nexport const RESOURCE_TYPE = 'type'\r\nexport const RESOURCE_TYPE_KEY = Symbol.for(RESOURCE_TYPE)\r\n\r\nexport function defineResourceRules (subject, resource, resourceService, can) {\r\n  const role = Roles[resource.permissions]\r\n\r\n  if (role >= Roles.member) {\r\n    can('read', resourceService, { _id: resource._id })\r\n  }\r\n  if (role >= Roles.manager) {\r\n    can('update', resourceService, { _id: resource._id })\r\n    can(['create', 'remove'], 'authorisations', { resource: resource._id })\r\n  }\r\n  if (role >= Roles.owner) {\r\n    can('remove', resourceService, { _id: resource._id })\r\n  }\r\n}\r\n\r\n// Hook computing default abilities for a given user\r\nexport function defineUserAbilities (subject, can, cannot) {\r\n  // Allow user registration\r\n  can('service', 'users')\r\n  can('create', 'users')\r\n  // Verification email, reset password, etc.\r\n  can('service', 'account')\r\n  can('create', 'account')\r\n  can('service', 'devices')\r\n  can('update', 'devices')\r\n  can('remove', 'devices')\r\n\r\n  if (subject && subject._id) {\r\n    // Read user profiles for authorizing\r\n    can('read', 'users')\r\n    // Update user profile and destroy it\r\n    can(['update', 'remove'], 'users', { _id: subject._id })\r\n    // Access authorisation service, then rights will be granted on a per-resource basis\r\n    can('service', 'authorisations')\r\n    // Access storage service, then rights will be granted on a per-resource basis\r\n    can('service', 'storage')\r\n    // This is for the user avatar\r\n    // take care that the storage service uses 'id' as input but produces _id as output\r\n    can('create', 'storage', { id: 'avatars/' + subject._id.toString() })\r\n    can('create', 'storage', { id: 'avatars/' + subject._id.toString() + '.thumbnail' })\r\n    can('remove', 'storage', { _id: 'avatars/' + subject._id.toString() })\r\n    can('remove', 'storage', { _id: 'avatars/' + subject._id.toString() + '.thumbnail' })\r\n    // Avatar is part of user profiles so that they can be read by any\r\n    can('read', 'storage', { _id: { $regex: '^avatars/*' } })\r\n    // Verification email, reset password, etc.\r\n    can('service', 'account')\r\n    can('create', 'account')\r\n    can('service', 'devices')\r\n    can('update', 'devices')\r\n    can('remove', 'devices')\r\n  }\r\n}\r\n\r\n// Compute abilities for a given user\r\nexport function defineAbilities (subject) {\r\n  const { rules, can, cannot } = AbilityBuilder.extract()\r\n\r\n  // Run registered hooks\r\n  hooks.forEach(hook => hook(subject, can, cannot))\r\n\r\n  // CASL cannot infer the object type from the object itself so we need\r\n  // to tell it how he can find the object type, i.e. service name.\r\n  return new Ability(rules, {\r\n    subjectName: resource => {\r\n      if (!resource || typeof resource === 'string') {\r\n        return resource\r\n      }\r\n      return resource[RESOURCE_TYPE_KEY]\r\n    }\r\n  })\r\n}\r\n\r\ndefineAbilities.registerHook = function (hook) {\r\n  if (!hooks.includes(hook)) {\r\n    hooks.push(hook)\r\n  }\r\n}\r\n\r\ndefineAbilities.unregisterHook = function (hook) {\r\n  hooks = hooks.filter(registeredHook => registeredHook !== hook)\r\n}\r\n\r\nexport function hasServiceAbilities (abilities, service) {\r\n  if (!abilities) return false\r\n  // The unique identifier of a service is its path not its name.\r\n  // Indeed we have for instance a 'groups' service in each organisation\r\n  // Take care that in client we have the service path while on server we have the actual object\r\n  const path = typeof service === 'string' ? service : service.getPath()\r\n  return abilities.can('service', path) || abilities.can('service', _.replace(path, /^.*\\//, '*/'))\r\n}\r\n\r\nexport function hasResourceAbilities (abilities, operation, resourceType, context, resource) {\r\n  if (!abilities) return false\r\n  // Create a shallow copy adding context and type\r\n  const object = Object.assign({}, resource)\r\n  object[RESOURCE_TYPE_KEY] = resourceType\r\n  // Add a virtual context to take it into account for object having no link to it\r\n  if (context) object.context = (typeof context === 'object' ? context._id.toString() : context.toString())\r\n\r\n  const result = abilities.can(operation, object)\r\n\r\n  return result\r\n}\r\n\r\n// Utility function used to remove the virtual context from query\r\nexport function removeContext (query) {\r\n  _.forOwn(query, (value, key) => {\r\n    // Process current attributes or recurse\r\n    // Take care to nested fields like 'field._id'\r\n    if (key === 'context') {\r\n      delete query.context\r\n    } else if (Array.isArray(value)) {\r\n      value.forEach(item => removeContext(item))\r\n      // Remove empty objects from array\r\n      // _.remove(value, item => _.isEmpty(item))\r\n      // Remove empty arrays from query\r\n      if (_.isEmpty(value)) delete query[key]\r\n    } else if (typeof value === 'object') {\r\n      removeContext(value)\r\n      // Remove empty objects from query\r\n      if (_.isEmpty(value)) delete query[key]\r\n    }\r\n  })\r\n  return query\r\n}\r\n\r\n// Get the query used to filter the objects according to given abilities\r\n// A null query indicates that access should not be granted\r\nexport function getQueryForAbilities (abilities, operation, resourceType) {\r\n  if (!abilities) return null\r\n\r\n  const rules = abilities.rulesFor(operation, resourceType)\r\n  const query = toMongoQuery(rules)\r\n  // Remove any context to avoid taking it into account because it is not really stored on objects\r\n  // We clone the object here because of references to the abilities rules (see https://github.com/kalisio/kdk/issues/384)\r\n  return (query ? removeContext(_.cloneDeep(query)) : null)\r\n}\r\n\r\nfunction buildSubjectsQueryForResource (resourceScope, resourceId, role) {\r\n  const query = { [resourceScope]: { $elemMatch: { _id: resourceId } } }\r\n  if (role) {\r\n    _.set(query[resourceScope], '$elemMatch.permissions', (typeof role === 'string' ? role : RoleNames[role]))\r\n  }\r\n  return query\r\n}\r\n\r\nexport function findSubjectsForResource (subjectService, resourceScope, resourceId, role) {\r\n  // Build the query\r\n  const query = buildSubjectsQueryForResource(resourceScope, resourceId, role)\r\n  // Execute the query\r\n  return subjectService.find({ query })\r\n}\r\n\r\nexport function countSubjectsForResource (subjectService, resourceScope, resourceId, role) {\r\n  // Build the query\r\n  const query = buildSubjectsQueryForResource(resourceScope, resourceId, role)\r\n  // Indicate we'd only like to count\r\n  query.$limit = 0\r\n  // Execute the query\r\n  return subjectService.find({ query })\r\n}\r\n\r\n// Hook computing organisation abilities for a given user\r\nexport function defineOrganisationAbilities (subject, can, cannot) {\r\n  if (subject) {\r\n    // Create new organisations\r\n    can('service', 'organisations')\r\n    can('create', 'organisations')\r\n\r\n    if (subject.organisations) {\r\n      subject.organisations.forEach(organisation => {\r\n        if (organisation._id) {\r\n          // Generic rules for resources\r\n          defineResourceRules(subject, organisation, 'organisations', can)\r\n          // Specific rules for organisations\r\n          const role = Roles[organisation.permissions]\r\n          if (role >= Roles.member) {\r\n            // The unique identifier of a service is its path not its name.\r\n            // Indeed we have for instance a 'groups' service in each organisation.\r\n            can('service', organisation._id.toString() + '/members')\r\n            can('read', 'members', { context: organisation._id })\r\n            can('service', organisation._id.toString() + '/tags')\r\n            can('read', 'tags', { context: organisation._id })\r\n            can('service', organisation._id.toString() + '/groups')\r\n            can('service', organisation._id.toString() + '/storage')\r\n            can(['read', 'create', 'remove'], 'storage', { context: organisation._id })\r\n          }\r\n          if (role >= Roles.manager) {\r\n            // The unique identifier of a service is its path not its name.\r\n            // Indeed we have for instance a 'groups' service in each organisation.\r\n            can('update', 'members', { context: organisation._id })\r\n            can('update', 'tags', { context: organisation._id })\r\n            can('create', 'groups', { context: organisation._id })\r\n            can(['create', 'remove'], 'tags', { context: organisation._id })\r\n            // Remove invited members\r\n            can(['remove'], 'users', { 'sponsor.organisationId': organisation._id })\r\n          }\r\n        }\r\n      })\r\n    }\r\n  }\r\n}\r\n\r\n// Hook computing group abilities for a given user\r\nexport function defineGroupAbilities (subject, can, cannot) {\r\n  if (subject) {\r\n    if (subject.groups) {\r\n      subject.groups.forEach(group => {\r\n        if (group._id) {\r\n          // Generic rules for resources\r\n          defineResourceRules(subject, group, 'groups', can)\r\n          // No specific rules for groups\r\n        }\r\n      })\r\n    }\r\n  }\r\n}\r\n\r\n// Helper functions to find the members of a given organisation\r\nexport function findMembersOfOrganisation (usersService, organisationId, role) {\r\n  return findSubjectsForResource(usersService, 'organisations', organisationId, role)\r\n}\r\n\r\nexport function countMembersOfOrganisation (usersService, organisationId, role) {\r\n  return countSubjectsForResource(usersService, 'organisations', organisationId, role)\r\n}\r\n\r\n// Helper functions to find the members of a given group\r\nexport function findMembersOfGroup (membersService, groupId, role) {\r\n  return findSubjectsForResource(membersService, 'groups', groupId, role)\r\n}\r\n\r\nexport function countMembersOfGroup (membersService, groupId, role) {\r\n  return countSubjectsForResource(membersService, 'groups', groupId, role)\r\n}\r\n\r\nexport function getRoleForOrganisation (user, organisationId) {\r\n  const result = _.find(user.organisations, { _id: organisationId })\r\n  if (!_.isUndefined(result)) return result.permissions\r\n  return undefined\r\n}\r\n\r\nexport function getRoleForGroup (user, organisationId, groupId) {\r\n  const result = _.find(user.groups, { context: organisationId, _id: groupId })\r\n  if (!_.isUndefined(result)) return result.permissions\r\n  return undefined\r\n}\r\n\r\nexport function findGroupsWithRole (user, organisationId, role) {\r\n  return _.filter(user.groups || [], { context: organisationId, permissions: (typeof role === 'string' ? role : RoleNames[role]) })\r\n}\r\n"]}
+{"version":3,"sources":["../../../core/common/permissions.js"],"names":["subject","args","rules","can","cannot","AbilityBuilder","extract","Promise","all","hooks","map","hook","Ability","subjectName","resource","RESOURCE_TYPE_KEY","defineAbilities","isSeniorRole","isJuniorRole","getSeniorRoles","getJuniorRoles","defineResourceRules","defineUserAbilities","hasServiceAbilities","hasResourceAbilities","removeContext","getQueryForAbilities","findSubjectsForResource","countSubjectsForResource","defineOrganisationAbilities","defineGroupAbilities","findMembersOfOrganisation","countMembersOfOrganisation","findMembersOfGroup","countMembersOfGroup","getRoleForOrganisation","getRoleForGroup","findGroupsWithRole","addAlias","Roles","member","manager","owner","RoleNames","roleName","juniorName","seniorName","seniorRoles","_","forEach","role","push","juniorRoles","RESOURCE_TYPE","Symbol","for","resourceService","permissions","_id","id","toString","$regex","registerHook","includes","unregisterHook","filter","registeredHook","abilities","service","path","getPath","replace","operation","resourceType","context","object","Object","assign","result","query","forOwn","value","key","Array","isArray","item","isEmpty","rulesFor","cloneDeep","buildSubjectsQueryForResource","resourceScope","resourceId","$elemMatch","set","subjectService","find","$limit","organisations","organisation","groups","group","usersService","organisationId","membersService","groupId","user","isUndefined","undefined"],"mappings":";;;;;;;AAqGA;;+BACO,WAAgCA,OAAhC,EAAyC,GAAGC,IAA5C,EAAkD;AACvD,UAAM,EAAEC,KAAF,EAASC,GAAT,EAAcC,MAAd,KAAyBC,oBAAeC,OAAf,EAA/B;;AAEA;AACA,UAAMC,QAAQC,GAAR,CAAYC,MAAMC,GAAN;AAAA,oCAAU,WAAMC,IAAN,EAAc;AACxC,cAAMA,KAAKX,OAAL,EAAcG,GAAd,EAAmBC,MAAnB,EAA2B,GAAGH,IAA9B,CAAN;AACD,OAFiB;;AAAA;AAAA;AAAA;AAAA,SAAZ,CAAN;;AAIA;AACA;AACA,WAAO,IAAIW,YAAJ,CAAYV,KAAZ,EAAmB;AACxBW,mBAAa,oBAAY;AACvB,YAAI,CAACC,QAAD,IAAa,OAAOA,QAAP,KAAoB,QAArC,EAA+C;AAC7C,iBAAOA,QAAP;AACD;AACD,eAAOA,SAASC,iBAAT,CAAP;AACD;AANuB,KAAnB,CAAP;AAQD,G;;kBAlBqBC,e;;;;;QAjFNC,Y,GAAAA,Y;QAIAC,Y,GAAAA,Y;QAIAC,c,GAAAA,c;QAMAC,c,GAAAA,c;QAaAC,mB,GAAAA,mB;QAgBAC,mB,GAAAA,mB;QAoEAC,mB,GAAAA,mB;QASAC,oB,GAAAA,oB;QAcAC,a,GAAAA,a;QAuBAC,oB,GAAAA,oB;QAkBAC,uB,GAAAA,uB;QAOAC,wB,GAAAA,wB;QAUAC,2B,GAAAA,2B;QAuCAC,oB,GAAAA,oB;QAeAC,yB,GAAAA,yB;QAIAC,0B,GAAAA,0B;QAKAC,kB,GAAAA,kB;QAIAC,mB,GAAAA,mB;QAIAC,sB,GAAAA,sB;QAMAC,e,GAAAA,e;QAMAC,kB,GAAAA,kB;;AAxShB;;;;AACA;;;;;;AAEA;AACAzB,aAAQ0B,QAAR,CAAiB,QAAjB,EAA2B,OAA3B;AACA1B,aAAQ0B,QAAR,CAAiB,MAAjB,EAAyB,CAAC,KAAD,EAAQ,MAAR,CAAzB;AACA1B,aAAQ0B,QAAR,CAAiB,QAAjB,EAA2B,QAA3B;AACA1B,aAAQ0B,QAAR,CAAiB,KAAjB,EAAwB,CAAC,MAAD,EAAS,QAAT,EAAmB,QAAnB,EAA6B,QAA7B,CAAxB;;AAEO,MAAMC,wBAAQ;AACnBC,UAAQ,CADW;AAEnBC,WAAS,CAFU;AAGnBC,SAAO;AAHY,CAAd;;AAMA,MAAMC,gCAAY,CACvB,QADuB,EAEvB,SAFuB,EAGvB,OAHuB,CAAlB;;AAMA,SAAS1B,YAAT,CAAuB2B,QAAvB,EAAiCC,UAAjC,EAA6C;AAClD,SAAON,MAAMK,QAAN,KAAmBL,MAAMM,UAAN,CAA1B;AACD;;AAEM,SAAS3B,YAAT,CAAuB0B,QAAvB,EAAiCE,UAAjC,EAA6C;AAClD,SAAOP,MAAMK,QAAN,IAAkBL,MAAMO,UAAN,CAAzB;AACD;;AAEM,SAAS3B,cAAT,CAAyByB,QAAzB,EAAmC;AACxC,QAAMG,cAAc,EAApB;AACAC,mBAAEC,OAAF,CAAUV,KAAV,EAAiBW,QAAQ;AAAE,QAAIX,MAAMK,QAAN,IAAkBM,IAAtB,EAA4BH,YAAYI,IAAZ,CAAiBR,UAAUO,IAAV,CAAjB;AAAmC,GAA1F;AACA,SAAOH,WAAP;AACD;;AAEM,SAAS3B,cAAT,CAAyBwB,QAAzB,EAAmC;AACxC,QAAMQ,cAAc,EAApB;AACAJ,mBAAEC,OAAF,CAAUV,KAAV,EAAiBW,QAAQ;AAAE,QAAIX,MAAMK,QAAN,KAAmBM,IAAvB,EAA6BE,YAAYD,IAAZ,CAAiBR,UAAUO,IAAV,CAAjB;AAAmC,GAA3F;AACA,SAAOE,WAAP;AACD;;AAED;AACA,IAAI3C,QAAQ,EAAZ;;AAEA;AACO,MAAM4C,wCAAgB,MAAtB;AACA,MAAMtC,gDAAoBuC,OAAOC,GAAP,CAAWF,aAAX,CAA1B;;AAEA,SAAShC,mBAAT,CAA8BrB,OAA9B,EAAuCc,QAAvC,EAAiD0C,eAAjD,EAAkErD,GAAlE,EAAuE;AAC5E,QAAM+C,OAAOX,MAAMzB,SAAS2C,WAAf,CAAb;;AAEA,MAAIP,QAAQX,MAAMC,MAAlB,EAA0B;AACxBrC,QAAI,MAAJ,EAAYqD,eAAZ,EAA6B,EAAEE,KAAK5C,SAAS4C,GAAhB,EAA7B;AACD;AACD,MAAIR,QAAQX,MAAME,OAAlB,EAA2B;AACzBtC,QAAI,QAAJ,EAAcqD,eAAd,EAA+B,EAAEE,KAAK5C,SAAS4C,GAAhB,EAA/B;AACAvD,QAAI,CAAC,QAAD,EAAW,QAAX,CAAJ,EAA0B,gBAA1B,EAA4C,EAAEW,UAAUA,SAAS4C,GAArB,EAA5C;AACD;AACD,MAAIR,QAAQX,MAAMG,KAAlB,EAAyB;AACvBvC,QAAI,QAAJ,EAAcqD,eAAd,EAA+B,EAAEE,KAAK5C,SAAS4C,GAAhB,EAA/B;AACD;AACF;;AAED;AACO,SAASpC,mBAAT,CAA8BtB,OAA9B,EAAuCG,GAAvC,EAA4CC,MAA5C,EAAoD;AACzD;AACAD,MAAI,SAAJ,EAAe,OAAf;AACAA,MAAI,QAAJ,EAAc,OAAd;AACA;AACAA,MAAI,SAAJ,EAAe,SAAf;AACAA,MAAI,QAAJ,EAAc,SAAd;AACAA,MAAI,SAAJ,EAAe,SAAf;AACAA,MAAI,QAAJ,EAAc,SAAd;AACAA,MAAI,QAAJ,EAAc,SAAd;;AAEA,MAAIH,WAAWA,QAAQ0D,GAAvB,EAA4B;AAC1B;AACAvD,QAAI,MAAJ,EAAY,OAAZ;AACA;AACAA,QAAI,CAAC,QAAD,EAAW,QAAX,CAAJ,EAA0B,OAA1B,EAAmC,EAAEuD,KAAK1D,QAAQ0D,GAAf,EAAnC;AACA;AACAvD,QAAI,SAAJ,EAAe,gBAAf;AACA;AACAA,QAAI,SAAJ,EAAe,SAAf;AACA;AACA;AACAA,QAAI,QAAJ,EAAc,SAAd,EAAyB,EAAEwD,IAAI,aAAa3D,QAAQ0D,GAAR,CAAYE,QAAZ,EAAnB,EAAzB;AACAzD,QAAI,QAAJ,EAAc,SAAd,EAAyB,EAAEwD,IAAI,aAAa3D,QAAQ0D,GAAR,CAAYE,QAAZ,EAAb,GAAsC,YAA5C,EAAzB;AACAzD,QAAI,QAAJ,EAAc,SAAd,EAAyB,EAAEuD,KAAK,aAAa1D,QAAQ0D,GAAR,CAAYE,QAAZ,EAApB,EAAzB;AACAzD,QAAI,QAAJ,EAAc,SAAd,EAAyB,EAAEuD,KAAK,aAAa1D,QAAQ0D,GAAR,CAAYE,QAAZ,EAAb,GAAsC,YAA7C,EAAzB;AACA;AACAzD,QAAI,MAAJ,EAAY,SAAZ,EAAuB,EAAEuD,KAAK,EAAEG,QAAQ,YAAV,EAAP,EAAvB;AACA;AACA1D,QAAI,SAAJ,EAAe,SAAf;AACAA,QAAI,QAAJ,EAAc,SAAd;AACAA,QAAI,SAAJ,EAAe,SAAf;AACAA,QAAI,QAAJ,EAAc,SAAd;AACAA,QAAI,QAAJ,EAAc,SAAd;AACD;AACF;;AAuBDa,gBAAgB8C,YAAhB,GAA+B,UAAUnD,IAAV,EAAgB;AAC7C,MAAI,CAACF,MAAMsD,QAAN,CAAepD,IAAf,CAAL,EAA2B;AACzBF,UAAM0C,IAAN,CAAWxC,IAAX;AACD;AACF,CAJD;;AAMAK,gBAAgBgD,cAAhB,GAAiC,UAAUrD,IAAV,EAAgB;AAC/CF,UAAQA,MAAMwD,MAAN,CAAaC,kBAAkBA,mBAAmBvD,IAAlD,CAAR;AACD,CAFD;;AAIO,SAASY,mBAAT,CAA8B4C,SAA9B,EAAyCC,OAAzC,EAAkD;AACvD,MAAI,CAACD,SAAL,EAAgB,OAAO,KAAP;AAChB;AACA;AACA;AACA,QAAME,OAAO,OAAOD,OAAP,KAAmB,QAAnB,GAA8BA,OAA9B,GAAwCA,QAAQE,OAAR,EAArD;AACA,SAAOH,UAAUhE,GAAV,CAAc,SAAd,EAAyBkE,IAAzB,KAAkCF,UAAUhE,GAAV,CAAc,SAAd,EAAyB6C,iBAAEuB,OAAF,CAAUF,IAAV,EAAgB,OAAhB,EAAyB,IAAzB,CAAzB,CAAzC;AACD;;AAEM,SAAS7C,oBAAT,CAA+B2C,SAA/B,EAA0CK,SAA1C,EAAqDC,YAArD,EAAmEC,OAAnE,EAA4E5D,QAA5E,EAAsF;AAC3F,MAAI,CAACqD,SAAL,EAAgB,OAAO,KAAP;AAChB;AACA,QAAMQ,SAASC,OAAOC,MAAP,CAAc,EAAd,EAAkB/D,QAAlB,CAAf;AACA6D,SAAO5D,iBAAP,IAA4B0D,YAA5B;AACA;AACA,MAAIC,OAAJ,EAAaC,OAAOD,OAAP,GAAkB,OAAOA,OAAP,KAAmB,QAAnB,GAA8BA,QAAQhB,GAAR,CAAYE,QAAZ,EAA9B,GAAuDc,QAAQd,QAAR,EAAzE;;AAEb,QAAMkB,SAASX,UAAUhE,GAAV,CAAcqE,SAAd,EAAyBG,MAAzB,CAAf;;AAEA,SAAOG,MAAP;AACD;;AAED;AACO,SAASrD,aAAT,CAAwBsD,KAAxB,EAA+B;AACpC/B,mBAAEgC,MAAF,CAASD,KAAT,EAAgB,CAACE,KAAD,EAAQC,GAAR,KAAgB;AAC9B;AACA;AACA,QAAIA,QAAQ,SAAZ,EAAuB;AACrB,aAAOH,MAAML,OAAb;AACD,KAFD,MAEO,IAAIS,MAAMC,OAAN,CAAcH,KAAd,CAAJ,EAA0B;AAC/BA,YAAMhC,OAAN,CAAcoC,QAAQ5D,cAAc4D,IAAd,CAAtB;AACA;AACA;AACA;AACA,UAAIrC,iBAAEsC,OAAF,CAAUL,KAAV,CAAJ,EAAsB,OAAOF,MAAMG,GAAN,CAAP;AACvB,KANM,MAMA,IAAI,OAAOD,KAAP,KAAiB,QAArB,EAA+B;AACpCxD,oBAAcwD,KAAd;AACA;AACA,UAAIjC,iBAAEsC,OAAF,CAAUL,KAAV,CAAJ,EAAsB,OAAOF,MAAMG,GAAN,CAAP;AACvB;AACF,GAhBD;AAiBA,SAAOH,KAAP;AACD;;AAED;AACA;AACO,SAASrD,oBAAT,CAA+ByC,SAA/B,EAA0CK,SAA1C,EAAqDC,YAArD,EAAmE;AACxE,MAAI,CAACN,SAAL,EAAgB,OAAO,IAAP;;AAEhB,QAAMjE,QAAQiE,UAAUoB,QAAV,CAAmBf,SAAnB,EAA8BC,YAA9B,CAAd;AACA,QAAMM,QAAQ,uBAAa7E,KAAb,CAAd;AACA;AACA;AACA,SAAQ6E,QAAQtD,cAAcuB,iBAAEwC,SAAF,CAAYT,KAAZ,CAAd,CAAR,GAA4C,IAApD;AACD;;AAED,SAASU,6BAAT,CAAwCC,aAAxC,EAAuDC,UAAvD,EAAmEzC,IAAnE,EAAyE;AACvE,QAAM6B,QAAQ,EAAE,CAACW,aAAD,GAAiB,EAAEE,YAAY,EAAElC,KAAKiC,UAAP,EAAd,EAAnB,EAAd;AACA,MAAIzC,IAAJ,EAAU;AACRF,qBAAE6C,GAAF,CAAMd,MAAMW,aAAN,CAAN,EAA4B,wBAA5B,EAAuD,OAAOxC,IAAP,KAAgB,QAAhB,GAA2BA,IAA3B,GAAkCP,UAAUO,IAAV,CAAzF;AACD;AACD,SAAO6B,KAAP;AACD;;AAEM,SAASpD,uBAAT,CAAkCmE,cAAlC,EAAkDJ,aAAlD,EAAiEC,UAAjE,EAA6EzC,IAA7E,EAAmF;AACxF;AACA,QAAM6B,QAAQU,8BAA8BC,aAA9B,EAA6CC,UAA7C,EAAyDzC,IAAzD,CAAd;AACA;AACA,SAAO4C,eAAeC,IAAf,CAAoB,EAAEhB,KAAF,EAApB,CAAP;AACD;;AAEM,SAASnD,wBAAT,CAAmCkE,cAAnC,EAAmDJ,aAAnD,EAAkEC,UAAlE,EAA8EzC,IAA9E,EAAoF;AACzF;AACA,QAAM6B,QAAQU,8BAA8BC,aAA9B,EAA6CC,UAA7C,EAAyDzC,IAAzD,CAAd;AACA;AACA6B,QAAMiB,MAAN,GAAe,CAAf;AACA;AACA,SAAOF,eAAeC,IAAf,CAAoB,EAAEhB,KAAF,EAApB,CAAP;AACD;;AAED;AACO,SAASlD,2BAAT,CAAsC7B,OAAtC,EAA+CG,GAA/C,EAAoDC,MAApD,EAA4D;AACjE,MAAIJ,OAAJ,EAAa;AACX;AACAG,QAAI,SAAJ,EAAe,eAAf;AACAA,QAAI,QAAJ,EAAc,eAAd;;AAEA,QAAIH,QAAQiG,aAAZ,EAA2B;AACzBjG,cAAQiG,aAAR,CAAsBhD,OAAtB,CAA8BiD,gBAAgB;AAC5C,YAAIA,aAAaxC,GAAjB,EAAsB;AACpB;AACArC,8BAAoBrB,OAApB,EAA6BkG,YAA7B,EAA2C,eAA3C,EAA4D/F,GAA5D;AACA;AACA,gBAAM+C,OAAOX,MAAM2D,aAAazC,WAAnB,CAAb;AACA,cAAIP,QAAQX,MAAMC,MAAlB,EAA0B;AACxB;AACA;AACArC,gBAAI,SAAJ,EAAe+F,aAAaxC,GAAb,CAAiBE,QAAjB,KAA8B,UAA7C;AACAzD,gBAAI,MAAJ,EAAY,SAAZ,EAAuB,EAAEuE,SAASwB,aAAaxC,GAAxB,EAAvB;AACAvD,gBAAI,SAAJ,EAAe+F,aAAaxC,GAAb,CAAiBE,QAAjB,KAA8B,OAA7C;AACAzD,gBAAI,MAAJ,EAAY,MAAZ,EAAoB,EAAEuE,SAASwB,aAAaxC,GAAxB,EAApB;AACAvD,gBAAI,SAAJ,EAAe+F,aAAaxC,GAAb,CAAiBE,QAAjB,KAA8B,SAA7C;AACAzD,gBAAI,SAAJ,EAAe+F,aAAaxC,GAAb,CAAiBE,QAAjB,KAA8B,UAA7C;AACAzD,gBAAI,CAAC,MAAD,EAAS,QAAT,EAAmB,QAAnB,CAAJ,EAAkC,SAAlC,EAA6C,EAAEuE,SAASwB,aAAaxC,GAAxB,EAA7C;AACD;AACD,cAAIR,QAAQX,MAAME,OAAlB,EAA2B;AACzBtC,gBAAI,QAAJ,EAAc,SAAd,EAAyB,EAAEuE,SAASwB,aAAaxC,GAAxB,EAAzB;AACAvD,gBAAI,QAAJ,EAAc,MAAd,EAAsB,EAAEuE,SAASwB,aAAaxC,GAAxB,EAAtB;AACAvD,gBAAI,QAAJ,EAAc,QAAd,EAAwB,EAAEuE,SAASwB,aAAaxC,GAAxB,EAAxB;AACAvD,gBAAI,CAAC,QAAD,EAAW,QAAX,CAAJ,EAA0B,MAA1B,EAAkC,EAAEuE,SAASwB,aAAaxC,GAAxB,EAAlC;AACA;AACAvD,gBAAI,CAAC,QAAD,CAAJ,EAAgB,OAAhB,EAAyB,EAAE,0BAA0B+F,aAAaxC,GAAzC,EAAzB;AACD;AACF;AACF,OA1BD;AA2BD;AACF;AACF;;AAED;AACO,SAAS5B,oBAAT,CAA+B9B,OAA/B,EAAwCG,GAAxC,EAA6CC,MAA7C,EAAqD;AAC1D,MAAIJ,OAAJ,EAAa;AACX,QAAIA,QAAQmG,MAAZ,EAAoB;AAClBnG,cAAQmG,MAAR,CAAelD,OAAf,CAAuBmD,SAAS;AAC9B,YAAIA,MAAM1C,GAAV,EAAe;AACb;AACArC,8BAAoBrB,OAApB,EAA6BoG,KAA7B,EAAoC,QAApC,EAA8CjG,GAA9C;AACA;AACD;AACF,OAND;AAOD;AACF;AACF;;AAED;AACO,SAAS4B,yBAAT,CAAoCsE,YAApC,EAAkDC,cAAlD,EAAkEpD,IAAlE,EAAwE;AAC7E,SAAOvB,wBAAwB0E,YAAxB,EAAsC,eAAtC,EAAuDC,cAAvD,EAAuEpD,IAAvE,CAAP;AACD;;AAEM,SAASlB,0BAAT,CAAqCqE,YAArC,EAAmDC,cAAnD,EAAmEpD,IAAnE,EAAyE;AAC9E,SAAOtB,yBAAyByE,YAAzB,EAAuC,eAAvC,EAAwDC,cAAxD,EAAwEpD,IAAxE,CAAP;AACD;;AAED;AACO,SAASjB,kBAAT,CAA6BsE,cAA7B,EAA6CC,OAA7C,EAAsDtD,IAAtD,EAA4D;AACjE,SAAOvB,wBAAwB4E,cAAxB,EAAwC,QAAxC,EAAkDC,OAAlD,EAA2DtD,IAA3D,CAAP;AACD;;AAEM,SAAShB,mBAAT,CAA8BqE,cAA9B,EAA8CC,OAA9C,EAAuDtD,IAAvD,EAA6D;AAClE,SAAOtB,yBAAyB2E,cAAzB,EAAyC,QAAzC,EAAmDC,OAAnD,EAA4DtD,IAA5D,CAAP;AACD;;AAEM,SAASf,sBAAT,CAAiCsE,IAAjC,EAAuCH,cAAvC,EAAuD;AAC5D,QAAMxB,SAAS9B,iBAAE+C,IAAF,CAAOU,KAAKR,aAAZ,EAA2B,EAAEvC,KAAK4C,cAAP,EAA3B,CAAf;AACA,MAAI,CAACtD,iBAAE0D,WAAF,CAAc5B,MAAd,CAAL,EAA4B,OAAOA,OAAOrB,WAAd;AAC5B,SAAOkD,SAAP;AACD;;AAEM,SAASvE,eAAT,CAA0BqE,IAA1B,EAAgCH,cAAhC,EAAgDE,OAAhD,EAAyD;AAC9D,QAAM1B,SAAS9B,iBAAE+C,IAAF,CAAOU,KAAKN,MAAZ,EAAoB,EAAEzB,SAAS4B,cAAX,EAA2B5C,KAAK8C,OAAhC,EAApB,CAAf;AACA,MAAI,CAACxD,iBAAE0D,WAAF,CAAc5B,MAAd,CAAL,EAA4B,OAAOA,OAAOrB,WAAd;AAC5B,SAAOkD,SAAP;AACD;;AAEM,SAAStE,kBAAT,CAA6BoE,IAA7B,EAAmCH,cAAnC,EAAmDpD,IAAnD,EAAyD;AAC9D,SAAOF,iBAAEiB,MAAF,CAASwC,KAAKN,MAAL,IAAe,EAAxB,EAA4B,EAAEzB,SAAS4B,cAAX,EAA2B7C,aAAc,OAAOP,IAAP,KAAgB,QAAhB,GAA2BA,IAA3B,GAAkCP,UAAUO,IAAV,CAA3E,EAA5B,CAAP;AACD","file":"permissions.js","sourcesContent":["import _ from 'lodash'\r\nimport { Ability, AbilityBuilder, toMongoQuery } from 'casl/dist/umd'\r\n\r\n// Define some alias to simplify ability definitions\r\nAbility.addAlias('update', 'patch')\r\nAbility.addAlias('read', ['get', 'find'])\r\nAbility.addAlias('remove', 'delete')\r\nAbility.addAlias('all', ['read', 'create', 'update', 'remove'])\r\n\r\nexport const Roles = {\r\n  member: 0,\r\n  manager: 1,\r\n  owner: 2\r\n}\r\n\r\nexport const RoleNames = [\r\n  'member',\r\n  'manager',\r\n  'owner'\r\n]\r\n\r\nexport function isSeniorRole (roleName, juniorName) {\r\n  return Roles[roleName] >= Roles[juniorName]\r\n}\r\n\r\nexport function isJuniorRole (roleName, seniorName) {\r\n  return Roles[roleName] < Roles[seniorName]\r\n}\r\n\r\nexport function getSeniorRoles (roleName) {\r\n  const seniorRoles = []\r\n  _.forEach(Roles, role => { if (Roles[roleName] < role) seniorRoles.push(RoleNames[role]) })\r\n  return seniorRoles\r\n}\r\n\r\nexport function getJuniorRoles (roleName) {\r\n  const juniorRoles = []\r\n  _.forEach(Roles, role => { if (Roles[roleName] >= role) juniorRoles.push(RoleNames[role]) })\r\n  return juniorRoles\r\n}\r\n\r\n// Hooks that can be added to customize abilities computation\r\nlet hooks = []\r\n\r\n// Get the unique global symbol to store resource type / context on a resource object\r\nexport const RESOURCE_TYPE = 'type'\r\nexport const RESOURCE_TYPE_KEY = Symbol.for(RESOURCE_TYPE)\r\n\r\nexport function defineResourceRules (subject, resource, resourceService, can) {\r\n  const role = Roles[resource.permissions]\r\n\r\n  if (role >= Roles.member) {\r\n    can('read', resourceService, { _id: resource._id })\r\n  }\r\n  if (role >= Roles.manager) {\r\n    can('update', resourceService, { _id: resource._id })\r\n    can(['create', 'remove'], 'authorisations', { resource: resource._id })\r\n  }\r\n  if (role >= Roles.owner) {\r\n    can('remove', resourceService, { _id: resource._id })\r\n  }\r\n}\r\n\r\n// Hook computing default abilities for a given user\r\nexport function defineUserAbilities (subject, can, cannot) {\r\n  // Allow user registration\r\n  can('service', 'users')\r\n  can('create', 'users')\r\n  // Verification email, reset password, etc.\r\n  can('service', 'account')\r\n  can('create', 'account')\r\n  can('service', 'devices')\r\n  can('update', 'devices')\r\n  can('remove', 'devices')\r\n\r\n  if (subject && subject._id) {\r\n    // Read user profiles for authorizing\r\n    can('read', 'users')\r\n    // Update user profile and destroy it\r\n    can(['update', 'remove'], 'users', { _id: subject._id })\r\n    // Access authorisation service, then rights will be granted on a per-resource basis\r\n    can('service', 'authorisations')\r\n    // Access storage service, then rights will be granted on a per-resource basis\r\n    can('service', 'storage')\r\n    // This is for the user avatar\r\n    // take care that the storage service uses 'id' as input but produces _id as output\r\n    can('create', 'storage', { id: 'avatars/' + subject._id.toString() })\r\n    can('create', 'storage', { id: 'avatars/' + subject._id.toString() + '.thumbnail' })\r\n    can('remove', 'storage', { _id: 'avatars/' + subject._id.toString() })\r\n    can('remove', 'storage', { _id: 'avatars/' + subject._id.toString() + '.thumbnail' })\r\n    // Avatar is part of user profiles so that they can be read by any\r\n    can('read', 'storage', { _id: { $regex: '^avatars/*' } })\r\n    // Verification email, reset password, etc.\r\n    can('service', 'account')\r\n    can('create', 'account')\r\n    can('service', 'devices')\r\n    can('update', 'devices')\r\n    can('remove', 'devices')\r\n  }\r\n}\r\n\r\n// Compute abilities for a given user\r\nexport async function defineAbilities (subject, ...args) {\r\n  const { rules, can, cannot } = AbilityBuilder.extract()\r\n\r\n  // Run registered hooks providing any additional arguments used to handle complex use cases\r\n  await Promise.all(hooks.map(async hook => {\r\n    await hook(subject, can, cannot, ...args)\r\n  }))\r\n\r\n  // CASL cannot infer the object type from the object itself so we need\r\n  // to tell it how he can find the object type, i.e. service name.\r\n  return new Ability(rules, {\r\n    subjectName: resource => {\r\n      if (!resource || typeof resource === 'string') {\r\n        return resource\r\n      }\r\n      return resource[RESOURCE_TYPE_KEY]\r\n    }\r\n  })\r\n}\r\n\r\ndefineAbilities.registerHook = function (hook) {\r\n  if (!hooks.includes(hook)) {\r\n    hooks.push(hook)\r\n  }\r\n}\r\n\r\ndefineAbilities.unregisterHook = function (hook) {\r\n  hooks = hooks.filter(registeredHook => registeredHook !== hook)\r\n}\r\n\r\nexport function hasServiceAbilities (abilities, service) {\r\n  if (!abilities) return false\r\n  // The unique identifier of a service is its path not its name.\r\n  // Indeed we have for instance a 'groups' service in each organisation\r\n  // Take care that in client we have the service path while on server we have the actual object\r\n  const path = typeof service === 'string' ? service : service.getPath()\r\n  return abilities.can('service', path) || abilities.can('service', _.replace(path, /^.*\\//, '*/'))\r\n}\r\n\r\nexport function hasResourceAbilities (abilities, operation, resourceType, context, resource) {\r\n  if (!abilities) return false\r\n  // Create a shallow copy adding context and type\r\n  const object = Object.assign({}, resource)\r\n  object[RESOURCE_TYPE_KEY] = resourceType\r\n  // Add a virtual context to take it into account for object having no link to it\r\n  if (context) object.context = (typeof context === 'object' ? context._id.toString() : context.toString())\r\n\r\n  const result = abilities.can(operation, object)\r\n\r\n  return result\r\n}\r\n\r\n// Utility function used to remove the virtual context from query\r\nexport function removeContext (query) {\r\n  _.forOwn(query, (value, key) => {\r\n    // Process current attributes or recurse\r\n    // Take care to nested fields like 'field._id'\r\n    if (key === 'context') {\r\n      delete query.context\r\n    } else if (Array.isArray(value)) {\r\n      value.forEach(item => removeContext(item))\r\n      // Remove empty objects from array\r\n      // _.remove(value, item => _.isEmpty(item))\r\n      // Remove empty arrays from query\r\n      if (_.isEmpty(value)) delete query[key]\r\n    } else if (typeof value === 'object') {\r\n      removeContext(value)\r\n      // Remove empty objects from query\r\n      if (_.isEmpty(value)) delete query[key]\r\n    }\r\n  })\r\n  return query\r\n}\r\n\r\n// Get the query used to filter the objects according to given abilities\r\n// A null query indicates that access should not be granted\r\nexport function getQueryForAbilities (abilities, operation, resourceType) {\r\n  if (!abilities) return null\r\n\r\n  const rules = abilities.rulesFor(operation, resourceType)\r\n  const query = toMongoQuery(rules)\r\n  // Remove any context to avoid taking it into account because it is not really stored on objects\r\n  // We clone the object here because of references to the abilities rules (see https://github.com/kalisio/kdk/issues/384)\r\n  return (query ? removeContext(_.cloneDeep(query)) : null)\r\n}\r\n\r\nfunction buildSubjectsQueryForResource (resourceScope, resourceId, role) {\r\n  const query = { [resourceScope]: { $elemMatch: { _id: resourceId } } }\r\n  if (role) {\r\n    _.set(query[resourceScope], '$elemMatch.permissions', (typeof role === 'string' ? role : RoleNames[role]))\r\n  }\r\n  return query\r\n}\r\n\r\nexport function findSubjectsForResource (subjectService, resourceScope, resourceId, role) {\r\n  // Build the query\r\n  const query = buildSubjectsQueryForResource(resourceScope, resourceId, role)\r\n  // Execute the query\r\n  return subjectService.find({ query })\r\n}\r\n\r\nexport function countSubjectsForResource (subjectService, resourceScope, resourceId, role) {\r\n  // Build the query\r\n  const query = buildSubjectsQueryForResource(resourceScope, resourceId, role)\r\n  // Indicate we'd only like to count\r\n  query.$limit = 0\r\n  // Execute the query\r\n  return subjectService.find({ query })\r\n}\r\n\r\n// Hook computing organisation abilities for a given user\r\nexport function defineOrganisationAbilities (subject, can, cannot) {\r\n  if (subject) {\r\n    // Create new organisations\r\n    can('service', 'organisations')\r\n    can('create', 'organisations')\r\n\r\n    if (subject.organisations) {\r\n      subject.organisations.forEach(organisation => {\r\n        if (organisation._id) {\r\n          // Generic rules for resources\r\n          defineResourceRules(subject, organisation, 'organisations', can)\r\n          // Specific rules for organisations\r\n          const role = Roles[organisation.permissions]\r\n          if (role >= Roles.member) {\r\n            // The unique identifier of a service is its path not its name.\r\n            // Indeed we have for instance a 'groups' service in each organisation.\r\n            can('service', organisation._id.toString() + '/members')\r\n            can('read', 'members', { context: organisation._id })\r\n            can('service', organisation._id.toString() + '/tags')\r\n            can('read', 'tags', { context: organisation._id })\r\n            can('service', organisation._id.toString() + '/groups')\r\n            can('service', organisation._id.toString() + '/storage')\r\n            can(['read', 'create', 'remove'], 'storage', { context: organisation._id })\r\n          }\r\n          if (role >= Roles.manager) {\r\n            can('update', 'members', { context: organisation._id })\r\n            can('update', 'tags', { context: organisation._id })\r\n            can('create', 'groups', { context: organisation._id })\r\n            can(['create', 'remove'], 'tags', { context: organisation._id })\r\n            // Remove invited members\r\n            can(['remove'], 'users', { 'sponsor.organisationId': organisation._id })\r\n          }\r\n        }\r\n      })\r\n    }\r\n  }\r\n}\r\n\r\n// Hook computing group abilities for a given user\r\nexport function defineGroupAbilities (subject, can, cannot) {\r\n  if (subject) {\r\n    if (subject.groups) {\r\n      subject.groups.forEach(group => {\r\n        if (group._id) {\r\n          // Generic rules for resources\r\n          defineResourceRules(subject, group, 'groups', can)\r\n          // No specific rules for groups\r\n        }\r\n      })\r\n    }\r\n  }\r\n}\r\n\r\n// Helper functions to find the members of a given organisation\r\nexport function findMembersOfOrganisation (usersService, organisationId, role) {\r\n  return findSubjectsForResource(usersService, 'organisations', organisationId, role)\r\n}\r\n\r\nexport function countMembersOfOrganisation (usersService, organisationId, role) {\r\n  return countSubjectsForResource(usersService, 'organisations', organisationId, role)\r\n}\r\n\r\n// Helper functions to find the members of a given group\r\nexport function findMembersOfGroup (membersService, groupId, role) {\r\n  return findSubjectsForResource(membersService, 'groups', groupId, role)\r\n}\r\n\r\nexport function countMembersOfGroup (membersService, groupId, role) {\r\n  return countSubjectsForResource(membersService, 'groups', groupId, role)\r\n}\r\n\r\nexport function getRoleForOrganisation (user, organisationId) {\r\n  const result = _.find(user.organisations, { _id: organisationId })\r\n  if (!_.isUndefined(result)) return result.permissions\r\n  return undefined\r\n}\r\n\r\nexport function getRoleForGroup (user, organisationId, groupId) {\r\n  const result = _.find(user.groups, { context: organisationId, _id: groupId })\r\n  if (!_.isUndefined(result)) return result.permissions\r\n  return undefined\r\n}\r\n\r\nexport function findGroupsWithRole (user, organisationId, role) {\r\n  return _.filter(user.groups || [], { context: organisationId, permissions: (typeof role === 'string' ? role : RoleNames[role]) })\r\n}\r\n"]}

package/lib/core/common/schemas/groups.create.json

@@ -16,7 +16,7 @@
     },
     "description": {
       "type": "string", 
-      "maxLength": 256,
+      "maxLength": 2048,
       "field": {
         "component": "form/KTextField",
         "label": "schemas.GROUPS_DESCRIPTION_FIELD_LABEL"

package/lib/core/common/schemas/groups.update.json

@@ -16,7 +16,7 @@
     },
     "description": {
       "type": "string", 
-      "maxLength": 256,
+      "maxLength": 2048,
       "field": {
         "component": "form/KTextField",
         "label": "schemas.GROUPS_DESCRIPTION_FIELD_LABEL"

package/lib/core/common/schemas/organisations.create.json

@@ -16,7 +16,7 @@
     },
     "description": {
       "type": "string", 
-      "maxLength": 256,
+      "maxLength": 2048,
       "field": {
         "component": "form/KTextField",
         "label": "schemas.ORGANISATIONS_DESCRIPTION_FIELD_LABEL"

package/lib/core/common/schemas/organisations.update.json

@@ -16,7 +16,7 @@
     },
     "description": {
       "type": "string", 
-      "maxLength": 256,
+      "maxLength": 2048,
       "field": {
         "component": "form/KTextField",
         "label": "schemas.ORGANISATIONS_DESCRIPTION_FIELD_LABEL"
@@ -27,7 +27,7 @@
       "field": {
         "component": "form/KAttachmentField",
         "label": "schemas.AVATAR_FIELD_LABEL",
-        "service": "storage",
+        "service": "<%= id %>/storage",
         "acceptedFiles": ".png,.jpg,.jpeg,.webp",
         "maxFilesize": 0.5,
         "autoProcessQueue": false,

package/lib/core/common/schemas/settings.update.json

@@ -0,0 +1,139 @@
+{
+  "$schema": "http://json-schema.org/draft-06/schema#",
+  "$id": "http://www.kalisio.xyz/schemas/settings.update.json#",
+  "title": "schemas.UPDATE_SETTINGS_TITLE",
+  "type": "object",
+  "properties": {
+    "shortTime": {
+      "type": "string",
+      "group": "schemas.TIME_FORMAT_SETTINGS",
+      "field": {
+        "component": "form/KTextField",
+        "label": "schemas.TIME_FORMAT_SHORT_TIME_FIELD_LABEL",
+        "helper": "schemas.TIME_FORMAT_SHORT_TIME_FIELD_HELPER"
+      }
+    },
+    "longTime": {
+      "type": "string",
+      "group": "schemas.TIME_FORMAT_SETTINGS",
+      "field": {
+        "component": "form/KTextField",
+        "label": "schemas.TIME_FORMAT_LONG_TIME_FIELD_LABEL",
+        "helper": "schemas.TIME_FORMAT_LONG_TIME_FIELD_HELPER"
+      }
+    },
+    "shortDate": {
+      "type": "string",
+      "group": "schemas.TIME_FORMAT_SETTINGS",
+      "field": {
+        "component": "form/KTextField",
+        "label": "schemas.TIME_FORMAT_SHORT_DATE_FIELD_LABEL",
+        "helper": "schemas.TIME_FORMAT_SHORT_DATE_FIELD_HELPER"
+
+      }
+    },
+    "longDate": {
+      "type": "string",
+      "group": "schemas.TIME_FORMAT_SETTINGS",
+      "field": {
+        "component": "form/KTextField",
+        "label": "schemas.TIME_FORMAT_LONG_DATE_FIELD_LABEL",
+        "helper": "schemas.TIME_FORMAT_LONG_DATE_FIELD_HELPER"
+      }
+    },
+    "shortYear": {
+      "type": "string",
+      "group": "schemas.TIME_FORMAT_SETTINGS",
+      "field": {
+        "component": "form/KTextField",
+        "label": "schemas.TIME_FORMAT_SHORT_YEAR_FIELD_LABEL",
+        "helper": "schemas.TIME_FORMAT_SHORT_YEAR_FIELD_HELPER"
+      }
+    },
+    "longYear": {
+      "type": "string",
+      "group": "schemas.TIME_FORMAT_SETTINGS",
+      "field": {
+        "component": "form/KTextField",
+        "label": "schemas.TIME_FORMAT_LONG_YEAR_FIELD_LABEL",
+        "helper": "schemas.TIME_FORMAT_LONG_YEAR_FIELD_HELPER"
+      }
+    },
+    "utc": {
+      "type": "boolean",
+      "group": "schemas.TIME_FORMAT_SETTINGS",
+      "field": {
+        "component": "form/KToggleField",
+        "label": "schemas.TIME_FORMAT_UTC_FIELD_LABEL"
+      }
+    },
+    "timelineStep": {
+      "type": "number",
+      "group": "schemas.TIMELINE_SETTINGS",
+      "field": {
+        "component": "form/KSelectField",
+        "label": "schemas.TIMELINE_STEP",
+        "options": [
+          { "label": "5m", "value": 5  },
+          { "label": "10m", "value": 10 },
+          { "label": "12m", "value": 12 },
+          { "label": "15m", "value": 15 },
+          { "label": "20m", "value": 20 },
+          { "label": "30m", "value": 30 },
+          { "label": "60m", "value": 60, "selected": true }
+        ]
+      }
+    },
+    "timeseriesSpan": {
+      "type": "number",
+      "group": "schemas.TIMESERIES_SETTINGS",
+      "field": {
+        "component": "form/KSelectField",
+        "label": "schemas.TIMESERIES_SPAN",
+        "options": [
+          { "label": "3H", "value": 180 },
+          { "label": "6H", "value": 360 },
+          { "label": "12H", "value": 720 },
+          { "label": "24H", "value": 1440, "selected": true },
+          { "label": "48H", "value": 2880 },
+          { "label": "72H", "value": 4320 },
+          { "label": "96H", "value": 5760 }
+        ]
+      }
+    },
+    "restoreView": {
+      "type": "boolean",
+      "group": "schemas.MAP_SETTINGS",
+      "field": {
+        "component": "form/KToggleField",
+        "label": "schemas.RESTORE_VIEW_FIELD_LABEL"
+      }
+    },
+    "restoreLayers": {
+      "type": "boolean",
+      "group": "schemas.MAP_SETTINGS",
+      "field": {
+        "component": "form/KToggleField",
+        "label": "schemas.RESTORE_LAYERS_FIELD_LABEL"
+      }
+    },
+    "location": {
+      "type": "string",
+      "group": "schemas.MAP_SETTINGS",
+      "field": {
+        "component": "form/KTextField",
+        "label": "schemas.LOCATION_FORMAT_LABEL",
+        "helper": "schemas.LOCATION_FORMAT_HELPER"
+      }
+    }
+  },
+  "required": [
+    "shortTime",
+    "longTime",
+    "shortDate",
+    "longDate",
+    "shortYear",
+    "longYear",
+    "location"
+  ]
+}

package/lib/core/common/schemas/tags.update.json

@@ -1,7 +1,7 @@
 {
   "$schema": "http://json-schema.org/draft-06/schema#",
   "$id": "http://www.kalisio.xyz/schemas/tags.update.json#",
-  "title": "schemas.OBJECT_NAME",
+  "title": "schemas.TAG_NAME",
   "description": "Tag edition schema",
   "type": "object",
   "properties": {
@@ -20,6 +20,14 @@
         "component": "form/KIconField",
         "label": "schemas.TAGS_ICON_FIELD_LABEL"
       }
+    },
+    "description": {
+      "type": "string", 
+      "maxLength": 2048,
+      "field": {
+        "component": "form/KTextField",
+        "label": "schemas.TAGS_DESCRIPTION_FIELD_LABEL"
+      }
     }
   },
   "required": ["value"]

package/lib/map/api/hooks/hooks.query.js

@@ -89,7 +89,7 @@ let aggregateFeaturesQuery = exports.aggregateFeaturesQuery = (() => {
             });
           });
           const elementResults = yield collection.aggregate(pipeline, aggregateOptions).toArray();
-          debug(`Generated ${elementResults.length} feature(s) for ${element} element`);
+          debug(`Generated ${elementResults.length} feature(s) for ${element} element`, elementResults);
           // Rearrange data so that we get ordered arrays indexed by element
           elementResults.forEach(function (result) {
             result.time = { [element]: result.time };
@@ -262,27 +262,31 @@ function asGeoJson(options = {}) {
     const params = hook.params;
     const query = params.query;
     if (!options.force && !params.asGeoJson) return;
-    if (query.$distinct) return; // Not applicable in this case
-    let results = hook.result;
+    if (query.$distinct || query.$aggregation) return; // Not applicable in this case
+    const longitudeProperty = options.longitudeProperty || 'longitude';
+    const latitudeProperty = options.latitudeProperty || 'latitude';
+    const altitudeProperty = options.altitudeProperty || 'altitude';
+    const geometryProperty = options.geometryProperty || 'geometry';
+    let results = _lodash2.default.get(hook, options.dataPath || 'result');
     // Already as GeoJson ?
     if (results.type === 'FeatureCollection') return;
-    const pagination = _lodash2.default.pick(results, ['total', 'skip', 'limit']);
-    results = Array.isArray(results) ? results : results.data;
+    const isPaginated = !_lodash2.default.isNil(results.data);
+    const pagination = isPaginated ? _lodash2.default.pick(results, ['total', 'skip', 'limit']) : {};
+    results = isPaginated ? results.data : results;
     results = results.filter(item => {
-      // Item locations are not already in GeoJson feature format so we need to convert if we can
-      if (options.longitudeProperty && options.latitudeProperty) {
-        return _lodash2.default.has(item, options.longitudeProperty) && _lodash2.default.has(item, options.latitudeProperty);
-      } else {
-        return true;
-      }
+      // Check if item is not already in GeoJson feature format and we can convert if required
+      return _lodash2.default.has(item, longitudeProperty) && _lodash2.default.has(item, latitudeProperty) ||
+      // When performing feature aggregation on geometries the result can be an array
+      Array.isArray(_lodash2.default.get(item, geometryProperty)) ||
+      // Check for a geometry property (previously provided or already transformed item)
+      _lodash2.default.has(item, geometryProperty + '.type') && _lodash2.default.has(item, geometryProperty + '.coordinates');
     }).map(item => {
       let coordinates;
-      // Item locations are not already in GeoJson feature format so we need to convert
       // Keep track of coordinates before picking properties
-      if (options.longitudeProperty && options.latitudeProperty) {
-        coordinates = [_lodash2.default.get(item, options.longitudeProperty), _lodash2.default.get(item, options.latitudeProperty)];
-        if (options.altitudeProperty && _lodash2.default.has(item, options.altitudeProperty)) {
-          coordinates.push(_lodash2.default.get(item, options.altitudeProperty));
+      if (_lodash2.default.has(item, longitudeProperty) && _lodash2.default.has(item, latitudeProperty)) {
+        coordinates = [_lodash2.default.get(item, longitudeProperty), _lodash2.default.get(item, latitudeProperty)];
+        if (_lodash2.default.has(item, altitudeProperty)) {
+          coordinates.push(_lodash2.default.get(item, altitudeProperty));
         }
       }
       if (options.pick) {
@@ -291,11 +295,26 @@ function asGeoJson(options = {}) {
       if (options.omit) {
         item = _lodash2.default.omit(item, options.omit);
       }
-      // Item locations are not already in GeoJson feature format so we need to convert
-      if (options.longitudeProperty && options.latitudeProperty) {
-        return Object.assign({ type: 'Feature', geometry: { type: 'Point', coordinates }, properties: {} }, item);
-      } else {
-        return item;
+      // Item locations are already in GeoJson format
+      if (_lodash2.default.has(item, geometryProperty + '.type') && _lodash2.default.has(item, geometryProperty + '.coordinates')) {
+        return Object.assign({
+          type: 'Feature',
+          geometry: _lodash2.default.get(item, geometryProperty),
+          properties: {}
+        }, _lodash2.default.omit(item, [geometryProperty]));
+      } else if (Array.isArray(_lodash2.default.get(item, geometryProperty))) {
+        return Object.assign({
+          type: 'Feature',
+          geometry: { type: 'GeometryCollection', geometries: _lodash2.default.get(item, geometryProperty) },
+          properties: {}
+        }, _lodash2.default.omit(item, [geometryProperty]));
+      } else if (coordinates) {
+        // Item locations are not already in GeoJson feature format so we need to convert
+        return Object.assign({
+          type: 'Feature',
+          geometry: { type: 'Point', coordinates },
+          properties: {}
+        }, _lodash2.default.omit(item, [longitudeProperty, latitudeProperty]));
       }
     });
     // Move some data to properties ?
@@ -307,16 +326,18 @@ function asGeoJson(options = {}) {
         });
       });
     }
-    // Copy pagination information so that client can use it anyway
+    // Copy pagination information if any so that client can use it anyway
     if (_lodash2.default.get(options, 'asFeatureCollection', true)) {
-      hook.result = Object.assign({
+      _lodash2.default.set(hook, options.dataPath || 'result', Object.assign({
         type: 'FeatureCollection',
         features: results
-      }, pagination);
-    } else {
-      hook.result = Object.assign({
+      }, pagination)); // If no pagination this merged object will be empty
+    } else if (isPaginated) {
+      _lodash2.default.set(hook, options.dataPath || 'result', Object.assign({
         data: results
-      }, pagination);
+      }, pagination));
+    } else {
+      _lodash2.default.set(hook, options.dataPath || 'result', results);
     }
   };
 }