@konplit-services/common 1.0.123 → 1.0.125
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { NextFunction, Request, Response } from "express";
|
|
2
2
|
import { JWT_Data } from "../services/Jwt";
|
|
3
|
+
import { USER_TYPES } from "../helper";
|
|
3
4
|
declare global {
|
|
4
5
|
namespace Express {
|
|
5
6
|
interface Request {
|
|
@@ -7,4 +8,4 @@ declare global {
|
|
|
7
8
|
}
|
|
8
9
|
}
|
|
9
10
|
}
|
|
10
|
-
export declare const hasPermission: (permissionCode: string) => (req: Request, res: Response, next: NextFunction) => Promise<void>;
|
|
11
|
+
export declare const hasPermission: (userType: USER_TYPES, permissionCode: string) => (req: Request, res: Response, next: NextFunction) => Promise<void>;
|
|
@@ -16,13 +16,16 @@ const error_codes_1 = require("../helper/errorCodes/error-codes");
|
|
|
16
16
|
const language_1 = require("../helper/lang/language");
|
|
17
17
|
const base_1 = require("../redis/base");
|
|
18
18
|
const constants_1 = require("../redis/constants");
|
|
19
|
-
const hasPermission = (permissionCode) => {
|
|
19
|
+
const hasPermission = (userType, permissionCode) => {
|
|
20
20
|
return (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
|
|
21
21
|
//comment
|
|
22
22
|
if (!req.currentUser) {
|
|
23
23
|
throw new notAuthorized_1.NotAuthorizedError(language_1.lang.not_authorized, error_codes_1.error_codes.INVALID_AUTHORIZATION);
|
|
24
24
|
}
|
|
25
25
|
const user = req.currentUser;
|
|
26
|
+
if (userType !== user.userType) {
|
|
27
|
+
throw new forbidden_error_1.ForbiddenError(language_1.lang.forbidden, error_codes_1.error_codes.INVALID_FORBIDDEN);
|
|
28
|
+
}
|
|
26
29
|
try {
|
|
27
30
|
let permissions = [];
|
|
28
31
|
const perm = yield base_1.redisWrapper.get((0, constants_1.getPermissions)(user.id));
|
|
@@ -18,10 +18,9 @@ const validAllowedFields = (allowFields) => {
|
|
|
18
18
|
const params = Object.keys(req.params);
|
|
19
19
|
const query = Object.keys(req.query);
|
|
20
20
|
const body = Object.keys(req.body);
|
|
21
|
-
const submittedFields = [
|
|
22
|
-
|
|
23
|
-
...
|
|
24
|
-
...body,
|
|
21
|
+
const submittedFields = [...params, ...query, ...body];
|
|
22
|
+
const newAllowedFields = [
|
|
23
|
+
...allowFields,
|
|
25
24
|
"search",
|
|
26
25
|
"page",
|
|
27
26
|
"limit",
|
|
@@ -30,7 +29,7 @@ const validAllowedFields = (allowFields) => {
|
|
|
30
29
|
"sort_by",
|
|
31
30
|
"order",
|
|
32
31
|
];
|
|
33
|
-
const extraFields = submittedFields.filter((field) => !
|
|
32
|
+
const extraFields = submittedFields.filter((field) => !newAllowedFields.includes(field));
|
|
34
33
|
if (extraFields.length > 0) {
|
|
35
34
|
throw new errors_1.BadRequestError(`Extra fields submitted: ${extraFields.join(", ")}`, error_codes_1.error_codes.INVALID_INPUT);
|
|
36
35
|
}
|