@loomcore/api 0.2.21 → 0.2.22

package/dist/__tests__/common-test.utils.js

@@ -5,6 +5,7 @@ import { Value } from "@sinclair/typebox/value";
 import jwt from "jsonwebtoken";
 import { ObjectId } from "mongodb";
 import { ApiController } from "../controllers/api.controller.js";
+import { authenticated } from "../middleware/index.js";
 import { MongoDBDatabase } from "../databases/mongo-db/mongo-db.database.js";
 import { LeftJoin } from "../databases/operations/left-join.operation.js";
 import { PostgresDatabase } from "../databases/postgres/postgres.database.js";
@@ -219,7 +220,7 @@ export class CategoryService extends GenericApiService {
 export class CategoryController extends ApiController {
     constructor(app, database) {
         const categoryService = new CategoryService(database);
-        super("categories", app, categoryService, "category", CategorySpec);
+        super("categories", app, categoryService, authenticated, "category", CategorySpec);
     }
 }
 export function setupTestConfig(isMultiTenant = true, dbType) {
@@ -284,7 +285,7 @@ export class ProductService extends GenericApiService {
 export class ProductsController extends ApiController {
     constructor(app, database) {
         const productService = new ProductService(database);
-        super("products", app, productService, "product", ProductSpec);
+        super("products", app, productService, authenticated, "product", ProductSpec);
     }
     async get(req, res, next) {
         res.set("Content-Type", "application/json");
@@ -359,7 +360,7 @@ export class MultiTenantProductsController extends ApiController {
             "internalNumber",
         ]);
         const PublicAggregatedProductSpec = entityUtils.getModelSpec(PublicAggregatedProductSchema);
-        super("multi-tenant-products", app, productService, "product", ProductSpec, PublicAggregatedProductSpec);
+        super("multi-tenant-products", app, productService, authenticated, "product", ProductSpec, PublicAggregatedProductSpec);
     }
 }
 function configureJwtSecret() {

package/dist/__tests__/test-objects.d.ts

@@ -13,6 +13,7 @@ export declare function getTestMetaOrg(): IOrganization;
 export declare function getTestMetaOrgDomain(organizationId?: string | number): Partial<IOrganizationDomain>;
 export declare function getTestMetaOrgUser(): IUser;
 export declare function getTestMetaOrgUserContext(): IUserContext;
+export declare function getTestMetaOrgAdminUserContext(): IUserContext;
 export declare function setTestOrgId(orgId: string | number): void;
 export declare function setTestOrgUserId(userId: string | number): void;
 export declare function getTestOrg(): IOrganization;

package/dist/__tests__/test-objects.js

@@ -65,6 +65,21 @@ export function getTestMetaOrgUserContext() {
         ],
     };
 }
+export function getTestMetaOrgAdminUserContext() {
+    return {
+        user: getTestMetaOrgUser(),
+        organization: getTestMetaOrg(),
+        authorizations: [
+            {
+                _id: "6939c54e57a1c6576a40c590",
+                _orgId: getTestMetaOrg()._id,
+                role: "admin",
+                feature: "admin",
+                config: {},
+            },
+        ],
+    };
+}
 let TEST_ORG_ID = "6926167d06c0073a778a124f";
 let TEST_ORG_USER_ID = "6926167d06c0073a778a1250";
 export function setTestOrgId(orgId) {

package/dist/controllers/api.controller.d.ts

@@ -2,15 +2,17 @@ import { Application, NextFunction, Request, Response } from 'express';
 import { IEntity, IModelSpec } from '@loomcore/common/models';
 import type { TSchema } from '@sinclair/typebox';
 import { IGenericApiService } from '../services/index.js';
+import { type MethodAuth } from '../middleware/index.js';
 export declare abstract class ApiController<T extends IEntity> {
     protected app: Application;
     protected service: IGenericApiService<T>;
     protected slug: string;
     protected apiResourceName: string;
+    protected routeAuth: MethodAuth;
     protected modelSpec?: IModelSpec;
     protected publicSpec?: IModelSpec;
     protected idSchema: TSchema;
-    protected constructor(slug: string, app: Application, service: IGenericApiService<T>, resourceName?: string, modelSpec?: IModelSpec, publicSpec?: IModelSpec);
+    protected constructor(slug: string, app: Application, service: IGenericApiService<T>, routeAuth?: MethodAuth, resourceName?: string, modelSpec?: IModelSpec, publicSpec?: IModelSpec);
     mapRoutes(app: Application): void;
     protected validate(entity: any, isPartial?: boolean): void;
     protected validateMany(entities: any[], isPartial?: boolean): void;

package/dist/controllers/api.controller.js

@@ -3,19 +3,21 @@ import { entityUtils } from '@loomcore/common/utils';
 import { Value } from '@sinclair/typebox/value';
 import { getIdSchema } from '@loomcore/common/validation';
 import { apiUtils } from '../utils/index.js';
-import { isAuthorized } from '../middleware/index.js';
+import { authenticated, isAuthorized, } from '../middleware/index.js';
 export class ApiController {
     app;
     service;
     slug;
     apiResourceName;
+    routeAuth;
     modelSpec;
     publicSpec;
     idSchema;
-    constructor(slug, app, service, resourceName = '', modelSpec, publicSpec) {
+    constructor(slug, app, service, routeAuth = authenticated, resourceName = '', modelSpec, publicSpec) {
         this.slug = slug;
         this.app = app;
         this.service = service;
+        this.routeAuth = routeAuth;
         this.apiResourceName = resourceName;
         this.modelSpec = modelSpec;
         this.publicSpec = publicSpec;
@@ -23,15 +25,16 @@ export class ApiController {
         this.mapRoutes(app);
     }
     mapRoutes(app) {
-        app.get(`/api/${this.slug}`, isAuthorized(), this.get.bind(this));
-        app.get(`/api/${this.slug}/all`, isAuthorized(), this.getAll.bind(this));
-        app.get(`/api/${this.slug}/count`, isAuthorized(), this.getCount.bind(this));
-        app.get(`/api/${this.slug}/:id`, isAuthorized(), this.getById.bind(this));
-        app.post(`/api/${this.slug}`, isAuthorized(), this.create.bind(this));
-        app.patch(`/api/${this.slug}/batch`, isAuthorized(), this.batchUpdate.bind(this));
-        app.put(`/api/${this.slug}/:id`, isAuthorized(), this.fullUpdateById.bind(this));
-        app.patch(`/api/${this.slug}/:id`, isAuthorized(), this.partialUpdateById.bind(this));
-        app.delete(`/api/${this.slug}/:id`, isAuthorized(), this.deleteById.bind(this));
+        const auth = isAuthorized(this.routeAuth);
+        app.get(`/api/${this.slug}`, auth, this.get.bind(this));
+        app.get(`/api/${this.slug}/all`, auth, this.getAll.bind(this));
+        app.get(`/api/${this.slug}/count`, auth, this.getCount.bind(this));
+        app.get(`/api/${this.slug}/:id`, auth, this.getById.bind(this));
+        app.post(`/api/${this.slug}`, auth, this.create.bind(this));
+        app.patch(`/api/${this.slug}/batch`, auth, this.batchUpdate.bind(this));
+        app.put(`/api/${this.slug}/:id`, auth, this.fullUpdateById.bind(this));
+        app.patch(`/api/${this.slug}/:id`, auth, this.partialUpdateById.bind(this));
+        app.delete(`/api/${this.slug}/:id`, auth, this.deleteById.bind(this));
     }
     validate(entity, isPartial = false) {
         const validationErrors = this.service.validate(entity, isPartial);

package/dist/controllers/auth.controller.js

@@ -40,8 +40,8 @@ export class AuthController {
     mapRoutes(app) {
         app.post(`/api/auth/login`, this.login.bind(this), this.afterAuth.bind(this));
         app.get(`/api/auth/refresh`, this.requestTokenUsingRefreshToken.bind(this));
-        app.get(`/api/auth/get-user-context`, isAuthorized(), this.getUserContext.bind(this));
-        app.patch(`/api/auth/change-password`, isAuthorized(), this.changePassword.bind(this));
+        app.get(`/api/auth/get-user-context`, isAuthorized({ read: true }), this.getUserContext.bind(this));
+        app.patch(`/api/auth/change-password`, isAuthorized({ update: true }), this.changePassword.bind(this));
         app.post(`/api/auth/forgot-password`, this.forgotPassword.bind(this));
         app.post(`/api/auth/reset-password`, this.resetPassword.bind(this));
     }

package/dist/controllers/authorizations.controller.js

@@ -1,9 +1,10 @@
+import { adminWrites } from "../middleware/index.js";
 import { AuthorizationModelSpec, } from "../models/authorization.model.js";
 import { MultiTenantApiService } from "../services/multi-tenant-api.service.js";
 import { ApiController } from "./api.controller.js";
 export class AuthorizationsController extends ApiController {
     constructor(app, database) {
         const authorizationService = new MultiTenantApiService(database, "authorizations", "authorization", AuthorizationModelSpec);
-        super("authorizations", app, authorizationService, "authorization", AuthorizationModelSpec);
+        super("authorizations", app, authorizationService, adminWrites, "authorization", AuthorizationModelSpec);
     }
 }

package/dist/controllers/features.controller.d.ts

@@ -1,7 +1,7 @@
-import { IFeature } from "../models/feature.model.js";
+import type { Application } from "express";
+import type { IDatabase } from "../databases/models/index.js";
+import { type IFeature } from "../models/feature.model.js";
 import { ApiController } from "./api.controller.js";
-import { Application } from "express";
-import { IDatabase } from "../databases/models/index.js";
 export declare class FeaturesController extends ApiController<IFeature> {
     constructor(app: Application, database: IDatabase);
 }

package/dist/controllers/features.controller.js

@@ -1,9 +1,10 @@
+import { adminWrites } from "../middleware/index.js";
 import { FeatureModelSpec } from "../models/feature.model.js";
-import { ApiController } from "./api.controller.js";
 import { MultiTenantApiService } from "../services/multi-tenant-api.service.js";
+import { ApiController } from "./api.controller.js";
 export class FeaturesController extends ApiController {
     constructor(app, database) {
-        const featureService = new MultiTenantApiService(database, 'features', 'feature', FeatureModelSpec);
-        super('features', app, featureService, 'feature', FeatureModelSpec, FeatureModelSpec);
+        const featureService = new MultiTenantApiService(database, "features", "feature", FeatureModelSpec);
+        super("features", app, featureService, adminWrites, "feature", FeatureModelSpec, FeatureModelSpec);
     }
 }

package/dist/controllers/organizations.controller.d.ts

@@ -1,8 +1,8 @@
-import { Application, NextFunction, Request, Response } from 'express';
-import { IOrganization } from '@loomcore/common/models';
-import { ApiController } from './api.controller.js';
-import { OrganizationService } from '../services/index.js';
-import { IDatabase } from '../databases/models/index.js';
+import type { IOrganization } from "@loomcore/common/models";
+import type { Application, NextFunction, Request, Response } from "express";
+import type { IDatabase } from "../databases/models/index.js";
+import { OrganizationService } from "../services/index.js";
+import { ApiController } from "./api.controller.js";
 export declare class OrganizationsController extends ApiController<IOrganization> {
     orgService: OrganizationService;
     constructor(app: Application, database: IDatabase);

package/dist/controllers/organizations.controller.js

@@ -1,28 +1,30 @@
-import { ApiController } from './api.controller.js';
-import { apiUtils } from '../utils/index.js';
-import { BadRequestError } from '../errors/index.js';
-import { OrganizationService } from '../services/index.js';
-import { isAuthorized } from '../middleware/index.js';
+import { BadRequestError } from "../errors/index.js";
+import { adminWrites, isAuthorized } from "../middleware/index.js";
+import { OrganizationService } from "../services/index.js";
+import { apiUtils } from "../utils/index.js";
+import { ApiController } from "./api.controller.js";
 export class OrganizationsController extends ApiController {
     orgService;
     constructor(app, database) {
         const orgService = new OrganizationService(database);
-        super('organizations', app, orgService);
+        super("organizations", app, orgService, adminWrites);
         this.orgService = orgService;
     }
     mapRoutes(app) {
         super.mapRoutes(app);
-        app.get(`/api/${this.slug}/get-by-name/:name`, isAuthorized(), this.getByName.bind(this));
-        app.get(`/api/${this.slug}/get-by-code/:code`, isAuthorized(), this.getByCode.bind(this));
+        const auth = isAuthorized(this.routeAuth);
+        app.get(`/api/${this.slug}/get-by-name/:name`, auth, this.getByName.bind(this));
+        app.get(`/api/${this.slug}/get-by-code/:code`, auth, this.getByCode.bind(this));
     }
     async getByName(req, res, next) {
-        console.log('in OrganizationController.getByName');
         const { name } = req.params;
         try {
-            res.set('Content-Type', 'application/json');
-            const entity = await this.orgService.findOne(req.userContext, { filters: { name: { contains: name } } });
+            res.set("Content-Type", "application/json");
+            const entity = await this.orgService.findOne(req.userContext, {
+                filters: { name: { contains: name } },
+            });
             if (!entity)
-                throw new BadRequestError('Name not found');
+                throw new BadRequestError("Organization name not found");
             apiUtils.apiResponse(res, 200, { data: entity });
         }
         catch (err) {
@@ -33,10 +35,12 @@ export class OrganizationsController extends ApiController {
     async getByCode(req, res, next) {
         const { code } = req.params;
         try {
-            res.set('Content-Type', 'application/json');
-            const entity = await this.orgService.findOne(req.userContext, { filters: { code: { eq: code } } });
+            res.set("Content-Type", "application/json");
+            const entity = await this.orgService.findOne(req.userContext, {
+                filters: { code: { eq: code } },
+            });
             if (!entity)
-                throw new BadRequestError('Code not found');
+                throw new BadRequestError("Organization code not found");
             apiUtils.apiResponse(res, 200, { data: entity });
         }
         catch (err) {

package/dist/controllers/query-api.controller.d.ts

@@ -2,15 +2,17 @@ import { Application, NextFunction, Request, Response } from 'express';
 import { IEntity, IModelSpec } from '@loomcore/common/models';
 import type { TSchema } from '@sinclair/typebox';
 import { IGenericQueryService } from '../services/index.js';
+import { type MethodAuth } from '../middleware/index.js';
 export declare abstract class QueryApiController<T extends IEntity> {
     protected app: Application;
     protected service: IGenericQueryService<T>;
     protected slug: string;
     protected apiResourceName: string;
+    protected routeAuth: MethodAuth;
     protected modelSpec?: IModelSpec;
     protected publicSpec?: IModelSpec;
     protected idSchema: TSchema;
-    protected constructor(slug: string, app: Application, service: IGenericQueryService<T>, resourceName?: string, modelSpec?: IModelSpec, publicSpec?: IModelSpec);
+    protected constructor(slug: string, app: Application, service: IGenericQueryService<T>, routeAuth?: MethodAuth, resourceName?: string, modelSpec?: IModelSpec, publicSpec?: IModelSpec);
     mapRoutes(app: Application): void;
     getAll(req: Request, res: Response, next: NextFunction): Promise<void>;
     get(req: Request, res: Response, next: NextFunction): Promise<void>;

package/dist/controllers/query-api.controller.js

@@ -2,19 +2,21 @@ import { BadRequestError } from '../errors/index.js';
 import { Value } from '@sinclair/typebox/value';
 import { getIdSchema } from '@loomcore/common/validation';
 import { apiUtils } from '../utils/index.js';
-import { isAuthorized } from '../middleware/index.js';
+import { authenticated, isAuthorized, } from '../middleware/index.js';
 export class QueryApiController {
     app;
     service;
     slug;
     apiResourceName;
+    routeAuth;
     modelSpec;
     publicSpec;
     idSchema;
-    constructor(slug, app, service, resourceName = '', modelSpec, publicSpec) {
+    constructor(slug, app, service, routeAuth = authenticated, resourceName = '', modelSpec, publicSpec) {
         this.slug = slug;
         this.app = app;
         this.service = service;
+        this.routeAuth = routeAuth;
         this.apiResourceName = resourceName;
         this.modelSpec = modelSpec;
         this.publicSpec = publicSpec;
@@ -22,10 +24,11 @@ export class QueryApiController {
         this.mapRoutes(app);
     }
     mapRoutes(app) {
-        app.get(`/api/${this.slug}`, isAuthorized(), this.get.bind(this));
-        app.get(`/api/${this.slug}/all`, isAuthorized(), this.getAll.bind(this));
-        app.get(`/api/${this.slug}/count`, isAuthorized(), this.getCount.bind(this));
-        app.get(`/api/${this.slug}/:id`, isAuthorized(), this.getById.bind(this));
+        const auth = isAuthorized(this.routeAuth);
+        app.get(`/api/${this.slug}`, auth, this.get.bind(this));
+        app.get(`/api/${this.slug}/all`, auth, this.getAll.bind(this));
+        app.get(`/api/${this.slug}/count`, auth, this.getCount.bind(this));
+        app.get(`/api/${this.slug}/:id`, auth, this.getById.bind(this));
     }
     async getAll(req, res, next) {
         res.set('Content-Type', 'application/json');

package/dist/controllers/roles.controller.js

@@ -1,9 +1,10 @@
+import { adminWrites } from "../middleware/index.js";
 import { RoleModelSpec } from "../models/role.model.js";
 import { MultiTenantApiService } from "../services/multi-tenant-api.service.js";
 import { ApiController } from "./api.controller.js";
 export class RolesController extends ApiController {
     constructor(app, database) {
         const roleService = new MultiTenantApiService(database, "roles", "role", RoleModelSpec);
-        super("roles", app, roleService, "role", RoleModelSpec, RoleModelSpec);
+        super("roles", app, roleService, adminWrites, "role", RoleModelSpec, RoleModelSpec);
     }
 }

package/dist/controllers/user-roles.controller.d.ts

@@ -1,7 +1,7 @@
+import type { Application } from "express";
+import type { IDatabase } from "../databases/models/index.js";
+import { type IUserRole } from "../models/user-role.model.js";
 import { ApiController } from "./api.controller.js";
-import { IDatabase } from "../databases/models/index.js";
-import { Application } from "express";
-import { IUserRole } from "../models/user-role.model.js";
 export declare class UserRolesController extends ApiController<IUserRole> {
     constructor(app: Application, database: IDatabase);
 }

package/dist/controllers/user-roles.controller.js

@@ -1,9 +1,10 @@
-import { ApiController } from "./api.controller.js";
-import { UserRoleModelSpec } from "../models/user-role.model.js";
+import { adminWrites } from "../middleware/index.js";
+import { UserRoleModelSpec, } from "../models/user-role.model.js";
 import { MultiTenantApiService } from "../services/multi-tenant-api.service.js";
+import { ApiController } from "./api.controller.js";
 export class UserRolesController extends ApiController {
     constructor(app, database) {
-        const userRoleService = new MultiTenantApiService(database, 'user_roles', 'user_role', UserRoleModelSpec);
-        super('user-roles', app, userRoleService, 'user-role', UserRoleModelSpec, UserRoleModelSpec);
+        const userRoleService = new MultiTenantApiService(database, "user_roles", "user_role", UserRoleModelSpec);
+        super("user-roles", app, userRoleService, adminWrites, "user-role", UserRoleModelSpec, UserRoleModelSpec);
     }
 }

package/dist/controllers/users.controller.d.ts

@@ -1,8 +1,10 @@
 import { type IModelSpec, type IUser } from "@loomcore/common/models";
 import type { Application } from "express";
 import type { IDatabase } from "../databases/models/index.js";
+import type { MethodAuth } from "../middleware/index.js";
 import { UserService } from "../services/index.js";
 import { ApiController } from "./api.controller.js";
+export declare const usersRouteAuth: MethodAuth;
 export interface UsersControllerOptions {
     userService?: UserService;
     userSpec?: IModelSpec;

package/dist/controllers/users.controller.js

@@ -1,13 +1,19 @@
 import { PublicUserSpec, UserSpec, } from "@loomcore/common/models";
 import { UserService } from "../services/index.js";
 import { ApiController } from "./api.controller.js";
+export const usersRouteAuth = {
+    read: true,
+    create: true,
+    update: true,
+    delete: ["admin"],
+};
 export class UsersController extends ApiController {
     userService;
     constructor(app, database, options = {}) {
         const userSpec = options.userSpec ?? UserSpec;
         const publicUserSpec = options.publicUserSpec ?? PublicUserSpec;
         const userService = options.userService ?? new UserService(database, userSpec);
-        super("users", app, userService, "user", userSpec, publicUserSpec);
+        super("users", app, userService, usersRouteAuth, "user", userSpec, publicUserSpec);
         this.userService = userService;
     }
 }

package/dist/middleware/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./ensure-user-context.js";
 export * from "./error-handler.js";
 export * from "./is-authorized.js";
+export * from "./method-auth.model.js";
 export * from "./request-lifecycle.js";

package/dist/middleware/index.js

@@ -1,4 +1,5 @@
 export * from "./ensure-user-context.js";
 export * from "./error-handler.js";
 export * from "./is-authorized.js";
+export * from "./method-auth.model.js";
 export * from "./request-lifecycle.js";

package/dist/middleware/is-authorized.d.ts

@@ -1,3 +1,4 @@
 import type { NextFunction, Request, Response } from "express";
-declare const isAuthorized: (allowedFeatures?: string[]) => (req: Request, _res: Response, next: NextFunction) => void;
+import type { MethodAuth } from "./method-auth.model.js";
+declare const isAuthorized: (config: MethodAuth) => (req: Request, _res: Response, next: NextFunction) => void;
 export { isAuthorized };

package/dist/middleware/is-authorized.js

@@ -1,8 +1,42 @@
 import jwt from "jsonwebtoken";
-import { UnauthenticatedError, UnauthorizedError } from "../errors/index.js";
+import { UnauthenticatedError, UnauthorizedError, } from "../errors/index.js";
 import { getAuthUserContextSpec } from "../utils/auth/auth-user-specs.util.js";
 import { getAuthConfig } from "../utils/auth/get-auth-config.util.js";
-const isAuthorized = (allowedFeatures) => {
+function resolveAuthMethod(req) {
+    switch (req.method.toUpperCase()) {
+        case "GET":
+        case "HEAD":
+            return "read";
+        case "POST":
+            return "create";
+        case "PUT":
+        case "PATCH":
+            return "update";
+        case "DELETE":
+            return "delete";
+        default:
+            return null;
+    }
+}
+function userHasFeature(userContext, feature) {
+    return userContext.authorizations.some((authorization) => authorization.feature === feature);
+}
+function isAdmin(userContext) {
+    return (userHasFeature(userContext, "admin") ||
+        userHasFeature(userContext, "system"));
+}
+function assertFeatureRequirement(userContext, requirement) {
+    if (requirement === undefined) {
+        throw new UnauthorizedError();
+    }
+    if (requirement === true) {
+        return;
+    }
+    if (!requirement.some((feature) => userHasFeature(userContext, feature))) {
+        throw new UnauthorizedError();
+    }
+}
+const isAuthorized = (config) => {
     return (req, _res, next) => {
         let token = null;
         if (req.headers?.authorization) {
@@ -20,20 +54,22 @@ const isAuthorized = (allowedFeatures) => {
             const rawPayload = jwt.verify(token, authConfig.clientSecret);
             const userContext = getAuthUserContextSpec().decode(rawPayload);
             req.userContext = userContext;
-            if (userContext.authorizations.some((authorization) => authorization.feature === "admin")) {
+            if (isAdmin(userContext)) {
                 next();
+                return;
             }
-            else if (allowedFeatures?.length) {
-                if (!userContext.authorizations.some((authorization) => allowedFeatures.includes(authorization.feature))) {
-                    throw new UnauthorizedError();
-                }
-                next();
-            }
-            else {
-                next();
+            const method = resolveAuthMethod(req);
+            if (!method) {
+                throw new UnauthorizedError();
             }
+            assertFeatureRequirement(userContext, config[method]);
+            next();
         }
         catch (err) {
+            if (err instanceof UnauthorizedError ||
+                err instanceof UnauthenticatedError) {
+                throw err;
+            }
             console.error(err);
             throw new UnauthenticatedError();
         }

package/dist/middleware/method-auth.model.d.ts

@@ -0,0 +1,9 @@
+export type FeatureRequirement = true | string[];
+export interface MethodAuth {
+    read?: FeatureRequirement;
+    create?: FeatureRequirement;
+    update?: FeatureRequirement;
+    delete?: FeatureRequirement;
+}
+export declare const authenticated: MethodAuth;
+export declare const adminWrites: MethodAuth;

package/dist/middleware/method-auth.model.js

@@ -0,0 +1,12 @@
+export const authenticated = {
+    read: true,
+    create: true,
+    update: true,
+    delete: true,
+};
+export const adminWrites = {
+    read: true,
+    create: ["admin"],
+    update: ["admin"],
+    delete: ["admin"],
+};

package/dist/services/user.service.d.ts

@@ -4,6 +4,9 @@ import type { IDatabase } from "../databases/models/index.js";
 import { MultiTenantApiService } from "./multi-tenant-api.service.js";
 export declare class UserService extends MultiTenantApiService<IUser> {
     constructor(database: IDatabase, modelSpec?: IModelSpec);
+    private isAdmin;
+    private assertAdmin;
+    private assertSelfOrAdmin;
     fullUpdateById(_userContext: IUserContext, _id: AppIdType, _entity: IUser): Promise<IUser>;
     update(userContext: IUserContext, queryObject: IQueryOptions, entity: Partial<IUser>): Promise<IUser[]>;
     batchUpdate(userContext: IUserContext, entities: Partial<IUser>[]): Promise<IUser[]>;

package/dist/services/user.service.js

@@ -1,25 +1,45 @@
 import { UserSpec, } from "@loomcore/common/models";
-import { BadRequestError, ServerError } from "../errors/index.js";
+import { BadRequestError, ServerError, UnauthorizedError, } from "../errors/index.js";
 import { passwordUtils } from "../utils/password.utils.js";
 import { MultiTenantApiService } from "./multi-tenant-api.service.js";
 export class UserService extends MultiTenantApiService {
     constructor(database, modelSpec = UserSpec) {
         super(database, "users", "user", modelSpec);
     }
+    isAdmin(userContext) {
+        return userContext.authorizations.some((authorization) => authorization.feature === "admin" ||
+            authorization.feature === "system");
+    }
+    assertAdmin(userContext) {
+        if (!this.isAdmin(userContext)) {
+            throw new UnauthorizedError();
+        }
+    }
+    assertSelfOrAdmin(userContext, id) {
+        if (this.isAdmin(userContext)) {
+            return;
+        }
+        if (userContext.user._id !== id) {
+            throw new UnauthorizedError();
+        }
+    }
     async fullUpdateById(_userContext, _id, _entity) {
         throw new ServerError("User full update is not allowed.");
     }
     async update(userContext, queryObject, entity) {
+        this.assertAdmin(userContext);
         this.assertPasswordUpdateAllowed(userContext, null, entity, false);
         return super.update(userContext, queryObject, entity);
     }
     async batchUpdate(userContext, entities) {
+        this.assertAdmin(userContext);
         for (const entity of entities) {
             this.assertPasswordUpdateAllowed(userContext, null, entity, false);
         }
         return super.batchUpdate(userContext, entities);
     }
     async partialUpdateById(userContext, id, entity, allowPasswordUpdate = false) {
+        this.assertSelfOrAdmin(userContext, id);
         this.assertPasswordUpdateAllowed(userContext, id, entity, allowPasswordUpdate);
         return super.partialUpdateById(userContext, id, entity);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcore/api",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "private": false,
   "description": "Loom Core Api - An opinionated Node.js api using Typescript, Express, and MongoDb or PostgreSQL",
   "scripts": {