@modular-rest/server 1.7.0 → 1.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modular-rest/server",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "a nodejs module based on KOAJS for developing Rest-APIs in a modular solution.",
   "main": "src/index.js",
   "scripts": {

package/src/class/collection_definition.js

@@ -14,7 +14,7 @@ class CollectionDefinition {
    * @param {string} option.collection - Collection name
    * @param {Object} option.schema - Mongoose schema
    * @param {Array<Permission>} option.permissions - A list of permissions for this collection
-   * @param {Array<DatabaseTrigger>} option.trigger - A database trigger
+   * @param {Array<DatabaseTrigger>=} option.trigger - A database trigger
    */
   constructor({ db, collection, schema, permissions, trigger }) {
     // string

package/src/class/database_trigger.js

@@ -7,10 +7,8 @@ class DatabaseTrigger {
   /**
    * Creates a new instance of `DatabaseTrigger`.
    *
-   * @param {string} operation - The name of the operation on which the callback should be triggered.
-   * @param {function} [callback=(query, queryResult) => {}] - The callback function to be triggered. It accepts two parameters:
-   * 1. `query` - The query that is being executed.
-   * 2. `queryResult` - The result of the query execution.
+   * @param {'find' | 'find-one' | 'count' | 'update-one' | 'insert-one' | 'remove-one' | 'aggregate'} operation - The operation to be triggered. Supported operations are:
+   * @param {function(query, queryResult)} callback - The callback to be called when the operation is executed.
    */
   constructor(operation, callback = (query, queryResult) => {}) {
     this.operation = operation;

package/src/class/security.js

@@ -17,7 +17,7 @@ class AccessDefinition {
 }
 
 /**
- * @typedef {('god_access'|'user_access'|'delete'|'upload_file_access'|'remove_file_access'|'anonymous_access')} PermissionType
+ * @typedef {('god_access'|'user_access'|'upload_file_access'|'remove_file_access'|'anonymous_access')} PermissionType
  */
 
 /**
@@ -31,12 +31,20 @@ class Permission {
    * @param {boolean} [options.read=false] - The read access of the permission.
    * @param {boolean} [options.write=false] - The write access of the permission.
    * @param {boolean} [options.onlyOwnData=false] - If true, users can perform CRUD on documents that they created already.
+   * @param {string} [options.ownerIdField='refId'] - The name of the field that contains the owner's id of the document.
    */
-  constructor({ type, read = false, write = false, onlyOwnData = false }) {
+  constructor({
+    type,
+    read = false,
+    write = false,
+    onlyOwnData = false,
+    ownerIdField = "refId",
+  }) {
     this.type = type;
     this.read = read;
     this.write = write;
     this.onlyOwnData = onlyOwnData;
+    this.ownerIdField = ownerIdField;
   }
 }
 

package/src/index.js

@@ -19,16 +19,24 @@ const userManager = require("./services/user_manager/service");
 
 module.exports = {
   createRest,
+
+  // Route utilities
   reply,
   TypeCasters,
   paginator,
   validator,
+
+  // Service utilities
   getCollection,
+
+  // Database
   CollectionDefinition,
   Schemas,
   Schema,
   DatabaseTrigger,
   ...SecurityClass,
+
+  // Middlewares
   middleware,
   userManager: userManager.main,
 };

package/src/services/data_provider/service.js

@@ -149,17 +149,19 @@ function _getPermissionList(db, collection, operationType) {
 
 function checkAccess(db, collection, operationType, queryOrDoc, user) {
   let key = false;
-  let permissionList = _getPermissionList(db, collection, operationType);
+  const permissionList = _getPermissionList(db, collection, operationType);
 
   permissionList.forEach((permission) => {
     let permissionType = permission.type;
 
     if (permission.onlyOwnData == true) {
-      let owner = queryOrDoc.owner;
-      let userId = user.id;
+      const userId = user.id;
 
       try {
-        if (owner.toString() == userId.toString()) key = true;
+        if (
+          queryOrDoc[permission.ownerIdField].toString() === userId.toString()
+        )
+          key = true;
       } catch (error) {
         key = false;
       }