@openforis/arena-core 2.4.5 → 2.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/auth/authorizer.d.ts +10 -0
  2. package/dist/auth/authorizer.js +28 -1
  3. package/dist/auth/authorizer.js.map +1 -1
  4. package/dist/esm/auth/authorizer.js +28 -1
  5. package/dist/esm/auth/authorizer.js.map +1 -1
  6. package/package.json +1 -1
package/dist/auth/authorizer.d.ts CHANGED
@@ -5,6 +5,7 @@ import { User } from './user';
5
5
  declare const canCreateTemplate: (user: User) => boolean;
6
6
  declare const getMaxSurveysUserCanCreate: (user: User) => number;
7
7
  declare const canViewSurvey: (user: User, surveyInfo: Survey) => boolean;
8
+ declare const canViewSurveyOrPublishedTemplate: (user: User, surveyInfo: Survey) => boolean;
8
9
  declare const canExportSurveysList: (user: User) => boolean;
9
10
  declare const canViewTemplates: (user: User) => boolean;
10
11
  declare const canEditSurveyConfig: (user: User) => boolean;
@@ -31,10 +32,13 @@ declare const canEditUser: (user: User, surveyInfo: Survey, userToUpdate: User)
31
32
  declare const canEditUserEmail: (user: User) => boolean;
32
33
  declare const canEditUserGroup: (user: User, surveyInfo: Survey, userToUpdate: User) => boolean;
33
34
  declare const canRemoveUser: (user: User, surveyInfo: Survey, userToRemove: User) => boolean;
35
+ declare const canManageUserGroups: (user: User, surveyInfo: Survey) => boolean;
36
+ declare const canEditUserAuthGroupExtraProps: (user: User, surveyInfo: Survey, userToUpdate: User) => boolean;
34
37
  declare const canEditUserSurveyManager: (user: User) => boolean;
35
38
  declare const canEditUserMaxSurveys: (user: User) => boolean;
36
39
  declare const canViewUsersAccessRequests: (user: User) => boolean;
37
40
  declare const canEditUsersAccessRequests: (user: User) => boolean;
41
+ declare const canManageUser2FADevices: (user: User) => boolean;
38
42
  declare const getUserGroupsCanAssign: ({ user, surveyInfo, editingLoggedUser, showOnlySurveyGroups, }: {
39
43
  user: User;
40
44
  surveyInfo?: Survey | null;
@@ -46,10 +50,12 @@ export declare const Authorizer: {
46
50
  canCreateTemplate: typeof canCreateTemplate;
47
51
  getMaxSurveysUserCanCreate: typeof getMaxSurveysUserCanCreate;
48
52
  canViewSurvey: typeof canViewSurvey;
53
+ canViewSurveyOrPublishedTemplate: typeof canViewSurveyOrPublishedTemplate;
49
54
  canExportSurvey: (user: User, surveyInfo: Survey) => boolean;
50
55
  canExportSurveysList: typeof canExportSurveysList;
51
56
  canViewTemplates: typeof canViewTemplates;
52
57
  canEditSurvey: (user: User, surveyInfo: Survey) => boolean;
58
+ canEditSomeSurvey: (user: User) => boolean;
53
59
  canEditSurveyConfig: typeof canEditSurveyConfig;
54
60
  canEditSurveyOwner: typeof canEditSurveyOwner;
55
61
  canEditTemplates: typeof canEditTemplates;
@@ -82,10 +88,14 @@ export declare const Authorizer: {
82
88
  canEditUserEmail: typeof canEditUserEmail;
83
89
  canEditUserGroup: typeof canEditUserGroup;
84
90
  canRemoveUser: typeof canRemoveUser;
91
+ canManageUserGroups: typeof canManageUserGroups;
92
+ canEditQualifierAttributeValue: typeof canManageUserGroups;
93
+ canEditUserAuthGroupExtraProps: typeof canEditUserAuthGroupExtraProps;
85
94
  canEditUserSurveyManager: typeof canEditUserSurveyManager;
86
95
  canEditUserMaxSurveys: typeof canEditUserMaxSurveys;
87
96
  canViewUsersAccessRequests: typeof canViewUsersAccessRequests;
88
97
  canEditUsersAccessRequests: typeof canEditUsersAccessRequests;
98
+ canManageUser2FADevices: typeof canManageUser2FADevices;
89
99
  getUserGroupsCanAssign: typeof getUserGroupsCanAssign;
90
100
  };
91
101
  export {};
package/dist/auth/authorizer.js CHANGED
@@ -42,11 +42,14 @@ const getMaxSurveysUserCanCreate = (user) => {
42
42
  };
43
43
  // READ
44
44
  const canViewSurvey = (user, surveyInfo) => users_1.Users.isSystemAdmin(user) || _hasAuthGroupForSurvey({ user, surveyInfo });
45
+ // any logged in user can view a published template (e.g. to clone it), without widening canViewSurvey
46
+ const canViewSurveyOrPublishedTemplate = (user, surveyInfo) => canViewSurvey(user, surveyInfo) || Boolean(user && (surveyInfo === null || surveyInfo === void 0 ? void 0 : surveyInfo.template) && surveyInfo.published);
45
47
  const canExportSurvey = _hasSurveyPermission(permission_1.Permission.recordAnalyse);
46
48
  const canExportSurveysList = (user) => users_1.Users.isSystemAdmin(user);
47
49
  const canViewTemplates = (user) => users_1.Users.isSystemAdmin(user);
48
50
  // UPDATE
49
51
  const canEditSurvey = _hasSurveyPermission(permission_1.Permission.surveyEdit);
52
+ const canEditSomeSurvey = _hasPermissionInSomeGroup(permission_1.Permission.surveyEdit);
50
53
  const canEditSurveyConfig = (user) => users_1.Users.isSystemAdmin(user);
51
54
  const canEditSurveyOwner = (user) => users_1.Users.isSystemAdmin(user);
52
55
  const canEditTemplates = (user) => users_1.Users.isSystemAdmin(user);
@@ -76,7 +79,7 @@ const canViewNotOwnedRecords = (user, surveyInfo) => {
76
79
  return false;
77
80
  };
78
81
  exports.canViewNotOwnedRecords = canViewNotOwnedRecords;
79
- exports.canExportRecordsList = _hasSurveyPermission(permission_1.Permission.surveyEdit);
82
+ exports.canExportRecordsList = _hasSurveyPermission(permission_1.Permission.recordAnalyse);
80
83
  // UPDATE
81
84
  const canEditRecord = (user, record, allowAnalysisStepEdit = false) => {
82
85
  var _a;
@@ -151,11 +154,28 @@ const canEditUserGroup = (user, surveyInfo, userToUpdate) => !users_1.Users.isEq
151
154
  const canRemoveUser = (user, surveyInfo, userToRemove) => !users_1.Users.isEqual(user)(userToRemove) &&
152
155
  !users_1.Users.isSystemAdmin(userToRemove) &&
153
156
  _hasUserEditAccess(user, surveyInfo, userToRemove);
157
+ // only survey admins (and system admins) can manage the user groups of a survey
158
+ const canManageUserGroups = (user, surveyInfo) => {
159
+ var _a;
160
+ if (!user)
161
+ return false;
162
+ if (users_1.Users.isSystemAdmin(user))
163
+ return true;
164
+ if (!surveyInfo)
165
+ return false;
166
+ return ((_a = _getSurveyUserGroup(user, surveyInfo)) === null || _a === void 0 ? void 0 : _a.name) === authGroup_1.AuthGroupName.surveyAdmin;
167
+ };
168
+ // qualifier attribute values are tied to user groups
169
+ const canEditQualifierAttributeValue = canManageUserGroups;
170
+ const canEditUserAuthGroupExtraProps = (user, surveyInfo, userToUpdate) => users_1.Users.isSystemAdmin(user) ||
171
+ (canInviteUsers(user, surveyInfo) && _hasAuthGroupForSurvey({ user: userToUpdate, surveyInfo }));
154
172
  const canEditUserSurveyManager = (user) => users_1.Users.isSystemAdmin(user);
155
173
  const canEditUserMaxSurveys = (user) => users_1.Users.isSystemAdmin(user);
156
174
  // USER ACCESS REQUESTS
157
175
  const canViewUsersAccessRequests = (user) => users_1.Users.isSystemAdmin(user);
158
176
  const canEditUsersAccessRequests = (user) => users_1.Users.isSystemAdmin(user);
177
+ // TWO-FACTOR AUTHENTICATION
178
+ const canManageUser2FADevices = (user) => users_1.Users.isSystemAdmin(user);
159
179
  // INVITE
160
180
  const getUserGroupsCanAssign = ({ user, surveyInfo = null, editingLoggedUser = false, showOnlySurveyGroups = false, }) => {
161
181
  const groups = [];
@@ -189,10 +209,12 @@ exports.Authorizer = {
189
209
  canCreateTemplate,
190
210
  getMaxSurveysUserCanCreate,
191
211
  canViewSurvey,
212
+ canViewSurveyOrPublishedTemplate,
192
213
  canExportSurvey,
193
214
  canExportSurveysList,
194
215
  canViewTemplates,
195
216
  canEditSurvey,
217
+ canEditSomeSurvey,
196
218
  canEditSurveyConfig,
197
219
  canEditSurveyOwner,
198
220
  canEditTemplates,
@@ -229,11 +251,16 @@ exports.Authorizer = {
229
251
  canEditUserEmail,
230
252
  canEditUserGroup,
231
253
  canRemoveUser,
254
+ canManageUserGroups,
255
+ canEditQualifierAttributeValue,
256
+ canEditUserAuthGroupExtraProps,
232
257
  canEditUserSurveyManager,
233
258
  canEditUserMaxSurveys,
234
259
  // User Access Requests
235
260
  canViewUsersAccessRequests,
236
261
  canEditUsersAccessRequests,
262
+ // Two-factor authentication
263
+ canManageUser2FADevices,
237
264
  // Invite
238
265
  getUserGroupsCanAssign,
239
266
  };
package/dist/auth/authorizer.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/auth/authorizer.ts"],"names":[],"mappings":";;;AAAA,sCAAgD;AAChD,sCAA2C;AAC3C,2CAAsD;AACtD,6CAAyC;AACzC,6CAA+D;AAE/D,mCAA+B;AAE/B,SAAS;AACT,gBAAgB;AAChB,SAAS;AAET,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,kBAAkB,GAAG,IAAI,EAAyB,EAAE,CAC/G,UAAU,CAAC,CAAC,CAAC,aAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAEpG,MAAM,sBAAsB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAsC,EAAW,EAAE,CACnG,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;AAEhD,MAAM,oBAAoB,GACxB,CAAC,UAAsB,EAAE,EAAE,CAC3B,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,IAAI,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAE7B,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACvD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,OAAO,uBAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAClE,CAAC,CAAA;AAEH,MAAM,yBAAyB,GAC7B,CAAC,UAAsB,EAAE,EAAE,CAC3B,CAAC,IAAU,EAAW,EAAE;IACtB,IAAI,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,MAAM,GAAG,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAU,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAA;AACtF,CAAC,CAAA;AAEH,SAAS;AACT,MAAM,eAAe,GAAG,yBAAyB,CAAC,uBAAU,CAAC,YAAY,CAAC,CAAA;AAC1E,MAAM,iBAAiB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC5E,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAU,EAAE;IACxD,IAAI,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IAChD,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAC3D,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,OAAO;AACP,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE,CAChE,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3E,MAAM,eAAe,GAAG,oBAAoB,CAAC,uBAAU,CAAC,aAAa,CAAC,CAAA;AACtE,MAAM,oBAAoB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC/E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC3E,SAAS;AACT,MAAM,aAAa,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AACjE,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC9E,MAAM,kBAAkB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC7E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC3E,MAAM,uBAAuB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAElF,SAAS;AACT,gBAAgB;AAChB,SAAS;AAET,SAAS;AACI,QAAA,eAAe,GAAG,oBAAoB,CAAC,uBAAU,CAAC,YAAY,CAAC,CAAA;AAE5E,OAAO;AACM,QAAA,aAAa,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AAC3D,QAAA,mBAAmB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,aAAa,CAAC,CAAA;AAC1E,MAAM,sBAAsB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE;IAChF,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,UAAU,CAAA;IACvC,MAAM,oBAAoB,GAAG,aAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;IAC7E,MAAM,SAAS,GAAG,oBAAoB,aAApB,oBAAoB,uBAApB,oBAAoB,CAAE,IAAI,CAAA;IAE5C,IAAI,SAAS,KAAK,yBAAa,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,gBAAO,CAAC,sCAAsC,CAAC,UAAU,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,SAAS,KAAK,yBAAa,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,gBAAO,CAAC,uCAAuC,CAAC,UAAU,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,IAAA,QAAA,mBAAmB,EAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAhBY,QAAA,sBAAsB,GAAtB,sBAAsB,CAgBlC;AACY,QAAA,oBAAoB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AAE/E,SAAS;AACF,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,MAAmB,EAAE,qBAAqB,GAAG,KAAK,EAAW,EAAE;;IACvG,IACE,CAAC,IAAI;QACL,CAAC,MAAM;QACP,uCAAuC;QACvC,CAAC,CAAC,qBAAqB,IAAI,gBAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,qGAAqG;IACrG,IAAI,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;IACxC,sFAAsF;IACtF,MAAM,aAAa,GAAG,aAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;IACtE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAA;IAEhC,sFAAsF;IACtF,6GAA6G;IAC7G,IAAI,CAAC,uBAAU,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,uBAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAE3F,+EAA+E;IAC/E,6CAA6C;IAC7C,qFAAqF;IACrF,MAAM,KAAK,GAAG,MAAA,uBAAU,CAAC,cAAc,CAAC,aAAa,CAAC,0CAAG,gBAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IACjF,OAAO,KAAK,KAAK,iCAAoB,CAAC,GAAG,IAAI,CAAC,KAAK,KAAK,iCAAoB,CAAC,GAAG,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9G,CAAC,CAAA;AA3BY,QAAA,aAAa,GAAb,aAAa,CA2BzB;AAED,MAAM,oBAAoB,GAAG,CAAC,IAAU,EAAE,MAAmB,EAAE,EAAE,CAAC,IAAA,QAAA,aAAa,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;AAEnG,MAAM,eAAe,GAAG,QAAA,aAAa,CAAA;AAErC,MAAM,eAAe,GAAG,oBAAoB,CAAA;AAE5C,MAAM,oBAAoB,GAAG,oBAAoB,CAAA;AAEjD,MAAM,mBAAmB,GAAG,oBAAoB,CAAA;AAEhD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,aAAa,CAAC,CAAA;AAExE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AAEpE,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,EAAE,CAC1D,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,SAAS,KAAI,oBAAoB,CAAC,uBAAU,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE1F,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,aAAa,CAAC,CAAA;AAExE,MAAM,oBAAoB,GAAG,iBAAiB,CAAA;AAE9C,SAAS;AACT,kBAAkB;AAClB,SAAS;AAET,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAExC,SAAS;AACT,aAAa;AACb,SAAS;AAET,MAAM,SAAS,GAAG,iBAAiB,CAAA;AAEnC,SAAS;AACT,eAAe;AACf,SAAS;AAET,SAAS;AACT,MAAM,cAAc,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AAElE,OAAO;AACP,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AAEtE,MAAM,wBAAwB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAoC,EAAE,EAAE,CAC1F,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAC5B,CAAC,aAAa,EAAE,EAAE,CAChB,uBAAU,CAAC,aAAa,CAAC,aAAa,CAAC;IACvC,aAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAClC,CAAC,mBAAmB,EAAE,EAAE,CACtB,uBAAU,CAAC,aAAa,CAAC,mBAAmB,CAAC;QAC7C,uBAAU,CAAC,aAAa,CAAC,mBAAmB,CAAC,KAAK,uBAAU,CAAC,aAAa,CAAC,aAAa,CAAC,CAC5F,CACJ,CAAA;AAEH,MAAM,WAAW,GAAG,CAAC,IAAU,EAAE,WAAmB,EAAE,UAAgB,EAAE,EAAE,CACxE,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,aAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;AAEhH,MAAM,sBAAsB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAsC,EAAE,EAAE,CAC1F,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE/D,MAAM,iCAAiC,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE,CACpF,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE/D,MAAM,eAAe,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEjE,OAAO;AACP,MAAM,kBAAkB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACzF,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC;IACzB,CAAC,oBAAoB,CAAC,uBAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1D,sDAAsD;QACtD,sBAAsB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;AAE/D,MAAM,cAAc,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEzE,MAAM,WAAW,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CAClF,aAAK,CAAC,WAAW,CAAC,YAAY,CAAC;IAC/B,CAAC,aAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;AAE3F,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAE3E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACvF,CAAC,aAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;AAE1F,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACpF,CAAC,aAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC;IAClC,CAAC,aAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClC,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;AAEpD,MAAM,wBAAwB,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC1E,MAAM,qBAAqB,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEvE,uBAAuB;AACvB,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AACrF,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAErF,SAAS;AACT,MAAM,sBAAsB,GAAG,CAAC,EAC9B,IAAI,EACJ,UAAU,GAAG,IAAI,EACjB,iBAAiB,GAAG,KAAK,EACzB,oBAAoB,GAAG,KAAK,GAM7B,EAAE,EAAE;IACH,MAAM,MAAM,GAAG,EAAE,CAAA;IAEjB,IAAI,YAAY,GAAgB,EAAE,CAAA;IAClC,IAAI,iBAAiB,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,kFAAkF;QAClF,YAAY,GAAG,EAAE,CAAA;IACnB,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,YAAY,GAAG,gBAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,gBAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YACxD,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,yBAAa,CAAC,YAAY,CAAC,CAAA;IAExF,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;IAE5B,IAAI,CAAC,oBAAoB,IAAI,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,aAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxF,mGAAmG;QACnG,MAAM,mBAAmB,GAAG,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;QACzG,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,uBAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACtC,CAAC,CAAA;AAEY,QAAA,UAAU,GAAG;IACxB,SAAS;IACT,eAAe;IACf,iBAAiB;IACjB,0BAA0B;IAC1B,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,gBAAgB;IAChB,aAAa;IACb,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,uBAAuB;IACvB,SAAS;IACT,eAAe,EAAf,QAAA,eAAe;IACf,aAAa,EAAb,QAAA,aAAa;IACb,mBAAmB,EAAnB,QAAA,mBAAmB;IACnB,sBAAsB,EAAtB,QAAA,sBAAsB;IACtB,oBAAoB,EAApB,QAAA,oBAAoB;IACpB,aAAa,EAAb,QAAA,aAAa;IACb,eAAe;IACf,eAAe;IACf,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,WAAW;IACX,cAAc;IACd,MAAM;IACN,SAAS;IACT,QAAQ;IACR,cAAc;IACd,kBAAkB;IAClB,WAAW;IACX,sBAAsB;IACtB,iCAAiC;IACjC,eAAe;IACf,cAAc;IACd,WAAW;IACX,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,0BAA0B;IAC1B,SAAS;IACT,sBAAsB;CACvB,CAAA","sourcesContent":["import { ArenaRecord, Records } from '../record'\nimport { Survey, Surveys } from '../survey'\nimport { AuthGroup, AuthGroupName } from './authGroup'\nimport { AuthGroups } from './authGroups'\nimport { Permission, RecordStepPermission } from './permission'\nimport { User } from './user'\nimport { Users } from './users'\n\n// ======\n// ====== Survey\n// ======\n\nconst _getSurveyUserGroup = (user: User, surveyInfo: Survey, includeSystemAdmin = true): AuthGroup | undefined =>\n surveyInfo ? Users.getAuthGroupBySurveyUuid(surveyInfo.uuid, includeSystemAdmin)(user) : undefined\n\nconst _hasAuthGroupForSurvey = ({ user, surveyInfo }: { user: User; surveyInfo: Survey }): boolean =>\n Boolean(_getSurveyUserGroup(user, surveyInfo))\n\nconst _hasSurveyPermission =\n (permission: Permission) =>\n (user: User, surveyInfo: Survey): boolean => {\n if (!user) return false\n\n if (Users.isSystemAdmin(user)) return true\n\n if (!surveyInfo) return false\n\n const authGroup = _getSurveyUserGroup(user, surveyInfo)\n if (!authGroup) return false\n\n return AuthGroups.getPermissions(authGroup).includes(permission)\n }\n\nconst _hasPermissionInSomeGroup =\n (permission: Permission) =>\n (user: User): boolean => {\n if (Users.isSystemAdmin(user)) return true\n const groups = Users.getAuthGroups(user)\n return groups.some((group) => AuthGroups.getPermissions(group).includes(permission))\n }\n\n// CREATE\nconst canCreateSurvey = _hasPermissionInSomeGroup(Permission.surveyCreate)\nconst canCreateTemplate = (user: User): boolean => Users.isSystemAdmin(user)\nconst getMaxSurveysUserCanCreate = (user: User): number => {\n if (Users.isSystemAdmin(user)) return Number.NaN\n if (canCreateSurvey(user)) return Users.getMaxSurveys(user)\n return 0\n}\n\n// READ\nconst canViewSurvey = (user: User, surveyInfo: Survey): boolean =>\n Users.isSystemAdmin(user) || _hasAuthGroupForSurvey({ user, surveyInfo })\nconst canExportSurvey = _hasSurveyPermission(Permission.recordAnalyse)\nconst canExportSurveysList = (user: User): boolean => Users.isSystemAdmin(user)\nconst canViewTemplates = (user: User): boolean => Users.isSystemAdmin(user)\n// UPDATE\nconst canEditSurvey = _hasSurveyPermission(Permission.surveyEdit)\nconst canEditSurveyConfig = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditSurveyOwner = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditTemplates = (user: User): boolean => Users.isSystemAdmin(user)\nconst canRefreshAllSurveyRdbs = (user: User): boolean => Users.isSystemAdmin(user)\n\n// ======\n// ====== Record\n// ======\n\n// CREATE\nexport const canCreateRecord = _hasSurveyPermission(Permission.recordCreate)\n\n// READ\nexport const canViewRecord = _hasSurveyPermission(Permission.recordView)\nexport const canExportAllRecords = _hasSurveyPermission(Permission.recordCleanse)\nexport const canViewNotOwnedRecords = (user: User, surveyInfo: Survey): boolean => {\n if (!surveyInfo || !canViewSurvey(user, surveyInfo)) return false\n\n const { uuid: surveyUuid } = surveyInfo\n const groupInCurrentSurvey = Users.getAuthGroupBySurveyUuid(surveyUuid)(user)\n const groupName = groupInCurrentSurvey?.name\n\n if (groupName === AuthGroupName.dataEditor) {\n return Surveys.isDataEditorViewNotOwnedRecordsAllowed(surveyInfo)\n }\n if (groupName === AuthGroupName.dataAnalyst) {\n return Surveys.isDataAnalystViewNotOwnedRecordsAllowed(surveyInfo)\n }\n if (canExportAllRecords(user, surveyInfo)) return true\n\n return false\n}\nexport const canExportRecordsList = _hasSurveyPermission(Permission.surveyEdit)\n\n// UPDATE\nexport const canEditRecord = (user: User, record: ArenaRecord, allowAnalysisStepEdit = false): boolean => {\n if (\n !user ||\n !record ||\n // records in analysis cannot be edited\n (!allowAnalysisStepEdit && Records.isInAnalysisStep(record))\n ) {\n return false\n }\n // system admin does not have an auth group associated to the survey, but he can always edit records;\n if (Users.isSystemAdmin(user)) {\n return true\n }\n const { surveyUuid, ownerUuid } = record\n // if user doesn't have an auth group associated to the survey, he cannot edit records\n const userAuthGroup = Users.getAuthGroupBySurveyUuid(surveyUuid)(user)\n if (!userAuthGroup) return false\n\n // groups without the record edit permission (e.g. survey guests) cannot edit records,\n // even when their record steps permission allows it (record steps permissions are used also to view records)\n if (!AuthGroups.getPermissions(userAuthGroup).includes(Permission.recordEdit)) return false\n\n // Level = 'all' or 'own'. If 'own', user can only edit records assigned to him\n // If 'all', he can edit all survey's records\n // permission checks must not throw: a group without record steps cannot edit records\n const level = AuthGroups.getRecordSteps(userAuthGroup)?.[Records.getStep(record)]\n return level === RecordStepPermission.all || (level === RecordStepPermission.own && ownerUuid === user.uuid)\n}\n\nconst canChangeRecordProps = (user: User, record: ArenaRecord) => canEditRecord(user, record, true)\n\nconst canDeleteRecord = canEditRecord\n\nconst canDemoteRecord = canChangeRecordProps\n\nconst canChangeRecordOwner = canChangeRecordProps\n\nconst canChangeRecordStep = canChangeRecordProps\n\nconst canCleanseRecords = _hasSurveyPermission(Permission.recordCleanse)\n\nconst canExportRecords = _hasSurveyPermission(Permission.recordView)\n\nconst canImportRecords = (user: User, surveyInfo: Survey) =>\n surveyInfo?.published && _hasSurveyPermission(Permission.recordCreate)(user, surveyInfo)\n\nconst canAnalyzeRecords = _hasSurveyPermission(Permission.recordAnalyse)\n\nconst canUpdateRecordsStep = canAnalyzeRecords\n\n// ======\n// ====== Explorer\n// ======\n\nconst canUseExplorer = canCleanseRecords\n\n// ======\n// ====== Map\n// ======\n\nconst canUseMap = canAnalyzeRecords\n\n// ======\n// ====== Users\n// ======\n\n// CREATE\nconst canInviteUsers = _hasSurveyPermission(Permission.userInvite)\n\n// READ\nconst canViewSurveyUsers = _hasSurveyPermission(Permission.userInvite)\n\nconst _usersBelongToSameSurvey = ({ user, userToView }: { user: User; userToView: User }) =>\n Users.getAuthGroups(user).some(\n (authGroupUser) =>\n AuthGroups.isSurveyGroup(authGroupUser) &&\n Users.getAuthGroups(userToView).some(\n (authGroupUserToView) =>\n AuthGroups.isSurveyGroup(authGroupUserToView) &&\n AuthGroups.getSurveyUuid(authGroupUserToView) === AuthGroups.getSurveyUuid(authGroupUser)\n )\n )\n\nconst canViewUser = (user: User, _surveyInfo: Survey, userToView: User) =>\n Users.isSystemAdmin(user) || Users.isEqual(userToView)(user) || _usersBelongToSameSurvey({ user, userToView })\n\nconst canViewOtherUsersEmail = ({ user, surveyInfo }: { user: User; surveyInfo: Survey }) =>\n Users.isSystemAdmin(user) || canInviteUsers(user, surveyInfo)\n\nconst canViewOtherUsersNameInSameSurvey = (user: User, surveyInfo: Survey): boolean =>\n _hasSurveyPermission(Permission.recordView)(user, surveyInfo)\n\nconst canViewAllUsers = (user: User) => Users.isSystemAdmin(user)\n\n// EDIT\nconst _hasUserEditAccess = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n Users.isSystemAdmin(user) ||\n (_hasSurveyPermission(Permission.userEdit)(user, surveyInfo) &&\n // user to update has an auth group in the same survey\n _hasAuthGroupForSurvey({ user: userToUpdate, surveyInfo }))\n\nconst canCreateUsers = (user: User): boolean => Users.isSystemAdmin(user)\n\nconst canEditUser = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n Users.hasAccepted(userToUpdate) &&\n (Users.isEqual(user)(userToUpdate) || _hasUserEditAccess(user, surveyInfo, userToUpdate))\n\nconst canEditUserEmail = (user: User): boolean => Users.isSystemAdmin(user)\n\nconst canEditUserGroup = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n !Users.isEqual(user)(userToUpdate) && _hasUserEditAccess(user, surveyInfo, userToUpdate)\n\nconst canRemoveUser = (user: User, surveyInfo: Survey, userToRemove: User): boolean =>\n !Users.isEqual(user)(userToRemove) &&\n !Users.isSystemAdmin(userToRemove) &&\n _hasUserEditAccess(user, surveyInfo, userToRemove)\n\nconst canEditUserSurveyManager = (user: User) => Users.isSystemAdmin(user)\nconst canEditUserMaxSurveys = (user: User) => Users.isSystemAdmin(user)\n\n// USER ACCESS REQUESTS\nconst canViewUsersAccessRequests = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditUsersAccessRequests = (user: User): boolean => Users.isSystemAdmin(user)\n\n// INVITE\nconst getUserGroupsCanAssign = ({\n user,\n surveyInfo = null,\n editingLoggedUser = false,\n showOnlySurveyGroups = false,\n}: {\n user: User\n surveyInfo?: Survey | null\n editingLoggedUser?: boolean\n showOnlySurveyGroups?: boolean\n}) => {\n const groups = []\n\n let surveyGroups: AuthGroup[] = []\n if (editingLoggedUser && !surveyInfo) {\n // This can happen for system administrators when they don't have an active survey\n surveyGroups = []\n } else if (surveyInfo) {\n if (surveyInfo.published) {\n surveyGroups = Surveys.getAuthGroups(surveyInfo)\n } else {\n const adminGroup = Surveys.getAuthGroupAdmin(surveyInfo)\n surveyGroups = adminGroup ? [adminGroup] : []\n }\n }\n\n // do not allow surveyEditor group selection (remove surveyEditor group completely?)\n surveyGroups = surveyGroups.filter((group) => group.name !== AuthGroupName.surveyEditor)\n\n groups.push(...surveyGroups)\n\n if (!showOnlySurveyGroups && (Users.isSystemAdmin(user) || Users.isSurveyManager(user))) {\n // Add SystemAdmin or SurveyManager group if current user is a SystemAdmin or SurveyManager himself\n const userNonSurveyGroups = Users.getAuthGroups(user).filter((group) => !AuthGroups.isSurveyGroup(group))\n groups.push(...userNonSurveyGroups)\n }\n return AuthGroups.sortGroups(groups)\n}\n\nexport const Authorizer = {\n // Survey\n canCreateSurvey,\n canCreateTemplate,\n getMaxSurveysUserCanCreate,\n canViewSurvey,\n canExportSurvey,\n canExportSurveysList,\n canViewTemplates,\n canEditSurvey,\n canEditSurveyConfig,\n canEditSurveyOwner,\n canEditTemplates,\n canRefreshAllSurveyRdbs,\n // Record\n canCreateRecord,\n canViewRecord,\n canExportAllRecords,\n canViewNotOwnedRecords,\n canExportRecordsList,\n canEditRecord,\n canDeleteRecord,\n canDemoteRecord,\n canChangeRecordOwner,\n canChangeRecordStep,\n canCleanseRecords,\n canExportRecords,\n canImportRecords,\n canAnalyzeRecords,\n canUpdateRecordsStep,\n // Explorer\n canUseExplorer,\n // Map\n canUseMap,\n // Users\n canInviteUsers,\n canViewSurveyUsers,\n canViewUser,\n canViewOtherUsersEmail,\n canViewOtherUsersNameInSameSurvey,\n canViewAllUsers,\n canCreateUsers,\n canEditUser,\n canEditUserEmail,\n canEditUserGroup,\n canRemoveUser,\n canEditUserSurveyManager,\n canEditUserMaxSurveys,\n // User Access Requests\n canViewUsersAccessRequests,\n canEditUsersAccessRequests,\n // Invite\n getUserGroupsCanAssign,\n}\n"]}
1
+ {"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/auth/authorizer.ts"],"names":[],"mappings":";;;AAAA,sCAAgD;AAChD,sCAA2C;AAC3C,2CAAsD;AACtD,6CAAyC;AACzC,6CAA+D;AAE/D,mCAA+B;AAE/B,SAAS;AACT,gBAAgB;AAChB,SAAS;AAET,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,kBAAkB,GAAG,IAAI,EAAyB,EAAE,CAC/G,UAAU,CAAC,CAAC,CAAC,aAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAEpG,MAAM,sBAAsB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAsC,EAAW,EAAE,CACnG,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;AAEhD,MAAM,oBAAoB,GACxB,CAAC,UAAsB,EAAE,EAAE,CAC3B,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,IAAI,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAE7B,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACvD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,OAAO,uBAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAClE,CAAC,CAAA;AAEH,MAAM,yBAAyB,GAC7B,CAAC,UAAsB,EAAE,EAAE,CAC3B,CAAC,IAAU,EAAW,EAAE;IACtB,IAAI,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,MAAM,GAAG,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAU,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAA;AACtF,CAAC,CAAA;AAEH,SAAS;AACT,MAAM,eAAe,GAAG,yBAAyB,CAAC,uBAAU,CAAC,YAAY,CAAC,CAAA;AAC1E,MAAM,iBAAiB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC5E,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAU,EAAE;IACxD,IAAI,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IAChD,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAC3D,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,OAAO;AACP,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE,CAChE,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3E,sGAAsG;AACtG,MAAM,gCAAgC,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE,CACnF,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,KAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,QAAQ,CAAA,IAAI,UAAU,CAAC,SAAS,CAAC,CAAA;AAClG,MAAM,eAAe,GAAG,oBAAoB,CAAC,uBAAU,CAAC,aAAa,CAAC,CAAA;AACtE,MAAM,oBAAoB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC/E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC3E,SAAS;AACT,MAAM,aAAa,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AACjE,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AAC1E,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC9E,MAAM,kBAAkB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC7E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC3E,MAAM,uBAAuB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAElF,SAAS;AACT,gBAAgB;AAChB,SAAS;AAET,SAAS;AACI,QAAA,eAAe,GAAG,oBAAoB,CAAC,uBAAU,CAAC,YAAY,CAAC,CAAA;AAE5E,OAAO;AACM,QAAA,aAAa,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AAC3D,QAAA,mBAAmB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,aAAa,CAAC,CAAA;AAC1E,MAAM,sBAAsB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE;IAChF,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,UAAU,CAAA;IACvC,MAAM,oBAAoB,GAAG,aAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;IAC7E,MAAM,SAAS,GAAG,oBAAoB,aAApB,oBAAoB,uBAApB,oBAAoB,CAAE,IAAI,CAAA;IAE5C,IAAI,SAAS,KAAK,yBAAa,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,gBAAO,CAAC,sCAAsC,CAAC,UAAU,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,SAAS,KAAK,yBAAa,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,gBAAO,CAAC,uCAAuC,CAAC,UAAU,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,IAAA,QAAA,mBAAmB,EAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAhBY,QAAA,sBAAsB,GAAtB,sBAAsB,CAgBlC;AACY,QAAA,oBAAoB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,aAAa,CAAC,CAAA;AAElF,SAAS;AACF,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,MAAmB,EAAE,qBAAqB,GAAG,KAAK,EAAW,EAAE;;IACvG,IACE,CAAC,IAAI;QACL,CAAC,MAAM;QACP,uCAAuC;QACvC,CAAC,CAAC,qBAAqB,IAAI,gBAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,qGAAqG;IACrG,IAAI,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;IACxC,sFAAsF;IACtF,MAAM,aAAa,GAAG,aAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;IACtE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAA;IAEhC,sFAAsF;IACtF,6GAA6G;IAC7G,IAAI,CAAC,uBAAU,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,uBAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAE3F,+EAA+E;IAC/E,6CAA6C;IAC7C,qFAAqF;IACrF,MAAM,KAAK,GAAG,MAAA,uBAAU,CAAC,cAAc,CAAC,aAAa,CAAC,0CAAG,gBAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IACjF,OAAO,KAAK,KAAK,iCAAoB,CAAC,GAAG,IAAI,CAAC,KAAK,KAAK,iCAAoB,CAAC,GAAG,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9G,CAAC,CAAA;AA3BY,QAAA,aAAa,GAAb,aAAa,CA2BzB;AAED,MAAM,oBAAoB,GAAG,CAAC,IAAU,EAAE,MAAmB,EAAE,EAAE,CAAC,IAAA,QAAA,aAAa,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;AAEnG,MAAM,eAAe,GAAG,QAAA,aAAa,CAAA;AAErC,MAAM,eAAe,GAAG,oBAAoB,CAAA;AAE5C,MAAM,oBAAoB,GAAG,oBAAoB,CAAA;AAEjD,MAAM,mBAAmB,GAAG,oBAAoB,CAAA;AAEhD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,aAAa,CAAC,CAAA;AAExE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AAEpE,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,EAAE,CAC1D,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,SAAS,KAAI,oBAAoB,CAAC,uBAAU,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE1F,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,aAAa,CAAC,CAAA;AAExE,MAAM,oBAAoB,GAAG,iBAAiB,CAAA;AAE9C,SAAS;AACT,kBAAkB;AAClB,SAAS;AAET,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAExC,SAAS;AACT,aAAa;AACb,SAAS;AAET,MAAM,SAAS,GAAG,iBAAiB,CAAA;AAEnC,SAAS;AACT,eAAe;AACf,SAAS;AAET,SAAS;AACT,MAAM,cAAc,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AAElE,OAAO;AACP,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAA;AAEtE,MAAM,wBAAwB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAoC,EAAE,EAAE,CAC1F,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAC5B,CAAC,aAAa,EAAE,EAAE,CAChB,uBAAU,CAAC,aAAa,CAAC,aAAa,CAAC;IACvC,aAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAClC,CAAC,mBAAmB,EAAE,EAAE,CACtB,uBAAU,CAAC,aAAa,CAAC,mBAAmB,CAAC;QAC7C,uBAAU,CAAC,aAAa,CAAC,mBAAmB,CAAC,KAAK,uBAAU,CAAC,aAAa,CAAC,aAAa,CAAC,CAC5F,CACJ,CAAA;AAEH,MAAM,WAAW,GAAG,CAAC,IAAU,EAAE,WAAmB,EAAE,UAAgB,EAAE,EAAE,CACxE,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,aAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;AAEhH,MAAM,sBAAsB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAsC,EAAE,EAAE,CAC1F,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE/D,MAAM,iCAAiC,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE,CACpF,oBAAoB,CAAC,uBAAU,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE/D,MAAM,eAAe,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEjE,OAAO;AACP,MAAM,kBAAkB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACzF,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC;IACzB,CAAC,oBAAoB,CAAC,uBAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1D,sDAAsD;QACtD,sBAAsB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;AAE/D,MAAM,cAAc,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEzE,MAAM,WAAW,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CAClF,aAAK,CAAC,WAAW,CAAC,YAAY,CAAC;IAC/B,CAAC,aAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;AAE3F,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAE3E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACvF,CAAC,aAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;AAE1F,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACpF,CAAC,aAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC;IAClC,CAAC,aAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClC,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;AAEpD,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE;;IACtE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,OAAO,CAAA,MAAA,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,0CAAE,IAAI,MAAK,yBAAa,CAAC,WAAW,CAAA;AAClF,CAAC,CAAA;AAED,qDAAqD;AACrD,MAAM,8BAA8B,GAAG,mBAAmB,CAAA;AAE1D,MAAM,8BAA8B,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACrG,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC;IACzB,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;AAElG,MAAM,wBAAwB,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC1E,MAAM,qBAAqB,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEvE,uBAAuB;AACvB,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AACrF,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAErF,4BAA4B;AAC5B,MAAM,uBAAuB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAElF,SAAS;AACT,MAAM,sBAAsB,GAAG,CAAC,EAC9B,IAAI,EACJ,UAAU,GAAG,IAAI,EACjB,iBAAiB,GAAG,KAAK,EACzB,oBAAoB,GAAG,KAAK,GAM7B,EAAE,EAAE;IACH,MAAM,MAAM,GAAG,EAAE,CAAA;IAEjB,IAAI,YAAY,GAAgB,EAAE,CAAA;IAClC,IAAI,iBAAiB,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,kFAAkF;QAClF,YAAY,GAAG,EAAE,CAAA;IACnB,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,YAAY,GAAG,gBAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,gBAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YACxD,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,yBAAa,CAAC,YAAY,CAAC,CAAA;IAExF,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;IAE5B,IAAI,CAAC,oBAAoB,IAAI,CAAC,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,aAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxF,mGAAmG;QACnG,MAAM,mBAAmB,GAAG,aAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;QACzG,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,uBAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACtC,CAAC,CAAA;AAEY,QAAA,UAAU,GAAG;IACxB,SAAS;IACT,eAAe;IACf,iBAAiB;IACjB,0BAA0B;IAC1B,aAAa;IACb,gCAAgC;IAChC,eAAe;IACf,oBAAoB;IACpB,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,uBAAuB;IACvB,SAAS;IACT,eAAe,EAAf,QAAA,eAAe;IACf,aAAa,EAAb,QAAA,aAAa;IACb,mBAAmB,EAAnB,QAAA,mBAAmB;IACnB,sBAAsB,EAAtB,QAAA,sBAAsB;IACtB,oBAAoB,EAApB,QAAA,oBAAoB;IACpB,aAAa,EAAb,QAAA,aAAa;IACb,eAAe;IACf,eAAe;IACf,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,WAAW;IACX,cAAc;IACd,MAAM;IACN,SAAS;IACT,QAAQ;IACR,cAAc;IACd,kBAAkB;IAClB,WAAW;IACX,sBAAsB;IACtB,iCAAiC;IACjC,eAAe;IACf,cAAc;IACd,WAAW;IACX,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,mBAAmB;IACnB,8BAA8B;IAC9B,8BAA8B;IAC9B,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,0BAA0B;IAC1B,4BAA4B;IAC5B,uBAAuB;IACvB,SAAS;IACT,sBAAsB;CACvB,CAAA","sourcesContent":["import { ArenaRecord, Records } from '../record'\nimport { Survey, Surveys } from '../survey'\nimport { AuthGroup, AuthGroupName } from './authGroup'\nimport { AuthGroups } from './authGroups'\nimport { Permission, RecordStepPermission } from './permission'\nimport { User } from './user'\nimport { Users } from './users'\n\n// ======\n// ====== Survey\n// ======\n\nconst _getSurveyUserGroup = (user: User, surveyInfo: Survey, includeSystemAdmin = true): AuthGroup | undefined =>\n surveyInfo ? Users.getAuthGroupBySurveyUuid(surveyInfo.uuid, includeSystemAdmin)(user) : undefined\n\nconst _hasAuthGroupForSurvey = ({ user, surveyInfo }: { user: User; surveyInfo: Survey }): boolean =>\n Boolean(_getSurveyUserGroup(user, surveyInfo))\n\nconst _hasSurveyPermission =\n (permission: Permission) =>\n (user: User, surveyInfo: Survey): boolean => {\n if (!user) return false\n\n if (Users.isSystemAdmin(user)) return true\n\n if (!surveyInfo) return false\n\n const authGroup = _getSurveyUserGroup(user, surveyInfo)\n if (!authGroup) return false\n\n return AuthGroups.getPermissions(authGroup).includes(permission)\n }\n\nconst _hasPermissionInSomeGroup =\n (permission: Permission) =>\n (user: User): boolean => {\n if (Users.isSystemAdmin(user)) return true\n const groups = Users.getAuthGroups(user)\n return groups.some((group) => AuthGroups.getPermissions(group).includes(permission))\n }\n\n// CREATE\nconst canCreateSurvey = _hasPermissionInSomeGroup(Permission.surveyCreate)\nconst canCreateTemplate = (user: User): boolean => Users.isSystemAdmin(user)\nconst getMaxSurveysUserCanCreate = (user: User): number => {\n if (Users.isSystemAdmin(user)) return Number.NaN\n if (canCreateSurvey(user)) return Users.getMaxSurveys(user)\n return 0\n}\n\n// READ\nconst canViewSurvey = (user: User, surveyInfo: Survey): boolean =>\n Users.isSystemAdmin(user) || _hasAuthGroupForSurvey({ user, surveyInfo })\n// any logged in user can view a published template (e.g. to clone it), without widening canViewSurvey\nconst canViewSurveyOrPublishedTemplate = (user: User, surveyInfo: Survey): boolean =>\n canViewSurvey(user, surveyInfo) || Boolean(user && surveyInfo?.template && surveyInfo.published)\nconst canExportSurvey = _hasSurveyPermission(Permission.recordAnalyse)\nconst canExportSurveysList = (user: User): boolean => Users.isSystemAdmin(user)\nconst canViewTemplates = (user: User): boolean => Users.isSystemAdmin(user)\n// UPDATE\nconst canEditSurvey = _hasSurveyPermission(Permission.surveyEdit)\nconst canEditSomeSurvey = _hasPermissionInSomeGroup(Permission.surveyEdit)\nconst canEditSurveyConfig = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditSurveyOwner = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditTemplates = (user: User): boolean => Users.isSystemAdmin(user)\nconst canRefreshAllSurveyRdbs = (user: User): boolean => Users.isSystemAdmin(user)\n\n// ======\n// ====== Record\n// ======\n\n// CREATE\nexport const canCreateRecord = _hasSurveyPermission(Permission.recordCreate)\n\n// READ\nexport const canViewRecord = _hasSurveyPermission(Permission.recordView)\nexport const canExportAllRecords = _hasSurveyPermission(Permission.recordCleanse)\nexport const canViewNotOwnedRecords = (user: User, surveyInfo: Survey): boolean => {\n if (!surveyInfo || !canViewSurvey(user, surveyInfo)) return false\n\n const { uuid: surveyUuid } = surveyInfo\n const groupInCurrentSurvey = Users.getAuthGroupBySurveyUuid(surveyUuid)(user)\n const groupName = groupInCurrentSurvey?.name\n\n if (groupName === AuthGroupName.dataEditor) {\n return Surveys.isDataEditorViewNotOwnedRecordsAllowed(surveyInfo)\n }\n if (groupName === AuthGroupName.dataAnalyst) {\n return Surveys.isDataAnalystViewNotOwnedRecordsAllowed(surveyInfo)\n }\n if (canExportAllRecords(user, surveyInfo)) return true\n\n return false\n}\nexport const canExportRecordsList = _hasSurveyPermission(Permission.recordAnalyse)\n\n// UPDATE\nexport const canEditRecord = (user: User, record: ArenaRecord, allowAnalysisStepEdit = false): boolean => {\n if (\n !user ||\n !record ||\n // records in analysis cannot be edited\n (!allowAnalysisStepEdit && Records.isInAnalysisStep(record))\n ) {\n return false\n }\n // system admin does not have an auth group associated to the survey, but he can always edit records;\n if (Users.isSystemAdmin(user)) {\n return true\n }\n const { surveyUuid, ownerUuid } = record\n // if user doesn't have an auth group associated to the survey, he cannot edit records\n const userAuthGroup = Users.getAuthGroupBySurveyUuid(surveyUuid)(user)\n if (!userAuthGroup) return false\n\n // groups without the record edit permission (e.g. survey guests) cannot edit records,\n // even when their record steps permission allows it (record steps permissions are used also to view records)\n if (!AuthGroups.getPermissions(userAuthGroup).includes(Permission.recordEdit)) return false\n\n // Level = 'all' or 'own'. If 'own', user can only edit records assigned to him\n // If 'all', he can edit all survey's records\n // permission checks must not throw: a group without record steps cannot edit records\n const level = AuthGroups.getRecordSteps(userAuthGroup)?.[Records.getStep(record)]\n return level === RecordStepPermission.all || (level === RecordStepPermission.own && ownerUuid === user.uuid)\n}\n\nconst canChangeRecordProps = (user: User, record: ArenaRecord) => canEditRecord(user, record, true)\n\nconst canDeleteRecord = canEditRecord\n\nconst canDemoteRecord = canChangeRecordProps\n\nconst canChangeRecordOwner = canChangeRecordProps\n\nconst canChangeRecordStep = canChangeRecordProps\n\nconst canCleanseRecords = _hasSurveyPermission(Permission.recordCleanse)\n\nconst canExportRecords = _hasSurveyPermission(Permission.recordView)\n\nconst canImportRecords = (user: User, surveyInfo: Survey) =>\n surveyInfo?.published && _hasSurveyPermission(Permission.recordCreate)(user, surveyInfo)\n\nconst canAnalyzeRecords = _hasSurveyPermission(Permission.recordAnalyse)\n\nconst canUpdateRecordsStep = canAnalyzeRecords\n\n// ======\n// ====== Explorer\n// ======\n\nconst canUseExplorer = canCleanseRecords\n\n// ======\n// ====== Map\n// ======\n\nconst canUseMap = canAnalyzeRecords\n\n// ======\n// ====== Users\n// ======\n\n// CREATE\nconst canInviteUsers = _hasSurveyPermission(Permission.userInvite)\n\n// READ\nconst canViewSurveyUsers = _hasSurveyPermission(Permission.userInvite)\n\nconst _usersBelongToSameSurvey = ({ user, userToView }: { user: User; userToView: User }) =>\n Users.getAuthGroups(user).some(\n (authGroupUser) =>\n AuthGroups.isSurveyGroup(authGroupUser) &&\n Users.getAuthGroups(userToView).some(\n (authGroupUserToView) =>\n AuthGroups.isSurveyGroup(authGroupUserToView) &&\n AuthGroups.getSurveyUuid(authGroupUserToView) === AuthGroups.getSurveyUuid(authGroupUser)\n )\n )\n\nconst canViewUser = (user: User, _surveyInfo: Survey, userToView: User) =>\n Users.isSystemAdmin(user) || Users.isEqual(userToView)(user) || _usersBelongToSameSurvey({ user, userToView })\n\nconst canViewOtherUsersEmail = ({ user, surveyInfo }: { user: User; surveyInfo: Survey }) =>\n Users.isSystemAdmin(user) || canInviteUsers(user, surveyInfo)\n\nconst canViewOtherUsersNameInSameSurvey = (user: User, surveyInfo: Survey): boolean =>\n _hasSurveyPermission(Permission.recordView)(user, surveyInfo)\n\nconst canViewAllUsers = (user: User) => Users.isSystemAdmin(user)\n\n// EDIT\nconst _hasUserEditAccess = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n Users.isSystemAdmin(user) ||\n (_hasSurveyPermission(Permission.userEdit)(user, surveyInfo) &&\n // user to update has an auth group in the same survey\n _hasAuthGroupForSurvey({ user: userToUpdate, surveyInfo }))\n\nconst canCreateUsers = (user: User): boolean => Users.isSystemAdmin(user)\n\nconst canEditUser = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n Users.hasAccepted(userToUpdate) &&\n (Users.isEqual(user)(userToUpdate) || _hasUserEditAccess(user, surveyInfo, userToUpdate))\n\nconst canEditUserEmail = (user: User): boolean => Users.isSystemAdmin(user)\n\nconst canEditUserGroup = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n !Users.isEqual(user)(userToUpdate) && _hasUserEditAccess(user, surveyInfo, userToUpdate)\n\nconst canRemoveUser = (user: User, surveyInfo: Survey, userToRemove: User): boolean =>\n !Users.isEqual(user)(userToRemove) &&\n !Users.isSystemAdmin(userToRemove) &&\n _hasUserEditAccess(user, surveyInfo, userToRemove)\n\n// only survey admins (and system admins) can manage the user groups of a survey\nconst canManageUserGroups = (user: User, surveyInfo: Survey): boolean => {\n if (!user) return false\n if (Users.isSystemAdmin(user)) return true\n if (!surveyInfo) return false\n return _getSurveyUserGroup(user, surveyInfo)?.name === AuthGroupName.surveyAdmin\n}\n\n// qualifier attribute values are tied to user groups\nconst canEditQualifierAttributeValue = canManageUserGroups\n\nconst canEditUserAuthGroupExtraProps = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n Users.isSystemAdmin(user) ||\n (canInviteUsers(user, surveyInfo) && _hasAuthGroupForSurvey({ user: userToUpdate, surveyInfo }))\n\nconst canEditUserSurveyManager = (user: User) => Users.isSystemAdmin(user)\nconst canEditUserMaxSurveys = (user: User) => Users.isSystemAdmin(user)\n\n// USER ACCESS REQUESTS\nconst canViewUsersAccessRequests = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditUsersAccessRequests = (user: User): boolean => Users.isSystemAdmin(user)\n\n// TWO-FACTOR AUTHENTICATION\nconst canManageUser2FADevices = (user: User): boolean => Users.isSystemAdmin(user)\n\n// INVITE\nconst getUserGroupsCanAssign = ({\n user,\n surveyInfo = null,\n editingLoggedUser = false,\n showOnlySurveyGroups = false,\n}: {\n user: User\n surveyInfo?: Survey | null\n editingLoggedUser?: boolean\n showOnlySurveyGroups?: boolean\n}) => {\n const groups = []\n\n let surveyGroups: AuthGroup[] = []\n if (editingLoggedUser && !surveyInfo) {\n // This can happen for system administrators when they don't have an active survey\n surveyGroups = []\n } else if (surveyInfo) {\n if (surveyInfo.published) {\n surveyGroups = Surveys.getAuthGroups(surveyInfo)\n } else {\n const adminGroup = Surveys.getAuthGroupAdmin(surveyInfo)\n surveyGroups = adminGroup ? [adminGroup] : []\n }\n }\n\n // do not allow surveyEditor group selection (remove surveyEditor group completely?)\n surveyGroups = surveyGroups.filter((group) => group.name !== AuthGroupName.surveyEditor)\n\n groups.push(...surveyGroups)\n\n if (!showOnlySurveyGroups && (Users.isSystemAdmin(user) || Users.isSurveyManager(user))) {\n // Add SystemAdmin or SurveyManager group if current user is a SystemAdmin or SurveyManager himself\n const userNonSurveyGroups = Users.getAuthGroups(user).filter((group) => !AuthGroups.isSurveyGroup(group))\n groups.push(...userNonSurveyGroups)\n }\n return AuthGroups.sortGroups(groups)\n}\n\nexport const Authorizer = {\n // Survey\n canCreateSurvey,\n canCreateTemplate,\n getMaxSurveysUserCanCreate,\n canViewSurvey,\n canViewSurveyOrPublishedTemplate,\n canExportSurvey,\n canExportSurveysList,\n canViewTemplates,\n canEditSurvey,\n canEditSomeSurvey,\n canEditSurveyConfig,\n canEditSurveyOwner,\n canEditTemplates,\n canRefreshAllSurveyRdbs,\n // Record\n canCreateRecord,\n canViewRecord,\n canExportAllRecords,\n canViewNotOwnedRecords,\n canExportRecordsList,\n canEditRecord,\n canDeleteRecord,\n canDemoteRecord,\n canChangeRecordOwner,\n canChangeRecordStep,\n canCleanseRecords,\n canExportRecords,\n canImportRecords,\n canAnalyzeRecords,\n canUpdateRecordsStep,\n // Explorer\n canUseExplorer,\n // Map\n canUseMap,\n // Users\n canInviteUsers,\n canViewSurveyUsers,\n canViewUser,\n canViewOtherUsersEmail,\n canViewOtherUsersNameInSameSurvey,\n canViewAllUsers,\n canCreateUsers,\n canEditUser,\n canEditUserEmail,\n canEditUserGroup,\n canRemoveUser,\n canManageUserGroups,\n canEditQualifierAttributeValue,\n canEditUserAuthGroupExtraProps,\n canEditUserSurveyManager,\n canEditUserMaxSurveys,\n // User Access Requests\n canViewUsersAccessRequests,\n canEditUsersAccessRequests,\n // Two-factor authentication\n canManageUser2FADevices,\n // Invite\n getUserGroupsCanAssign,\n}\n"]}
package/dist/esm/auth/authorizer.js CHANGED
@@ -39,11 +39,14 @@ const getMaxSurveysUserCanCreate = (user) => {
39
39
  };
40
40
  // READ
41
41
  const canViewSurvey = (user, surveyInfo) => Users.isSystemAdmin(user) || _hasAuthGroupForSurvey({ user, surveyInfo });
42
+ // any logged in user can view a published template (e.g. to clone it), without widening canViewSurvey
43
+ const canViewSurveyOrPublishedTemplate = (user, surveyInfo) => canViewSurvey(user, surveyInfo) || Boolean(user && (surveyInfo === null || surveyInfo === void 0 ? void 0 : surveyInfo.template) && surveyInfo.published);
42
44
  const canExportSurvey = _hasSurveyPermission(Permission.recordAnalyse);
43
45
  const canExportSurveysList = (user) => Users.isSystemAdmin(user);
44
46
  const canViewTemplates = (user) => Users.isSystemAdmin(user);
45
47
  // UPDATE
46
48
  const canEditSurvey = _hasSurveyPermission(Permission.surveyEdit);
49
+ const canEditSomeSurvey = _hasPermissionInSomeGroup(Permission.surveyEdit);
47
50
  const canEditSurveyConfig = (user) => Users.isSystemAdmin(user);
48
51
  const canEditSurveyOwner = (user) => Users.isSystemAdmin(user);
49
52
  const canEditTemplates = (user) => Users.isSystemAdmin(user);
@@ -72,7 +75,7 @@ export const canViewNotOwnedRecords = (user, surveyInfo) => {
72
75
  return true;
73
76
  return false;
74
77
  };
75
- export const canExportRecordsList = _hasSurveyPermission(Permission.surveyEdit);
78
+ export const canExportRecordsList = _hasSurveyPermission(Permission.recordAnalyse);
76
79
  // UPDATE
77
80
  export const canEditRecord = (user, record, allowAnalysisStepEdit = false) => {
78
81
  var _a;
@@ -146,11 +149,28 @@ const canEditUserGroup = (user, surveyInfo, userToUpdate) => !Users.isEqual(user
146
149
  const canRemoveUser = (user, surveyInfo, userToRemove) => !Users.isEqual(user)(userToRemove) &&
147
150
  !Users.isSystemAdmin(userToRemove) &&
148
151
  _hasUserEditAccess(user, surveyInfo, userToRemove);
152
+ // only survey admins (and system admins) can manage the user groups of a survey
153
+ const canManageUserGroups = (user, surveyInfo) => {
154
+ var _a;
155
+ if (!user)
156
+ return false;
157
+ if (Users.isSystemAdmin(user))
158
+ return true;
159
+ if (!surveyInfo)
160
+ return false;
161
+ return ((_a = _getSurveyUserGroup(user, surveyInfo)) === null || _a === void 0 ? void 0 : _a.name) === AuthGroupName.surveyAdmin;
162
+ };
163
+ // qualifier attribute values are tied to user groups
164
+ const canEditQualifierAttributeValue = canManageUserGroups;
165
+ const canEditUserAuthGroupExtraProps = (user, surveyInfo, userToUpdate) => Users.isSystemAdmin(user) ||
166
+ (canInviteUsers(user, surveyInfo) && _hasAuthGroupForSurvey({ user: userToUpdate, surveyInfo }));
149
167
  const canEditUserSurveyManager = (user) => Users.isSystemAdmin(user);
150
168
  const canEditUserMaxSurveys = (user) => Users.isSystemAdmin(user);
151
169
  // USER ACCESS REQUESTS
152
170
  const canViewUsersAccessRequests = (user) => Users.isSystemAdmin(user);
153
171
  const canEditUsersAccessRequests = (user) => Users.isSystemAdmin(user);
172
+ // TWO-FACTOR AUTHENTICATION
173
+ const canManageUser2FADevices = (user) => Users.isSystemAdmin(user);
154
174
  // INVITE
155
175
  const getUserGroupsCanAssign = ({ user, surveyInfo = null, editingLoggedUser = false, showOnlySurveyGroups = false, }) => {
156
176
  const groups = [];
@@ -184,10 +204,12 @@ export const Authorizer = {
184
204
  canCreateTemplate,
185
205
  getMaxSurveysUserCanCreate,
186
206
  canViewSurvey,
207
+ canViewSurveyOrPublishedTemplate,
187
208
  canExportSurvey,
188
209
  canExportSurveysList,
189
210
  canViewTemplates,
190
211
  canEditSurvey,
212
+ canEditSomeSurvey,
191
213
  canEditSurveyConfig,
192
214
  canEditSurveyOwner,
193
215
  canEditTemplates,
@@ -224,11 +246,16 @@ export const Authorizer = {
224
246
  canEditUserEmail,
225
247
  canEditUserGroup,
226
248
  canRemoveUser,
249
+ canManageUserGroups,
250
+ canEditQualifierAttributeValue,
251
+ canEditUserAuthGroupExtraProps,
227
252
  canEditUserSurveyManager,
228
253
  canEditUserMaxSurveys,
229
254
  // User Access Requests
230
255
  canViewUsersAccessRequests,
231
256
  canEditUsersAccessRequests,
257
+ // Two-factor authentication
258
+ canManageUser2FADevices,
232
259
  // Invite
233
260
  getUserGroupsCanAssign,
234
261
  };
package/dist/esm/auth/authorizer.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../../src/auth/authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,OAAO,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAAU,OAAO,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,EAAa,aAAa,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAE/D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAE/B,SAAS;AACT,gBAAgB;AAChB,SAAS;AAET,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,kBAAkB,GAAG,IAAI,EAAyB,EAAE,CAC/G,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAEpG,MAAM,sBAAsB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAsC,EAAW,EAAE,CACnG,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;AAEhD,MAAM,oBAAoB,GACxB,CAAC,UAAsB,EAAE,EAAE,CAC3B,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAE7B,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACvD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,OAAO,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAClE,CAAC,CAAA;AAEH,MAAM,yBAAyB,GAC7B,CAAC,UAAsB,EAAE,EAAE,CAC3B,CAAC,IAAU,EAAW,EAAE;IACtB,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAA;AACtF,CAAC,CAAA;AAEH,SAAS;AACT,MAAM,eAAe,GAAG,yBAAyB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AAC1E,MAAM,iBAAiB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC5E,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAU,EAAE;IACxD,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IAChD,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAC3D,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,OAAO;AACP,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE,CAChE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3E,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AACtE,MAAM,oBAAoB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC/E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC3E,SAAS;AACT,MAAM,aAAa,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACjE,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC9E,MAAM,kBAAkB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC7E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC3E,MAAM,uBAAuB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAElF,SAAS;AACT,gBAAgB;AAChB,SAAS;AAET,SAAS;AACT,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AAE5E,OAAO;AACP,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE;IAChF,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,UAAU,CAAA;IACvC,MAAM,oBAAoB,GAAG,KAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;IAC7E,MAAM,SAAS,GAAG,oBAAoB,aAApB,oBAAoB,uBAApB,oBAAoB,CAAE,IAAI,CAAA;IAE5C,IAAI,SAAS,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,sCAAsC,CAAC,UAAU,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,uCAAuC,CAAC,UAAU,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAE/E,SAAS;AACT,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,MAAmB,EAAE,qBAAqB,GAAG,KAAK,EAAW,EAAE;;IACvG,IACE,CAAC,IAAI;QACL,CAAC,MAAM;QACP,uCAAuC;QACvC,CAAC,CAAC,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,qGAAqG;IACrG,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;IACxC,sFAAsF;IACtF,MAAM,aAAa,GAAG,KAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;IACtE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAA;IAEhC,sFAAsF;IACtF,6GAA6G;IAC7G,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAE3F,+EAA+E;IAC/E,6CAA6C;IAC7C,qFAAqF;IACrF,MAAM,KAAK,GAAG,MAAA,UAAU,CAAC,cAAc,CAAC,aAAa,CAAC,0CAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IACjF,OAAO,KAAK,KAAK,oBAAoB,CAAC,GAAG,IAAI,CAAC,KAAK,KAAK,oBAAoB,CAAC,GAAG,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9G,CAAC,CAAA;AAED,MAAM,oBAAoB,GAAG,CAAC,IAAU,EAAE,MAAmB,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;AAEnG,MAAM,eAAe,GAAG,aAAa,CAAA;AAErC,MAAM,eAAe,GAAG,oBAAoB,CAAA;AAE5C,MAAM,oBAAoB,GAAG,oBAAoB,CAAA;AAEjD,MAAM,mBAAmB,GAAG,oBAAoB,CAAA;AAEhD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAExE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAEpE,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,EAAE,CAC1D,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,SAAS,KAAI,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE1F,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAExE,MAAM,oBAAoB,GAAG,iBAAiB,CAAA;AAE9C,SAAS;AACT,kBAAkB;AAClB,SAAS;AAET,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAExC,SAAS;AACT,aAAa;AACb,SAAS;AAET,MAAM,SAAS,GAAG,iBAAiB,CAAA;AAEnC,SAAS;AACT,eAAe;AACf,SAAS;AAET,SAAS;AACT,MAAM,cAAc,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAElE,OAAO;AACP,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAEtE,MAAM,wBAAwB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAoC,EAAE,EAAE,CAC1F,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAC5B,CAAC,aAAa,EAAE,EAAE,CAChB,UAAU,CAAC,aAAa,CAAC,aAAa,CAAC;IACvC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAClC,CAAC,mBAAmB,EAAE,EAAE,CACtB,UAAU,CAAC,aAAa,CAAC,mBAAmB,CAAC;QAC7C,UAAU,CAAC,aAAa,CAAC,mBAAmB,CAAC,KAAK,UAAU,CAAC,aAAa,CAAC,aAAa,CAAC,CAC5F,CACJ,CAAA;AAEH,MAAM,WAAW,GAAG,CAAC,IAAU,EAAE,WAAmB,EAAE,UAAgB,EAAE,EAAE,CACxE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;AAEhH,MAAM,sBAAsB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAsC,EAAE,EAAE,CAC1F,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE/D,MAAM,iCAAiC,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE,CACpF,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE/D,MAAM,eAAe,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEjE,OAAO;AACP,MAAM,kBAAkB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACzF,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;IACzB,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1D,sDAAsD;QACtD,sBAAsB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;AAE/D,MAAM,cAAc,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEzE,MAAM,WAAW,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CAClF,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;IAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;AAE3F,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAE3E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACvF,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;AAE1F,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACpF,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC;IAClC,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClC,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;AAEpD,MAAM,wBAAwB,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC1E,MAAM,qBAAqB,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEvE,uBAAuB;AACvB,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AACrF,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAErF,SAAS;AACT,MAAM,sBAAsB,GAAG,CAAC,EAC9B,IAAI,EACJ,UAAU,GAAG,IAAI,EACjB,iBAAiB,GAAG,KAAK,EACzB,oBAAoB,GAAG,KAAK,GAM7B,EAAE,EAAE;IACH,MAAM,MAAM,GAAG,EAAE,CAAA;IAEjB,IAAI,YAAY,GAAgB,EAAE,CAAA;IAClC,IAAI,iBAAiB,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,kFAAkF;QAClF,YAAY,GAAG,EAAE,CAAA;IACnB,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YACxD,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,YAAY,CAAC,CAAA;IAExF,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;IAE5B,IAAI,CAAC,oBAAoB,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxF,mGAAmG;QACnG,MAAM,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;QACzG,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS;IACT,eAAe;IACf,iBAAiB;IACjB,0BAA0B;IAC1B,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,gBAAgB;IAChB,aAAa;IACb,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,uBAAuB;IACvB,SAAS;IACT,eAAe;IACf,aAAa;IACb,mBAAmB;IACnB,sBAAsB;IACtB,oBAAoB;IACpB,aAAa;IACb,eAAe;IACf,eAAe;IACf,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,WAAW;IACX,cAAc;IACd,MAAM;IACN,SAAS;IACT,QAAQ;IACR,cAAc;IACd,kBAAkB;IAClB,WAAW;IACX,sBAAsB;IACtB,iCAAiC;IACjC,eAAe;IACf,cAAc;IACd,WAAW;IACX,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,0BAA0B;IAC1B,SAAS;IACT,sBAAsB;CACvB,CAAA","sourcesContent":["import { ArenaRecord, Records } from '../record'\nimport { Survey, Surveys } from '../survey'\nimport { AuthGroup, AuthGroupName } from './authGroup'\nimport { AuthGroups } from './authGroups'\nimport { Permission, RecordStepPermission } from './permission'\nimport { User } from './user'\nimport { Users } from './users'\n\n// ======\n// ====== Survey\n// ======\n\nconst _getSurveyUserGroup = (user: User, surveyInfo: Survey, includeSystemAdmin = true): AuthGroup | undefined =>\n surveyInfo ? Users.getAuthGroupBySurveyUuid(surveyInfo.uuid, includeSystemAdmin)(user) : undefined\n\nconst _hasAuthGroupForSurvey = ({ user, surveyInfo }: { user: User; surveyInfo: Survey }): boolean =>\n Boolean(_getSurveyUserGroup(user, surveyInfo))\n\nconst _hasSurveyPermission =\n (permission: Permission) =>\n (user: User, surveyInfo: Survey): boolean => {\n if (!user) return false\n\n if (Users.isSystemAdmin(user)) return true\n\n if (!surveyInfo) return false\n\n const authGroup = _getSurveyUserGroup(user, surveyInfo)\n if (!authGroup) return false\n\n return AuthGroups.getPermissions(authGroup).includes(permission)\n }\n\nconst _hasPermissionInSomeGroup =\n (permission: Permission) =>\n (user: User): boolean => {\n if (Users.isSystemAdmin(user)) return true\n const groups = Users.getAuthGroups(user)\n return groups.some((group) => AuthGroups.getPermissions(group).includes(permission))\n }\n\n// CREATE\nconst canCreateSurvey = _hasPermissionInSomeGroup(Permission.surveyCreate)\nconst canCreateTemplate = (user: User): boolean => Users.isSystemAdmin(user)\nconst getMaxSurveysUserCanCreate = (user: User): number => {\n if (Users.isSystemAdmin(user)) return Number.NaN\n if (canCreateSurvey(user)) return Users.getMaxSurveys(user)\n return 0\n}\n\n// READ\nconst canViewSurvey = (user: User, surveyInfo: Survey): boolean =>\n Users.isSystemAdmin(user) || _hasAuthGroupForSurvey({ user, surveyInfo })\nconst canExportSurvey = _hasSurveyPermission(Permission.recordAnalyse)\nconst canExportSurveysList = (user: User): boolean => Users.isSystemAdmin(user)\nconst canViewTemplates = (user: User): boolean => Users.isSystemAdmin(user)\n// UPDATE\nconst canEditSurvey = _hasSurveyPermission(Permission.surveyEdit)\nconst canEditSurveyConfig = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditSurveyOwner = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditTemplates = (user: User): boolean => Users.isSystemAdmin(user)\nconst canRefreshAllSurveyRdbs = (user: User): boolean => Users.isSystemAdmin(user)\n\n// ======\n// ====== Record\n// ======\n\n// CREATE\nexport const canCreateRecord = _hasSurveyPermission(Permission.recordCreate)\n\n// READ\nexport const canViewRecord = _hasSurveyPermission(Permission.recordView)\nexport const canExportAllRecords = _hasSurveyPermission(Permission.recordCleanse)\nexport const canViewNotOwnedRecords = (user: User, surveyInfo: Survey): boolean => {\n if (!surveyInfo || !canViewSurvey(user, surveyInfo)) return false\n\n const { uuid: surveyUuid } = surveyInfo\n const groupInCurrentSurvey = Users.getAuthGroupBySurveyUuid(surveyUuid)(user)\n const groupName = groupInCurrentSurvey?.name\n\n if (groupName === AuthGroupName.dataEditor) {\n return Surveys.isDataEditorViewNotOwnedRecordsAllowed(surveyInfo)\n }\n if (groupName === AuthGroupName.dataAnalyst) {\n return Surveys.isDataAnalystViewNotOwnedRecordsAllowed(surveyInfo)\n }\n if (canExportAllRecords(user, surveyInfo)) return true\n\n return false\n}\nexport const canExportRecordsList = _hasSurveyPermission(Permission.surveyEdit)\n\n// UPDATE\nexport const canEditRecord = (user: User, record: ArenaRecord, allowAnalysisStepEdit = false): boolean => {\n if (\n !user ||\n !record ||\n // records in analysis cannot be edited\n (!allowAnalysisStepEdit && Records.isInAnalysisStep(record))\n ) {\n return false\n }\n // system admin does not have an auth group associated to the survey, but he can always edit records;\n if (Users.isSystemAdmin(user)) {\n return true\n }\n const { surveyUuid, ownerUuid } = record\n // if user doesn't have an auth group associated to the survey, he cannot edit records\n const userAuthGroup = Users.getAuthGroupBySurveyUuid(surveyUuid)(user)\n if (!userAuthGroup) return false\n\n // groups without the record edit permission (e.g. survey guests) cannot edit records,\n // even when their record steps permission allows it (record steps permissions are used also to view records)\n if (!AuthGroups.getPermissions(userAuthGroup).includes(Permission.recordEdit)) return false\n\n // Level = 'all' or 'own'. If 'own', user can only edit records assigned to him\n // If 'all', he can edit all survey's records\n // permission checks must not throw: a group without record steps cannot edit records\n const level = AuthGroups.getRecordSteps(userAuthGroup)?.[Records.getStep(record)]\n return level === RecordStepPermission.all || (level === RecordStepPermission.own && ownerUuid === user.uuid)\n}\n\nconst canChangeRecordProps = (user: User, record: ArenaRecord) => canEditRecord(user, record, true)\n\nconst canDeleteRecord = canEditRecord\n\nconst canDemoteRecord = canChangeRecordProps\n\nconst canChangeRecordOwner = canChangeRecordProps\n\nconst canChangeRecordStep = canChangeRecordProps\n\nconst canCleanseRecords = _hasSurveyPermission(Permission.recordCleanse)\n\nconst canExportRecords = _hasSurveyPermission(Permission.recordView)\n\nconst canImportRecords = (user: User, surveyInfo: Survey) =>\n surveyInfo?.published && _hasSurveyPermission(Permission.recordCreate)(user, surveyInfo)\n\nconst canAnalyzeRecords = _hasSurveyPermission(Permission.recordAnalyse)\n\nconst canUpdateRecordsStep = canAnalyzeRecords\n\n// ======\n// ====== Explorer\n// ======\n\nconst canUseExplorer = canCleanseRecords\n\n// ======\n// ====== Map\n// ======\n\nconst canUseMap = canAnalyzeRecords\n\n// ======\n// ====== Users\n// ======\n\n// CREATE\nconst canInviteUsers = _hasSurveyPermission(Permission.userInvite)\n\n// READ\nconst canViewSurveyUsers = _hasSurveyPermission(Permission.userInvite)\n\nconst _usersBelongToSameSurvey = ({ user, userToView }: { user: User; userToView: User }) =>\n Users.getAuthGroups(user).some(\n (authGroupUser) =>\n AuthGroups.isSurveyGroup(authGroupUser) &&\n Users.getAuthGroups(userToView).some(\n (authGroupUserToView) =>\n AuthGroups.isSurveyGroup(authGroupUserToView) &&\n AuthGroups.getSurveyUuid(authGroupUserToView) === AuthGroups.getSurveyUuid(authGroupUser)\n )\n )\n\nconst canViewUser = (user: User, _surveyInfo: Survey, userToView: User) =>\n Users.isSystemAdmin(user) || Users.isEqual(userToView)(user) || _usersBelongToSameSurvey({ user, userToView })\n\nconst canViewOtherUsersEmail = ({ user, surveyInfo }: { user: User; surveyInfo: Survey }) =>\n Users.isSystemAdmin(user) || canInviteUsers(user, surveyInfo)\n\nconst canViewOtherUsersNameInSameSurvey = (user: User, surveyInfo: Survey): boolean =>\n _hasSurveyPermission(Permission.recordView)(user, surveyInfo)\n\nconst canViewAllUsers = (user: User) => Users.isSystemAdmin(user)\n\n// EDIT\nconst _hasUserEditAccess = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n Users.isSystemAdmin(user) ||\n (_hasSurveyPermission(Permission.userEdit)(user, surveyInfo) &&\n // user to update has an auth group in the same survey\n _hasAuthGroupForSurvey({ user: userToUpdate, surveyInfo }))\n\nconst canCreateUsers = (user: User): boolean => Users.isSystemAdmin(user)\n\nconst canEditUser = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n Users.hasAccepted(userToUpdate) &&\n (Users.isEqual(user)(userToUpdate) || _hasUserEditAccess(user, surveyInfo, userToUpdate))\n\nconst canEditUserEmail = (user: User): boolean => Users.isSystemAdmin(user)\n\nconst canEditUserGroup = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n !Users.isEqual(user)(userToUpdate) && _hasUserEditAccess(user, surveyInfo, userToUpdate)\n\nconst canRemoveUser = (user: User, surveyInfo: Survey, userToRemove: User): boolean =>\n !Users.isEqual(user)(userToRemove) &&\n !Users.isSystemAdmin(userToRemove) &&\n _hasUserEditAccess(user, surveyInfo, userToRemove)\n\nconst canEditUserSurveyManager = (user: User) => Users.isSystemAdmin(user)\nconst canEditUserMaxSurveys = (user: User) => Users.isSystemAdmin(user)\n\n// USER ACCESS REQUESTS\nconst canViewUsersAccessRequests = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditUsersAccessRequests = (user: User): boolean => Users.isSystemAdmin(user)\n\n// INVITE\nconst getUserGroupsCanAssign = ({\n user,\n surveyInfo = null,\n editingLoggedUser = false,\n showOnlySurveyGroups = false,\n}: {\n user: User\n surveyInfo?: Survey | null\n editingLoggedUser?: boolean\n showOnlySurveyGroups?: boolean\n}) => {\n const groups = []\n\n let surveyGroups: AuthGroup[] = []\n if (editingLoggedUser && !surveyInfo) {\n // This can happen for system administrators when they don't have an active survey\n surveyGroups = []\n } else if (surveyInfo) {\n if (surveyInfo.published) {\n surveyGroups = Surveys.getAuthGroups(surveyInfo)\n } else {\n const adminGroup = Surveys.getAuthGroupAdmin(surveyInfo)\n surveyGroups = adminGroup ? [adminGroup] : []\n }\n }\n\n // do not allow surveyEditor group selection (remove surveyEditor group completely?)\n surveyGroups = surveyGroups.filter((group) => group.name !== AuthGroupName.surveyEditor)\n\n groups.push(...surveyGroups)\n\n if (!showOnlySurveyGroups && (Users.isSystemAdmin(user) || Users.isSurveyManager(user))) {\n // Add SystemAdmin or SurveyManager group if current user is a SystemAdmin or SurveyManager himself\n const userNonSurveyGroups = Users.getAuthGroups(user).filter((group) => !AuthGroups.isSurveyGroup(group))\n groups.push(...userNonSurveyGroups)\n }\n return AuthGroups.sortGroups(groups)\n}\n\nexport const Authorizer = {\n // Survey\n canCreateSurvey,\n canCreateTemplate,\n getMaxSurveysUserCanCreate,\n canViewSurvey,\n canExportSurvey,\n canExportSurveysList,\n canViewTemplates,\n canEditSurvey,\n canEditSurveyConfig,\n canEditSurveyOwner,\n canEditTemplates,\n canRefreshAllSurveyRdbs,\n // Record\n canCreateRecord,\n canViewRecord,\n canExportAllRecords,\n canViewNotOwnedRecords,\n canExportRecordsList,\n canEditRecord,\n canDeleteRecord,\n canDemoteRecord,\n canChangeRecordOwner,\n canChangeRecordStep,\n canCleanseRecords,\n canExportRecords,\n canImportRecords,\n canAnalyzeRecords,\n canUpdateRecordsStep,\n // Explorer\n canUseExplorer,\n // Map\n canUseMap,\n // Users\n canInviteUsers,\n canViewSurveyUsers,\n canViewUser,\n canViewOtherUsersEmail,\n canViewOtherUsersNameInSameSurvey,\n canViewAllUsers,\n canCreateUsers,\n canEditUser,\n canEditUserEmail,\n canEditUserGroup,\n canRemoveUser,\n canEditUserSurveyManager,\n canEditUserMaxSurveys,\n // User Access Requests\n canViewUsersAccessRequests,\n canEditUsersAccessRequests,\n // Invite\n getUserGroupsCanAssign,\n}\n"]}
1
+ {"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../../src/auth/authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,OAAO,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAAU,OAAO,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,EAAa,aAAa,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAE/D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAE/B,SAAS;AACT,gBAAgB;AAChB,SAAS;AAET,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,kBAAkB,GAAG,IAAI,EAAyB,EAAE,CAC/G,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAEpG,MAAM,sBAAsB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAsC,EAAW,EAAE,CACnG,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;AAEhD,MAAM,oBAAoB,GACxB,CAAC,UAAsB,EAAE,EAAE,CAC3B,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAE7B,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACvD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,OAAO,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAClE,CAAC,CAAA;AAEH,MAAM,yBAAyB,GAC7B,CAAC,UAAsB,EAAE,EAAE,CAC3B,CAAC,IAAU,EAAW,EAAE;IACtB,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAA;AACtF,CAAC,CAAA;AAEH,SAAS;AACT,MAAM,eAAe,GAAG,yBAAyB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AAC1E,MAAM,iBAAiB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC5E,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAU,EAAE;IACxD,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IAChD,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAC3D,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,OAAO;AACP,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE,CAChE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3E,sGAAsG;AACtG,MAAM,gCAAgC,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE,CACnF,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,KAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,QAAQ,CAAA,IAAI,UAAU,CAAC,SAAS,CAAC,CAAA;AAClG,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AACtE,MAAM,oBAAoB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC/E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC3E,SAAS;AACT,MAAM,aAAa,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACjE,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAC1E,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC9E,MAAM,kBAAkB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC7E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC3E,MAAM,uBAAuB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAElF,SAAS;AACT,gBAAgB;AAChB,SAAS;AAET,SAAS;AACT,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AAE5E,OAAO;AACP,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE;IAChF,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,UAAU,CAAA;IACvC,MAAM,oBAAoB,GAAG,KAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;IAC7E,MAAM,SAAS,GAAG,oBAAoB,aAApB,oBAAoB,uBAApB,oBAAoB,CAAE,IAAI,CAAA;IAE5C,IAAI,SAAS,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,sCAAsC,CAAC,UAAU,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,uCAAuC,CAAC,UAAU,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAElF,SAAS;AACT,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,MAAmB,EAAE,qBAAqB,GAAG,KAAK,EAAW,EAAE;;IACvG,IACE,CAAC,IAAI;QACL,CAAC,MAAM;QACP,uCAAuC;QACvC,CAAC,CAAC,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,qGAAqG;IACrG,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;IACxC,sFAAsF;IACtF,MAAM,aAAa,GAAG,KAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;IACtE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAA;IAEhC,sFAAsF;IACtF,6GAA6G;IAC7G,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAE3F,+EAA+E;IAC/E,6CAA6C;IAC7C,qFAAqF;IACrF,MAAM,KAAK,GAAG,MAAA,UAAU,CAAC,cAAc,CAAC,aAAa,CAAC,0CAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IACjF,OAAO,KAAK,KAAK,oBAAoB,CAAC,GAAG,IAAI,CAAC,KAAK,KAAK,oBAAoB,CAAC,GAAG,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9G,CAAC,CAAA;AAED,MAAM,oBAAoB,GAAG,CAAC,IAAU,EAAE,MAAmB,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;AAEnG,MAAM,eAAe,GAAG,aAAa,CAAA;AAErC,MAAM,eAAe,GAAG,oBAAoB,CAAA;AAE5C,MAAM,oBAAoB,GAAG,oBAAoB,CAAA;AAEjD,MAAM,mBAAmB,GAAG,oBAAoB,CAAA;AAEhD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAExE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAEpE,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,EAAE,CAC1D,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,SAAS,KAAI,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE1F,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAExE,MAAM,oBAAoB,GAAG,iBAAiB,CAAA;AAE9C,SAAS;AACT,kBAAkB;AAClB,SAAS;AAET,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAExC,SAAS;AACT,aAAa;AACb,SAAS;AAET,MAAM,SAAS,GAAG,iBAAiB,CAAA;AAEnC,SAAS;AACT,eAAe;AACf,SAAS;AAET,SAAS;AACT,MAAM,cAAc,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAElE,OAAO;AACP,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAEtE,MAAM,wBAAwB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAoC,EAAE,EAAE,CAC1F,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAC5B,CAAC,aAAa,EAAE,EAAE,CAChB,UAAU,CAAC,aAAa,CAAC,aAAa,CAAC;IACvC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAClC,CAAC,mBAAmB,EAAE,EAAE,CACtB,UAAU,CAAC,aAAa,CAAC,mBAAmB,CAAC;QAC7C,UAAU,CAAC,aAAa,CAAC,mBAAmB,CAAC,KAAK,UAAU,CAAC,aAAa,CAAC,aAAa,CAAC,CAC5F,CACJ,CAAA;AAEH,MAAM,WAAW,GAAG,CAAC,IAAU,EAAE,WAAmB,EAAE,UAAgB,EAAE,EAAE,CACxE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;AAEhH,MAAM,sBAAsB,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAsC,EAAE,EAAE,CAC1F,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE/D,MAAM,iCAAiC,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE,CACpF,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAE/D,MAAM,eAAe,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEjE,OAAO;AACP,MAAM,kBAAkB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACzF,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;IACzB,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1D,sDAAsD;QACtD,sBAAsB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;AAE/D,MAAM,cAAc,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEzE,MAAM,WAAW,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CAClF,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;IAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;AAE3F,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAE3E,MAAM,gBAAgB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACvF,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;AAE1F,MAAM,aAAa,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACpF,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC;IAClC,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;IAClC,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;AAEpD,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAW,EAAE;;IACtE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,OAAO,CAAA,MAAA,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,0CAAE,IAAI,MAAK,aAAa,CAAC,WAAW,CAAA;AAClF,CAAC,CAAA;AAED,qDAAqD;AACrD,MAAM,8BAA8B,GAAG,mBAAmB,CAAA;AAE1D,MAAM,8BAA8B,GAAG,CAAC,IAAU,EAAE,UAAkB,EAAE,YAAkB,EAAW,EAAE,CACrG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;IACzB,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;AAElG,MAAM,wBAAwB,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC1E,MAAM,qBAAqB,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAEvE,uBAAuB;AACvB,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AACrF,MAAM,0BAA0B,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAErF,4BAA4B;AAC5B,MAAM,uBAAuB,GAAG,CAAC,IAAU,EAAW,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAElF,SAAS;AACT,MAAM,sBAAsB,GAAG,CAAC,EAC9B,IAAI,EACJ,UAAU,GAAG,IAAI,EACjB,iBAAiB,GAAG,KAAK,EACzB,oBAAoB,GAAG,KAAK,GAM7B,EAAE,EAAE;IACH,MAAM,MAAM,GAAG,EAAE,CAAA;IAEjB,IAAI,YAAY,GAAgB,EAAE,CAAA;IAClC,IAAI,iBAAiB,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,kFAAkF;QAClF,YAAY,GAAG,EAAE,CAAA;IACnB,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YACxD,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,YAAY,CAAC,CAAA;IAExF,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;IAE5B,IAAI,CAAC,oBAAoB,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxF,mGAAmG;QACnG,MAAM,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;QACzG,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS;IACT,eAAe;IACf,iBAAiB;IACjB,0BAA0B;IAC1B,aAAa;IACb,gCAAgC;IAChC,eAAe;IACf,oBAAoB;IACpB,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,uBAAuB;IACvB,SAAS;IACT,eAAe;IACf,aAAa;IACb,mBAAmB;IACnB,sBAAsB;IACtB,oBAAoB;IACpB,aAAa;IACb,eAAe;IACf,eAAe;IACf,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,WAAW;IACX,cAAc;IACd,MAAM;IACN,SAAS;IACT,QAAQ;IACR,cAAc;IACd,kBAAkB;IAClB,WAAW;IACX,sBAAsB;IACtB,iCAAiC;IACjC,eAAe;IACf,cAAc;IACd,WAAW;IACX,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,mBAAmB;IACnB,8BAA8B;IAC9B,8BAA8B;IAC9B,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,0BAA0B;IAC1B,4BAA4B;IAC5B,uBAAuB;IACvB,SAAS;IACT,sBAAsB;CACvB,CAAA","sourcesContent":["import { ArenaRecord, Records } from '../record'\nimport { Survey, Surveys } from '../survey'\nimport { AuthGroup, AuthGroupName } from './authGroup'\nimport { AuthGroups } from './authGroups'\nimport { Permission, RecordStepPermission } from './permission'\nimport { User } from './user'\nimport { Users } from './users'\n\n// ======\n// ====== Survey\n// ======\n\nconst _getSurveyUserGroup = (user: User, surveyInfo: Survey, includeSystemAdmin = true): AuthGroup | undefined =>\n surveyInfo ? Users.getAuthGroupBySurveyUuid(surveyInfo.uuid, includeSystemAdmin)(user) : undefined\n\nconst _hasAuthGroupForSurvey = ({ user, surveyInfo }: { user: User; surveyInfo: Survey }): boolean =>\n Boolean(_getSurveyUserGroup(user, surveyInfo))\n\nconst _hasSurveyPermission =\n (permission: Permission) =>\n (user: User, surveyInfo: Survey): boolean => {\n if (!user) return false\n\n if (Users.isSystemAdmin(user)) return true\n\n if (!surveyInfo) return false\n\n const authGroup = _getSurveyUserGroup(user, surveyInfo)\n if (!authGroup) return false\n\n return AuthGroups.getPermissions(authGroup).includes(permission)\n }\n\nconst _hasPermissionInSomeGroup =\n (permission: Permission) =>\n (user: User): boolean => {\n if (Users.isSystemAdmin(user)) return true\n const groups = Users.getAuthGroups(user)\n return groups.some((group) => AuthGroups.getPermissions(group).includes(permission))\n }\n\n// CREATE\nconst canCreateSurvey = _hasPermissionInSomeGroup(Permission.surveyCreate)\nconst canCreateTemplate = (user: User): boolean => Users.isSystemAdmin(user)\nconst getMaxSurveysUserCanCreate = (user: User): number => {\n if (Users.isSystemAdmin(user)) return Number.NaN\n if (canCreateSurvey(user)) return Users.getMaxSurveys(user)\n return 0\n}\n\n// READ\nconst canViewSurvey = (user: User, surveyInfo: Survey): boolean =>\n Users.isSystemAdmin(user) || _hasAuthGroupForSurvey({ user, surveyInfo })\n// any logged in user can view a published template (e.g. to clone it), without widening canViewSurvey\nconst canViewSurveyOrPublishedTemplate = (user: User, surveyInfo: Survey): boolean =>\n canViewSurvey(user, surveyInfo) || Boolean(user && surveyInfo?.template && surveyInfo.published)\nconst canExportSurvey = _hasSurveyPermission(Permission.recordAnalyse)\nconst canExportSurveysList = (user: User): boolean => Users.isSystemAdmin(user)\nconst canViewTemplates = (user: User): boolean => Users.isSystemAdmin(user)\n// UPDATE\nconst canEditSurvey = _hasSurveyPermission(Permission.surveyEdit)\nconst canEditSomeSurvey = _hasPermissionInSomeGroup(Permission.surveyEdit)\nconst canEditSurveyConfig = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditSurveyOwner = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditTemplates = (user: User): boolean => Users.isSystemAdmin(user)\nconst canRefreshAllSurveyRdbs = (user: User): boolean => Users.isSystemAdmin(user)\n\n// ======\n// ====== Record\n// ======\n\n// CREATE\nexport const canCreateRecord = _hasSurveyPermission(Permission.recordCreate)\n\n// READ\nexport const canViewRecord = _hasSurveyPermission(Permission.recordView)\nexport const canExportAllRecords = _hasSurveyPermission(Permission.recordCleanse)\nexport const canViewNotOwnedRecords = (user: User, surveyInfo: Survey): boolean => {\n if (!surveyInfo || !canViewSurvey(user, surveyInfo)) return false\n\n const { uuid: surveyUuid } = surveyInfo\n const groupInCurrentSurvey = Users.getAuthGroupBySurveyUuid(surveyUuid)(user)\n const groupName = groupInCurrentSurvey?.name\n\n if (groupName === AuthGroupName.dataEditor) {\n return Surveys.isDataEditorViewNotOwnedRecordsAllowed(surveyInfo)\n }\n if (groupName === AuthGroupName.dataAnalyst) {\n return Surveys.isDataAnalystViewNotOwnedRecordsAllowed(surveyInfo)\n }\n if (canExportAllRecords(user, surveyInfo)) return true\n\n return false\n}\nexport const canExportRecordsList = _hasSurveyPermission(Permission.recordAnalyse)\n\n// UPDATE\nexport const canEditRecord = (user: User, record: ArenaRecord, allowAnalysisStepEdit = false): boolean => {\n if (\n !user ||\n !record ||\n // records in analysis cannot be edited\n (!allowAnalysisStepEdit && Records.isInAnalysisStep(record))\n ) {\n return false\n }\n // system admin does not have an auth group associated to the survey, but he can always edit records;\n if (Users.isSystemAdmin(user)) {\n return true\n }\n const { surveyUuid, ownerUuid } = record\n // if user doesn't have an auth group associated to the survey, he cannot edit records\n const userAuthGroup = Users.getAuthGroupBySurveyUuid(surveyUuid)(user)\n if (!userAuthGroup) return false\n\n // groups without the record edit permission (e.g. survey guests) cannot edit records,\n // even when their record steps permission allows it (record steps permissions are used also to view records)\n if (!AuthGroups.getPermissions(userAuthGroup).includes(Permission.recordEdit)) return false\n\n // Level = 'all' or 'own'. If 'own', user can only edit records assigned to him\n // If 'all', he can edit all survey's records\n // permission checks must not throw: a group without record steps cannot edit records\n const level = AuthGroups.getRecordSteps(userAuthGroup)?.[Records.getStep(record)]\n return level === RecordStepPermission.all || (level === RecordStepPermission.own && ownerUuid === user.uuid)\n}\n\nconst canChangeRecordProps = (user: User, record: ArenaRecord) => canEditRecord(user, record, true)\n\nconst canDeleteRecord = canEditRecord\n\nconst canDemoteRecord = canChangeRecordProps\n\nconst canChangeRecordOwner = canChangeRecordProps\n\nconst canChangeRecordStep = canChangeRecordProps\n\nconst canCleanseRecords = _hasSurveyPermission(Permission.recordCleanse)\n\nconst canExportRecords = _hasSurveyPermission(Permission.recordView)\n\nconst canImportRecords = (user: User, surveyInfo: Survey) =>\n surveyInfo?.published && _hasSurveyPermission(Permission.recordCreate)(user, surveyInfo)\n\nconst canAnalyzeRecords = _hasSurveyPermission(Permission.recordAnalyse)\n\nconst canUpdateRecordsStep = canAnalyzeRecords\n\n// ======\n// ====== Explorer\n// ======\n\nconst canUseExplorer = canCleanseRecords\n\n// ======\n// ====== Map\n// ======\n\nconst canUseMap = canAnalyzeRecords\n\n// ======\n// ====== Users\n// ======\n\n// CREATE\nconst canInviteUsers = _hasSurveyPermission(Permission.userInvite)\n\n// READ\nconst canViewSurveyUsers = _hasSurveyPermission(Permission.userInvite)\n\nconst _usersBelongToSameSurvey = ({ user, userToView }: { user: User; userToView: User }) =>\n Users.getAuthGroups(user).some(\n (authGroupUser) =>\n AuthGroups.isSurveyGroup(authGroupUser) &&\n Users.getAuthGroups(userToView).some(\n (authGroupUserToView) =>\n AuthGroups.isSurveyGroup(authGroupUserToView) &&\n AuthGroups.getSurveyUuid(authGroupUserToView) === AuthGroups.getSurveyUuid(authGroupUser)\n )\n )\n\nconst canViewUser = (user: User, _surveyInfo: Survey, userToView: User) =>\n Users.isSystemAdmin(user) || Users.isEqual(userToView)(user) || _usersBelongToSameSurvey({ user, userToView })\n\nconst canViewOtherUsersEmail = ({ user, surveyInfo }: { user: User; surveyInfo: Survey }) =>\n Users.isSystemAdmin(user) || canInviteUsers(user, surveyInfo)\n\nconst canViewOtherUsersNameInSameSurvey = (user: User, surveyInfo: Survey): boolean =>\n _hasSurveyPermission(Permission.recordView)(user, surveyInfo)\n\nconst canViewAllUsers = (user: User) => Users.isSystemAdmin(user)\n\n// EDIT\nconst _hasUserEditAccess = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n Users.isSystemAdmin(user) ||\n (_hasSurveyPermission(Permission.userEdit)(user, surveyInfo) &&\n // user to update has an auth group in the same survey\n _hasAuthGroupForSurvey({ user: userToUpdate, surveyInfo }))\n\nconst canCreateUsers = (user: User): boolean => Users.isSystemAdmin(user)\n\nconst canEditUser = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n Users.hasAccepted(userToUpdate) &&\n (Users.isEqual(user)(userToUpdate) || _hasUserEditAccess(user, surveyInfo, userToUpdate))\n\nconst canEditUserEmail = (user: User): boolean => Users.isSystemAdmin(user)\n\nconst canEditUserGroup = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n !Users.isEqual(user)(userToUpdate) && _hasUserEditAccess(user, surveyInfo, userToUpdate)\n\nconst canRemoveUser = (user: User, surveyInfo: Survey, userToRemove: User): boolean =>\n !Users.isEqual(user)(userToRemove) &&\n !Users.isSystemAdmin(userToRemove) &&\n _hasUserEditAccess(user, surveyInfo, userToRemove)\n\n// only survey admins (and system admins) can manage the user groups of a survey\nconst canManageUserGroups = (user: User, surveyInfo: Survey): boolean => {\n if (!user) return false\n if (Users.isSystemAdmin(user)) return true\n if (!surveyInfo) return false\n return _getSurveyUserGroup(user, surveyInfo)?.name === AuthGroupName.surveyAdmin\n}\n\n// qualifier attribute values are tied to user groups\nconst canEditQualifierAttributeValue = canManageUserGroups\n\nconst canEditUserAuthGroupExtraProps = (user: User, surveyInfo: Survey, userToUpdate: User): boolean =>\n Users.isSystemAdmin(user) ||\n (canInviteUsers(user, surveyInfo) && _hasAuthGroupForSurvey({ user: userToUpdate, surveyInfo }))\n\nconst canEditUserSurveyManager = (user: User) => Users.isSystemAdmin(user)\nconst canEditUserMaxSurveys = (user: User) => Users.isSystemAdmin(user)\n\n// USER ACCESS REQUESTS\nconst canViewUsersAccessRequests = (user: User): boolean => Users.isSystemAdmin(user)\nconst canEditUsersAccessRequests = (user: User): boolean => Users.isSystemAdmin(user)\n\n// TWO-FACTOR AUTHENTICATION\nconst canManageUser2FADevices = (user: User): boolean => Users.isSystemAdmin(user)\n\n// INVITE\nconst getUserGroupsCanAssign = ({\n user,\n surveyInfo = null,\n editingLoggedUser = false,\n showOnlySurveyGroups = false,\n}: {\n user: User\n surveyInfo?: Survey | null\n editingLoggedUser?: boolean\n showOnlySurveyGroups?: boolean\n}) => {\n const groups = []\n\n let surveyGroups: AuthGroup[] = []\n if (editingLoggedUser && !surveyInfo) {\n // This can happen for system administrators when they don't have an active survey\n surveyGroups = []\n } else if (surveyInfo) {\n if (surveyInfo.published) {\n surveyGroups = Surveys.getAuthGroups(surveyInfo)\n } else {\n const adminGroup = Surveys.getAuthGroupAdmin(surveyInfo)\n surveyGroups = adminGroup ? [adminGroup] : []\n }\n }\n\n // do not allow surveyEditor group selection (remove surveyEditor group completely?)\n surveyGroups = surveyGroups.filter((group) => group.name !== AuthGroupName.surveyEditor)\n\n groups.push(...surveyGroups)\n\n if (!showOnlySurveyGroups && (Users.isSystemAdmin(user) || Users.isSurveyManager(user))) {\n // Add SystemAdmin or SurveyManager group if current user is a SystemAdmin or SurveyManager himself\n const userNonSurveyGroups = Users.getAuthGroups(user).filter((group) => !AuthGroups.isSurveyGroup(group))\n groups.push(...userNonSurveyGroups)\n }\n return AuthGroups.sortGroups(groups)\n}\n\nexport const Authorizer = {\n // Survey\n canCreateSurvey,\n canCreateTemplate,\n getMaxSurveysUserCanCreate,\n canViewSurvey,\n canViewSurveyOrPublishedTemplate,\n canExportSurvey,\n canExportSurveysList,\n canViewTemplates,\n canEditSurvey,\n canEditSomeSurvey,\n canEditSurveyConfig,\n canEditSurveyOwner,\n canEditTemplates,\n canRefreshAllSurveyRdbs,\n // Record\n canCreateRecord,\n canViewRecord,\n canExportAllRecords,\n canViewNotOwnedRecords,\n canExportRecordsList,\n canEditRecord,\n canDeleteRecord,\n canDemoteRecord,\n canChangeRecordOwner,\n canChangeRecordStep,\n canCleanseRecords,\n canExportRecords,\n canImportRecords,\n canAnalyzeRecords,\n canUpdateRecordsStep,\n // Explorer\n canUseExplorer,\n // Map\n canUseMap,\n // Users\n canInviteUsers,\n canViewSurveyUsers,\n canViewUser,\n canViewOtherUsersEmail,\n canViewOtherUsersNameInSameSurvey,\n canViewAllUsers,\n canCreateUsers,\n canEditUser,\n canEditUserEmail,\n canEditUserGroup,\n canRemoveUser,\n canManageUserGroups,\n canEditQualifierAttributeValue,\n canEditUserAuthGroupExtraProps,\n canEditUserSurveyManager,\n canEditUserMaxSurveys,\n // User Access Requests\n canViewUsersAccessRequests,\n canEditUsersAccessRequests,\n // Two-factor authentication\n canManageUser2FADevices,\n // Invite\n getUserGroupsCanAssign,\n}\n"]}
package/package.json CHANGED
@@ -4,7 +4,7 @@
4
4
  "name": "OpenForis",
5
5
  "email": "openforis.arena@gmail.com"
6
6
  },
7
- "version": "2.4.5",
7
+ "version": "2.5.0",
8
8
  "description": "Arena core module",
9
9
  "repository": {
10
10
  "type": "git",