@opengis/admin 0.3.20 → 0.3.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/admin",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "description": "This project Softpro Admin",
   "main": "dist/admin.js",
   "type": "module",

package/server/routes/widget/controllers/widget.del.js

@@ -1,3 +1,11 @@
+import { isFileExists } from "@opengis/fastify-file/utils.js";
+
+async function checkAccess(pg, objectid, id) {
+  const { uid, filepath } = await pg.query(`select uid, file_path as filepath from crm.files where entity_id=$1 and file_id=$2`, [objectid, id])
+    .then(el => el.rows?.[0] || {});
+  return { uid, exists: filepath ? await isFileExists(filepath) : null };
+}
+
 /**
  * Дістає CRM дані для vue хешує ідентифікатори, підтягує селекти
  *
@@ -21,21 +29,29 @@ import { pgClients, logChanges } from "@opengis/fastify-table/utils.js";
 
 export default async function widgetDel({
   pg = pgClients.client, params = {}, session = {},
-}) {
+}, reply) {
   const { user = {} } = session.passport || {};
   if (!user.uid) return { error: 'access restricted', status: 403 };
   const { type, objectid, id } = params;
 
   if (!objectid) return { error: 'id required', status: 400 };
 
+  // force delete db entry if file not exists
+  const { exists, uid } = ['file', 'gallery'].includes(type) ? await checkAccess(pg, objectid, id) : null;
+
+  if (exists && !user?.user_type?.includes?.('admin') && uid && user?.uid !== uid) {
+    return reply.status(403).send('access restricted: file exists, not an author');
+  }
+
   const sqls = {
     comment: 'delete from crm.communications where entity_id=$1 and uid=$2 and communication_id=$3',
     checklist: 'delete from crm.checklists where entity_id=$1 and uid=$2 and checklist_id=$3',
-    file: 'update crm.files set file_status=3 where entity_id=$1 and uid=$2 and file_id=$3 returning uploaded_name',
-    gallery: 'update crm.files set file_status=3 where entity_id=$1 and uid=$2 and file_id=$3 returning uploaded_name',
+    file: `update crm.files set file_status=3 where entity_id=$1 and ${!exists || user?.user_type?.includes?.('admin') ? '$2=$2' : 'uid=$2'} and file_id=$3 returning uploaded_name`,
+    gallery: `update crm.files set file_status=3 where entity_id=$1 and ${!exists || user?.user_type?.includes?.('admin') ? '$2=$2' : 'uid=$2'} and file_id=$3 returning uploaded_name`,
   };
   const sql = sqls[type];
-  if (!sql) return { error: 'type not valid', status: 401 };
+  // console.log(sql);
+  if (!sql) return reply.status(400).send('type not valid');
 
   const { rows = [] } = await pg.query(sql, [objectid, user.uid, id]);
   const table = { comment: 'crm.communications', checklist: 'crm.checklists', file: 'crm.files', gallery: 'crm.files' }[type];