@openinc/parse-server-opendash 3.14.3 → 3.14.5

package/dist/hooks/Permission.js

@@ -3,9 +3,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.init = init;
 const __1 = require("..");
 const types_1 = require("../types");
+const masterKeyPermission = [
+    "opendash:can-admin-tenants",
+    "opendash:tenant:change-tag-prefix",
+    "opendash:source:write-tag-ignore-tenant-prefix",
+    "opendash:source:write-tag-group",
+];
 async function init() {
     (0, __1.beforeSaveHook)(types_1.Permission, async (request) => {
         const { object, original, user } = request;
+        if (masterKeyPermission.includes(object.get("key")) && !request.master) {
+            throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, `User is not allowed to create or update permission with key '${object.get("key")}' without master key`);
+        }
         await (0, __1.defaultHandler)(request);
         await (0, __1.defaultAclHandler)(request, {
             allowCustomACL: true,

package/dist/index.js

@@ -403,7 +403,15 @@ async function defaultHandler(request) {
             const user = (await request.user?.fetch({
                 useMasterKey: true,
             }));
-            request.object.set("tenant", user.get("tenant"));
+            try {
+                await requirePermission(request, "opendash:can-admin-tenants", "User is not allowed to use tag which ignores tenant prefix");
+                if (!request.object.get("tenant")) {
+                    request.object.set("tenant", user.get("tenant"));
+                }
+            }
+            catch (error) {
+                request.object.set("tenant", user.get("tenant"));
+            }
         }
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openinc/parse-server-opendash",
-  "version": "3.14.3",
+  "version": "3.14.5",
   "description": "Parse Server Cloud Code for open.INC Stack.",
   "packageManager": "pnpm@10.13.1",
   "keywords": [