@qikdev/sdk 0.1.182 → 0.1.184
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/main.js +1 -1
- package/package.json +1 -1
- package/src/api/qik.access.js +773 -706
- package/src/api/qik.utils.js +1 -1
- package/src/version.js +1 -1
package/src/api/qik.access.js
CHANGED
|
@@ -1,6 +1,3 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
1
|
/**
|
|
5
2
|
* Creates a new Access Module instance.
|
|
6
3
|
* This module provides a number of helper functions for managing and understanding permissions of the current
|
|
@@ -11,780 +8,850 @@
|
|
|
11
8
|
* @param {QikCore} qik A reference to the parent instance of the QikCore module. This module is usually created by a QikCore instance that passes itself in as the first argument.
|
|
12
9
|
*/
|
|
13
10
|
|
|
14
|
-
var QikAccess = function(QikCore) {
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
11
|
+
var QikAccess = function (QikCore) {
|
|
12
|
+
if (!QikCore.auth) {
|
|
13
|
+
throw new Error(
|
|
14
|
+
`Can't Instantiate QikAccess before QikAccess has been initialized`,
|
|
15
|
+
);
|
|
16
|
+
}
|
|
17
|
+
|
|
18
|
+
if (!QikCore.utils) {
|
|
19
|
+
throw new Error(
|
|
20
|
+
`Can't Instantiate QikAccess before QikCore.utils has been initialized`,
|
|
21
|
+
);
|
|
22
|
+
}
|
|
23
|
+
|
|
24
|
+
//////////////////////////////////
|
|
25
|
+
|
|
26
|
+
var service = {};
|
|
27
|
+
|
|
28
|
+
///////////////////////////////////////////////
|
|
29
|
+
|
|
30
|
+
service.featureFlags = {
|
|
31
|
+
all: 1,
|
|
32
|
+
impersonation: 2,
|
|
33
|
+
products: 4,
|
|
34
|
+
checkin: 8,
|
|
35
|
+
events: 16,
|
|
36
|
+
ticketing: 32,
|
|
37
|
+
emails: 64,
|
|
38
|
+
sms: 128,
|
|
39
|
+
images: 256,
|
|
40
|
+
actions: 512,
|
|
41
|
+
timers: 1024,
|
|
42
|
+
listenertriggers: 2048,
|
|
43
|
+
builder: 4096,
|
|
44
|
+
scopes: 8192,
|
|
45
|
+
components: 16384,
|
|
46
|
+
video: 32768,
|
|
47
|
+
audio: 65536,
|
|
48
|
+
files: 131072,
|
|
49
|
+
developer: 262144,
|
|
50
|
+
notifications: 524288,
|
|
51
|
+
payments: 1048576,
|
|
52
|
+
comments: 2097152,
|
|
53
|
+
workflows: 4194304,
|
|
54
|
+
forms: 8388608,
|
|
55
|
+
};
|
|
56
|
+
|
|
57
|
+
service.featureIsIncludedInByteflag = function (byteflag, feature) {
|
|
58
|
+
return (
|
|
59
|
+
(byteflag & service.featureFlags[feature]) ===
|
|
60
|
+
service.featureFlags[feature]
|
|
61
|
+
);
|
|
62
|
+
};
|
|
63
|
+
|
|
64
|
+
///////////////////////////////////////////////
|
|
65
|
+
|
|
66
|
+
/**
|
|
67
|
+
* @alias access.hasFeature
|
|
68
|
+
* @description Checks if a user has a specific feature enabled for their organisation
|
|
69
|
+
* @param {Object} user The user to check
|
|
70
|
+
* @param {String} feature The feature to check is enabled/disabled
|
|
71
|
+
* @example
|
|
72
|
+
* const user = sdk.auth.getCurrentUser();
|
|
73
|
+
* const formsFeatureIsEnabled = sdk.access.hasFeature(user, 'forms');
|
|
74
|
+
*/
|
|
75
|
+
service.hasFeature = function (user, feature) {
|
|
76
|
+
const organisation = user?.organisation || {};
|
|
77
|
+
const features = organisation.features || {};
|
|
78
|
+
|
|
79
|
+
if (features.all) {
|
|
80
|
+
return true;
|
|
18
81
|
}
|
|
19
82
|
|
|
20
|
-
if (
|
|
21
|
-
|
|
83
|
+
if (features[feature]) {
|
|
84
|
+
return true;
|
|
22
85
|
}
|
|
23
86
|
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
var service = {};
|
|
27
|
-
|
|
28
|
-
///////////////////////////////////////////////
|
|
87
|
+
// Check the byteflag
|
|
88
|
+
const byteflag = organisation.ff;
|
|
29
89
|
|
|
30
|
-
service.
|
|
31
|
-
|
|
32
|
-
"impersonation": 2,
|
|
33
|
-
"products": 4,
|
|
34
|
-
"checkin": 8,
|
|
35
|
-
"events": 16,
|
|
36
|
-
"ticketing": 32,
|
|
37
|
-
"emails": 64,
|
|
38
|
-
"sms": 128,
|
|
39
|
-
"images": 256,
|
|
40
|
-
"actions": 512,
|
|
41
|
-
"timers": 1024,
|
|
42
|
-
"listenertriggers": 2048,
|
|
43
|
-
"builder": 4096,
|
|
44
|
-
"scopes": 8192,
|
|
45
|
-
"components": 16384,
|
|
46
|
-
"video": 32768,
|
|
47
|
-
"audio": 65536,
|
|
48
|
-
"files": 131072,
|
|
49
|
-
"developer": 262144,
|
|
50
|
-
"notifications": 524288,
|
|
51
|
-
"payments": 1048576,
|
|
52
|
-
"comments": 2097152,
|
|
53
|
-
"workflows": 4194304,
|
|
54
|
-
"forms": 8388608
|
|
90
|
+
if (service.featureIsIncludedInByteflag(byteflag, "all")) {
|
|
91
|
+
return true;
|
|
55
92
|
}
|
|
56
93
|
|
|
57
|
-
|
|
58
|
-
|
|
94
|
+
//Let us know if there are any permissions for this user
|
|
95
|
+
return service.featureIsIncludedInByteflag(byteflag, feature);
|
|
96
|
+
};
|
|
97
|
+
|
|
98
|
+
///////////////////////////////////////////////
|
|
99
|
+
|
|
100
|
+
/**
|
|
101
|
+
* @alias access.isAdministrator
|
|
102
|
+
* @description Check if a user object is an administrator
|
|
103
|
+
* @param {Object} user The user session to check
|
|
104
|
+
* @example
|
|
105
|
+
* const userIsAnAdministrator = sdk.access.isAdministrator({firstName:'Jeffrey', lastName:'Winger', ...});
|
|
106
|
+
*/
|
|
107
|
+
service.isAdministrator = function (user) {
|
|
108
|
+
return user && user?.userType == "administrator";
|
|
109
|
+
};
|
|
110
|
+
|
|
111
|
+
///////////////////////////////////////////////
|
|
112
|
+
|
|
113
|
+
/**
|
|
114
|
+
* @alias access.getAllDescendants
|
|
115
|
+
* @description Get all children of a specified scope
|
|
116
|
+
* @param {Object} scope A scope object with child scopes
|
|
117
|
+
* @example
|
|
118
|
+
* const childScopes = sdk.access.getAllDescendants({title:'Global', children:[{title:'Australia', ...}, {title:'New Zealand', ...}]});
|
|
119
|
+
*/
|
|
120
|
+
service.getAllDescendants = function (scope) {
|
|
121
|
+
//Start by including the scope id
|
|
122
|
+
var results = [];
|
|
123
|
+
|
|
124
|
+
addScope(scope);
|
|
125
|
+
|
|
126
|
+
function addScope(entry) {
|
|
127
|
+
//Add this scope to the results
|
|
128
|
+
var id = QikCore.utils.id(entry);
|
|
129
|
+
results.push(id);
|
|
130
|
+
|
|
131
|
+
(entry.children || []).forEach(function (child) {
|
|
132
|
+
addScope(child);
|
|
133
|
+
});
|
|
59
134
|
}
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
135
|
+
return results;
|
|
136
|
+
};
|
|
137
|
+
|
|
138
|
+
///////////////////////////////////////////////
|
|
139
|
+
|
|
140
|
+
/**
|
|
141
|
+
* @alias access.hashPermissions
|
|
142
|
+
* @description Get a lookup of all permissions a user has been granted
|
|
143
|
+
* @param {Object} user A user session object
|
|
144
|
+
* @example
|
|
145
|
+
* const permissions = sdk.access.hashPermissions({firstName:'Mighty', lastName:'Mouse', permissionSets:[...], ...});
|
|
146
|
+
*/
|
|
147
|
+
service.hashPermissions = function (user) {
|
|
148
|
+
var results = {};
|
|
149
|
+
|
|
150
|
+
for (var key in user?.permissions || {}) {
|
|
151
|
+
//Get the permission set
|
|
152
|
+
var permissionSet = user?.permissions[key];
|
|
153
|
+
|
|
154
|
+
//Get all Scope ids from the permission set
|
|
155
|
+
var allIDs = service.getAllDescendants(permissionSet);
|
|
156
|
+
|
|
157
|
+
//For each permission defined in the set
|
|
158
|
+
(permissionSet.permissions || []).forEach(function (permissionString) {
|
|
159
|
+
//Include the top scope
|
|
160
|
+
if (!results[permissionString]) {
|
|
161
|
+
results[permissionString] = [];
|
|
79
162
|
}
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
// Check the byteflag
|
|
86
|
-
const byteflag = organisation.ff;
|
|
87
|
-
|
|
88
|
-
if(service.featureIsIncludedInByteflag(byteflag, 'all')) {
|
|
89
|
-
return true;
|
|
90
|
-
}
|
|
91
|
-
|
|
92
|
-
//Let us know if there are any permissions for this user
|
|
93
|
-
return service.featureIsIncludedInByteflag(byteflag, feature)
|
|
163
|
+
results[permissionString] = [
|
|
164
|
+
...new Set(results[permissionString].concat(allIDs)),
|
|
165
|
+
];
|
|
166
|
+
});
|
|
94
167
|
}
|
|
95
168
|
|
|
96
169
|
///////////////////////////////////////////////
|
|
97
170
|
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
171
|
+
return results;
|
|
172
|
+
};
|
|
173
|
+
|
|
174
|
+
///////////////////////////////////////////////
|
|
175
|
+
|
|
176
|
+
/**
|
|
177
|
+
* @alias access.allUserScopes
|
|
178
|
+
* @description Return an array of ids of all scopes that a given user has been granted a permission in
|
|
179
|
+
* @param {Object} user A user session object
|
|
180
|
+
* @example
|
|
181
|
+
* const permissions = sdk.access.allUserScopes({firstName:'Mighty', lastName:'Mouse', permissionSets:[...], ...});
|
|
182
|
+
*
|
|
183
|
+
* // Would result in:
|
|
184
|
+
* ['61eca4746971e75c1fc670cf', '61eca4746971e75c1fc670ca', '77eca4746971e75c1fc670cf'],
|
|
185
|
+
*/
|
|
186
|
+
service.allUserScopes = function (user) {
|
|
187
|
+
var collected = {};
|
|
188
|
+
var permissions = user?.permissions || {};
|
|
189
|
+
|
|
190
|
+
////////////////////////
|
|
191
|
+
|
|
192
|
+
function pluckScope(scopeObject) {
|
|
193
|
+
if (!scopeObject) {
|
|
194
|
+
return;
|
|
195
|
+
}
|
|
196
|
+
|
|
197
|
+
var scopeID = QikCore.utils.id(scopeObject);
|
|
198
|
+
if (!scopeID) {
|
|
199
|
+
return;
|
|
200
|
+
}
|
|
201
|
+
|
|
202
|
+
//Add to the collection
|
|
203
|
+
collected[scopeID] = 1;
|
|
204
|
+
|
|
205
|
+
//If there are children, then recursively pluck the ids
|
|
206
|
+
if (scopeObject.children && scopeObject.children.length) {
|
|
207
|
+
scopeObject.children.forEach(function (scope) {
|
|
208
|
+
pluckScope(scope);
|
|
209
|
+
});
|
|
210
|
+
}
|
|
107
211
|
}
|
|
108
212
|
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
/**
|
|
112
|
-
* @alias access.getAllDescendants
|
|
113
|
-
* @description Get all children of a specified scope
|
|
114
|
-
* @param {Object} scope A scope object with child scopes
|
|
115
|
-
* @example
|
|
116
|
-
* const childScopes = sdk.access.getAllDescendants({title:'Global', children:[{title:'Australia', ...}, {title:'New Zealand', ...}]});
|
|
117
|
-
*/
|
|
118
|
-
service.getAllDescendants = function(scope) {
|
|
119
|
-
|
|
120
|
-
//Start by including the scope id
|
|
121
|
-
var results = [];
|
|
122
|
-
|
|
123
|
-
addScope(scope);
|
|
124
|
-
|
|
125
|
-
function addScope(entry) {
|
|
126
|
-
//Add this scope to the results
|
|
127
|
-
var id = QikCore.utils.id(entry);
|
|
128
|
-
results.push(id);
|
|
129
|
-
|
|
130
|
-
(entry.children || []).forEach(function(child) {
|
|
131
|
-
addScope(child);
|
|
132
|
-
})
|
|
133
|
-
}
|
|
134
|
-
return results;
|
|
135
|
-
|
|
213
|
+
////////////////////////
|
|
136
214
|
|
|
215
|
+
for (var scopeID in permissions) {
|
|
216
|
+
pluckScope(permissions[scopeID]);
|
|
137
217
|
}
|
|
138
218
|
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
219
|
+
////////////////////////
|
|
220
|
+
|
|
221
|
+
return Object.keys(collected);
|
|
222
|
+
};
|
|
223
|
+
|
|
224
|
+
///////////////////////////////////////////////
|
|
225
|
+
|
|
226
|
+
/**
|
|
227
|
+
* @alias access.actionableScopes
|
|
228
|
+
* @description Return an array of all scopes that a given user can perform a specified action in
|
|
229
|
+
* @param {Object} user A user session object
|
|
230
|
+
* @param {String} action The action
|
|
231
|
+
* @param {String} definition The defined type of item the action will be performed on
|
|
232
|
+
* @param {String} type The basic type of item the action will be performed on
|
|
233
|
+
* @param {Object} options Additional options and parameters
|
|
234
|
+
* @example
|
|
235
|
+
* const user = sdk.auth.getCurrentUser();
|
|
236
|
+
* const canCreateInScopes = sdk.access.actionableScopes(user, 'create', 'car', 'article');
|
|
237
|
+
* const canDeleteInScopes = sdk.access.actionableScopes(user, 'delete', 'profile');
|
|
238
|
+
*
|
|
239
|
+
* // Would result in something like:
|
|
240
|
+
* ['61eca4746971e75c1fc670cf', '61eca4746971e75c1fc670ca', '77eca4746971e75c1fc670cf'],
|
|
241
|
+
*/
|
|
242
|
+
service.actionableScopes = function (
|
|
243
|
+
user,
|
|
244
|
+
action,
|
|
245
|
+
definition,
|
|
246
|
+
type,
|
|
247
|
+
options,
|
|
248
|
+
) {
|
|
249
|
+
options = options || {};
|
|
250
|
+
|
|
251
|
+
/////////////////////////
|
|
252
|
+
|
|
253
|
+
var validScopes = [];
|
|
254
|
+
|
|
255
|
+
if (user?.userType == "administrator") {
|
|
256
|
+
validScopes = service.allUserScopes(user, options);
|
|
257
|
+
} else {
|
|
258
|
+
var permissionsLookup = service.hashPermissions(user);
|
|
259
|
+
|
|
260
|
+
var checkTypeName = definition || type;
|
|
261
|
+
if (!checkTypeName) {
|
|
262
|
+
return validScopes;
|
|
263
|
+
}
|
|
264
|
+
|
|
265
|
+
var stringKey = `${checkTypeName}.${action}`;
|
|
266
|
+
validScopes = permissionsLookup[stringKey];
|
|
174
267
|
}
|
|
175
268
|
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
var scopeID = QikCore.utils.id(scopeObject);
|
|
203
|
-
if (!scopeID) {
|
|
204
|
-
return;
|
|
205
|
-
}
|
|
206
|
-
|
|
207
|
-
//Add to the collection
|
|
208
|
-
collected[scopeID] = 1;
|
|
209
|
-
|
|
210
|
-
//If there are children, then recursively pluck the ids
|
|
211
|
-
if (scopeObject.children && scopeObject.children.length) {
|
|
212
|
-
scopeObject.children.forEach(function(scope) {
|
|
213
|
-
pluckScope(scope);
|
|
214
|
-
})
|
|
215
|
-
}
|
|
216
|
-
}
|
|
217
|
-
|
|
218
|
-
////////////////////////
|
|
219
|
-
|
|
220
|
-
for (var scopeID in permissions) {
|
|
221
|
-
pluckScope(permissions[scopeID]);
|
|
222
|
-
}
|
|
223
|
-
|
|
224
|
-
////////////////////////
|
|
225
|
-
|
|
226
|
-
return Object.keys(collected);
|
|
269
|
+
/////////////////////////
|
|
270
|
+
|
|
271
|
+
return validScopes || [];
|
|
272
|
+
};
|
|
273
|
+
|
|
274
|
+
///////////////////////////////////////////////
|
|
275
|
+
|
|
276
|
+
/**
|
|
277
|
+
* @alias access.isOwner
|
|
278
|
+
* @description Return whether or not a user is considered an Owner of a specified item
|
|
279
|
+
* @param {Object} user The user to check
|
|
280
|
+
* @param {Object} item The item
|
|
281
|
+
* @example
|
|
282
|
+
* const user = sdk.auth.getCurrentUser();
|
|
283
|
+
* const item = {title:'A piece of content', meta:{personaAuthor:'61eca4746971e75c1fc670ca'}, ...}
|
|
284
|
+
*
|
|
285
|
+
* // Returns true if the user owns the item
|
|
286
|
+
* const isTheOwner = sdk.access.isOwner(user, item);
|
|
287
|
+
*/
|
|
288
|
+
service.isOwner = function (user, item) {
|
|
289
|
+
var userID = QikCore.utils.id(user);
|
|
290
|
+
var personaID = QikCore.utils.id(user?.persona);
|
|
291
|
+
|
|
292
|
+
var metaObject = item.meta;
|
|
293
|
+
if (!metaObject) {
|
|
294
|
+
return false;
|
|
227
295
|
}
|
|
228
296
|
|
|
229
|
-
|
|
297
|
+
/////////////////////////////////////////////
|
|
230
298
|
|
|
231
|
-
|
|
232
|
-
* @alias access.actionableScopes
|
|
233
|
-
* @description Return an array of all scopes that a given user can perform a specified action in
|
|
234
|
-
* @param {Object} user A user session object
|
|
235
|
-
* @param {String} action The action
|
|
236
|
-
* @param {String} definition The defined type of item the action will be performed on
|
|
237
|
-
* @param {String} type The basic type of item the action will be performed on
|
|
238
|
-
* @param {Object} options Additional options and parameters
|
|
239
|
-
* @example
|
|
240
|
-
* const user = sdk.auth.getCurrentUser();
|
|
241
|
-
* const canCreateInScopes = sdk.access.actionableScopes(user, 'create', 'car', 'article');
|
|
242
|
-
* const canDeleteInScopes = sdk.access.actionableScopes(user, 'delete', 'profile');
|
|
243
|
-
*
|
|
244
|
-
* // Would result in something like:
|
|
245
|
-
* ['61eca4746971e75c1fc670cf', '61eca4746971e75c1fc670ca', '77eca4746971e75c1fc670cf'],
|
|
246
|
-
*/
|
|
247
|
-
service.actionableScopes = function(user, action, definition, type, options) {
|
|
248
|
-
options = options || {}
|
|
249
|
-
|
|
250
|
-
/////////////////////////
|
|
251
|
-
|
|
252
|
-
var validScopes = [];
|
|
253
|
-
|
|
254
|
-
if (user?.userType == 'administrator') {
|
|
255
|
-
validScopes = service.allUserScopes(user, options)
|
|
256
|
-
} else {
|
|
257
|
-
var permissionsLookup = service.hashPermissions(user);
|
|
258
|
-
|
|
259
|
-
var checkTypeName = definition || type;
|
|
260
|
-
if (!checkTypeName) {
|
|
261
|
-
return validScopes;
|
|
262
|
-
}
|
|
263
|
-
|
|
264
|
-
var stringKey = `${checkTypeName}.${action}`;
|
|
265
|
-
validScopes = permissionsLookup[stringKey]
|
|
266
|
-
}
|
|
299
|
+
var userOwners = metaObject.userOwners || [];
|
|
267
300
|
|
|
268
|
-
|
|
301
|
+
var users = QikCore.utils.ids([...userOwners, metaObject.userAuthor]);
|
|
302
|
+
var userHash = QikCore.utils.hash(users);
|
|
269
303
|
|
|
270
|
-
|
|
304
|
+
if (userHash[userID]) {
|
|
305
|
+
return true;
|
|
271
306
|
}
|
|
272
307
|
|
|
308
|
+
/////////////////////////////////////////////
|
|
273
309
|
|
|
274
|
-
|
|
310
|
+
var personaOwners = metaObject.personaOwners || [];
|
|
275
311
|
|
|
276
|
-
|
|
277
|
-
|
|
278
|
-
|
|
279
|
-
|
|
280
|
-
|
|
281
|
-
* @example
|
|
282
|
-
* const user = sdk.auth.getCurrentUser();
|
|
283
|
-
* const item = {title:'A piece of content', meta:{personaAuthor:'61eca4746971e75c1fc670ca'}, ...}
|
|
284
|
-
*
|
|
285
|
-
* // Returns true if the user owns the item
|
|
286
|
-
* const isTheOwner = sdk.access.isOwner(user, item);
|
|
287
|
-
*/
|
|
288
|
-
service.isOwner = function(user, item) {
|
|
289
|
-
var userID = QikCore.utils.id(user);
|
|
290
|
-
var personaID = QikCore.utils.id(user?.persona);
|
|
291
|
-
|
|
292
|
-
|
|
293
|
-
var metaObject = item.meta;
|
|
294
|
-
if (!metaObject) {
|
|
295
|
-
return false;
|
|
296
|
-
}
|
|
297
|
-
|
|
298
|
-
/////////////////////////////////////////////
|
|
299
|
-
|
|
300
|
-
var userOwners = metaObject.userOwners || [];
|
|
301
|
-
|
|
302
|
-
var users = QikCore.utils.ids([...userOwners, metaObject.userAuthor]);
|
|
303
|
-
var userHash = QikCore.utils.hash(users);
|
|
304
|
-
|
|
305
|
-
if (userHash[userID]) {
|
|
306
|
-
return true;
|
|
307
|
-
}
|
|
308
|
-
|
|
309
|
-
/////////////////////////////////////////////
|
|
310
|
-
|
|
311
|
-
var personaOwners = metaObject.personaOwners || [];
|
|
312
|
-
|
|
313
|
-
var personas = QikCore.utils.ids([...personaOwners, metaObject.personaAuthor]);
|
|
314
|
-
var personaHash = QikCore.utils.hash(personas);
|
|
315
|
-
// console.log('PERSONAS', personas, personaHash, '-', metaObject.personaAuthor, metaObject.personaOwners)
|
|
316
|
-
|
|
317
|
-
if (personaHash[personaID]) {
|
|
318
|
-
return true;
|
|
319
|
-
}
|
|
312
|
+
var personas = QikCore.utils.ids([
|
|
313
|
+
...personaOwners,
|
|
314
|
+
metaObject.personaAuthor,
|
|
315
|
+
]);
|
|
316
|
+
var personaHash = QikCore.utils.hash(personas);
|
|
320
317
|
|
|
318
|
+
if (personaHash[personaID]) {
|
|
319
|
+
return true;
|
|
321
320
|
}
|
|
322
321
|
|
|
323
|
-
|
|
324
|
-
|
|
325
|
-
|
|
326
|
-
|
|
327
|
-
|
|
328
|
-
|
|
329
|
-
|
|
330
|
-
|
|
331
|
-
|
|
332
|
-
|
|
333
|
-
|
|
334
|
-
|
|
335
|
-
|
|
336
|
-
|
|
337
|
-
|
|
338
|
-
|
|
339
|
-
|
|
340
|
-
|
|
341
|
-
|
|
342
|
-
|
|
343
|
-
.flat();
|
|
344
|
-
|
|
345
|
-
return allPermissions;
|
|
322
|
+
return service.isAssignee(user, item);
|
|
323
|
+
};
|
|
324
|
+
|
|
325
|
+
/**
|
|
326
|
+
* @alias access.isAssignee
|
|
327
|
+
* @description Return whether or not a user is an assignee of a specified item
|
|
328
|
+
* @param {Object} user The user to check
|
|
329
|
+
* @param {Object} item The item
|
|
330
|
+
* @example
|
|
331
|
+
* const user = sdk.auth.getCurrentUser();
|
|
332
|
+
* const item = {title:'A workflow card', assignees:['61eca4746971e75c1fc670ca'], ...}
|
|
333
|
+
*
|
|
334
|
+
* // Returns true if the user owns the item
|
|
335
|
+
* const isAssignee = sdk.access.isAssignee(user, item);
|
|
336
|
+
*/
|
|
337
|
+
service.isAssignee = function (user, contentItem) {
|
|
338
|
+
// Check the user profile ids
|
|
339
|
+
const profileIDs = QikCore.utils.ids(user.profiles);
|
|
340
|
+
if (!profileIDs.length) {
|
|
341
|
+
return false;
|
|
346
342
|
}
|
|
347
343
|
|
|
348
|
-
|
|
349
|
-
|
|
350
|
-
/**
|
|
351
|
-
* @alias access.allPermissionTypes
|
|
352
|
-
* @description Returns an array of content types a given user has permission to interact with
|
|
353
|
-
* @param {Object} user The user to check
|
|
354
|
-
* @param {Boolean} asHash Whether to retrieve the result as a keyed object hash, by default
|
|
355
|
-
* the response will be an array
|
|
356
|
-
* @example
|
|
357
|
-
* const user = sdk.auth.getCurrentUser();
|
|
358
|
-
*
|
|
359
|
-
* // Returns ['image', 'testimonial']
|
|
360
|
-
* const types = sdk.access.allPermissionTypes(user);
|
|
361
|
-
*
|
|
362
|
-
* // Returns {image:true, testimonial:true}
|
|
363
|
-
* const types = sdk.access.allPermissionTypes(user, true);
|
|
364
|
-
*/
|
|
365
|
-
service.allPermissionTypes = function(user, asHash) {
|
|
366
|
-
if (asHash) {
|
|
367
|
-
return service.allPermissions(user).reduce(function(set, string) {
|
|
368
|
-
var type = string.split('.')[0];
|
|
369
|
-
set[type] = true;
|
|
370
|
-
return set;
|
|
371
|
-
}, {});
|
|
372
|
-
} else {
|
|
373
|
-
return service.allPermissions(user).map(function(string) {
|
|
374
|
-
return string.split('.')[0];
|
|
375
|
-
});
|
|
376
|
-
}
|
|
344
|
+
// Check if the content item has assignees set
|
|
345
|
+
const assigneeIDs = QikCore.utils.ids(contentItem.assignees);
|
|
377
346
|
|
|
347
|
+
if (!assigneeIDs.length) {
|
|
348
|
+
return false;
|
|
378
349
|
}
|
|
379
350
|
|
|
380
|
-
|
|
381
|
-
|
|
382
|
-
|
|
383
|
-
|
|
384
|
-
|
|
385
|
-
|
|
386
|
-
|
|
387
|
-
|
|
388
|
-
|
|
389
|
-
|
|
390
|
-
|
|
391
|
-
|
|
392
|
-
|
|
393
|
-
|
|
394
|
-
|
|
395
|
-
|
|
396
|
-
|
|
397
|
-
|
|
398
|
-
|
|
399
|
-
|
|
351
|
+
// Return the intersection of assignees and profile ids
|
|
352
|
+
const set = new Set(assigneeIDs);
|
|
353
|
+
const matches = profileIDs.filter((item) => set.has(item));
|
|
354
|
+
const isAssignee = !!matches.length;
|
|
355
|
+
|
|
356
|
+
return isAssignee;
|
|
357
|
+
};
|
|
358
|
+
|
|
359
|
+
///////////////////////////////////////////////
|
|
360
|
+
|
|
361
|
+
/**
|
|
362
|
+
* @alias access.allPermissions
|
|
363
|
+
* @description Returns an array of all permissions a given user has access to
|
|
364
|
+
* @param {Object} user The user to check
|
|
365
|
+
* @example
|
|
366
|
+
* const user = sdk.auth.getCurrentUser();
|
|
367
|
+
* const permissions = sdk.access.allPermissions(user);
|
|
368
|
+
*
|
|
369
|
+
* // Returns
|
|
370
|
+
* ['image.viewany', 'testimonial.viewany', 'testimonial.viewfield.title', ...]
|
|
371
|
+
*/
|
|
372
|
+
service.allPermissions = function (user) {
|
|
373
|
+
var allPermissions = Object.values(user?.permissions)
|
|
374
|
+
.map(function (permissionScope) {
|
|
375
|
+
return permissionScope.permissions;
|
|
376
|
+
})
|
|
377
|
+
.flat();
|
|
378
|
+
|
|
379
|
+
return allPermissions;
|
|
380
|
+
};
|
|
381
|
+
|
|
382
|
+
///////////////////////////////////////////////
|
|
383
|
+
|
|
384
|
+
/**
|
|
385
|
+
* @alias access.allPermissionTypes
|
|
386
|
+
* @description Returns an array of content types a given user has permission to interact with
|
|
387
|
+
* @param {Object} user The user to check
|
|
388
|
+
* @param {Boolean} asHash Whether to retrieve the result as a keyed object hash, by default
|
|
389
|
+
* the response will be an array
|
|
390
|
+
* @example
|
|
391
|
+
* const user = sdk.auth.getCurrentUser();
|
|
392
|
+
*
|
|
393
|
+
* // Returns ['image', 'testimonial']
|
|
394
|
+
* const types = sdk.access.allPermissionTypes(user);
|
|
395
|
+
*
|
|
396
|
+
* // Returns {image:true, testimonial:true}
|
|
397
|
+
* const types = sdk.access.allPermissionTypes(user, true);
|
|
398
|
+
*/
|
|
399
|
+
service.allPermissionTypes = function (user, asHash) {
|
|
400
|
+
if (asHash) {
|
|
401
|
+
return service.allPermissions(user).reduce(function (set, string) {
|
|
402
|
+
var type = string.split(".")[0];
|
|
403
|
+
set[type] = true;
|
|
404
|
+
return set;
|
|
405
|
+
}, {});
|
|
406
|
+
} else {
|
|
407
|
+
return service.allPermissions(user).map(function (string) {
|
|
408
|
+
return string.split(".")[0];
|
|
409
|
+
});
|
|
410
|
+
}
|
|
411
|
+
};
|
|
412
|
+
|
|
413
|
+
///////////////////////////////////////////////
|
|
414
|
+
|
|
415
|
+
/**
|
|
416
|
+
* @alias access.canKnowOf
|
|
417
|
+
* @description Checks if a user has any permissions relating to a specified type of content
|
|
418
|
+
* @param {Object} user The user to check
|
|
419
|
+
* @param {String} typeKey The type or definition to check
|
|
420
|
+
* @param {Object} options Additional options and parameters
|
|
421
|
+
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
422
|
+
* @example
|
|
423
|
+
* const user = sdk.auth.getCurrentUser();
|
|
424
|
+
* const canAccessImageSection = sdk.access.canKnowOf(user, 'image');
|
|
425
|
+
* const canAccessCustomerUploadSection = sdk.access.canKnowOf(user, 'customerUpload');
|
|
426
|
+
*/
|
|
427
|
+
service.canKnowOf = function (user, typeKey, options) {
|
|
428
|
+
options = options || {};
|
|
429
|
+
options.cache = options.cache || {};
|
|
430
|
+
|
|
431
|
+
//Let us know if there are any permissions for this user
|
|
432
|
+
return service.allPermissionTypes(user, true)[typeKey];
|
|
433
|
+
};
|
|
434
|
+
|
|
435
|
+
///////////////////////////////////////////////
|
|
436
|
+
|
|
437
|
+
/**
|
|
438
|
+
* @alias access.checkActionAccess
|
|
439
|
+
* @description Helpful function for checking whether a given user has access to do a given action on a specified item
|
|
440
|
+
* @param {Object} user The user to check
|
|
441
|
+
* @param {Object} item The item to check
|
|
442
|
+
* @param {String} ANY_ACTION The 'any' action to check
|
|
443
|
+
* @param {String} OWN_ACTION The 'owned' action to check
|
|
444
|
+
* @param {Object} options Additional options and parameters
|
|
445
|
+
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
446
|
+
* @example
|
|
447
|
+
* const user = sdk.auth.getCurrentUser();
|
|
448
|
+
* const canEditItem = sdk.access.checkActionAccess(user, {_id:'61eca4746971e75c1fc670ca', meta:{...}}, 'editany', 'editown');
|
|
449
|
+
* const canViewItem = sdk.access.checkActionAccess(user, {_id:'61eca4746971e75c1fc670ca', meta:{...}}, 'viewany', 'viewown');
|
|
450
|
+
*
|
|
451
|
+
* // Example of looping through a large array of items
|
|
452
|
+
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
453
|
+
*
|
|
454
|
+
* // Create an in memory cache object outside of the loop
|
|
455
|
+
* const cache = {}
|
|
456
|
+
*
|
|
457
|
+
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
458
|
+
* return sdk.access.checkActionAccess(user, item, 'editany', 'editown', {cache});
|
|
459
|
+
* })
|
|
460
|
+
*/
|
|
461
|
+
service.checkActionAccess = function (
|
|
462
|
+
user,
|
|
463
|
+
item,
|
|
464
|
+
ANY_ACTION,
|
|
465
|
+
OWN_ACTION,
|
|
466
|
+
options,
|
|
467
|
+
) {
|
|
468
|
+
options = options || {};
|
|
469
|
+
options.cache = options.cache || {};
|
|
470
|
+
|
|
471
|
+
//Allow everything if we're a super user
|
|
472
|
+
if (service.isAdministrator(user)) {
|
|
473
|
+
return true;
|
|
400
474
|
}
|
|
401
475
|
|
|
476
|
+
//////////////////////////////////
|
|
402
477
|
|
|
403
|
-
|
|
404
|
-
|
|
405
|
-
/**
|
|
406
|
-
* @alias access.checkActionAccess
|
|
407
|
-
* @description Helpful function for checking whether a given user has access to do a given action on a specified item
|
|
408
|
-
* @param {Object} user The user to check
|
|
409
|
-
* @param {Object} item The item to check
|
|
410
|
-
* @param {String} ANY_ACTION The 'any' action to check
|
|
411
|
-
* @param {String} OWN_ACTION The 'owned' action to check
|
|
412
|
-
* @param {Object} options Additional options and parameters
|
|
413
|
-
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
414
|
-
* @example
|
|
415
|
-
* const user = sdk.auth.getCurrentUser();
|
|
416
|
-
* const canEditItem = sdk.access.checkActionAccess(user, {_id:'61eca4746971e75c1fc670ca', meta:{...}}, 'editany', 'editown');
|
|
417
|
-
* const canViewItem = sdk.access.checkActionAccess(user, {_id:'61eca4746971e75c1fc670ca', meta:{...}}, 'viewany', 'viewown');
|
|
418
|
-
*
|
|
419
|
-
* // Example of looping through a large array of items
|
|
420
|
-
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
421
|
-
*
|
|
422
|
-
* // Create an in memory cache object outside of the loop
|
|
423
|
-
* const cache = {}
|
|
424
|
-
*
|
|
425
|
-
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
426
|
-
* return sdk.access.checkActionAccess(user, item, 'editany', 'editown', {cache});
|
|
427
|
-
* })
|
|
428
|
-
*/
|
|
429
|
-
service.checkActionAccess = function(user, item, ANY_ACTION, OWN_ACTION, options) {
|
|
430
|
-
|
|
431
|
-
options = options || {};
|
|
432
|
-
options.cache = options.cache || {};
|
|
433
|
-
|
|
434
|
-
//Allow everything if we're a super user
|
|
435
|
-
if (service.isAdministrator(user)) {
|
|
436
|
-
return true;
|
|
437
|
-
}
|
|
438
|
-
|
|
439
|
-
//////////////////////////////////
|
|
440
|
-
|
|
441
|
-
var type = item.meta.type;
|
|
442
|
-
var definition = item.meta.definition || type;
|
|
443
|
-
|
|
444
|
-
//////////////////////////////////
|
|
445
|
-
|
|
446
|
-
var itemScopes = item.meta.scopes || [];
|
|
447
|
-
|
|
448
|
-
//////////////////////////////////
|
|
449
|
-
|
|
450
|
-
var actionAnyScopesHash;
|
|
451
|
-
var anyCacheKey = `access-${user?.cacheKey}-${ANY_ACTION}-${definition}-${type}`
|
|
452
|
-
|
|
453
|
-
if (options.cache[anyCacheKey]) {
|
|
454
|
-
actionAnyScopesHash = options.cache[anyCacheKey];
|
|
478
|
+
var type = item.meta?.type;
|
|
479
|
+
var definition = item.meta?.definition || type;
|
|
455
480
|
|
|
456
|
-
|
|
457
|
-
|
|
458
|
-
|
|
481
|
+
if (!definition) {
|
|
482
|
+
return false;
|
|
483
|
+
}
|
|
459
484
|
|
|
460
|
-
|
|
461
|
-
actionAnyScopesHash = QikCore.utils.hash(actionAnyScopes);
|
|
462
|
-
options.cache[anyCacheKey] = actionAnyScopesHash;
|
|
463
|
-
}
|
|
485
|
+
//////////////////////////////////
|
|
464
486
|
|
|
465
|
-
|
|
487
|
+
var itemScopes = QikCore.utils.ids(item.meta.scopes || []);
|
|
466
488
|
|
|
467
|
-
|
|
468
|
-
if (actionAnyScopesHash) {
|
|
469
|
-
//Check if the item is in any of the scopes the user can access
|
|
470
|
-
var isInAnyScopes = itemScopes.some(function(scopeID) {
|
|
471
|
-
return actionAnyScopesHash[scopeID];
|
|
472
|
-
})
|
|
489
|
+
//////////////////////////////////
|
|
473
490
|
|
|
474
|
-
|
|
475
|
-
|
|
476
|
-
}
|
|
477
|
-
}
|
|
491
|
+
var actionAnyScopesHash;
|
|
492
|
+
var anyCacheKey = `access-${user?.cacheKey}-${ANY_ACTION}-${definition}-${type}`;
|
|
478
493
|
|
|
479
|
-
|
|
480
|
-
|
|
481
|
-
|
|
482
|
-
|
|
483
|
-
|
|
484
|
-
|
|
485
|
-
|
|
486
|
-
var actionOwnScopesHash;
|
|
487
|
-
var ownCacheKey = `access-${user?.cacheKey}-${OWN_ACTION}-${definition}-${type}`
|
|
488
|
-
|
|
489
|
-
if (options.cache[ownCacheKey]) {
|
|
490
|
-
actionOwnScopesHash = options.cache[ownCacheKey];
|
|
491
|
-
} else {
|
|
492
|
-
|
|
493
|
-
//Check if we can view this type of thing in any scopes
|
|
494
|
-
var actionOwnScopes = service.actionableScopes(user, OWN_ACTION, definition, type, options);
|
|
495
|
-
//Get a fash hash of the scopes
|
|
496
|
-
actionOwnScopesHash = QikCore.utils.hash(actionOwnScopes);
|
|
497
|
-
options.cache[ownCacheKey] = actionOwnScopesHash;
|
|
498
|
-
}
|
|
499
|
-
|
|
500
|
-
//If we have data about what they can do
|
|
501
|
-
if (actionOwnScopesHash) {
|
|
502
|
-
//Check if the item is in any of the scopes the user can access
|
|
503
|
-
var isInOwnScopes = itemScopes.some(function(scopeID) {
|
|
504
|
-
return actionOwnScopesHash[scopeID];
|
|
505
|
-
})
|
|
506
|
-
|
|
507
|
-
if (isInOwnScopes) {
|
|
508
|
-
return true;
|
|
509
|
-
}
|
|
510
|
-
}
|
|
511
|
-
}
|
|
494
|
+
if (options.cache[anyCacheKey]) {
|
|
495
|
+
actionAnyScopesHash = options.cache[anyCacheKey];
|
|
496
|
+
} else {
|
|
497
|
+
//Check if we can view this type of thing in any scopes
|
|
498
|
+
var actionAnyScopes = QikCore.utils.ids(
|
|
499
|
+
service.actionableScopes(user, ANY_ACTION, definition, type, options),
|
|
500
|
+
);
|
|
512
501
|
|
|
513
|
-
|
|
502
|
+
//Get a fash hash of the scopes
|
|
503
|
+
actionAnyScopesHash = QikCore.utils.hash(actionAnyScopes);
|
|
514
504
|
|
|
515
|
-
|
|
516
|
-
return false
|
|
505
|
+
options.cache[anyCacheKey] = actionAnyScopesHash;
|
|
517
506
|
}
|
|
518
507
|
|
|
508
|
+
//////////////////////////////////
|
|
519
509
|
|
|
520
|
-
|
|
521
|
-
|
|
522
|
-
|
|
523
|
-
|
|
524
|
-
|
|
525
|
-
|
|
526
|
-
* @param {String} permission The permission the user may have been granted
|
|
527
|
-
* @example
|
|
528
|
-
* const user = sdk.auth.getCurrentUser();
|
|
529
|
-
* const isAllowedToCreateItems = sdk.access.has(user, 'video.create');
|
|
530
|
-
*/
|
|
531
|
-
service.has = function(user, permission) {
|
|
532
|
-
|
|
533
|
-
//Allow everything if we're a super user
|
|
534
|
-
if (service.isAdministrator(user)) {
|
|
535
|
-
return true;
|
|
536
|
-
}
|
|
510
|
+
//If we have data about what they can do
|
|
511
|
+
if (actionAnyScopesHash) {
|
|
512
|
+
//Check if the item is in any of the scopes the user can access
|
|
513
|
+
var isInAnyScopes = itemScopes.some(function (scopeID) {
|
|
514
|
+
return actionAnyScopesHash[scopeID];
|
|
515
|
+
});
|
|
537
516
|
|
|
538
|
-
|
|
539
|
-
return
|
|
517
|
+
if (isInAnyScopes) {
|
|
518
|
+
return true;
|
|
519
|
+
}
|
|
540
520
|
}
|
|
541
521
|
|
|
522
|
+
//////////////////////////////////
|
|
542
523
|
|
|
543
|
-
|
|
544
|
-
|
|
545
|
-
|
|
546
|
-
|
|
547
|
-
|
|
548
|
-
|
|
549
|
-
|
|
550
|
-
|
|
551
|
-
|
|
552
|
-
|
|
553
|
-
|
|
554
|
-
|
|
555
|
-
|
|
556
|
-
|
|
557
|
-
|
|
558
|
-
|
|
559
|
-
|
|
560
|
-
options.cache =
|
|
561
|
-
|
|
562
|
-
|
|
563
|
-
|
|
564
|
-
|
|
565
|
-
|
|
524
|
+
//Check if the user owns this content
|
|
525
|
+
var isOwner = service.isOwner(user, item);
|
|
526
|
+
|
|
527
|
+
//If the user is the owner
|
|
528
|
+
if (isOwner) {
|
|
529
|
+
var actionOwnScopesHash;
|
|
530
|
+
var ownCacheKey = `access-${user?.cacheKey}-${OWN_ACTION}-${definition}-${type}`;
|
|
531
|
+
|
|
532
|
+
if (options.cache[ownCacheKey]) {
|
|
533
|
+
actionOwnScopesHash = options.cache[ownCacheKey];
|
|
534
|
+
} else {
|
|
535
|
+
//Check if we can view this type of thing in any scopes
|
|
536
|
+
var actionOwnScopes = QikCore.utils.ids(
|
|
537
|
+
service.actionableScopes(user, OWN_ACTION, definition, type, options),
|
|
538
|
+
);
|
|
539
|
+
//Get a fash hash of the scopes
|
|
540
|
+
actionOwnScopesHash = QikCore.utils.hash(actionOwnScopes);
|
|
541
|
+
options.cache[ownCacheKey] = actionOwnScopesHash;
|
|
542
|
+
}
|
|
543
|
+
|
|
544
|
+
//If we have data about what they can do
|
|
545
|
+
if (actionOwnScopesHash) {
|
|
546
|
+
//Check if the item is in any of the scopes the user can access
|
|
547
|
+
var isInOwnScopes = itemScopes.some(function (scopeID) {
|
|
548
|
+
return actionOwnScopesHash[scopeID];
|
|
549
|
+
});
|
|
550
|
+
|
|
551
|
+
if (isInOwnScopes) {
|
|
552
|
+
return true;
|
|
566
553
|
}
|
|
567
|
-
|
|
568
|
-
var createableScopes = service.actionableScopes(user, 'create', definition, type);
|
|
569
|
-
return createableScopes.length
|
|
554
|
+
}
|
|
570
555
|
}
|
|
571
556
|
|
|
572
|
-
|
|
573
|
-
|
|
574
|
-
/**
|
|
575
|
-
* @alias access.canListItem
|
|
576
|
-
* @description Helpful function for checking whether a given user can list a specified item
|
|
577
|
-
* @param {Object} user The user to check
|
|
578
|
-
* @param {Object} item The item to check
|
|
579
|
-
* @param {Object} options Additional options and parameters
|
|
580
|
-
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
581
|
-
* @example
|
|
582
|
-
* const user = sdk.auth.getCurrentUser();
|
|
583
|
-
*
|
|
584
|
-
* // Example of looping through a large array of items
|
|
585
|
-
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
586
|
-
*
|
|
587
|
-
* // Create an in memory cache object outside of the loop
|
|
588
|
-
* const cache = {}
|
|
589
|
-
*
|
|
590
|
-
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
591
|
-
* return sdk.access.canListItem(user, item, {cache});
|
|
592
|
-
* })
|
|
593
|
-
*/
|
|
594
|
-
service.canListItem = function(user, item, options) {
|
|
595
|
-
options = options || {};
|
|
596
|
-
options.cache = options.cache || {}
|
|
597
|
-
|
|
598
|
-
|
|
599
|
-
//Check if we can list the item
|
|
600
|
-
var canList = service.checkActionAccess(user, item, 'listany', 'listown', options);
|
|
601
|
-
|
|
602
|
-
|
|
603
|
-
if (canList) {
|
|
604
|
-
return true;
|
|
605
|
-
}
|
|
606
|
-
|
|
607
|
-
//If we can view the item then we should be able to list it also
|
|
608
|
-
var canView = service.canViewItem(user, item, options);
|
|
609
|
-
if (canView) {
|
|
610
|
-
return true;
|
|
611
|
-
}
|
|
612
|
-
|
|
613
|
-
return false;
|
|
557
|
+
//////////////////////////////////
|
|
614
558
|
|
|
559
|
+
//No access by default
|
|
560
|
+
return false;
|
|
561
|
+
};
|
|
562
|
+
|
|
563
|
+
///////////////////////////////////////////////
|
|
564
|
+
|
|
565
|
+
/**
|
|
566
|
+
* @alias access.has
|
|
567
|
+
* @description Helpful function for checking whether a given user has a specified permission
|
|
568
|
+
* @param {Object} user The user to check
|
|
569
|
+
* @param {String} permission The permission the user may have been granted
|
|
570
|
+
* @example
|
|
571
|
+
* const user = sdk.auth.getCurrentUser();
|
|
572
|
+
* const isAllowedToCreateItems = sdk.access.has(user, 'video.create');
|
|
573
|
+
*/
|
|
574
|
+
service.has = function (user, permission) {
|
|
575
|
+
//Allow everything if we're a super user
|
|
576
|
+
if (service.isAdministrator(user)) {
|
|
577
|
+
return true;
|
|
615
578
|
}
|
|
616
579
|
|
|
617
|
-
|
|
618
|
-
|
|
619
|
-
|
|
620
|
-
|
|
621
|
-
|
|
622
|
-
|
|
623
|
-
|
|
624
|
-
|
|
625
|
-
|
|
626
|
-
|
|
627
|
-
|
|
628
|
-
|
|
629
|
-
|
|
630
|
-
|
|
631
|
-
|
|
632
|
-
|
|
633
|
-
|
|
634
|
-
|
|
635
|
-
|
|
636
|
-
|
|
637
|
-
|
|
638
|
-
|
|
639
|
-
|
|
640
|
-
service.
|
|
641
|
-
|
|
642
|
-
options = options || {}
|
|
643
|
-
options.cache = options.cache || {}
|
|
644
|
-
|
|
645
|
-
|
|
646
|
-
|
|
647
|
-
//Check if we can view the item
|
|
648
|
-
var canView = service.checkActionAccess(user, item, 'viewany', 'viewOwn', options);
|
|
649
|
-
if (canView) {
|
|
650
|
-
return true;
|
|
651
|
-
}
|
|
652
|
-
|
|
653
|
-
//If we can edit the item then we should be able to view it also
|
|
654
|
-
var canEdit = service.canEditItem(user, item, options);
|
|
655
|
-
if (canEdit) {
|
|
656
|
-
return true;
|
|
657
|
-
}
|
|
658
|
-
|
|
659
|
-
return false;
|
|
580
|
+
var permissionsLookup = service.hashPermissions(user);
|
|
581
|
+
return permissionsLookup[permission];
|
|
582
|
+
};
|
|
583
|
+
|
|
584
|
+
///////////////////////////////////////////////
|
|
585
|
+
|
|
586
|
+
/**
|
|
587
|
+
* @alias access.canCreate
|
|
588
|
+
* @description Helpful function for checking whether a given user can create a specified type of item
|
|
589
|
+
* @param {Object} user The user to check
|
|
590
|
+
* @param {String} definition The defined type key
|
|
591
|
+
* @param {String} type The basic type key
|
|
592
|
+
* @param {Object} options Additional options and parameters
|
|
593
|
+
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
594
|
+
* @example
|
|
595
|
+
* const user = sdk.auth.getCurrentUser();
|
|
596
|
+
* const userCanCreateShortFilms = sdk.access.canCreate(user, 'shortFilm', 'video');
|
|
597
|
+
*/
|
|
598
|
+
service.canCreate = function (user, definition, type, options) {
|
|
599
|
+
options = options || {};
|
|
600
|
+
options.cache = options.cache || {};
|
|
601
|
+
|
|
602
|
+
//Allow everything if we're a super user
|
|
603
|
+
if (service.isAdministrator(user)) {
|
|
604
|
+
return true;
|
|
660
605
|
}
|
|
661
606
|
|
|
662
|
-
|
|
663
|
-
|
|
664
|
-
|
|
665
|
-
|
|
666
|
-
|
|
667
|
-
|
|
668
|
-
|
|
669
|
-
|
|
670
|
-
|
|
671
|
-
|
|
672
|
-
|
|
673
|
-
|
|
674
|
-
|
|
675
|
-
|
|
676
|
-
|
|
677
|
-
|
|
678
|
-
|
|
679
|
-
|
|
680
|
-
|
|
681
|
-
|
|
682
|
-
|
|
683
|
-
|
|
684
|
-
|
|
685
|
-
|
|
686
|
-
|
|
687
|
-
|
|
688
|
-
|
|
689
|
-
|
|
690
|
-
|
|
607
|
+
var createableScopes = service.actionableScopes(
|
|
608
|
+
user,
|
|
609
|
+
"create",
|
|
610
|
+
definition,
|
|
611
|
+
type,
|
|
612
|
+
);
|
|
613
|
+
return createableScopes.length;
|
|
614
|
+
};
|
|
615
|
+
|
|
616
|
+
///////////////////////////////////////////////
|
|
617
|
+
|
|
618
|
+
/**
|
|
619
|
+
* @alias access.canListItem
|
|
620
|
+
* @description Helpful function for checking whether a given user can list a specified item
|
|
621
|
+
* @param {Object} user The user to check
|
|
622
|
+
* @param {Object} item The item to check
|
|
623
|
+
* @param {Object} options Additional options and parameters
|
|
624
|
+
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
625
|
+
* @example
|
|
626
|
+
* const user = sdk.auth.getCurrentUser();
|
|
627
|
+
*
|
|
628
|
+
* // Example of looping through a large array of items
|
|
629
|
+
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
630
|
+
*
|
|
631
|
+
* // Create an in memory cache object outside of the loop
|
|
632
|
+
* const cache = {}
|
|
633
|
+
*
|
|
634
|
+
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
635
|
+
* return sdk.access.canListItem(user, item, {cache});
|
|
636
|
+
* })
|
|
637
|
+
*/
|
|
638
|
+
service.canListItem = function (user, item, options) {
|
|
639
|
+
options = options || {};
|
|
640
|
+
options.cache = options.cache || {};
|
|
641
|
+
|
|
642
|
+
//Check if we can list the item
|
|
643
|
+
var canList = service.checkActionAccess(
|
|
644
|
+
user,
|
|
645
|
+
item,
|
|
646
|
+
"listany",
|
|
647
|
+
"listown",
|
|
648
|
+
options,
|
|
649
|
+
);
|
|
650
|
+
|
|
651
|
+
if (canList) {
|
|
652
|
+
return true;
|
|
691
653
|
}
|
|
692
654
|
|
|
693
|
-
|
|
694
|
-
|
|
695
|
-
|
|
696
|
-
|
|
697
|
-
* @description Helpful function for checking whether a given user can delete a specified item
|
|
698
|
-
* @param {Object} user The user to check
|
|
699
|
-
* @param {Object} item The item to check
|
|
700
|
-
* @param {Object} options Additional options and parameters
|
|
701
|
-
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
702
|
-
* @example
|
|
703
|
-
* const user = sdk.auth.getCurrentUser();
|
|
704
|
-
*
|
|
705
|
-
* // Example of looping through a large array of items
|
|
706
|
-
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
707
|
-
*
|
|
708
|
-
* // Create an in memory cache object outside of the loop
|
|
709
|
-
* const cache = {}
|
|
710
|
-
*
|
|
711
|
-
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
712
|
-
* return sdk.access.canDeleteItem(user, item, {cache});
|
|
713
|
-
* })
|
|
714
|
-
*/
|
|
715
|
-
service.canDeleteItem = function(user, item, options) {
|
|
716
|
-
options = options || {}
|
|
717
|
-
options.cache = options.cache || {}
|
|
718
|
-
|
|
719
|
-
return service.checkActionAccess(user, item, 'deleteany', 'deleteown', options);
|
|
655
|
+
//If we can view the item then we should be able to list it also
|
|
656
|
+
var canView = service.canViewItem(user, item, options);
|
|
657
|
+
if (canView) {
|
|
658
|
+
return true;
|
|
720
659
|
}
|
|
721
660
|
|
|
722
|
-
|
|
723
|
-
|
|
724
|
-
|
|
725
|
-
|
|
726
|
-
|
|
727
|
-
|
|
728
|
-
|
|
729
|
-
|
|
730
|
-
|
|
731
|
-
|
|
732
|
-
|
|
733
|
-
|
|
734
|
-
|
|
735
|
-
|
|
736
|
-
|
|
737
|
-
|
|
738
|
-
|
|
739
|
-
|
|
740
|
-
|
|
741
|
-
|
|
742
|
-
|
|
743
|
-
|
|
744
|
-
|
|
745
|
-
|
|
746
|
-
|
|
747
|
-
|
|
748
|
-
|
|
661
|
+
return false;
|
|
662
|
+
};
|
|
663
|
+
|
|
664
|
+
///////////////////////////////////////////////
|
|
665
|
+
|
|
666
|
+
/**
|
|
667
|
+
* @alias access.canViewItem
|
|
668
|
+
* @description Helpful function for checking whether a given user can view a specified item
|
|
669
|
+
* @param {Object} user The user to check
|
|
670
|
+
* @param {Object} item The item to check
|
|
671
|
+
* @param {Object} options Additional options and parameters
|
|
672
|
+
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
673
|
+
* @example
|
|
674
|
+
* const user = sdk.auth.getCurrentUser();
|
|
675
|
+
*
|
|
676
|
+
* // Example of looping through a large array of items
|
|
677
|
+
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
678
|
+
*
|
|
679
|
+
* // Create an in memory cache object outside of the loop
|
|
680
|
+
* const cache = {}
|
|
681
|
+
*
|
|
682
|
+
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
683
|
+
* return sdk.access.canViewItem(user, item, {cache});
|
|
684
|
+
* })
|
|
685
|
+
*/
|
|
686
|
+
service.canViewItem = function (user, item, options) {
|
|
687
|
+
options = options || {};
|
|
688
|
+
options.cache = options.cache || {};
|
|
689
|
+
|
|
690
|
+
//Check if we can view the item
|
|
691
|
+
var canView = service.checkActionAccess(
|
|
692
|
+
user,
|
|
693
|
+
item,
|
|
694
|
+
"viewany",
|
|
695
|
+
"viewOwn",
|
|
696
|
+
options,
|
|
697
|
+
);
|
|
698
|
+
if (canView) {
|
|
699
|
+
return true;
|
|
749
700
|
}
|
|
750
701
|
|
|
751
|
-
|
|
752
|
-
|
|
753
|
-
|
|
754
|
-
|
|
755
|
-
* @description Helpful function for checking whether a given user can erase a specified item
|
|
756
|
-
* @param {Object} user The user to check
|
|
757
|
-
* @param {Object} item The item to check
|
|
758
|
-
* @param {Object} options Additional options and parameters
|
|
759
|
-
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
760
|
-
* @example
|
|
761
|
-
* const user = sdk.auth.getCurrentUser();
|
|
762
|
-
*
|
|
763
|
-
* // Example of looping through a large array of items
|
|
764
|
-
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
765
|
-
*
|
|
766
|
-
* // Create an in memory cache object outside of the loop
|
|
767
|
-
* const cache = {}
|
|
768
|
-
*
|
|
769
|
-
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
770
|
-
* return sdk.access.canEraseItem(user, item, {cache});
|
|
771
|
-
* })
|
|
772
|
-
*/
|
|
773
|
-
service.canEraseItem = function(user, item, options) {
|
|
774
|
-
options = options || {}
|
|
775
|
-
options.cache = options.cache || {}
|
|
776
|
-
|
|
777
|
-
return service.checkActionAccess(user, item, 'eraseany', 'eraseown', options);
|
|
702
|
+
//If we can edit the item then we should be able to view it also
|
|
703
|
+
var canEdit = service.canEditItem(user, item, options);
|
|
704
|
+
if (canEdit) {
|
|
705
|
+
return true;
|
|
778
706
|
}
|
|
779
707
|
|
|
780
|
-
|
|
781
|
-
|
|
782
|
-
|
|
783
|
-
|
|
784
|
-
|
|
708
|
+
return false;
|
|
709
|
+
};
|
|
710
|
+
|
|
711
|
+
///////////////////////////////////////////////
|
|
712
|
+
|
|
713
|
+
/**
|
|
714
|
+
* @alias access.canEditItem
|
|
715
|
+
* @description Helpful function for checking whether a given user can edit a specified item
|
|
716
|
+
* @param {Object} user The user to check
|
|
717
|
+
* @param {Object} item The item to check
|
|
718
|
+
* @param {Object} options Additional options and parameters
|
|
719
|
+
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
720
|
+
* @example
|
|
721
|
+
* const user = sdk.auth.getCurrentUser();
|
|
722
|
+
*
|
|
723
|
+
* // Example of looping through a large array of items
|
|
724
|
+
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
725
|
+
*
|
|
726
|
+
* // Create an in memory cache object outside of the loop
|
|
727
|
+
* const cache = {}
|
|
728
|
+
*
|
|
729
|
+
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
730
|
+
* return sdk.access.canEditItem(user, item, {cache});
|
|
731
|
+
* })
|
|
732
|
+
*/
|
|
733
|
+
service.canEditItem = function (user, item, options) {
|
|
734
|
+
options = options || {};
|
|
735
|
+
options.cache = options.cache || {};
|
|
736
|
+
|
|
737
|
+
var allowed = service.checkActionAccess(
|
|
738
|
+
user,
|
|
739
|
+
item,
|
|
740
|
+
"editany",
|
|
741
|
+
"editown",
|
|
742
|
+
options,
|
|
743
|
+
);
|
|
744
|
+
return allowed;
|
|
745
|
+
};
|
|
746
|
+
|
|
747
|
+
///////////////////////////////////////////////
|
|
748
|
+
|
|
749
|
+
/**
|
|
750
|
+
* @alias access.canDeleteItem
|
|
751
|
+
* @description Helpful function for checking whether a given user can delete a specified item
|
|
752
|
+
* @param {Object} user The user to check
|
|
753
|
+
* @param {Object} item The item to check
|
|
754
|
+
* @param {Object} options Additional options and parameters
|
|
755
|
+
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
756
|
+
* @example
|
|
757
|
+
* const user = sdk.auth.getCurrentUser();
|
|
758
|
+
*
|
|
759
|
+
* // Example of looping through a large array of items
|
|
760
|
+
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
761
|
+
*
|
|
762
|
+
* // Create an in memory cache object outside of the loop
|
|
763
|
+
* const cache = {}
|
|
764
|
+
*
|
|
765
|
+
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
766
|
+
* return sdk.access.canDeleteItem(user, item, {cache});
|
|
767
|
+
* })
|
|
768
|
+
*/
|
|
769
|
+
service.canDeleteItem = function (user, item, options) {
|
|
770
|
+
options = options || {};
|
|
771
|
+
options.cache = options.cache || {};
|
|
772
|
+
|
|
773
|
+
return service.checkActionAccess(
|
|
774
|
+
user,
|
|
775
|
+
item,
|
|
776
|
+
"deleteany",
|
|
777
|
+
"deleteown",
|
|
778
|
+
options,
|
|
779
|
+
);
|
|
780
|
+
};
|
|
781
|
+
|
|
782
|
+
///////////////////////////////////////////////
|
|
783
|
+
|
|
784
|
+
/**
|
|
785
|
+
* @alias access.canRestoreItem
|
|
786
|
+
* @description Helpful function for checking whether a given user can restore a specified item
|
|
787
|
+
* @param {Object} user The user to check
|
|
788
|
+
* @param {Object} item The item to check
|
|
789
|
+
* @param {Object} options Additional options and parameters
|
|
790
|
+
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
791
|
+
* @example
|
|
792
|
+
* const user = sdk.auth.getCurrentUser();
|
|
793
|
+
*
|
|
794
|
+
* // Example of looping through a large array of items
|
|
795
|
+
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
796
|
+
*
|
|
797
|
+
* // Create an in memory cache object outside of the loop
|
|
798
|
+
* const cache = {}
|
|
799
|
+
*
|
|
800
|
+
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
801
|
+
* return sdk.access.canRestoreItem(user, item, {cache});
|
|
802
|
+
* })
|
|
803
|
+
*/
|
|
804
|
+
service.canRestoreItem = function (user, item, options) {
|
|
805
|
+
options = options || {};
|
|
806
|
+
options.cache = options.cache || {};
|
|
807
|
+
|
|
808
|
+
return service.checkActionAccess(
|
|
809
|
+
user,
|
|
810
|
+
item,
|
|
811
|
+
"restoreany",
|
|
812
|
+
"restoreown",
|
|
813
|
+
options,
|
|
814
|
+
);
|
|
815
|
+
};
|
|
816
|
+
|
|
817
|
+
///////////////////////////////////////////////
|
|
818
|
+
|
|
819
|
+
/**
|
|
820
|
+
* @alias access.canEraseItem
|
|
821
|
+
* @description Helpful function for checking whether a given user can erase a specified item
|
|
822
|
+
* @param {Object} user The user to check
|
|
823
|
+
* @param {Object} item The item to check
|
|
824
|
+
* @param {Object} options Additional options and parameters
|
|
825
|
+
* @param {Object} options.cache Provide an existing object to use as an in memory cache, can be useful to increase performance if running this function in a large for/while loop
|
|
826
|
+
* @example
|
|
827
|
+
* const user = sdk.auth.getCurrentUser();
|
|
828
|
+
*
|
|
829
|
+
* // Example of looping through a large array of items
|
|
830
|
+
* const largeArrayOfItems = [{_id:'...', title...}, {_id:'...', title...}...]
|
|
831
|
+
*
|
|
832
|
+
* // Create an in memory cache object outside of the loop
|
|
833
|
+
* const cache = {}
|
|
834
|
+
*
|
|
835
|
+
* const filtered = largeArrayOfItems.filter(function(item) {
|
|
836
|
+
* return sdk.access.canEraseItem(user, item, {cache});
|
|
837
|
+
* })
|
|
838
|
+
*/
|
|
839
|
+
service.canEraseItem = function (user, item, options) {
|
|
840
|
+
options = options || {};
|
|
841
|
+
options.cache = options.cache || {};
|
|
842
|
+
|
|
843
|
+
return service.checkActionAccess(
|
|
844
|
+
user,
|
|
845
|
+
item,
|
|
846
|
+
"eraseany",
|
|
847
|
+
"eraseown",
|
|
848
|
+
options,
|
|
849
|
+
);
|
|
850
|
+
};
|
|
851
|
+
|
|
852
|
+
return service;
|
|
853
|
+
};
|
|
785
854
|
|
|
786
855
|
///////////////////////////////////////////////////////////////////////////////
|
|
787
856
|
|
|
788
|
-
|
|
789
|
-
|
|
790
|
-
export default QikAccess;
|
|
857
|
+
export default QikAccess;
|