@terreno/api 0.0.1

package/dist/permissions.js

@@ -0,0 +1,331 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Permissions = exports.OwnerQueryFilter = void 0;
+exports.checkPermissions = checkPermissions;
+exports.permissionMiddleware = permissionMiddleware;
+// Defaults closed
+var Sentry = __importStar(require("@sentry/node"));
+var mongoose_1 = __importDefault(require("mongoose"));
+var api_1 = require("./api");
+var errors_1 = require("./errors");
+var logger_1 = require("./logger");
+var OwnerQueryFilter = function (user) {
+    if (user) {
+        return { ownerId: user === null || user === void 0 ? void 0 : user.id };
+    }
+    // Return a null, so we know to return no results.
+    return null;
+};
+exports.OwnerQueryFilter = OwnerQueryFilter;
+exports.Permissions = {
+    IsAdmin: function (_method, user) {
+        return Boolean(user === null || user === void 0 ? void 0 : user.admin);
+    },
+    IsAny: function () {
+        return true;
+    },
+    IsAuthenticated: function (_method, user) {
+        if (!user) {
+            return false;
+        }
+        return Boolean(user.id);
+    },
+    IsAuthenticatedOrReadOnly: function (method, user) {
+        if ((user === null || user === void 0 ? void 0 : user.id) && !(user === null || user === void 0 ? void 0 : user.isAnonymous)) {
+            return true;
+        }
+        return method === "list" || method === "read";
+    },
+    IsOwner: function (_method, user, obj) {
+        var _a;
+        // When checking if we can possibly perform the action, return true.
+        if (!obj) {
+            return true;
+        }
+        if (!user) {
+            return false;
+        }
+        if (user === null || user === void 0 ? void 0 : user.admin) {
+            return true;
+        }
+        var ownerId = ((_a = obj === null || obj === void 0 ? void 0 : obj.ownerId) === null || _a === void 0 ? void 0 : _a._id) || (obj === null || obj === void 0 ? void 0 : obj.ownerId);
+        return (user === null || user === void 0 ? void 0 : user.id) && ownerId && String(ownerId) === String(user === null || user === void 0 ? void 0 : user.id);
+    },
+    IsOwnerOrReadOnly: function (method, user, obj) {
+        // When checking if we can possibly perform the action, return true.
+        if (!obj) {
+            return true;
+        }
+        if (user === null || user === void 0 ? void 0 : user.admin) {
+            return true;
+        }
+        if ((user === null || user === void 0 ? void 0 : user.id) && (obj === null || obj === void 0 ? void 0 : obj.ownerId) && String(obj === null || obj === void 0 ? void 0 : obj.ownerId) === String(user === null || user === void 0 ? void 0 : user.id)) {
+            return true;
+        }
+        return method === "list" || method === "read";
+    },
+};
+function checkPermissions(method, permissions, user, obj) {
+    return __awaiter(this, void 0, void 0, function () {
+        var anyTrue, permissions_1, permissions_1_1, perm, e_1_1;
+        var e_1, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    anyTrue = false;
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, 6, 7, 8]);
+                    permissions_1 = __values(permissions), permissions_1_1 = permissions_1.next();
+                    _b.label = 2;
+                case 2:
+                    if (!!permissions_1_1.done) return [3 /*break*/, 5];
+                    perm = permissions_1_1.value;
+                    return [4 /*yield*/, perm(method, user, obj)];
+                case 3:
+                    // May or may not be a promise.
+                    if (!(_b.sent())) {
+                        return [2 /*return*/, false];
+                    }
+                    anyTrue = true;
+                    _b.label = 4;
+                case 4:
+                    permissions_1_1 = permissions_1.next();
+                    return [3 /*break*/, 2];
+                case 5: return [3 /*break*/, 8];
+                case 6:
+                    e_1_1 = _b.sent();
+                    e_1 = { error: e_1_1 };
+                    return [3 /*break*/, 8];
+                case 7:
+                    try {
+                        if (permissions_1_1 && !permissions_1_1.done && (_a = permissions_1.return)) _a.call(permissions_1);
+                    }
+                    finally { if (e_1) throw e_1.error; }
+                    return [7 /*endfinally*/];
+                case 8: return [2 /*return*/, anyTrue];
+            }
+        });
+    });
+}
+// Check the permissions for a given model and method. If the method is a read, update, or delete,
+// finds the relevant object, checks the permissions, and attaches the object to the request as
+// req.obj.
+function permissionMiddleware(baseModel, options) {
+    var _this = this;
+    return function (req, _res, next) { return __awaiter(_this, void 0, void 0, function () {
+        var method, reqMethod, model, builtQuery, populatedQuery, data, error_1, hiddenDoc, error, reason, error, error_2;
+        var _a, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    if (req.method === "OPTIONS") {
+                        return [2 /*return*/, next()];
+                    }
+                    _e.label = 1;
+                case 1:
+                    _e.trys.push([1, 10, , 11]);
+                    method = void 0;
+                    reqMethod = req.method.toLowerCase();
+                    if (reqMethod === "post") {
+                        method = "create";
+                    }
+                    else if (reqMethod === "get") {
+                        if (req.params.id) {
+                            method = "read";
+                        }
+                        else {
+                            method = "list";
+                        }
+                    }
+                    else if (reqMethod === "patch") {
+                        method = "update";
+                    }
+                    else if (reqMethod === "delete") {
+                        method = "delete";
+                    }
+                    else {
+                        throw new errors_1.APIError({
+                            status: 405,
+                            title: "Method ".concat(req.method, " not allowed"),
+                        });
+                    }
+                    model = (0, api_1.getModel)(baseModel, req.body, options);
+                    return [4 /*yield*/, checkPermissions(method, options.permissions[method], req.user)];
+                case 2:
+                    // All methods check for permissions.
+                    if (!(_e.sent())) {
+                        throw new errors_1.APIError({
+                            status: 405,
+                            title: "Access to ".concat(method.toUpperCase(), " on ").concat(model.modelName, " ") +
+                                "denied for ".concat((_a = req.user) === null || _a === void 0 ? void 0 : _a.id),
+                        });
+                    }
+                    if (method === "create" || method === "list") {
+                        return [2 /*return*/, next()];
+                    }
+                    builtQuery = model.findById(req.params.id);
+                    populatedQuery = (0, api_1.addPopulateToQuery)(builtQuery, options.populatePaths);
+                    data = void 0;
+                    _e.label = 3;
+                case 3:
+                    _e.trys.push([3, 5, , 6]);
+                    return [4 /*yield*/, populatedQuery.exec()];
+                case 4:
+                    data = _e.sent();
+                    return [3 /*break*/, 6];
+                case 5:
+                    error_1 = _e.sent();
+                    throw new errors_1.APIError({
+                        error: error_1,
+                        status: 500,
+                        title: "GET failed on ".concat(req.params.id),
+                    });
+                case 6:
+                    if (!(!data || (["update", "delete"].includes(method) && (data === null || data === void 0 ? void 0 : data.__t) && !((_b = req.body) === null || _b === void 0 ? void 0 : _b.__t)))) return [3 /*break*/, 8];
+                    // For discriminated models, return 404 without checking hidden state
+                    if (["update", "delete"].includes(method) && (data === null || data === void 0 ? void 0 : data.__t) && !((_c = req.body) === null || _c === void 0 ? void 0 : _c.__t)) {
+                        throw new errors_1.APIError({
+                            status: 404,
+                            title: "Document ".concat(req.params.id, " not found for model ").concat(model.modelName),
+                        });
+                    }
+                    return [4 /*yield*/, model.collection.findOne({
+                            _id: new mongoose_1.default.Types.ObjectId(req.params.id),
+                        })];
+                case 7:
+                    hiddenDoc = _e.sent();
+                    if (!hiddenDoc) {
+                        Sentry.captureMessage("Document ".concat(req.params.id, " not found for model ").concat(model.modelName));
+                        error = new errors_1.APIError({
+                            status: 404,
+                            title: "Document ".concat(req.params.id, " not found for model ").concat(model.modelName),
+                        });
+                        error.meta = undefined;
+                        throw error;
+                    }
+                    reason = hiddenDoc.deleted
+                        ? { deleted: "true" }
+                        : hiddenDoc.disabled
+                            ? { disabled: "true" }
+                            : hiddenDoc.archived
+                                ? { archived: "true" }
+                                : null;
+                    // If no reason found, treat as not found
+                    if (!reason) {
+                        error = new errors_1.APIError({
+                            status: 404,
+                            title: "Document ".concat(req.params.id, " not found for model ").concat(model.modelName),
+                        });
+                        error.meta = undefined;
+                        throw error;
+                    }
+                    throw new errors_1.APIError({
+                        // We don't want to send this to Sentry because it's expected behavior.
+                        disableExternalErrorTracking: true,
+                        meta: reason,
+                        status: 404,
+                        title: "Document ".concat(req.params.id, " not found for model ").concat(model.modelName),
+                    });
+                case 8: return [4 /*yield*/, checkPermissions(method, options.permissions[method], req.user, data)];
+                case 9:
+                    if (!(_e.sent())) {
+                        throw new errors_1.APIError({
+                            status: 403,
+                            title: "Access to GET on ".concat(model.modelName, ":").concat(req.params.id, " denied for ").concat((_d = req.user) === null || _d === void 0 ? void 0 : _d.id),
+                        });
+                    }
+                    req.obj = data;
+                    return [2 /*return*/, next()];
+                case 10:
+                    error_2 = _e.sent();
+                    logger_1.logger.error("Permissions error: ".concat(error_2 instanceof Error ? error_2.message : error_2));
+                    return [2 /*return*/, next(error_2)];
+                case 11: return [2 /*return*/];
+            }
+        });
+    }); };
+}

package/dist/permissions.test.d.ts

@@ -0,0 +1 @@
+export {};