@tmlmobilidade/controllers 20260706.931.16 → 20260706.1756.42

package/dist/agencies/agencies.d.ts

@@ -1,20 +1,27 @@
 import { type FastifyReply, type FastifyRequest } from '@tmlmobilidade/fastify';
-import { type Agency } from '@tmlmobilidade/types';
+import { type ActionsOf, type Agency, type Permission } from '@tmlmobilidade/types';
+interface GetAllAgenciesQuery {
+    actions?: string | string[];
+    scope?: Permission['scope'];
+}
 export declare class AgenciesSharedController {
     /**
      * Returns all Agencies sorted by ID.
      * @param request The request object
      * @param reply The reply object
      */
-    static getAll(request: FastifyRequest, reply: FastifyReply<Agency[]>): Promise<void>;
+    static getAll(request: FastifyRequest<{
+        Querystring: GetAllAgenciesQuery;
+    }>, reply: FastifyReply<Agency[]>): Promise<never>;
     /**
      * Returns an Agency by ID.
      * @param request The request object
      * @param reply The reply object
      */
-    static getById(request: FastifyRequest<{
+    static getById<S extends Permission['scope']>(request: FastifyRequest<{
         Params: {
             id: string;
         };
-    }>, reply: FastifyReply<Agency>): Promise<void>;
+    }>, reply: FastifyReply<Agency>, scope: S, action: ActionsOf<S>): Promise<never>;
 }
+export {};

package/dist/agencies/agencies.js

@@ -2,6 +2,10 @@
 import { HTTP_STATUS, HttpException } from '@tmlmobilidade/consts';
 import { agencies } from '@tmlmobilidade/interfaces';
 import { Logger } from '@tmlmobilidade/logger';
+import { PermissionCatalog } from '@tmlmobilidade/types';
+function getAgencyIdsFromPermission(permission) {
+    return permission?.resources?.agency_ids ?? [];
+}
 /* * */
 export class AgenciesSharedController {
     //
@@ -11,7 +15,32 @@ export class AgenciesSharedController {
      * @param reply The reply object
      */
     static async getAll(request, reply) {
-        const allAgencies = await agencies.findMany({}, { sort: { _id: 1 } });
+        //
+        // A. Setup variables
+        const scope = request.query.scope;
+        const actions = (Array.isArray(request.query.actions) ? request.query.actions : request.query.actions?.split(','))?.filter(Boolean);
+        if (!scope || !actions?.length) {
+            throw new HttpException(HTTP_STATUS.BAD_REQUEST, 'Missing scope or actions query parameters');
+        }
+        //
+        // Detect which agency_ids the user has access to,
+        // based on their permissions. If none, return an empty array.
+        const permittedAgencyIds = actions.flatMap(action => getAgencyIdsFromPermission(PermissionCatalog.get(request.permissions, scope, action)));
+        if (!permittedAgencyIds.length) {
+            Logger.issue({
+                context: {
+                    action: 'getAll',
+                    feature: 'agencies',
+                    request,
+                },
+                level: 'info',
+                messageOrError: 'No agency_ids found in permissions',
+            });
+            return reply.send({ data: [], error: null, statusCode: HTTP_STATUS.OK });
+        }
+        const allowAllAgencies = permittedAgencyIds.includes(PermissionCatalog.ALLOW_ALL_FLAG);
+        const queryFilters = allowAllAgencies ? {} : { _id: { $in: permittedAgencyIds } };
+        const allAgencies = await agencies.findMany(queryFilters, { sort: { _id: 1 } });
         reply.send({ data: allAgencies, error: null, statusCode: HTTP_STATUS.OK });
     }
     /**
@@ -19,8 +48,28 @@ export class AgenciesSharedController {
      * @param request The request object
      * @param reply The reply object
      */
-    static async getById(request, reply) {
-        const agencyData = await agencies.findById(request.params.id);
+    static async getById(request, reply, scope, action) {
+        //
+        // Detect which agency_ids the user has access to,
+        // based on their permissions. If none, return an empty array.
+        const agenciesPermission = PermissionCatalog.get(request.permissions, scope, action);
+        const permittedAgencyIds = getAgencyIdsFromPermission(agenciesPermission);
+        if (!permittedAgencyIds.length) {
+            Logger.issue({
+                context: {
+                    action: 'getById',
+                    feature: 'agencies',
+                    request,
+                    value: request.params.id,
+                },
+                level: 'info',
+                messageOrError: 'No agency_ids found in permissions',
+            });
+            return reply.send({ data: null, error: null, statusCode: HTTP_STATUS.OK });
+        }
+        const allowAllAgencies = permittedAgencyIds.includes(PermissionCatalog.ALLOW_ALL_FLAG);
+        const queryFilters = allowAllAgencies ? { _id: request.params.id } : { _id: { $eq: request.params.id, $in: permittedAgencyIds } };
+        const agencyData = await agencies.findOne(queryFilters);
         if (!agencyData) {
             const error = new HttpException(HTTP_STATUS.NOT_FOUND, 'Agency not found');
             Logger.issue({

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@tmlmobilidade/controllers",
-	"version": "20260706.931.16",
+	"version": "20260706.1756.42",
 	"author": {
 		"email": "iso@tmlmobilidade.pt",
 		"name": "TML-ISO"