dbm-graph-api 1.1.49 → 1.1.50

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/package.json +1 -1
  2. package/src/dbm-graph-api/Api.js +10 -12
  3. package/src/dbm-graph-api/UrlRequest.js +66 -10
  4. package/src/dbm-graph-api/WebSocketConnection.js +102 -37
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "dbm-graph-api",
3
- "version": "1.1.49",
3
+ "version": "1.1.50",
4
4
  "main": "index.js",
5
5
  "type": "module",
6
6
  "scripts": {
package/src/dbm-graph-api/Api.js CHANGED
@@ -25,7 +25,7 @@ export default class Api extends Dbm.core.BaseObject {
25
25
  return this;
26
26
  }
27
27
 
28
- _callback_connection(aWebSocket, aRequest) {
28
+ async _callback_connection(aWebSocket, aRequest) {
29
29
  let newWebSocketConnection = new WebSocketConnection();
30
30
 
31
31
  newWebSocketConnection.item.setValue("api", this.item);
@@ -48,17 +48,15 @@ export default class Api extends Dbm.core.BaseObject {
48
48
  let userId = 1*value.split(":")[1];
49
49
  let user = Dbm.getRepositoryItem("graphDatabase").controller.getUser(userId);
50
50
 
51
- user.verifySession(value).then(function(aIsValidSession) {
52
- //console.log("verifySession", aIsValidSession);
51
+ let isValidSession = await user.verifySession(value);
53
52
 
54
- if(aIsValidSession) {
55
- newWebSocketConnection.setInitialUser(userId);
56
- }
57
- else {
58
- newWebSocketConnection.setInitialUser(0);
59
- }
60
-
61
- });
53
+ if(isValidSession) {
54
+ await newWebSocketConnection.setInitialUser(userId);
55
+ }
56
+ else {
57
+ await newWebSocketConnection.setInitialUser(0);
58
+ };
59
+
62
60
  hasUserCookie = true;
63
61
  break;
64
62
  }
@@ -66,7 +64,7 @@ export default class Api extends Dbm.core.BaseObject {
66
64
  }
67
65
 
68
66
  if(!hasUserCookie) {
69
- newWebSocketConnection.setInitialUser(0);
67
+ await newWebSocketConnection.setInitialUser(0);
70
68
  }
71
69
  }
72
70
 
package/src/dbm-graph-api/UrlRequest.js CHANGED
@@ -30,16 +30,36 @@ export default class UrlRequest extends Dbm.core.BaseObject {
30
30
  let database = Dbm.getInstance().repository.getItem("graphDatabase").controller;
31
31
  let urlObject = await database.getObjectByUrl(url);
32
32
 
33
+ let logs = [];
34
+
33
35
  if(urlObject) {
34
- let encodeSession = new DbmGraphApi.range.EncodeSession();
35
- encodeSession.outputController = this;
36
+ let isOk = false;
37
+ let visibility = await urlObject.getVisibility();
38
+ if(visibility === "public") {
39
+ isOk = true;
40
+ }
41
+ else {
42
+ let isAdmin = await this.hasRole("admin");
43
+ if(isAdmin) {
44
+ isOk = true;
45
+ }
46
+ }
36
47
 
37
- await encodeSession.encodeSingleWithTypes(urlObject.id, ["urlRequest"]);
38
- encodeSession.destroy();
39
- this._responseData = {"id": urlObject.id};
48
+ if(isOk) {
49
+ let encodeSession = new DbmGraphApi.range.EncodeSession();
50
+ encodeSession.outputController = this;
51
+
52
+ await encodeSession.encodeSingleWithTypes(urlObject.id, ["urlRequest"]);
53
+ encodeSession.destroy();
54
+ this._responseData = {"id": urlObject.id, "logs": logs};
55
+ }
56
+ else {
57
+ this._responseData = {"id": urlObject.id, "logs": ["Not allowed to load item"]};
58
+ }
40
59
  }
41
60
  else {
42
- this._responseData = {"id": 0};
61
+ logs.push("Not found");
62
+ this._responseData = {"id": 0, "logs": logs};
43
63
  }
44
64
  }
45
65
 
@@ -111,13 +131,29 @@ export default class UrlRequest extends Dbm.core.BaseObject {
111
131
  let encodeSession = new DbmGraphApi.range.EncodeSession();
112
132
  encodeSession.outputController = this;
113
133
 
114
- //METODO: check visibility
134
+ let isOk = false;
135
+ let visibility = await Dbm.node.getDatabase().getObjectVisibility(aId);
136
+ if(visibility === "public") {
137
+ isOk = true;
138
+ }
139
+ else {
140
+ let isAdmin = await this.hasRole("admin");
141
+ if(isAdmin) {
142
+ isOk = true;
143
+ }
144
+ }
115
145
 
116
- await encodeSession.encodeSingleWithTypes(aId, aEncodes);
146
+ let logs = [];
147
+ if(isOk) {
148
+ await encodeSession.encodeSingleWithTypes(aId, aEncodes);
117
149
 
118
- encodeSession.destroy();
150
+ encodeSession.destroy();
151
+ }
152
+ else {
153
+ logs.push("Not allowed to load item");
154
+ }
119
155
 
120
- this._responseData = {"id": aId};
156
+ this._responseData = {"id": aId, "logs": logs};
121
157
  }
122
158
 
123
159
  async requestData(aFunctionName, aData) {
@@ -236,6 +272,26 @@ export default class UrlRequest extends Dbm.core.BaseObject {
236
272
  throw(new Error("Only signed in users can use this endpoint"));
237
273
  }
238
274
 
275
+ let hasRole = await user.hasRole(aRole);
276
+ if(!hasRole) {
277
+ throw(new Error("User doesn't have privileges"));
278
+ }
279
+
239
280
  return true;
240
281
  }
282
+
283
+ async hasRole(aRole) {
284
+ let user = await this.getUser();
285
+
286
+ if(!user) {
287
+ return false;
288
+ }
289
+
290
+ let hasRole = await user.hasRole(aRole);
291
+ if(!hasRole) {
292
+ return false;
293
+ }
294
+
295
+ return true;
296
+ }
241
297
  }
package/src/dbm-graph-api/WebSocketConnection.js CHANGED
@@ -166,23 +166,39 @@ export default class WebSocketConnection extends Dbm.core.BaseObject {
166
166
  case "item":
167
167
  {
168
168
  let id = data['id'];
169
- //METODO: check visibility in database
170
-
171
- let encodeSession = new DbmGraphApi.range.EncodeSession();
172
- encodeSession.outputController = this;
169
+
170
+ let isOk = false;
171
+ let visibility = await Dbm.node.getDatabase().getObjectVisibility(id);
172
+ if(visibility === "public") {
173
+ isOk = true;
174
+ }
175
+ else {
176
+ let isAdmin = await this.hasRole("admin");
177
+ if(isAdmin) {
178
+ isOk = true;
179
+ }
180
+ }
173
181
 
174
182
  let logs = [];
175
183
 
176
- try {
177
- await encodeSession.encodeSingleWithTypes(id, data.encode);
184
+ if(isOk) {
185
+ let encodeSession = new DbmGraphApi.range.EncodeSession();
186
+ encodeSession.outputController = this;
187
+
188
+ try {
189
+ await encodeSession.encodeSingleWithTypes(id, data.encode);
190
+ }
191
+ catch(theError) {
192
+ logs.push(theError.message);
193
+ console.error(theError);
194
+ }
195
+
196
+ encodeSession.destroy();
178
197
  }
179
- catch(theError) {
180
- logs.push(theError.message);
181
- console.error(theError);
198
+ else {
199
+ logs.push("Not allowed to load item");
182
200
  }
183
201
 
184
- encodeSession.destroy();
185
-
186
202
  this._sendData({"type": "item/response", "id": id, "requestId": data["requestId"], "logs": logs});
187
203
  }
188
204
  break;
@@ -192,32 +208,47 @@ export default class WebSocketConnection extends Dbm.core.BaseObject {
192
208
  if(url[url.length-1] !== "/") {
193
209
  url += "/";
194
210
  }
195
- //METODO: check visibility in database
196
-
197
211
 
198
-
199
- let database = Dbm.getInstance().repository.getItem("graphDatabase").controller;
212
+ let database = Dbm.node.getDatabase();
200
213
  let urlObject = await database.getObjectByUrl(url);
201
214
 
215
+ let logs = [];
216
+
217
+ let id = 0;
202
218
  if(urlObject) {
203
- let encodeSession = new DbmGraphApi.range.EncodeSession();
204
- encodeSession.outputController = this;
219
+ id = urlObject.id;
205
220
 
206
- await encodeSession.encodeSingleWithTypes(urlObject.id, ["urlRequest"]);
207
- encodeSession.destroy();
208
- this._sendData({"type": "url/response", "id": urlObject.id, "requestId": data["requestId"]});
209
- }
210
- else {
211
- this._sendData({"type": "url/response", "id": 0, "requestId": data["requestId"]});
221
+ let isOk = false;
222
+ let visibility = await urlObject.getVisibility();
223
+ if(visibility === "public") {
224
+ isOk = true;
225
+ }
226
+ else {
227
+ let isAdmin = await this.hasRole("admin");
228
+ if(isAdmin) {
229
+ isOk = true;
230
+ }
231
+ }
232
+
233
+ if(isOk) {
234
+ let encodeSession = new DbmGraphApi.range.EncodeSession();
235
+ encodeSession.outputController = this;
236
+
237
+ await encodeSession.encodeSingleWithTypes(urlObject.id, ["urlRequest"]);
238
+ encodeSession.destroy();
239
+ }
240
+ else {
241
+ logs.push("Not allowed to load item");
242
+ }
212
243
  }
244
+
245
+ this._sendData({"type": "url/response", "id": id, "requestId": data["requestId"], "logs": logs});
213
246
  }
214
247
  break;
215
248
  case "admin/createObject":
216
249
  {
217
- //METODO: require role
218
250
  let returnId = 0;
219
- let user = await this.getUser();
220
- if(user) {
251
+ if(await this.hasRole("admin")) {
221
252
  let types = data['types'];
222
253
  let database = Dbm.getInstance().repository.getItem("graphDatabase").controller;
223
254
  let visibility = data['visibility'] ? data['visibility'] : 'draft';
@@ -256,8 +287,7 @@ export default class WebSocketConnection extends Dbm.core.BaseObject {
256
287
 
257
288
  let theObject = database.getObject(data.id);
258
289
 
259
- let user = await this.getUser();
260
- if(user) {
290
+ if(await this.hasRole("admin")) {
261
291
  if(data.changes) {
262
292
  await this._applyChanges(theObject, data.changes, request);
263
293
  }
@@ -288,21 +318,28 @@ export default class WebSocketConnection extends Dbm.core.BaseObject {
288
318
 
289
319
  let isVerified = await user.verifySignedSessionToken(data.token);
290
320
 
321
+ let roleIds = [];
291
322
  let userId = 0;
292
323
  if(isVerified) {
293
- //METODO: set user for connection
294
-
295
324
  userId = user.id;
296
325
  this.item.setValue("user", user);
326
+
327
+ let roles = await user.getRoles();
328
+
329
+ let currentArray = roles;
330
+ let currentArrayLength = currentArray.length;
331
+ for(let i = 0; i < currentArrayLength; i++) {
332
+ roleIds.push(await currentArray[i].getIdentifier());
333
+ }
297
334
  }
298
335
 
299
- this._sendData({"type": "currentUser/response", "id": userId, "requestId": data["requestId"]});
336
+ this._sendData({"type": "currentUser/response", "id": userId, "roles": roleIds, "requestId": data["requestId"]});
300
337
  }
301
338
  break;
302
339
  case "user/signOut":
303
340
  {
304
341
  this.item.setValue("user", null);
305
- this._sendData({"type": "currentUser/response", "id": 0, "requestId": data["requestId"]});
342
+ this._sendData({"type": "currentUser/response", "id": 0, "roles": [], "requestId": data["requestId"]});
306
343
  }
307
344
  break;
308
345
  case "heartbeat":
@@ -367,19 +404,27 @@ export default class WebSocketConnection extends Dbm.core.BaseObject {
367
404
 
368
405
  }
369
406
 
370
- setInitialUser(aId) {
407
+ async setInitialUser(aId) {
371
408
 
372
- if(aId) {
373
- let database = Dbm.getInstance().repository.getItem("graphDatabase").controller;
409
+ let roleIds = [];
374
410
 
375
- let user = database.getUser(aId);
411
+ if(aId) {
412
+ let user = Dbm.node.getDatabase().getUser(aId);
376
413
  this.item.setValue("user", user);
414
+
415
+ let roles = await user.getRoles();
416
+
417
+ let currentArray = roles;
418
+ let currentArrayLength = currentArray.length;
419
+ for(let i = 0; i < currentArrayLength; i++) {
420
+ roleIds.push(await currentArray[i].getIdentifier());
421
+ }
377
422
  }
378
423
  else {
379
424
  this.item.setValue("user", null);
380
425
  }
381
426
 
382
- this._sendData({"type": "connectionReady", "user": aId});
427
+ this._sendData({"type": "connectionReady", "user": aId, "roles": roleIds});
383
428
  }
384
429
 
385
430
  async getUser() {
@@ -393,6 +438,26 @@ export default class WebSocketConnection extends Dbm.core.BaseObject {
393
438
  throw(new Error("Only signed in users can use this endpoint"));
394
439
  }
395
440
 
441
+ let hasRole = await user.hasRole(aRole);
442
+ if(!hasRole) {
443
+ throw(new Error("User doesn't have privileges"));
444
+ }
445
+
396
446
  return true;
397
447
  }
448
+
449
+ async hasRole(aRole) {
450
+ let user = await this.getUser();
451
+
452
+ if(!user) {
453
+ return false;
454
+ }
455
+
456
+ let hasRole = await user.hasRole(aRole);
457
+ if(!hasRole) {
458
+ return false;
459
+ }
460
+
461
+ return true;
462
+ }
398
463
  }