expressa 2.0.13 → 2.0.15

package/controllers/users.js

@@ -1,52 +1,52 @@
-const auth = require('../auth')
-const util = require('../util')
-const collectionsApi = require('./collections')
-const permissions = require('../middleware/permissions')
-
-exports.login = async (req, collection) => {
-  const password = req.body.password
-
-  if (typeof req.body.email !== 'string') {
-    throw new util.ApiError(400, 'email must be a string')
-  }
-
-  req.body.email = req.body.email.toLowerCase()
-
-  // check if user exists
-  const result = await req.db[collection].find({
-    email: req.body.email
-  })
-  if (result.length === 0) {
-    throw new util.ApiError(400, 'No ' + collection + ' found with this email.')
-  }
-  const user = result[0]
-  if (!auth.isValidPassword(password, user.password)) {
-    throw new util.ApiError(401, 'Incorrect password')
-  }
-  const jwt_options = req.settings.jwt_expires_in ? { expiresIn: req.settings.jwt_expires_in } : {}
-  const payload = auth.doLogin({
-    id: user._id,
-    collection,
-    timestamp: user.meta.password_last_updated_at,
-    jwt_secret: req.getSetting('jwt_secret'),
-    jwt_options
-  })
-  req.uid = user._id
-  req.ucollection = collection
-  req.user = user
-  await permissions.addRolePermissionsAsync(req)
-  payload.canUseAdmin = req.hasPermission('login to admin')
-  return payload
-}
-
-exports.register = function (req, collection) {
-  req.url = `/${collection}`
-  req.params.collection = collection
-  return collectionsApi.insert(req)
-}
-
-exports.getMe = function (req, collection) {
-  req.params.collection = collection
-  req.params.id = req.uid
-  return collectionsApi.getById(req)
-}
+const auth = require('../auth')
+const util = require('../util')
+const collectionsApi = require('./collections')
+const permissions = require('../middleware/permissions')
+
+exports.login = async (req, collection) => {
+  const password = req.body.password
+
+  if (typeof req.body.email !== 'string') {
+    throw new util.ApiError(400, 'email must be a string')
+  }
+
+  req.body.email = req.body.email.toLowerCase()
+
+  // check if user exists
+  const result = await req.db[collection].find({
+    email: req.body.email
+  })
+  if (result.length === 0) {
+    throw new util.ApiError(400, 'No ' + collection + ' found with this email.')
+  }
+  const user = result[0]
+  if (!auth.isValidPassword(password, user.password)) {
+    throw new util.ApiError(401, 'Incorrect password')
+  }
+  const jwt_options = req.settings.jwt_expires_in ? { expiresIn: req.settings.jwt_expires_in } : {}
+  const payload = auth.doLogin({
+    id: user._id,
+    collection,
+    timestamp: user.meta.password_last_updated_at,
+    jwt_secret: req.getSetting('jwt_secret'),
+    jwt_options
+  })
+  req.uid = user._id
+  req.ucollection = collection
+  req.user = user
+  await permissions.addRolePermissionsAsync(req)
+  payload.canUseAdmin = req.hasPermission('login to admin')
+  return payload
+}
+
+exports.register = function (req, collection) {
+  req.url = `/${collection}`
+  req.params.collection = collection
+  return collectionsApi.insert(req)
+}
+
+exports.getMe = function (req, collection) {
+  req.params.collection = collection
+  req.params.id = req.uid
+  return collectionsApi.getById(req)
+}

package/middleware/permissions.js

@@ -2,15 +2,9 @@ const util = require('../util')
 let authenticatedRoleExists
 
 async function addRolePermissions (req, roles) {
-  req.permissions = req.permissions || {}
-  const roleDocs = await Promise.all(roles.map((name) => req.db.role.get(name)))
-  roleDocs.forEach((roleDoc) => {
-    for (const permission in roleDoc.permissions) {
-      if (roleDoc.permissions[permission]) {
-        req.permissions[permission] = true
-      }
-    }
-  })
+  const rolePermissions = await util.getEffectivePermissionsForRoles(roles, req.db)
+  req.permissions ??= {}
+  req.permissions = { ...req.permissions, ...rolePermissions }
 }
 
 async function doesAuthenticatedRoleExist(req) {
@@ -31,7 +25,7 @@ module.exports.addRolePermissionsAsync = async function addRolePermissionsMiddle
     req.hasPermission = () => true
     return
   }
-  req.hasPermission = (permission) => req.permissions && req.permissions[permission]
+  req.hasPermission = (permission) => util.hasPermission(req.permissions, permission)
   let roles = ['Anonymous']
   const isAuthenticatedRole = await doesAuthenticatedRoleExist(req)
   if (req.uid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expressa",
-  "version": "2.0.13",
+  "version": "2.0.15",
   "description": "API framework using JSON schemas",
   "main": "index.js",
   "repository": "https://github.com/thomas4019/expressa",

package/util.js

@@ -75,6 +75,8 @@ exports.getSchemaProperty = function(collection, path) {
   for (const part of parts) {
     if (obj.properties && obj.properties[part]) {
       obj = obj.properties[part]
+    } else if (obj.items && obj.items.properties && obj.items.properties[part]) {
+      obj = obj.items.properties[part]
     } else {
       return
     }
@@ -497,6 +499,23 @@ exports.getDatabaseOffset = function getDatabaseOffset(page, itemsPerPage) {
   return (page - 1) * itemsPerPage
 }
 
+exports.hasPermission = function hasPermission(permissions, permission) {
+  return permissions && permissions[permission]
+}
+
+exports.getEffectivePermissionsForRoles = async function getEffectivePermissionsForRoles(roles, db) {
+  const permissions = {}
+  const roleDocs = await Promise.all(roles.map((name) => db.role.get(name)))
+  roleDocs.forEach((roleDoc) => {
+    for (const permission in roleDoc.permissions) {
+      if (roleDoc.permissions[permission]) {
+        permissions[permission] = true
+      }
+    }
+  })
+  return permissions
+}
+
 exports.createHash = auth.createHash
 exports.isHashed = auth.isHashed
 exports.doLogin = auth.doLogin