grm-shared-library 1.1.115 → 1.1.116
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/modules/common/services/access-validation.service.js +21 -8
- package/dist/cjs/modules/common/services/access-validation.service.js.map +1 -1
- package/dist/esm/modules/common/services/access-validation.service.js +21 -8
- package/dist/esm/modules/common/services/access-validation.service.js.map +1 -1
- package/dist/types/modules/common/interfaces/access-validation.interface.d.ts +3 -0
- package/dist/types/modules/common/services/access-validation.service.d.ts +1 -1
- package/dist/types/modules/user/interfaces/access-scope.d.ts +2 -0
- package/package.json +1 -1
|
@@ -16,7 +16,10 @@ class AccessValidationService {
|
|
|
16
16
|
if (accessScope.isSuperAdmin) {
|
|
17
17
|
return;
|
|
18
18
|
}
|
|
19
|
-
if (accessScope.
|
|
19
|
+
if (accessScope.isOrganizationUser || accessScope.isControlCentreUser) {
|
|
20
|
+
return;
|
|
21
|
+
}
|
|
22
|
+
if (accessScope.isMobileUser) {
|
|
20
23
|
return;
|
|
21
24
|
}
|
|
22
25
|
throw new common_1.ForbiddenException(`Access denied: Insufficient permissions to access ${pluralEntityName}`);
|
|
@@ -27,25 +30,30 @@ class AccessValidationService {
|
|
|
27
30
|
* @param entity - The entity to check access for
|
|
28
31
|
* @param entityName - The name of the entity (for error messages)
|
|
29
32
|
*/
|
|
30
|
-
validateEntityAccess(accessScope, entity, entityName = 'Entity') {
|
|
33
|
+
validateEntityAccess(accessScope, entity, entityName = 'Entity', creatorId) {
|
|
31
34
|
if (accessScope.isSuperAdmin) {
|
|
32
35
|
return;
|
|
33
36
|
}
|
|
34
|
-
if (!entity.organizationId && !entity.controlCentreId) {
|
|
37
|
+
if (!entity.organizationId && !entity.controlCentreId && !entity.creatorId) {
|
|
35
38
|
throw new common_1.ForbiddenException(`Access denied: ${entityName} has no access control information`);
|
|
36
39
|
}
|
|
37
|
-
if (accessScope.
|
|
40
|
+
if (accessScope.isOrganizationUser) {
|
|
38
41
|
if (entity.organizationId !== accessScope.organizationFilter) {
|
|
39
42
|
throw new common_1.ForbiddenException(`Access denied: ${entityName} does not belong to your organization`);
|
|
40
43
|
}
|
|
41
44
|
return;
|
|
42
45
|
}
|
|
43
|
-
if (accessScope.
|
|
46
|
+
if (accessScope.isControlCentreUser) {
|
|
44
47
|
if (entity.controlCentreId !== accessScope.controlCentreFilter) {
|
|
45
48
|
throw new common_1.ForbiddenException(`Access denied: ${entityName} does not belong to your control centre`);
|
|
46
49
|
}
|
|
47
50
|
return;
|
|
48
51
|
}
|
|
52
|
+
if (accessScope.isMobileUser) {
|
|
53
|
+
if (creatorId && entity.creatorId === creatorId) {
|
|
54
|
+
return;
|
|
55
|
+
}
|
|
56
|
+
}
|
|
49
57
|
throw new common_1.ForbiddenException(`Access denied: Insufficient permissions to access this ${entityName} entity`);
|
|
50
58
|
}
|
|
51
59
|
/**
|
|
@@ -59,16 +67,21 @@ class AccessValidationService {
|
|
|
59
67
|
return;
|
|
60
68
|
}
|
|
61
69
|
if (createDto.organizationId) {
|
|
62
|
-
if (accessScope.
|
|
70
|
+
if (accessScope.isOrganizationUser && createDto.organizationId !== accessScope.organizationFilter) {
|
|
63
71
|
throw new common_1.ForbiddenException(`Cannot create ${entityName} for this organization`);
|
|
64
72
|
}
|
|
65
73
|
}
|
|
66
74
|
if (createDto.controlCentreId) {
|
|
67
|
-
if (accessScope.
|
|
75
|
+
if (accessScope.isControlCentreUser && createDto.controlCentreId !== accessScope.controlCentreFilter) {
|
|
68
76
|
throw new common_1.ForbiddenException(`Cannot create ${entityName} for this control centre`);
|
|
69
77
|
}
|
|
70
78
|
}
|
|
71
|
-
if (
|
|
79
|
+
if (createDto.creatorId) {
|
|
80
|
+
if (accessScope.isMobileUser && createDto.creatorId !== accessScope.mobileFilter) {
|
|
81
|
+
throw new common_1.ForbiddenException(`Cannot create ${entityName} for another user`);
|
|
82
|
+
}
|
|
83
|
+
}
|
|
84
|
+
if (!accessScope.organizationFilter && !accessScope.controlCentreFilter && !accessScope.mobileFilter) {
|
|
72
85
|
throw new common_1.ForbiddenException(`Insufficient permissions to create ${entityName}`);
|
|
73
86
|
}
|
|
74
87
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"access-validation.service.js","sourceRoot":"","sources":["../../../../../src/modules/common/services/access-validation.service.ts"],"names":[],"mappings":";;;AAAA,2CAAoD;AAIpD;;;GAGG;AACH,MAAa,uBAAuB;IAEhC;;;;OAIG;IACH,kBAAkB,CAAC,WAAwB,EAAE,mBAA2B,UAAU;QAC9E,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,kBAAkB,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACpE,OAAO;QACX,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,qDAAqD,gBAAgB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAChB,WAAwB,EACxB,MAAS,EACT,aAAqB,QAAQ;
|
|
1
|
+
{"version":3,"file":"access-validation.service.js","sourceRoot":"","sources":["../../../../../src/modules/common/services/access-validation.service.ts"],"names":[],"mappings":";;;AAAA,2CAAoD;AAIpD;;;GAGG;AACH,MAAa,uBAAuB;IAEhC;;;;OAIG;IACH,kBAAkB,CAAC,WAAwB,EAAE,mBAA2B,UAAU;QAC9E,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,kBAAkB,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACpE,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,qDAAqD,gBAAgB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAChB,WAAwB,EACxB,MAAS,EACT,aAAqB,QAAQ,EAC7B,SAAkB;QAElB,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACzE,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,UAAU,oCAAoC,CAAC,CAAC;QACnG,CAAC;QAED,IAAI,WAAW,CAAC,kBAAkB,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,cAAc,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAC3D,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,UAAU,uCAAuC,CAAC,CAAC;YACtG,CAAC;YACD,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,eAAe,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBAC7D,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,UAAU,yCAAyC,CAAC,CAAC;YACxG,CAAC;YACD,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,IAAI,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC9C,OAAO;YACX,CAAC;QACL,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,0DAA0D,UAAU,SAAS,CAAC,CAAC;IAChH,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAChB,WAAwB,EACxB,SAAY,EACZ,aAAqB,QAAQ;QAE7B,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;YAC3B,IAAI,WAAW,CAAC,kBAAkB,IAAI,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAChG,MAAM,IAAI,2BAAkB,CAAC,iBAAiB,UAAU,wBAAwB,CAAC,CAAC;YACtF,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,mBAAmB,IAAI,SAAS,CAAC,eAAe,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACnG,MAAM,IAAI,2BAAkB,CAAC,iBAAiB,UAAU,0BAA0B,CAAC,CAAC;YACxF,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,WAAW,CAAC,YAAY,IAAI,SAAS,CAAC,SAAS,KAAK,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC/E,MAAM,IAAI,2BAAkB,CAAC,iBAAiB,UAAU,mBAAmB,CAAC,CAAC;YACjF,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,mBAAmB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;YACnG,MAAM,IAAI,2BAAkB,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;CACJ;AAvGD,0DAuGC"}
|
|
@@ -13,7 +13,10 @@ export class AccessValidationService {
|
|
|
13
13
|
if (accessScope.isSuperAdmin) {
|
|
14
14
|
return;
|
|
15
15
|
}
|
|
16
|
-
if (accessScope.
|
|
16
|
+
if (accessScope.isOrganizationUser || accessScope.isControlCentreUser) {
|
|
17
|
+
return;
|
|
18
|
+
}
|
|
19
|
+
if (accessScope.isMobileUser) {
|
|
17
20
|
return;
|
|
18
21
|
}
|
|
19
22
|
throw new ForbiddenException(`Access denied: Insufficient permissions to access ${pluralEntityName}`);
|
|
@@ -24,25 +27,30 @@ export class AccessValidationService {
|
|
|
24
27
|
* @param entity - The entity to check access for
|
|
25
28
|
* @param entityName - The name of the entity (for error messages)
|
|
26
29
|
*/
|
|
27
|
-
validateEntityAccess(accessScope, entity, entityName = 'Entity') {
|
|
30
|
+
validateEntityAccess(accessScope, entity, entityName = 'Entity', creatorId) {
|
|
28
31
|
if (accessScope.isSuperAdmin) {
|
|
29
32
|
return;
|
|
30
33
|
}
|
|
31
|
-
if (!entity.organizationId && !entity.controlCentreId) {
|
|
34
|
+
if (!entity.organizationId && !entity.controlCentreId && !entity.creatorId) {
|
|
32
35
|
throw new ForbiddenException(`Access denied: ${entityName} has no access control information`);
|
|
33
36
|
}
|
|
34
|
-
if (accessScope.
|
|
37
|
+
if (accessScope.isOrganizationUser) {
|
|
35
38
|
if (entity.organizationId !== accessScope.organizationFilter) {
|
|
36
39
|
throw new ForbiddenException(`Access denied: ${entityName} does not belong to your organization`);
|
|
37
40
|
}
|
|
38
41
|
return;
|
|
39
42
|
}
|
|
40
|
-
if (accessScope.
|
|
43
|
+
if (accessScope.isControlCentreUser) {
|
|
41
44
|
if (entity.controlCentreId !== accessScope.controlCentreFilter) {
|
|
42
45
|
throw new ForbiddenException(`Access denied: ${entityName} does not belong to your control centre`);
|
|
43
46
|
}
|
|
44
47
|
return;
|
|
45
48
|
}
|
|
49
|
+
if (accessScope.isMobileUser) {
|
|
50
|
+
if (creatorId && entity.creatorId === creatorId) {
|
|
51
|
+
return;
|
|
52
|
+
}
|
|
53
|
+
}
|
|
46
54
|
throw new ForbiddenException(`Access denied: Insufficient permissions to access this ${entityName} entity`);
|
|
47
55
|
}
|
|
48
56
|
/**
|
|
@@ -56,16 +64,21 @@ export class AccessValidationService {
|
|
|
56
64
|
return;
|
|
57
65
|
}
|
|
58
66
|
if (createDto.organizationId) {
|
|
59
|
-
if (accessScope.
|
|
67
|
+
if (accessScope.isOrganizationUser && createDto.organizationId !== accessScope.organizationFilter) {
|
|
60
68
|
throw new ForbiddenException(`Cannot create ${entityName} for this organization`);
|
|
61
69
|
}
|
|
62
70
|
}
|
|
63
71
|
if (createDto.controlCentreId) {
|
|
64
|
-
if (accessScope.
|
|
72
|
+
if (accessScope.isControlCentreUser && createDto.controlCentreId !== accessScope.controlCentreFilter) {
|
|
65
73
|
throw new ForbiddenException(`Cannot create ${entityName} for this control centre`);
|
|
66
74
|
}
|
|
67
75
|
}
|
|
68
|
-
if (
|
|
76
|
+
if (createDto.creatorId) {
|
|
77
|
+
if (accessScope.isMobileUser && createDto.creatorId !== accessScope.mobileFilter) {
|
|
78
|
+
throw new ForbiddenException(`Cannot create ${entityName} for another user`);
|
|
79
|
+
}
|
|
80
|
+
}
|
|
81
|
+
if (!accessScope.organizationFilter && !accessScope.controlCentreFilter && !accessScope.mobileFilter) {
|
|
69
82
|
throw new ForbiddenException(`Insufficient permissions to create ${entityName}`);
|
|
70
83
|
}
|
|
71
84
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"access-validation.service.js","sourceRoot":"","sources":["../../../../../src/modules/common/services/access-validation.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIpD;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IAEhC;;;;OAIG;IACH,kBAAkB,CAAC,WAAwB,EAAE,mBAA2B,UAAU;QAC9E,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,kBAAkB,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACpE,OAAO;QACX,CAAC;QAED,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,gBAAgB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAChB,WAAwB,EACxB,MAAS,EACT,aAAqB,QAAQ;
|
|
1
|
+
{"version":3,"file":"access-validation.service.js","sourceRoot":"","sources":["../../../../../src/modules/common/services/access-validation.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIpD;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IAEhC;;;;OAIG;IACH,kBAAkB,CAAC,WAAwB,EAAE,mBAA2B,UAAU;QAC9E,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,kBAAkB,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACpE,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,gBAAgB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAChB,WAAwB,EACxB,MAAS,EACT,aAAqB,QAAQ,EAC7B,SAAkB;QAElB,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACzE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,UAAU,oCAAoC,CAAC,CAAC;QACnG,CAAC;QAED,IAAI,WAAW,CAAC,kBAAkB,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,cAAc,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAC3D,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,UAAU,uCAAuC,CAAC,CAAC;YACtG,CAAC;YACD,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,eAAe,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBAC7D,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,UAAU,yCAAyC,CAAC,CAAC;YACxG,CAAC;YACD,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,IAAI,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC9C,OAAO;YACX,CAAC;QACL,CAAC;QAED,MAAM,IAAI,kBAAkB,CAAC,0DAA0D,UAAU,SAAS,CAAC,CAAC;IAChH,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAChB,WAAwB,EACxB,SAAY,EACZ,aAAqB,QAAQ;QAE7B,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;YAC3B,IAAI,WAAW,CAAC,kBAAkB,IAAI,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAChG,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,UAAU,wBAAwB,CAAC,CAAC;YACtF,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,mBAAmB,IAAI,SAAS,CAAC,eAAe,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACnG,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,UAAU,0BAA0B,CAAC,CAAC;YACxF,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,WAAW,CAAC,YAAY,IAAI,SAAS,CAAC,SAAS,KAAK,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC/E,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,UAAU,mBAAmB,CAAC,CAAC;YACjF,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,mBAAmB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;YACnG,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;CACJ"}
|
|
@@ -4,6 +4,7 @@
|
|
|
4
4
|
export interface EntityAccessCheck {
|
|
5
5
|
organizationId?: number;
|
|
6
6
|
controlCentreId?: number;
|
|
7
|
+
creatorId?: number;
|
|
7
8
|
}
|
|
8
9
|
/**
|
|
9
10
|
* Interface for create DTOs that need access validation
|
|
@@ -11,6 +12,7 @@ export interface EntityAccessCheck {
|
|
|
11
12
|
export interface CreateEntityAccessCheck {
|
|
12
13
|
organizationId?: number;
|
|
13
14
|
controlCentreId?: number;
|
|
15
|
+
creatorId?: number;
|
|
14
16
|
}
|
|
15
17
|
/**
|
|
16
18
|
* Interface for update DTOs that need access validation
|
|
@@ -18,4 +20,5 @@ export interface CreateEntityAccessCheck {
|
|
|
18
20
|
export interface UpdateEntityAccessCheck {
|
|
19
21
|
organizationId?: number;
|
|
20
22
|
controlCentreId?: number;
|
|
23
|
+
creatorId?: number;
|
|
21
24
|
}
|
|
@@ -17,7 +17,7 @@ export declare class AccessValidationService {
|
|
|
17
17
|
* @param entity - The entity to check access for
|
|
18
18
|
* @param entityName - The name of the entity (for error messages)
|
|
19
19
|
*/
|
|
20
|
-
validateEntityAccess<T extends EntityAccessCheck>(accessScope: AccessScope, entity: T, entityName?: string): void;
|
|
20
|
+
validateEntityAccess<T extends EntityAccessCheck>(accessScope: AccessScope, entity: T, entityName?: string, creatorId?: number): void;
|
|
21
21
|
/**
|
|
22
22
|
* Validates if a user can create an entity with the specified organization/control centre
|
|
23
23
|
* @param accessScope - The access scope for the user
|