kuzzle 2.19.2 → 2.19.5

package/lib/core/security/roleRepository.js

@@ -19,18 +19,18 @@
  * limitations under the License.
  */
 
-'use strict';
+"use strict";
 
-const Bluebird = require('bluebird');
+const Bluebird = require("bluebird");
 
-const kuzzleStateEnum = require('../../kuzzle/kuzzleStateEnum');
-const { Role } = require('../../model/security/role');
-const Repository = require('../shared/repository');
-const kerror = require('../../kerror');
-const didYouMean = require('../../util/didYouMean');
-const cacheDbEnum = require('../cache/cacheDbEnum');
+const kuzzleStateEnum = require("../../kuzzle/kuzzleStateEnum");
+const { Role } = require("../../model/security/role");
+const Repository = require("../shared/repository");
+const kerror = require("../../kerror");
+const didYouMean = require("../../util/didYouMean");
+const cacheDbEnum = require("../cache/cacheDbEnum");
 
-const roleRightsError = kerror.wrap('security', 'role');
+const roleRightsError = kerror.wrap("security", "role");
 
 /**
  * @class RoleRepository
@@ -41,7 +41,7 @@ class RoleRepository extends Repository {
    * @constructor
    * @param {SecurityModule} securityModule
    */
-  constructor (securityModule) {
+  constructor(securityModule) {
     super({
       cache: cacheDbEnum.NONE,
       store: global.kuzzle.internalIndex,
@@ -49,12 +49,12 @@ class RoleRepository extends Repository {
 
     this.module = securityModule;
 
-    this.collection = 'roles';
+    this.collection = "roles";
     this.ObjectConstructor = Role;
     this.roles = new Map();
   }
 
-  init () {
+  init() {
     /**
      * Creates a new role
      * @param  {String} id - role identifier / name
@@ -63,9 +63,9 @@ class RoleRepository extends Repository {
      * @returns {Role}
      * @throws If already exists or if the content is invalid
      */
-    global.kuzzle.onAsk(
-      'core:security:role:create',
-      (id, content, opts) => this.create(id, content, opts));
+    global.kuzzle.onAsk("core:security:role:create", (id, content, opts) =>
+      this.create(id, content, opts)
+    );
 
     /**
      * Creates a new role, or replaces it if it already exists
@@ -76,8 +76,9 @@ class RoleRepository extends Repository {
      * @throws If the content is invalid
      */
     global.kuzzle.onAsk(
-      'core:security:role:createOrReplace',
-      (id, content, opts) => this.createOrReplace(id, content, opts));
+      "core:security:role:createOrReplace",
+      (id, content, opts) => this.createOrReplace(id, content, opts)
+    );
 
     /**
      * Deletes an existing role
@@ -86,9 +87,9 @@ class RoleRepository extends Repository {
      * @throws If the role doesn't exist, if it is protected, or if it's
      *         still in use
      */
-    global.kuzzle.onAsk(
-      'core:security:role:delete',
-      (id, opts) => this.deleteById(id, opts));
+    global.kuzzle.onAsk("core:security:role:delete", (id, opts) =>
+      this.deleteById(id, opts)
+    );
 
     /**
      * Loads and returns an existing role
@@ -96,7 +97,7 @@ class RoleRepository extends Repository {
      * @returns {Role}
      * @throws {NotFoundError} If the role doesn't exist
      */
-    global.kuzzle.onAsk('core:security:role:get', id => this.load(id));
+    global.kuzzle.onAsk("core:security:role:get", (id) => this.load(id));
 
     /**
      * Invalidates the RAM cache from the given role ID. If none is provided,
@@ -104,9 +105,9 @@ class RoleRepository extends Repository {
      *
      * @param  {String} [id] - role identifier
      */
-    global.kuzzle.onAsk(
-      'core:security:role:invalidate',
-      id => this.invalidate(id));
+    global.kuzzle.onAsk("core:security:role:invalidate", (id) =>
+      this.invalidate(id)
+    );
 
     /**
      * Gets multiple roles
@@ -114,7 +115,9 @@ class RoleRepository extends Repository {
      * @returns {Array.<Role>}
      * @throws If one or more roles don't exist
      */
-    global.kuzzle.onAsk('core:security:role:mGet', ids => this.loadRoles(ids));
+    global.kuzzle.onAsk("core:security:role:mGet", (ids) =>
+      this.loadRoles(ids)
+    );
 
     /**
      * Searches roles associated to a provided list of API controllers
@@ -123,17 +126,17 @@ class RoleRepository extends Repository {
      * @param  {Number} size
      * @returns {Object} Search results
      */
-    global.kuzzle.onAsk(
-      'core:security:role:search',
-      (controllers, opts) => this.searchRole(controllers, opts));
+    global.kuzzle.onAsk("core:security:role:search", (controllers, opts) =>
+      this.searchRole(controllers, opts)
+    );
 
     /**
      * Removes all existing roles and invalidates the RAM cache
      * @param  {Object} opts (refresh)
      */
-    global.kuzzle.onAsk(
-      'core:security:role:truncate',
-      opts => this.truncate(opts));
+    global.kuzzle.onAsk("core:security:role:truncate", (opts) =>
+      this.truncate(opts)
+    );
 
     /**
      * Updates an existing profile using a partial content
@@ -143,14 +146,14 @@ class RoleRepository extends Repository {
      *                         userId (used for metadata)
      * @returns {Role} Updated role
      */
-    global.kuzzle.onAsk(
-      'core:security:role:update',
-      (id, content, opts) => this.update(id, content, opts));
+    global.kuzzle.onAsk("core:security:role:update", (id, content, opts) =>
+      this.update(id, content, opts)
+    );
 
     /**
      * Verifies that existing roles are sane
      */
-    global.kuzzle.onAsk('core:security:verify', () => this.sanityCheck());
+    global.kuzzle.onAsk("core:security:verify", () => this.sanityCheck());
   }
 
   /**
@@ -160,18 +163,17 @@ class RoleRepository extends Repository {
    * @param {Object} options - resetCache (false)
    * @returns {Promise.<Array.<Role>>}
    */
-  loadRoles (ids) {
+  loadRoles(ids) {
     const roles = [];
 
     for (const id of ids) {
       let role = this.roles.get(id);
 
-      if (! role) {
-        role = this.loadOneFromDatabase(id)
-          .then(r => {
-            this.roles.set(id, r);
-            return r;
-          });
+      if (!role) {
+        role = this.loadOneFromDatabase(id).then((r) => {
+          this.roles.set(id, r);
+          return r;
+        });
 
         this.roles.set(id, role);
       }
@@ -190,10 +192,10 @@ class RoleRepository extends Repository {
    * @param {Object} [opts]
    * @returns {Role}
    */
-  async _createOrReplace (
+  async _createOrReplace(
     id,
     content,
-    { force = false, method, refresh = 'false', userId = null } = {}
+    { force = false, method, refresh = "false", userId = null } = {}
   ) {
     const dto = {
       ...content,
@@ -220,9 +222,9 @@ class RoleRepository extends Repository {
    * @param {Object} [opts]
    * @returns {Role}
    */
-  async create (id, content, opts) {
+  async create(id, content, opts) {
     return this._createOrReplace(id, content, {
-      method: 'create',
+      method: "create",
       ...opts,
     });
   }
@@ -235,9 +237,9 @@ class RoleRepository extends Repository {
    * @param {Object} [opts]
    * @returns {Role}
    */
-  async createOrReplace (id, content, opts) {
+  async createOrReplace(id, content, opts) {
     return this._createOrReplace(id, content, {
-      method: 'createOrReplace',
+      method: "createOrReplace",
       ...opts,
     });
   }
@@ -253,7 +255,7 @@ class RoleRepository extends Repository {
    * @param  {Object} [opts]
    * @returns {Promise}
    */
-  async update (id, content, { force, refresh, retryOnConflict, userId } = {}) {
+  async update(id, content, { force, refresh, retryOnConflict, userId } = {}) {
     const updated = await this.fromDTO({
       // /!\ order is important
       ...content,
@@ -267,7 +269,7 @@ class RoleRepository extends Repository {
 
     return this.validateAndSaveRole(updated, {
       force,
-      method: 'replace',
+      method: "replace",
       refresh,
       retryOnConflict,
     });
@@ -280,7 +282,7 @@ class RoleRepository extends Repository {
    * @returns {Promise.<Role>} role
    * @throws {NotFoundError} If the corresponding role doesn't exist
    */
-  async load (id) {
+  async load(id) {
     if (this.roles.has(id)) {
       return this.roles.get(id);
     }
@@ -295,13 +297,12 @@ class RoleRepository extends Repository {
   /**
    * @override
    */
-  async loadOneFromDatabase (id) {
+  async loadOneFromDatabase(id) {
     try {
       return await super.loadOneFromDatabase(id);
-    }
-    catch (err) {
+    } catch (err) {
       if (err.status === 404) {
-        throw kerror.get('security', 'role', 'not_found', id);
+        throw kerror.get("security", "role", "not_found", id);
       }
       throw err;
     }
@@ -311,25 +312,27 @@ class RoleRepository extends Repository {
    * @param {Object} body Search body containing either "query" or "controllers"
    * @param {Object} options
    */
-  async searchRole (body, { from = 0, size = 9999 } = {}) {
-    if (! body.controllers) {
+  async searchRole(body, { from = 0, size = 9999 } = {}) {
+    if (!body.controllers) {
       return this.search(body, { from, size });
     }
 
     const searchResults = await this.search(
-      { query: {}, sort: [{ _id: { order: 'asc' } }] },
-      { from: 0, size: 9999 }); // /!\ NOT the options values
+      { query: {}, sort: [{ _id: { order: "asc" } }] },
+      { from: 0, size: 9999 }
+    ); // /!\ NOT the options values
 
     const result = {
       hits: searchResults.hits,
-      total: searchResults.total
+      total: searchResults.total,
     };
 
     if (body.controllers.length > 0) {
-      result.hits = searchResults.hits
-        .filter(role => Object
-          .keys(role.controllers)
-          .some(key => key === '*' || body.controllers.includes(key)));
+      result.hits = searchResults.hits.filter((role) =>
+        Object.keys(role.controllers).some(
+          (key) => key === "*" || body.controllers.includes(key)
+        )
+      );
 
       result.total = result.hits.length;
     }
@@ -346,11 +349,11 @@ class RoleRepository extends Repository {
    * @param {object} [options] The persistence options
    * @returns Promise
    */
-  async validateAndSaveRole (role, options = {}) {
+  async validateAndSaveRole(role, options = {}) {
     await role.validateDefinition();
 
-    if (role._id === 'anonymous' && ! role.canLogIn()) {
-      throw kerror.get('security', 'role', 'login_required');
+    if (role._id === "anonymous" && !role.canLogIn()) {
+      throw kerror.get("security", "role", "login_required");
     }
 
     this.checkRoleNativeRights(role);
@@ -368,33 +371,34 @@ class RoleRepository extends Repository {
    *
    * @param {Role} role
    */
-  checkRoleNativeRights (role) {
-    Object.keys(role.controllers).forEach(roleController => {
-      if ( roleController !== '*'
-        && ! global.kuzzle.funnel.isNativeController(roleController)
+  checkRoleNativeRights(role) {
+    Object.keys(role.controllers).forEach((roleController) => {
+      if (
+        roleController !== "*" &&
+        !global.kuzzle.funnel.isNativeController(roleController)
       ) {
         return;
       }
 
-      if (roleController === '*') {
-        Object.keys(role.controllers['*'].actions).forEach(action => {
-          if (action !== '*') {
-            throw roleRightsError.get('unknown_action', role._id, action, '*');
+      if (roleController === "*") {
+        Object.keys(role.controllers["*"].actions).forEach((action) => {
+          if (action !== "*") {
+            throw roleRightsError.get("unknown_action", role._id, action, "*");
           }
         });
-      }
-      else {
+      } else {
         const controller = global.kuzzle.funnel.controllers.get(roleController);
         const actions = Object.keys(role.controllers[roleController].actions);
 
-        actions.forEach(action => {
-          if (action !== '*' && ! controller._isAction(action)) {
+        actions.forEach((action) => {
+          if (action !== "*" && !controller._isAction(action)) {
             throw roleRightsError.get(
-              'unknown_action',
+              "unknown_action",
               role._id,
               action,
               roleController,
-              didYouMean(action, controller.__actions));
+              didYouMean(action, controller.__actions)
+            );
           }
         });
       }
@@ -407,23 +411,25 @@ class RoleRepository extends Repository {
    * @param {Role} role
    * @param {Force} force
    */
-  checkRolePluginsRights (role, { force = false, forceWarn = false } = {}) {
+  checkRolePluginsRights(role, { force = false, forceWarn = false } = {}) {
     const plugins = global.kuzzle.pluginsManager;
 
     for (const roleController of Object.keys(role.controllers)) {
-      if ( roleController === '*'
-        || global.kuzzle.funnel.isNativeController(roleController)
+      if (
+        roleController === "*" ||
+        global.kuzzle.funnel.isNativeController(roleController)
       ) {
         return;
       }
 
-      if (! plugins.isController(roleController)) {
-        if (! force) {
+      if (!plugins.isController(roleController)) {
+        if (!force) {
           throw roleRightsError.get(
-            'unknown_controller',
+            "unknown_controller",
             role._id,
             roleController,
-            didYouMean(roleController, plugins.getControllerNames()));
+            didYouMean(roleController, plugins.getControllerNames())
+          );
         }
 
         // Do not print any warning if Kuzzle is not started or if warn is not forced.
@@ -432,7 +438,9 @@ class RoleRepository extends Repository {
         // then we need to display non-existing controllers with the sanity check
         // made after plugins controllers loading.
         if (global.kuzzle.state === kuzzleStateEnum.RUNNING || forceWarn) {
-          global.kuzzle.log.warn(`The role "${role._id}" gives access to the non-existing controller "${roleController}".`);
+          global.kuzzle.log.warn(
+            `The role "${role._id}" gives access to the non-existing controller "${roleController}".`
+          );
         }
 
         return;
@@ -440,19 +448,22 @@ class RoleRepository extends Repository {
 
       const roleActions = Object.keys(role.controllers[roleController].actions);
       for (const action of roleActions) {
-        if (action !== '*' && ! plugins.isAction(roleController, action)) {
-          if (! force) {
+        if (action !== "*" && !plugins.isAction(roleController, action)) {
+          if (!force) {
             throw roleRightsError.get(
-              'unknown_action',
+              "unknown_action",
               role._id,
               action,
               roleController,
-              didYouMean(action, plugins.getActions(roleController)));
+              didYouMean(action, plugins.getActions(roleController))
+            );
           }
 
           // see the other comment
           if (global.kuzzle.state === kuzzleStateEnum.RUNNING || forceWarn) {
-            global.kuzzle.log.warn(`The role "${role._id}" gives access to the non-existing action "${action}" for the controller "${roleController}".`);
+            global.kuzzle.log.warn(
+              `The role "${role._id}" gives access to the non-existing action "${action}" for the controller "${roleController}".`
+            );
           }
         }
       }
@@ -464,7 +475,7 @@ class RoleRepository extends Repository {
    * If there are some, Kuzzle will log a warning.
    */
 
-  async sanityCheck () {
+  async sanityCheck() {
     const roles = await this.search({}, {});
 
     for (const role of roles.hits) {
@@ -479,7 +490,7 @@ class RoleRepository extends Repository {
    * @param {object} [options]
    * @returns Promise
    */
-  async deleteById (id, options) {
+  async deleteById(id, options) {
     const role = await this.load(id);
     return this.delete(role, options);
   }
@@ -487,20 +498,23 @@ class RoleRepository extends Repository {
   /**
    * @override
    */
-  async delete (role, { refresh = 'false' } = {}) {
-    if (['admin', 'default', 'anonymous'].indexOf(role._id) > -1) {
-      throw kerror.get('security', 'role', 'cannot_delete');
+  async delete(role, { refresh = "false" } = {}) {
+    if (["admin", "default", "anonymous"].indexOf(role._id) > -1) {
+      throw kerror.get("security", "role", "cannot_delete");
     }
 
-    const query = { term: { 'policies.roleId': role._id } };
+    const query = { term: { "policies.roleId": role._id } };
 
-    const response = await this.module.profile.search({ query }, {
-      from: 0,
-      size: 1
-    });
+    const response = await this.module.profile.search(
+      { query },
+      {
+        from: 0,
+        size: 1,
+      }
+    );
 
     if (response.total > 0) {
-      throw kerror.get('security', 'role', 'in_use', role._id);
+      throw kerror.get("security", "role", "in_use", role._id);
     }
 
     await this.deleteFromDatabase(role._id, { refresh });
@@ -514,11 +528,11 @@ class RoleRepository extends Repository {
    * @param {Role} role
    * @returns {object}
    */
-  serializeToDatabase (role) {
+  serializeToDatabase(role) {
     const serializedRole = {};
 
-    Object.keys(role).forEach(key => {
-      if (key !== '_id' && key !== 'restrictedTo') {
+    Object.keys(role).forEach((key) => {
+      if (key !== "_id" && key !== "restrictedTo") {
         serializedRole[key] = role[key];
       }
     });
@@ -529,11 +543,10 @@ class RoleRepository extends Repository {
   /**
    * @override
    */
-  async truncate (opts) {
+  async truncate(opts) {
     try {
       await super.truncate(opts);
-    }
-    finally {
+    } finally {
       this.invalidate();
     }
   }
@@ -543,11 +556,10 @@ class RoleRepository extends Repository {
    * the entire cache is emptied.
    * @param {string} [roleId]
    */
-  invalidate (roleId) {
-    if (! roleId) {
+  invalidate(roleId) {
+    if (!roleId) {
       this.roles.clear();
-    }
-    else {
+    } else {
       this.roles.delete(roleId);
     }
   }