plugin-file-preview-auth 1.2.9 → 1.3.0

package/dist/server/plugin.js

@@ -377,15 +377,97 @@ class PluginFilePreviewAuthServer extends import_server.Plugin {
     }
     ctx.throw(404, "Attachment not found for this preview file");
   }
+  getParentCollections(fileCollectionName) {
+    const parents = [];
+    for (const collection of this.db.collections.values()) {
+      if (collection.name === fileCollectionName) continue;
+      for (const field of collection.fields.values()) {
+        const options = field.options || {};
+        if (field.type === "belongsToMany" && options.target === fileCollectionName && options.through) {
+          parents.push({
+            collectionName: collection.name,
+            throughTable: options.through,
+            otherKey: options.otherKey || "attachmentId",
+            foreignKey: options.foreignKey || `${collection.model.name.toLowerCase()}Id`
+          });
+        }
+      }
+    }
+    return parents;
+  }
+  async checkParentCollectionAccess(attachmentId, fileCollectionName, currentRoles, ctx) {
+    var _a, _b, _c;
+    const parents = this.getParentCollections(fileCollectionName);
+    if (parents.length === 0) {
+      const canView = this.app.acl.can({
+        roles: currentRoles,
+        resource: fileCollectionName,
+        action: "view"
+      });
+      return !!canView;
+    }
+    for (const parent of parents) {
+      const canView = this.app.acl.can({
+        roles: currentRoles,
+        resource: parent.collectionName,
+        action: "view"
+      });
+      if (!canView) continue;
+      try {
+        const throughCollection = this.db.getCollection(parent.throughTable);
+        if (throughCollection) {
+          const links = await throughCollection.repository.find({
+            filter: { [parent.otherKey]: attachmentId }
+          });
+          if (links.length > 0) {
+            const parentIds = links.map((l) => l.get(parent["foreignKey"])).filter(Boolean);
+            if (parentIds.length > 0) {
+              let dataScopeFilter = ((_a = canView.params) == null ? void 0 : _a.filter) || {};
+              if (ctx && ctx.app.environment) {
+                dataScopeFilter = ctx.app.environment.renderJsonTemplate(dataScopeFilter, {
+                  $user: ((_b = ctx.state.currentUser) == null ? void 0 : _b.toJSON) ? ctx.state.currentUser.toJSON() : ctx.state.currentUser,
+                  $nRole: ctx.state.currentRole
+                });
+              }
+              const parentCollection = this.db.getCollection(parent.collectionName);
+              const pk = ((_c = parentCollection == null ? void 0 : parentCollection.model) == null ? void 0 : _c.primaryKeyAttribute) || "id";
+              const count = await parentCollection.repository.count({
+                filter: {
+                  $and: [
+                    { [pk]: { $in: parentIds } },
+                    dataScopeFilter
+                  ]
+                }
+              });
+              if (count > 0) return true;
+            }
+          }
+        }
+      } catch (error) {
+        this.log.warn(`[FilePreviewAuth] Failed to query through table "${parent.throughTable}":`, error.message);
+      }
+    }
+    return false;
+  }
   async assertCanAccessAttachment(ctx, attachment) {
+    var _a, _b;
     const currentUser = this.assertAuthenticated(ctx);
     const createdById = getAttachmentValue(attachment, "createdById");
     const currentRoles = ctx.state.currentRoles || [];
     const userRoles = currentUser.roles || [];
     const isOwner = createdById != null && String(createdById) === String(currentUser.id);
     const isAdmin = currentRoles.includes("root") || currentRoles.includes("admin") || userRoles.some((role) => role === "root" || role === "admin" || (role == null ? void 0 : role.name) === "root" || (role == null ? void 0 : role.name) === "admin");
-    if (!isOwner && !isAdmin) {
-      ctx.throw(403, "Permission denied: you cannot view other users' files");
+    if (isOwner || isAdmin) {
+      return;
+    }
+    const attachmentId = getAttachmentValue(attachment, "id");
+    if (!attachmentId) {
+      ctx.throw(403, "Permission denied: virtual attachment cannot be accessed");
+    }
+    const collectionName = ((_b = (_a = attachment.constructor) == null ? void 0 : _a.collection) == null ? void 0 : _b.name) || getAttachmentValue(attachment, "collectionName") || "attachments";
+    const hasParentAccess = await this.checkParentCollectionAccess(attachmentId, collectionName, currentRoles, ctx);
+    if (!hasParentAccess) {
+      ctx.throw(403, "Permission denied: you do not have permission to access this attachment");
     }
   }
   assertAuthenticated(ctx) {

package/package.json

@@ -6,7 +6,7 @@
   "description": "Preview PDF, image, and text files with Bearer token authentication via blob URLs.",
   "description.vi-VN": "Xem trước file PDF, hình ảnh và văn bản với xác thực Bearer token qua blob URL.",
   "description.zh-CN": "通过 Bearer 令牌认证和 Blob URL 预览 PDF、图片和文本文件。",
-  "version": "1.2.9",
+  "version": "1.3.0",
   "main": "dist/server/index.js",
   "files": [
     "dist",