-
-
Notifications
You must be signed in to change notification settings - Fork 3.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into feat/CAPTCHA
- Loading branch information
Showing
14 changed files
with
197 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,47 +1,78 @@ | ||
| const { getRoleByName } = require('~/models/Role'); | ||
| const { logger } = require('~/config'); | ||
|
|
||
| /** | ||
| * Core function to check if a user has one or more required permissions | ||
| * | ||
| * @param {object} user - The user object | ||
| * @param {PermissionTypes} permissionType - The type of permission to check | ||
| * @param {Permissions[]} permissions - The list of specific permissions to check | ||
| * @param {Record<Permissions, string[]>} [bodyProps] - An optional object where keys are permissions and values are arrays of properties to check | ||
| * @param {object} [checkObject] - The object to check properties against | ||
| * @returns {Promise<boolean>} Whether the user has the required permissions | ||
| */ | ||
| const checkAccess = async (user, permissionType, permissions, bodyProps = {}, checkObject = {}) => { | ||
| if (!user) { | ||
| return false; | ||
| } | ||
|
|
||
| const role = await getRoleByName(user.role); | ||
| if (role && role[permissionType]) { | ||
| const hasAnyPermission = permissions.some((permission) => { | ||
| if (role[permissionType][permission]) { | ||
| return true; | ||
| } | ||
|
|
||
| if (bodyProps[permission] && checkObject) { | ||
| return bodyProps[permission].some((prop) => | ||
| Object.prototype.hasOwnProperty.call(checkObject, prop), | ||
| ); | ||
| } | ||
|
|
||
| return false; | ||
| }); | ||
|
|
||
| return hasAnyPermission; | ||
| } | ||
|
|
||
| return false; | ||
| }; | ||
|
|
||
| /** | ||
| * Middleware to check if a user has one or more required permissions, optionally based on `req.body` properties. | ||
| * | ||
| * @param {PermissionTypes} permissionType - The type of permission to check. | ||
| * @param {Permissions[]} permissions - The list of specific permissions to check. | ||
| * @param {Record<Permissions, string[]>} [bodyProps] - An optional object where keys are permissions and values are arrays of `req.body` properties to check. | ||
| * @returns {Function} Express middleware function. | ||
| * @returns {(req: ServerRequest, res: ServerResponse, next: NextFunction) => Promise<void>} Express middleware function. | ||
| */ | ||
| const generateCheckAccess = (permissionType, permissions, bodyProps = {}) => { | ||
| return async (req, res, next) => { | ||
| try { | ||
| const { user } = req; | ||
| if (!user) { | ||
| return res.status(401).json({ message: 'Authorization required' }); | ||
| } | ||
| const hasAccess = await checkAccess( | ||
| req.user, | ||
| permissionType, | ||
| permissions, | ||
| bodyProps, | ||
| req.body, | ||
| ); | ||
|
|
||
| const role = await getRoleByName(user.role); | ||
| if (role && role[permissionType]) { | ||
| const hasAnyPermission = permissions.some((permission) => { | ||
| if (role[permissionType][permission]) { | ||
| return true; | ||
| } | ||
|
|
||
| if (bodyProps[permission] && req.body) { | ||
| return bodyProps[permission].some((prop) => | ||
| Object.prototype.hasOwnProperty.call(req.body, prop), | ||
| ); | ||
| } | ||
|
|
||
| return false; | ||
| }); | ||
|
|
||
| if (hasAnyPermission) { | ||
| return next(); | ||
| } | ||
| if (hasAccess) { | ||
| return next(); | ||
| } | ||
|
|
||
| logger.warn( | ||
| `[${permissionType}] Forbidden: Insufficient permissions for User ${req.user.id}: ${permissions.join(', ')}`, | ||
| ); | ||
| return res.status(403).json({ message: 'Forbidden: Insufficient permissions' }); | ||
| } catch (error) { | ||
| logger.error(error); | ||
| return res.status(500).json({ message: `Server error: ${error.message}` }); | ||
| } | ||
| }; | ||
| }; | ||
|
|
||
| module.exports = generateCheckAccess; | ||
| module.exports = { | ||
| checkAccess, | ||
| generateCheckAccess, | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,8 @@ | ||
| const checkAdmin = require('./checkAdmin'); | ||
| const generateCheckAccess = require('./generateCheckAccess'); | ||
| const { checkAccess, generateCheckAccess } = require('./generateCheckAccess'); | ||
|
|
||
| module.exports = { | ||
| checkAdmin, | ||
| checkAccess, | ||
| generateCheckAccess, | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.