added permissions to userDocument

index.js

@@ -60,6 +60,7 @@ import userRouter from './src/routes/user.route.js'
 import userCriminalRecordRouter from './src/routes/userCriminalRecord.route.js'
 import userMotivation from './src/routes/userMotivation.route.js'
 import userDocumentRouter from './src/routes/userDocument.route.js'
+import userPermissionRouter from './src/routes/userPermission.route.js'
 import userYearRouter from './src/routes/userYear.route.js'
 
 import userModel from './src/models/user.model.js';
@@ -69,6 +70,7 @@ import responsibilityModel from './src/models/responsibility.model.js';
 import supporterYearModel from './src/models/supporterYear.model.js';
 import supporterDayModel from './src/models/supporterDay.model.js';
 import userDocumentModel from './src/models/userDocument.model.js';
+import userPermissionModel from './src/models/userPermission.model.js';
 
 app.use('/avatar', avatarRouter);
 app.use('/event', eventRouter);
@@ -82,6 +84,7 @@ app.use('/supporterYear', supporterYearRouter);
 app.use('/userCriminalRecord', userCriminalRecordRouter);
 app.use('/userMotivation', userMotivation);
 app.use('/userDocument', userDocumentRouter);
+app.use('/userPermission', userPermissionRouter);
 app.use('/userYear', userYearRouter);
 
 // set port, listen for requests
@@ -103,4 +106,7 @@ supporterYearModel.hasMany(supporterDayModel, {foreignKey: 'uuid'})
 supporterDayModel.hasOne(supporterYearModel, {foreignKey: 'uuid'})
 
 userModel.hasOne(userDocumentModel, {foreignKey: 'uuid'})
-userDocumentModel.hasOne(userModel, {foreignKey: 'uuid'})
+userDocumentModel.hasOne(userModel, {foreignKey: 'uuid'})
+
+userModel.hasMany(userPermissionModel, {foreignKey: 'uuid'})
+userPermissionModel.hasOne(userModel, {foreignKey: 'uuid'})

src/controllers/userDocument.controller.js

@@ -1,10 +1,13 @@
 import userDocumentModel from '../models/userDocument.model.js'
 import settingModel from '../models/setting.model.js'
+import userPermissionModel from '../models/userPermission.model.js'
 
 export async function findAll(req, res) {
+	const executingUser = req.kauth.grant.access_token.content.sub
 	const year = req.query.year || await settingModel.findByPk('currentYear')
 	const isLT = req.kauth.grant.access_token.content.groups.includes(year + '_LT')
-	if (!isLT) {
+	const allowed = isLT || (await userPermissionModel.findOne({where: { uuid: executingUser, permission: 'userDocument'}})).allowed
+	if (!allowed) {
 		res.status(403).send()
 		return;
 	}
@@ -21,10 +24,12 @@ export async function findOne(req, res) {
 		res.status(400).send('bad request')
 		return;
 	}
+	const executingUser = req.kauth.grant.access_token.content.sub
+	const isSelf = executingUser === req.params.uuid
 	const year = (await settingModel.findByPk('currentYear')).value
 	const isLT = req.kauth.grant.access_token.content.groups.includes(year + '_LT')
-	const isSelf = req.kauth.grant.access_token.content.sub === req.params.uuid
-	if (!isLT && !isSelf) {
+	const allowed = isLT || isSelf || (await userPermissionModel.findOne({where: { uuid: executingUser, permission: 'userDocument'}})).allowed
+	if (!allowed) {
 		res.status(403).send()
 		return;
 	}
@@ -37,9 +42,11 @@ export async function findOne(req, res) {
 }
 
 export async function createOrUpdate(req, res) {
+	const executingUser = req.kauth.grant.access_token.content.sub
 	const year = (await settingModel.findByPk('currentYear')).value
 	const isLT = req.kauth.grant.access_token.content.groups.includes(year + '_LT')
-	if (!isLT) {
+	const allowed = isLT || (await userPermissionModel.findOne({where: { uuid: executingUser, permission: 'userDocument'}})).allowed
+	if (!allowed) {
 		res.status(403).send()
 		return;
 	}

src/controllers/userPermission.controller.js

@@ -0,0 +1,48 @@
+import userPermissionModel from '../models/userPermission.model.js'
+import settingModel from '../models/setting.model.js'
+
+export async function findAll(req, res) {
+	try {
+		const userPermission = await userPermissionModel.findAll({where: req.query})
+		res.status(200).send(userPermission)
+	} catch(e) {
+		res.status(400).send()
+	}
+}
+
+export async function findOne(req, res) {
+	if (!req.params || !req.params.uuid || !req.params.permission ) {
+		res.status(400).send('bad request')
+		return;
+	}
+	const userPermission = await userPermissionModel.findOne({where: {permission: req.params.permission, uuid: req.params.uuid}})
+	if (userPermission) {
+		res.status(200).send(userPermission)
+	} else {
+		res.status(404).send('not found')
+	}
+}
+
+export async function createOrUpdate(req, res) {
+	const year = (await settingModel.findByPk('currentYear')).value
+	const isLT = req.kauth.grant.access_token.content.groups.includes(year + '_LT')
+	if (!isLT) {
+		res.status(403).send()
+		return;
+	}
+	if (!req.params || !req.params.uuid || !req.params.permission ) {
+		res.status(400).send('bad request')
+		return;
+	}
+	const userPermission = await userPermissionModel.findOne({where: {permission: req.params.permission, uuid: req.params.uuid}})
+	if (userPermission) {
+		userPermissionModel.update(req.body);
+		res.status(200).send(userPermission)
+	} else {
+		var data = req.body
+		data.permission = req.params.permission
+		data.uuid = req.params.uuid
+		userPermissionModel.create(data)
+		res.status(200).send(userPermission)
+	}
+}

src/controllers/userYear.controller.js

@@ -4,12 +4,14 @@ import keycloak from '../config/keycloak.js';
 import settingModel from "../models/setting.model.js";
 import userModel from "../models/user.model.js";
 import userDocumentModel from "../models/userDocument.model.js";
+import userPermissionModel from "../models/userPermission.model.js";
 import { addToTeamMailinglist, sendMailToUser } from "./mail.controller.js";
 
 export async function findAll(req, res) {
-	const year = req.query.year || await settingModel.findByPk('currentYear')
+	const year = req.query.year || (await settingModel.findByPk('currentYear')).value
 	const isLT = req.kauth.grant.access_token.content.groups.includes(year + '_LT')
-	if (!isLT) {
+	const permissions = await userPermissionModel.findAll({where: {uuid: req.kauth.grant.access_token.content.sub}})
+	if (!isLT && req.query.status !== '4') {
 		res.status(403).send()
 		return;
 	}
@@ -19,12 +21,25 @@ export async function findAll(req, res) {
 		data['include'].push({
 			model: userModel
 		})
+		if (!isLT) {
+			let attributes = [];
+			for (const key in userModel.rawAttributes) {
+				if (userModel.rawAttributes[key]['public']) {
+					attributes.push(key)
+				}
+			};
+			if (attributes.length > 0) {
+				data['include'][0]['attributes'] = attributes
+			}
+		}
 	}
-	if (typeof req.query.documentBundle !== 'undefined') {
-		userYearModel.belongsTo(userDocumentModel, {foreignKey: 'uuid', targetKey: 'uuid'})
-		data['include'].push({
-			model: userDocumentModel
-		})
+	if (isLT || permissions.find(permission => permission.permission === 'userDocument')?.allowed) {
+		if (typeof req.query.documentBundle !== 'undefined') {
+			userYearModel.belongsTo(userDocumentModel, {foreignKey: 'uuid', targetKey: 'uuid'})
+			data['include'].push({
+				model: userDocumentModel
+			})
+		}
 	}
 	delete req.query.userBundle
 	delete req.query.documentBundle

src/models/userPermission.model.js

@@ -0,0 +1,21 @@
+import { DataTypes } from 'sequelize';
+import sequelize from './db.model.js';
+
+export default sequelize.define('UserPermission', {
+  uuid: {
+    type: DataTypes.UUID,
+    primaryKey: true,
+    references: {
+        model: 'Users',
+        key: 'uuid'
+    }
+  },
+  permission: {
+    type: DataTypes.STRING,
+    primaryKey: true
+  },
+  allowed: {
+    type: DataTypes.BOOLEAN,
+    defaultValue: false
+  }
+});

src/routes/userPermission.route.js

@@ -0,0 +1,11 @@
+import { Router } from 'express';
+import keycloak from '../config/keycloak.js';
+import { findAll, findOne, createOrUpdate } from '../controllers/userPermission.controller.js'
+
+var router = new Router();
+
+    router.get('/', keycloak.protect(), findAll);
+    router.get('/:uuid/:permission', keycloak.protect(), findOne);
+    router.post('/:uuid/:permission', keycloak.protect(), createOrUpdate);
+
+export default router