chamomind/jws-backend
chamomind/jws-backend
7
0
Fork 0
Code Issues Projects 1 Releases Packages 1 Wiki Activity Actions

fix: permission failed

Browse source
This commit is contained in:
Methapon Metanipat 2024-09-04 16:47:14 +07:00
parent 859b733245
commit 94cb990b9c
1 changed files with 22 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

41
src/controllers/user-controller.ts
View file

@ -470,7 +470,7 @@ export class UserController extends Controller {
where: { id: userId },
}),
prisma.branch.findMany({
include: { user: { where: { id: req.user.sub } } },
include: { user: { where: { userId: req.user.sub } } },
where: {
id: {
in: Array.isArray(body.branchId) ? body.branchId : body.branchId ? [body.branchId] : [],
@ -515,10 +515,11 @@ export class UserController extends Controller {
const THROW_PERM_MSG = "You do not have permission to perform this action.";
const THROW_PERM_CODE = "noPermission";
if (setRoleIndex < userRoleIndex) {
if (setRoleIndex !== -1 && setRoleIndex < userRoleIndex) {
throw new HttpError(HttpStatus.FORBIDDEN, THROW_PERM_MSG, THROW_PERM_CODE);
}
if (!globalAllow(req.user)) {
if (!globalAllow(req.user) && body.branchId) {
if (branch.some((v) => !v.user.find((v) => v.userId === req.user.sub))) {
throw new HttpError(HttpStatus.FORBIDDEN, THROW_PERM_MSG, THROW_PERM_CODE);
}
@ -542,24 +543,26 @@ export class UserController extends Controller {
const role = list.find((v) => v.name === body.userRole);
const resultAddRole = role && (await addUserRoles(userId, [role]));
if (role) {
const resultAddRole = await addUserRoles(userId, [role]);
if (!resultAddRole) {
throw new Error("Failed. Cannot set user's role.");
} else {
if (Array.isArray(currentRole))
await removeUserRoles(
userId,
currentRole.filter(
(a) =>
!["uma_authorization", "offline_access", "default-roles"].some((b) =>
a.name.includes(b),
),
),
);
if (!resultAddRole) {
throw new Error("Failed. Cannot set user's role.");
} else {
if (Array.isArray(currentRole))
await removeUserRoles(
userId,
currentRole.filter(
(a) =>
!["uma_authorization", "offline_access", "default-roles"].some((b) =>
a.name.includes(b),
),
),
);
}
userRole = role.name;
}
userRole = role.name;
}
if (body.username) {