chamomind/jws-backend
chamomind/jws-backend
6
0
Fork 0
Code Issues Projects 1 Releases Packages 1 Wiki Activity Actions

feat: permission control

Browse source
This commit is contained in:
Methapon Metanipat 2024-09-05 09:01:34 +07:00
parent 42cce880cd
commit b53dcb3a19
1 changed files with 61 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

51
src/controllers/customer-controller.ts
View file

@ -18,6 +18,7 @@ import prisma from "../db";
import minio, { deleteFolder, presignedGetObjectIfExist } from "../services/minio"; import minio, { deleteFolder, presignedGetObjectIfExist } from "../services/minio";
import HttpStatus from "../interfaces/http-status"; import HttpStatus from "../interfaces/http-status";
import HttpError from "../interfaces/http-error"; import HttpError from "../interfaces/http-error";
import { isSystem } from "../utils/keycloak";
if (!process.env.MINIO_BUCKET) { if (!process.env.MINIO_BUCKET) {
throw Error("Require MinIO bucket."); throw Error("Require MinIO bucket.");
@ -200,6 +201,13 @@ export class CustomerController extends Controller {
user: { user: {
where: { userId: req.user.sub }, where: { userId: req.user.sub },
}, },
headOffice: {
include: {
user: {
where: { userId: req.user.sub },
},
},
},
}, },
}), }),
]); ]);
@ -212,7 +220,8 @@ export class CustomerController extends Controller {
); );
} }
if (body.registeredBranchId !== undefined && !globalAllow(req.user)) { if (body.registeredBranchId !== undefined && !isSystem(req.user)) {
if (!globalAllow(req.user)) {
if (body.registeredBranchId === null || (branch && branch.user.length === 0)) { if (body.registeredBranchId === null || (branch && branch.user.length === 0)) {
throw new HttpError( throw new HttpError(
HttpStatus.FORBIDDEN, HttpStatus.FORBIDDEN,
@ -220,6 +229,21 @@ export class CustomerController extends Controller {
"noPermission", "noPermission",
); );
} }
} else {
if (
body.registeredBranchId === null ||
(branch &&
branch.user.length === 0 &&
branch.headOffice &&
branch.headOffice.user.length === 0)
) {
throw new HttpError(
HttpStatus.FORBIDDEN,
"You do not have permission to perform this action.",
"noPermission",
);
}
}
} }
const record = await prisma.$transaction( const record = await prisma.$transaction(
@ -286,6 +310,13 @@ export class CustomerController extends Controller {
user: { user: {
where: { userId: req.user.sub }, where: { userId: req.user.sub },
}, },
headOffice: {
include: {
user: {
where: { userId: req.user.sub },
},
},
},
}, },
}), }),
]); ]);
@ -298,7 +329,8 @@ export class CustomerController extends Controller {
); );
} }
if (body.registeredBranchId !== undefined && !globalAllow(req.user)) { if (body.registeredBranchId !== undefined && !isSystem(req.user)) {
if (!globalAllow(req.user)) {
if (body.registeredBranchId === null || (branch && branch.user.length === 0)) { if (body.registeredBranchId === null || (branch && branch.user.length === 0)) {
throw new HttpError( throw new HttpError(
HttpStatus.FORBIDDEN, HttpStatus.FORBIDDEN,
@ -306,6 +338,21 @@ export class CustomerController extends Controller {
"noPermission", "noPermission",
); );
} }
} else {
if (
body.registeredBranchId === null ||
(branch &&
branch.user.length === 0 &&
branch.headOffice &&
branch.headOffice.user.length === 0)
) {
throw new HttpError(
HttpStatus.FORBIDDEN,
"You do not have permission to perform this action.",
"noPermission",
);
}
}
} }
const record = await prisma.$transaction(async (tx) => { const record = await prisma.$transaction(async (tx) => {