From 4d3ed0232ed8ee927d1c8a6155a8e950e9225cc8 Mon Sep 17 00:00:00 2001
From: prafull-opensignlabs <prafull.navkar@nxglabs.com>
Date: Mon, 20 Nov 2023 14:11:32 +0530
Subject: [PATCH] security changes in getDocument function & add getDrive
 function

---
 apps/OpenSignServer/cloud/main.js             |  2 +
 .../cloud/parsefunction/getDocument.js        | 63 ++++++++++++-------
 .../cloud/parsefunction/getDrive.js           | 51 +++++++++++++++
 3 files changed, 94 insertions(+), 22 deletions(-)
 create mode 100644 apps/OpenSignServer/cloud/parsefunction/getDrive.js

diff --git a/apps/OpenSignServer/cloud/main.js b/apps/OpenSignServer/cloud/main.js
index e7eca1022..2ecc0fbf1 100644
--- a/apps/OpenSignServer/cloud/main.js
+++ b/apps/OpenSignServer/cloud/main.js
@@ -15,6 +15,7 @@ import AuthLoginAsMail from './parsefunction/AuthLoginAsMail.js';
 import getUserId from './parsefunction/getUserId.js';
 import getUserDetails from './parsefunction/getUserDetails.js';
 import getDocument from './parsefunction/getDocument.js';
+import getDrive from './parsefunction/getDrive.js';
 // import getInProgressReport from './parsefunction/getInProgressReport.js';
 
 Parse.Cloud.define('AddUserToRole', addUserToGroups);
@@ -34,3 +35,4 @@ Parse.Cloud.define('AuthLoginAsMail', AuthLoginAsMail);
 Parse.Cloud.define('getUserId', getUserId);
 Parse.Cloud.define('getUserDetails', getUserDetails);
 Parse.Cloud.define('getDocument', getDocument);
+Parse.Cloud.define('getDrive', getDrive)
diff --git a/apps/OpenSignServer/cloud/parsefunction/getDocument.js b/apps/OpenSignServer/cloud/parsefunction/getDocument.js
index 81640f721..9e4d71ff3 100644
--- a/apps/OpenSignServer/cloud/parsefunction/getDocument.js
+++ b/apps/OpenSignServer/cloud/parsefunction/getDocument.js
@@ -1,31 +1,50 @@
+import axios from 'axios';
+
 export default async function getDocument(request) {
+  const serverUrl = process.env.SERVER_URL;
   const docId = request.params.docId;
-  const userId = request.params.userId;
-  if (docId && userId) {
-    try {
-      const query = new Parse.Query('contracts_Document');
-      query.equalTo('objectId', docId);
-      query.include('ExtUserPtr');
-      query.include('CreatedBy');
-      query.include('Signers');
-      query.include('AuditTrail.UserPtr');
-      query.include('Placeholders');
-      const res = await query.first({ useMasterKey: true });
-      if (res) {
-        const acl = res.getACL();
-        if (acl && acl.getReadAccess(userId)) {
-          return res;
+
+  try {
+    const userRes = await axios.get(serverUrl + '/users/me', {
+      headers: {
+        'X-Parse-Application-Id': process.env.APP_ID,
+        'X-Parse-Session-Token': request.headers['sessiontoken'],
+      },
+    });
+    const userId = userRes.data && userRes.data.objectId;
+    if (docId && userId) {
+      try {
+        const query = new Parse.Query('contracts_Document');
+        query.equalTo('objectId', docId);
+        query.include('ExtUserPtr');
+        query.include('CreatedBy');
+        query.include('Signers');
+        query.include('AuditTrail.UserPtr');
+        query.include('Placeholders');
+        const res = await query.first({ useMasterKey: true });
+        if (res) {
+          const acl = res.getACL();
+          if (acl && acl.getReadAccess(userId)) {
+            return res;
+          } else {
+            return { error: "You don't have access of this document!" };
+          }
         } else {
           return { error: "You don't have access of this document!" };
         }
-      } else {
-        return { error: "You don't have access of this document!" };
+      } catch (err) {
+        console.log('err', err);
+        return err;
       }
-    } catch (err) {
-      console.log('err', err);
-      return err;
+    } else {
+      return { error: 'Please pass required parameters!' };
+    }
+  } catch (err) {
+    console.log('err');
+    if (err.code == 209) {
+      return { error: 'Invalid session token' };
+    } else {
+      return { error: "You don't have access of this document!" };
     }
-  } else {
-    return { error: 'Please pass required parameters!' };
   }
 }
diff --git a/apps/OpenSignServer/cloud/parsefunction/getDrive.js b/apps/OpenSignServer/cloud/parsefunction/getDrive.js
new file mode 100644
index 000000000..567d1b08f
--- /dev/null
+++ b/apps/OpenSignServer/cloud/parsefunction/getDrive.js
@@ -0,0 +1,51 @@
+import axios from 'axios';
+export default async function getDrive(request) {
+  const serverUrl = process.env.SERVER_URL;
+  const appId = process.env.APP_ID;
+
+  const classUrl = serverUrl + '/classes/contracts_Document';
+  const docId = request.params.docId;
+  try {
+    const userRes = await axios.get(serverUrl + '/users/me', {
+      headers: {
+        'X-Parse-Application-Id': appId,
+        'X-Parse-Session-Token': request.headers['sessiontoken'],
+      },
+    });
+    const userId = userRes.data && userRes.data.objectId;
+    if (userId) {
+      let url;
+      if (docId) {
+        url = `${classUrl}?where={"Folder":{"__type":"Pointer","className":"contracts_Document","objectId":"${docId}"},"$or":[{"CreatedBy":{"$exists":false}},{"CreatedBy":{"__type":"Pointer","className":"_User","objectId":"${userId}"}}]}&include=ExtUserPtr,Signers,Folder`;
+      } else {
+        url = `${classUrl}?where={"Folder":{"$exists":false},"$or":[{"CreatedBy":{"$exists":false}},{"CreatedBy":{"__type":"Pointer","className":"_User","objectId":"${userId}"}}]}&include=ExtUserPtr,Signers`;
+      }
+      try {
+        const res = await axios.get(url, {
+          headers: {
+            'X-Parse-Application-Id': appId,
+            'X-Parse-Master-key': process.env.MASTER_KEY,
+          },
+        });
+        console.log('res.data.results ', res.data.results);
+        if (res.data && res.data.results) {
+          return res.data.results;
+        } else {
+          return [];
+        }
+      } catch (err) {
+        console.log('err', err);
+        return { error: "You don't have access to drive" };
+      }
+    } else {
+      return { error: 'Please provide required parameter!' };
+    }
+  } catch (err) {
+    console.log('err', err);
+    if (err.code == 209) {
+      return { error: 'Invalid session token' };
+    } else {
+      return { error: "You don't have access!" };
+    }
+  }
+}