WEBDIENSTE/OpenSign
1
0
Fork 0
mirror of https://github.com/OpenSignLabs/OpenSign.git synced 2026-09-27 20:14:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2576 from nxglabs/sync-to-public_repo-27677371306

Browse Source 
Merge pull request #2575 from nxglabs/staging
This commit is contained in:
raktima-opensignlabs
2026-06-17 09:08:15 +00:00
parent 6271fedcbf
commit be0c4a2cbf
25 changed files with 1079 additions and 671 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/OpenSignServer/cloud/parsefunction/addUser.js
+73 -26
View File
@@ -7,6 +7,59 @@ export default async function addUser(request) {
const currentUser = { __type: 'Pointer', className: '_User', objectId: request.user.id };
if (name && email && password && organization && team && role && tenantId) {
try {
// Derive the caller's tenant/organization/role from the server-side
// record rather than trusting client-supplied identifiers. This
// prevents an authenticated low-privileged user from creating an admin
// or assigning the new user to an arbitrary tenant/organization/team.
const callerQuery = new Parse.Query('contracts_Users');
callerQuery.equalTo('UserId', currentUser);
callerQuery.notEqualTo('IsDisabled', true);
const callerExtUser = await callerQuery.first({ useMasterKey: true });
if (!callerExtUser) {
throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'User not found.');
}
const callerRole = callerExtUser.get('UserRole');
const isAdmin = callerRole === 'contracts_Admin';
const isOrgAdmin = callerRole === 'contracts_OrgAdmin';
if (!isAdmin && !isOrgAdmin) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
const callerTenantId = callerExtUser.get('TenantId')?.id;
const callerOrgId = callerExtUser.get('OrganizationId')?.id;
// Enforce tenant-bound writes for all admins and require org scope for OrgAdmin callers.
if (!callerTenantId || tenantId !== callerTenantId || (isOrgAdmin && !callerOrgId)) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
// Only allow creating non-admin roles; never allow elevating to a
// tenant Admin through this endpoint.
const allowedRoles = ['OrgAdmin', 'Editor', 'User'];
if (!allowedRoles.includes(role)) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Invalid role.');
}
// Resolve and authorize the target organization within the caller's tenant.
const targetOrgId = organization.objectId;
if (!targetOrgId) {
throw new Parse.Error(Parse.Error.INVALID_QUERY, 'Please provide all required fields.');
}
const orgQuery = new Parse.Query('contracts_Organizations');
const targetOrg = await orgQuery.get(targetOrgId, { useMasterKey: true });
if (targetOrg.get('TenantId')?.id !== callerTenantId) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
// An OrgAdmin may only add users to their own organization.
if (isOrgAdmin && targetOrgId !== callerOrgId) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
// Authorize the target team belongs to the target organization.
const teamQuery = new Parse.Query('contracts_Teams');
const targetTeam = await teamQuery.get(team, { useMasterKey: true });
if (targetTeam.get('OrganizationId')?.id !== targetOrgId) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
const extUser = new Parse.Object('contracts_Users');
extUser.set('Name', name);
if (phone) {
@@ -14,33 +67,27 @@ export default async function addUser(request) {
}
extUser.set('Email', email);
extUser.set('UserRole', `contracts_${role}`);
if (team) {
extUser.set('TeamIds', [
{
__type: 'Pointer',
className: 'contracts_Teams',
objectId: team,
},
]);
}
if (organization.objectId) {
extUser.set('OrganizationId', {
extUser.set('TeamIds', [
{
__type: 'Pointer',
className: 'contracts_Organizations',
objectId: organization.objectId,
});
}
className: 'contracts_Teams',
objectId: team,
},
]);
extUser.set('OrganizationId', {
__type: 'Pointer',
className: 'contracts_Organizations',
objectId: targetOrgId,
});
if (organization.company) {
extUser.set('Company', organization.company);
}
if (tenantId) {
extUser.set('TenantId', {
__type: 'Pointer',
className: 'partners_Tenant',
objectId: tenantId,
});
}
extUser.set('TenantId', {
__type: 'Pointer',
className: 'partners_Tenant',
objectId: callerTenantId,
});
if (timezone) {
extUser.set('Timezone', timezone);
}
@@ -61,10 +108,10 @@ export default async function addUser(request) {
extUser.set('UserId', user);
const acl = new Parse.ACL();
acl.setPublicReadAccess(true);
acl.setPublicWriteAccess(true);
acl.setReadAccess(request.user.id, true);
acl.setWriteAccess(request.user.id, true);
acl.setReadAccess(user.id, true);
acl.setWriteAccess(user.id, true);
extUser.setACL(acl);
const extUserRes = await extUser.save();
@@ -82,10 +129,10 @@ export default async function addUser(request) {
extUser.set('CreatedBy', currentUser);
extUser.set('UserId', { __type: 'Pointer', className: '_User', objectId: userRes.id });
const acl = new Parse.ACL();
acl.setPublicReadAccess(true);
acl.setPublicWriteAccess(true);
acl.setReadAccess(request.user.id, true);
acl.setWriteAccess(request.user.id, true);
acl.setReadAccess(userRes.id, true);
acl.setWriteAccess(userRes.id, true);
extUser.setACL(acl);
const res = await extUser.save();
apps/OpenSignServer/cloud/parsefunction/createBatchDocs.js
+14 -3
View File
@@ -116,13 +116,24 @@ async function sendMail(document, publicUrl) {
: senderEmail;
if (document.SendinOrder) {
signerMail = signerMail.slice();
signerMail.splice(1);
const getRole = signer => signer?.SignerRole || signer?.signer_role || signer?.role || 'signer';
const firstSignerIndex = signerMail.findIndex(signer => getRole(signer) === 'signer');
signerMail = signerMail.filter((signer, idx) => {
const role = getRole(signer);
return role === 'viewer' || idx === firstSignerIndex;
});
if (signerMail.length === 0 && document?.Placeholders?.length > 0) {
signerMail = document.Placeholders.filter(x => x?.Role !== 'prefill').slice(0, 1);
}
}
for (let i = 0; i < signerMail.length; i++) {
try {
let url = `${serverUrl}/functions/sendmailv3`;
const headers = { 'Content-Type': 'application/json', 'X-Parse-Application-Id': appId };
const headers = {
'Content-Type': 'application/json',
'X-Parse-Application-Id': appId,
};
const objectId = signerMail[i]?.signerObjId;
const hostUrl = baseUrl.origin;
let encodeBase64;
apps/OpenSignServer/cloud/parsefunction/filterDocs.js
+2
View File
@@ -43,6 +43,8 @@ async function fetchDocumentsByName(
query.notEqualTo('IsArchive', true);
query.descending('updatedAt');
query.exclude('AuditTrail');
query.exclude('OriginalDocument');
query.exclude('SignedDocument');
query.notEqualTo('Type', 'Folder');
try {
return await query.find({ useMasterKey: true });
apps/OpenSignServer/cloud/parsefunction/getDrive.js
+2
View File
@@ -36,6 +36,8 @@ export default async function getDrive(request) {
query.skip(skip);
query.limit(limit);
query.exclude('AuditTrail');
query.exclude('OriginalDocument');
query.exclude('SignedDocument');
const res = await query.find({ useMasterKey: true });
return res;
} catch (err) {
apps/OpenSignServer/cloud/parsefunction/getUserListByOrg.js
+33
View File
@@ -9,6 +9,39 @@ export default async function getUserListByOrg(req) {
throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'User is not authenticated.');
} else {
try {
if (!OrganizationId) {
throw new Parse.Error(Parse.Error.INVALID_QUERY, 'Please provide organizationId.');
}
// Authorize the requested organization against the caller's server-side
// tenant/organization. This prevents an authenticated user from
// enumerating users in an arbitrary organization or tenant.
const callerQuery = new Parse.Query('contracts_Users');
callerQuery.equalTo('UserId', {
__type: 'Pointer',
className: '_User',
objectId: req.user.id,
});
callerQuery.notEqualTo('IsDisabled', true);
const callerExtUser = await callerQuery.first({ useMasterKey: true });
if (!callerExtUser) {
throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'User not found.');
}
const callerTenantId = callerExtUser.get('TenantId')?.id;
const callerOrgId = callerExtUser.get('OrganizationId')?.id;
const callerRole = callerExtUser.get('UserRole');
const isAdmin = callerRole === 'contracts_Admin' || callerRole === 'contracts_OrgAdmin';
const orgQuery = new Parse.Query('contracts_Organizations');
const targetOrg = await orgQuery.get(OrganizationId, { useMasterKey: true });
// Must belong to the caller's tenant.
if (!callerTenantId || targetOrg.get('TenantId')?.id !== callerTenantId) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
// Non-admins may only list their own organization.
if (!isAdmin && OrganizationId !== callerOrgId) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
const extUser = new Parse.Query('contracts_Users');
extUser.equalTo('OrganizationId', orgPtr);
extUser.include('TeamIds');
apps/OpenSignServer/cloud/parsefunction/updateTenant.js
+24
View File
@@ -8,6 +8,30 @@ export default async function updateTenant(request) {
if (!request.user) {
throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'unauthorized');
}
// Derive the caller's tenant and role server-side. Never trust the
// client-supplied tenantId: an authenticated user may only update their own
// tenant and must hold an admin role to do so.
const callerQuery = new Parse.Query('contracts_Users');
callerQuery.equalTo('UserId', {
__type: 'Pointer',
className: '_User',
objectId: request.user.id,
});
callerQuery.notEqualTo('IsDisabled', true);
const callerExtUser = await callerQuery.first({ useMasterKey: true });
if (!callerExtUser) {
throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'User not found.');
}
const callerRole = callerExtUser.get('UserRole');
if (callerRole !== 'contracts_Admin' && callerRole !== 'contracts_OrgAdmin') {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
const callerTenantId = callerExtUser.get('TenantId')?.id;
if (!callerTenantId || callerTenantId !== tenantId) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Unauthorized.');
}
const validKeys = ['CompletionBody', 'CompletionSubject', 'RequestBody', 'RequestSubject'];
try {
const tenant = new Parse.Object('partners_Tenant');
apps/OpenSignServer/package-lock.json
Generated
+49 -45
View File
@@ -18,13 +18,13 @@
"@signpdf/placeholder-pdf-lib": "^3.3.0",
"@signpdf/signer-p12": "^3.3.0",
"@signpdf/signpdf": "^3.3.0",
"axios": "^1.15.2",
"axios": "^1.16.0",
"coherentpdf": "^2.5.5",
"cors": "^2.8.6",
"date-fns-tz": "^3.2.0",
"dotenv": "^17.4.2",
"express": "^5.2.1",
"form-data": "^4.0.5",
"form-data": "^4.0.6",
"generate-api-key": "^1.0.2",
"googleapis": "^171.4.0",
"libreoffice-convert": "^1.8.1",
@@ -38,7 +38,7 @@
"p-limit": "^7.3.0",
"parse": "^8.1.0",
"parse-dbtool": "^1.2.0",
"parse-server": "^8.6.76",
"parse-server": "^8.6.77",
"parse-server-api-mail-adapter": "^5.0.5",
"pdf-lib": "^1.17.1",
"posthog-node": "^5.21.2",
@@ -46,7 +46,7 @@
"rate-limiter-flexible": "^9.1.1",
"sharp": "^0.34.5",
"speakeasy": "^2.0.0",
"ws": "^8.20.0"
"ws": ">=8.21.0"
},
"devDependencies": {
"@babel/eslint-parser": "^7.28.6",
@@ -5729,12 +5729,12 @@
}
},
"node_modules/axios": {
"version": "1.15.2",
"resolved": "https://registry.npmjs.org/axios/-/axios-1.15.2.tgz",
"integrity": "sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==",
"version": "1.16.0",
"resolved": "https://registry.npmjs.org/axios/-/axios-1.16.0.tgz",
"integrity": "sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==",
"license": "MIT",
"dependencies": {
"follow-redirects": "^1.15.11",
"follow-redirects": "^1.16.0",
"form-data": "^4.0.5",
"proxy-from-env": "^2.1.0"
}
@@ -7420,9 +7420,9 @@
"license": "MIT"
},
"node_modules/fast-xml-builder": {
"version": "1.1.5",
"resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.5.tgz",
"integrity": "sha512-4TJn/8FKLeslLAH3dnohXqE3QSoxkhvaMzepOIZytwJXZO69Bfz0HBdDHzOTOon6G59Zrk6VQ2bEiv1t61rfkA==",
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
"integrity": "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==",
"funding": [
{
"type": "github",
@@ -7431,7 +7431,8 @@
],
"license": "MIT",
"dependencies": {
"path-expression-matcher": "^1.1.3"
"path-expression-matcher": "^1.5.0",
"xml-naming": "^0.1.0"
}
},
"node_modules/fast-xml-parser": {
@@ -7735,16 +7736,16 @@
}
},
"node_modules/form-data": {
"version": "4.0.5",
"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
"integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
"version": "4.0.6",
"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
"integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
"license": "MIT",
"dependencies": {
"asynckit": "^0.4.0",
"combined-stream": "^1.0.8",
"es-set-tostringtag": "^2.1.0",
"hasown": "^2.0.2",
"mime-types": "^2.1.12"
"hasown": "^2.0.4",
"mime-types": "^2.1.35"
},
"engines": {
"node": ">= 6"
@@ -8797,9 +8798,9 @@
}
},
"node_modules/hasown": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
"integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
"version": "2.0.4",
"resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
"integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
"license": "MIT",
"dependencies": {
"function-bind": "^1.1.2"
@@ -11082,9 +11083,9 @@
}
},
"node_modules/parse-server": {
"version": "8.6.76",
"resolved": "https://registry.npmjs.org/parse-server/-/parse-server-8.6.76.tgz",
"integrity": "sha512-PVdrGBLitd3WcKWss7ZI4yoWKQIAwzPSdBx9c8kngL1eqFNGelRKAwQ2+xy52V/pV2b+5M2/UpTlx0pxOphqbw==",
"version": "8.6.77",
"resolved": "https://registry.npmjs.org/parse-server/-/parse-server-8.6.77.tgz",
"integrity": "sha512-eQBdaiSN0eUDDv8tQiTClS9EpaBv61XS8xtrgI/CfFEWXh1WDVCyJnVeM2Z8P8V2mmtC7GgLLqp2Yvptc8Hkrg==",
"hasInstallScript": true,
"license": "Apache-2.0",
"dependencies": {
@@ -11923,25 +11924,13 @@
}
},
"node_modules/protobufjs": {
"version": "7.5.5",
"resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.5.tgz",
"integrity": "sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg==",
"hasInstallScript": true,
"version": "8.6.3",
"resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.6.3.tgz",
"integrity": "sha512-alQyzT0j401LGBtwsqu6uprjR6pfNH1UJf9N6GBFMjIcd+HzTe0/HrjAbFCqun+zvnfLarrxAtMM2xvZ+kFZ5A==",
"license": "BSD-3-Clause",
"optional": true,
"dependencies": {
"@protobufjs/aspromise": "^1.1.2",
"@protobufjs/base64": "^1.1.2",
"@protobufjs/codegen": "^2.0.4",
"@protobufjs/eventemitter": "^1.1.0",
"@protobufjs/fetch": "^1.1.0",
"@protobufjs/float": "^1.0.2",
"@protobufjs/inquire": "^1.1.0",
"@protobufjs/path": "^1.1.2",
"@protobufjs/pool": "^1.1.0",
"@protobufjs/utf8": "^1.1.0",
"@types/node": ">=13.7.0",
"long": "^5.0.0"
"long": "^5.3.2"
},
"engines": {
"node": ">=12.0.0"
@@ -13272,9 +13261,9 @@
"license": "MIT"
},
"node_modules/tmp": {
"version": "0.2.5",
"resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
"integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
"version": "0.2.7",
"resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz",
"integrity": "sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==",
"license": "MIT",
"engines": {
"node": ">=14.14"
@@ -13906,9 +13895,9 @@
"license": "ISC"
},
"node_modules/ws": {
"version": "8.20.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
"integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
"version": "8.21.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
"integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
@@ -13926,6 +13915,21 @@
}
}
},
"node_modules/xml-naming": {
"version": "0.1.0",
"resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.1.0.tgz",
"integrity": "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/NaturalIntelligence"
}
],
"license": "MIT",
"engines": {
"node": ">=16.0.0"
}
},
"node_modules/xtend": {
"version": "4.0.2",
"resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
apps/OpenSignServer/package.json
+8 -5
View File
@@ -27,13 +27,13 @@
"@signpdf/placeholder-pdf-lib": "^3.3.0",
"@signpdf/signer-p12": "^3.3.0",
"@signpdf/signpdf": "^3.3.0",
"axios": "^1.15.2",
"axios": "^1.16.0",
"coherentpdf": "^2.5.5",
"cors": "^2.8.6",
"date-fns-tz": "^3.2.0",
"dotenv": "^17.4.2",
"express": "^5.2.1",
"form-data": "^4.0.5",
"form-data": "^4.0.6",
"generate-api-key": "^1.0.2",
"googleapis": "^171.4.0",
"libreoffice-convert": "^1.8.1",
@@ -47,7 +47,7 @@
"p-limit": "^7.3.0",
"parse": "^8.1.0",
"parse-dbtool": "^1.2.0",
"parse-server": "^8.6.76",
"parse-server": "^8.6.77",
"parse-server-api-mail-adapter": "^5.0.5",
"pdf-lib": "^1.17.1",
"posthog-node": "^5.21.2",
@@ -55,7 +55,7 @@
"rate-limiter-flexible": "^9.1.1",
"sharp": "^0.34.5",
"speakeasy": "^2.0.0",
"ws": "^8.20.0"
"ws": ">=8.21.0"
},
"type": "module",
"devDependencies": {
@@ -71,7 +71,10 @@
"ws": "$ws",
"parse": "$parse",
"form-data": "$form-data",
"@parse/push-adapter": "$@parse/push-adapter"
"@parse/push-adapter": "$@parse/push-adapter",
"fast-xml-builder": "1.2.0",
"protobufjs": ">=7.6.3",
"tmp": ">=0.2.7"
},
"engines": {
"node": "18 || 20 || 22"