UBERF-5603 (#4754)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

server/account/src/index.ts

@@ -913,13 +913,22 @@ export async function getUserWorkspaces (db: Db, productId: string, token: strin
  * @public
  */
 export async function getWorkspaceInfo (db: Db, productId: string, token: string): Promise<ClientWorkspaceInfo> {
-  const { email, workspace } = decodeToken(token)
+  const { email, workspace, extra } = decodeToken(token)
+  const guest = extra?.guest === 'true'
   let account: Pick<Account, 'admin' | 'workspaces'> | null = null
-  if (email !== systemAccountEmail) {
+  const query: Filter<Workspace> = {
+    workspace: workspace.name
+  }
+  if (email !== systemAccountEmail && !guest) {
     account = await getAccount(db, email)
     if (account === null) {
       throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
     }
+  } else if (guest) {
+    account = {
+      admin: false,
+      workspaces: []
+    }
   } else {
     account = {
       admin: true,
@@ -927,12 +936,13 @@ export async function getWorkspaceInfo (db: Db, productId: string, token: string
     }
   }
 
+  if (account.admin !== true && !guest) {
+    query._id = { $in: account.workspaces }
+  }
+
   const [ws] = (
-    await db
-      .collection<Workspace>(WORKSPACE_COLLECTION)
-      .find(withProductId(productId, account.admin === true ? {} : { _id: { $in: account.workspaces } }))
-      .toArray()
-  ).filter((it) => it.disabled !== true && it.workspace === workspace.name)
+    await db.collection<Workspace>(WORKSPACE_COLLECTION).find(withProductId(productId, query)).toArray()
+  ).filter((it) => it.disabled !== true)
   if (ws == null) {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
   }
@@ -967,6 +977,7 @@ export async function setRole (
   role: AccountRole,
   client?: Client
 ): Promise<void> {
+  if (!Object.values(AccountRole).includes(role)) return
   const email = cleanEmail(_email)
   const connection = client ?? (await connect(getTransactor(), getWorkspaceId(workspace, productId)))
   try {
@@ -975,9 +986,8 @@ export async function setRole (
     const existingAccount = await ops.findOne(contact.class.PersonAccount, { email })
 
     if (existingAccount !== undefined) {
-      const value = isNaN(Number(role)) ? 0 : Number(role)
       await ops.update(existingAccount, {
-        role: value
+        role
       })
     }
   } finally {
@@ -1123,7 +1133,7 @@ async function createPersonAccount (
       await ops.createDoc(contact.class.PersonAccount, core.space.Model, {
         email: account.email,
         person: employee,
-        role: 0
+        role: AccountRole.User
       })
     } else {
       const employee = await ops.findOne(contact.mixin.Employee, { _id: existingAccount.person as Ref<Employee> })
@@ -1468,6 +1478,7 @@ export function getMethods (
   migrateOperations: [string, MigrateOperation][]
 ): Record<string, AccountMethod> {
   return {
+    getEndpoint: wrap(async () => getEndpoint()),
     login: wrap(login),
     join: wrap(join),
     checkJoin: wrap(checkJoin),

server/middleware/src/spaceSecurity.ts

@@ -14,6 +14,7 @@
 //
 import core, {
   Account,
+  AccountRole,
   AttachedDoc,
   Class,
   Doc,
@@ -369,6 +370,10 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
   }
 
   async tx (ctx: SessionContext, tx: Tx): Promise<TxMiddlewareResult> {
+    const account = await getUser(this.storage, ctx)
+    if (account.role === AccountRole.Guest) {
+      throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
+    }
     await this.processTx(ctx, tx)
     const targets = await this.getTxTargets(ctx, tx)
     const res = await this.provideTx(ctx, tx)
@@ -476,7 +481,7 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
     const account = await getUser(this.storage, ctx)
     const field = this.getKey(_class)
 
-    if (!isSystem(account)) {
+    if (!isSystem(account) && account.role !== AccountRole.Guest) {
       if (!isOwner(account) || !this.storage.hierarchy.isDerived(_class, core.class.Space)) {
         if (query[field] !== undefined) {
           ;(newQuery as any)[field] = await this.mergeQuery(account, query[field], domain)
@@ -487,7 +492,7 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
       }
     }
     const findResult = await this.provideFindAll(ctx, _class, newQuery, options)
-    if (!isOwner(account)) {
+    if (!isOwner(account) && account.role !== AccountRole.Guest) {
       if (options?.lookup !== undefined) {
         for (const object of findResult) {
           if (object.$lookup !== undefined) {

server/mongo/src/__tests__/minmodel.ts

@@ -29,7 +29,8 @@ import core, {
   type Ref,
   type TxCreateDoc,
   type TxCUD,
-  TxFactory
+  TxFactory,
+  AccountRole
 } from '@hcengineering/core'
 import type { IntlString, Plugin } from '@hcengineering/platform'
 import { plugin } from '@hcengineering/platform'
@@ -199,8 +200,8 @@ export function genMinModel (): TxCUD<Doc>[] {
   const u1 = 'User1' as Ref<Account>
   const u2 = 'User2' as Ref<Account>
   txes.push(
-    createDoc(core.class.Account, { email: 'user1@site.com', role: 0 }, u1),
-    createDoc(core.class.Account, { email: 'user2@site.com', role: 0 }, u2),
+    createDoc(core.class.Account, { email: 'user1@site.com', role: AccountRole.User }, u1),
+    createDoc(core.class.Account, { email: 'user2@site.com', role: AccountRole.User }, u2),
     createDoc(core.class.Space, {
       name: 'Sp1',
       description: '',

server/ws/src/__tests__/minmodel.ts

@@ -28,7 +28,8 @@ import core, {
   type Obj,
   type Ref,
   type TxCUD,
-  type TxCreateDoc
+  type TxCreateDoc,
+  AccountRole
 } from '@hcengineering/core'
 import type { IntlString, Plugin } from '@hcengineering/platform'
 import { plugin } from '@hcengineering/platform'
@@ -189,8 +190,8 @@ export function genMinModel (): TxCUD<Doc>[] {
   const u1 = 'User1' as Ref<Account>
   const u2 = 'User2' as Ref<Account>
   txes.push(
-    createDoc(core.class.Account, { email: 'user1@site.com', role: 0 }, u1),
-    createDoc(core.class.Account, { email: 'user2@site.com', role: 0 }, u2),
+    createDoc(core.class.Account, { email: 'user1@site.com', role: AccountRole.User }, u1),
+    createDoc(core.class.Account, { email: 'user2@site.com', role: AccountRole.User }, u2),
     createDoc(core.class.Space, {
       name: 'Sp1',
       description: '',