WEBDIENSTE/huly-platform
1
0
Fork 0
mirror of https://github.com/hcengineering/platform.git synced 2026-09-06 17:57:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

UBERF-5603 (#4754)

Browse Source 
Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>
This commit is contained in:
Denis Bykhov
2024-02-23 15:39:49 +07:00
committed by GitHub
parent cc8a1d549a
commit ffc8d1dfac
184 changed files with 2755 additions and 561 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/middleware/src/spaceSecurity.ts
+7 -2
View File
@@ -14,6 +14,7 @@
//
import core, {
Account,
AccountRole,
AttachedDoc,
Class,
Doc,
@@ -369,6 +370,10 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
}
async tx (ctx: SessionContext, tx: Tx): Promise<TxMiddlewareResult> {
const account = await getUser(this.storage, ctx)
if (account.role === AccountRole.Guest) {
throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
}
await this.processTx(ctx, tx)
const targets = await this.getTxTargets(ctx, tx)
const res = await this.provideTx(ctx, tx)
@@ -476,7 +481,7 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
const account = await getUser(this.storage, ctx)
const field = this.getKey(_class)
if (!isSystem(account)) {
if (!isSystem(account) && account.role !== AccountRole.Guest) {
if (!isOwner(account) || !this.storage.hierarchy.isDerived(_class, core.class.Space)) {
if (query[field] !== undefined) {
;(newQuery as any)[field] = await this.mergeQuery(account, query[field], domain)
@@ -487,7 +492,7 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
}
}
const findResult = await this.provideFindAll(ctx, _class, newQuery, options)
if (!isOwner(account)) {
if (!isOwner(account) && account.role !== AccountRole.Guest) {
if (options?.lookup !== undefined) {
for (const object of findResult) {
if (object.$lookup !== undefined) {