Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (currentUser) {
// Do not filter if options.skipAccess has been set.
if (ctx.options.skipAccess) {
debug('skipAccess: true - skipping access filters')
return next()
}
// Do not filter if the request is being made against a single model instance.
if (_get(ctx.query, 'where.id')) {
debug('looking up by Id - skipping access filters')
return next()
}
// Do not apply filters if no group access acls were applied.
const loopbackContext = LoopBackContext.getCurrentContext({ bind: true })
const groupAccessApplied = Boolean(loopbackContext && loopbackContext.get('groupAccessApplied'))
if (!groupAccessApplied) {
debug('acls not appled - skipping access filters')
return next()
}
debug('%s observe access: query=%s, options=%o, hookState=%o',
Model.modelName, JSON.stringify(ctx.query, null, 4), ctx.options, ctx.hookState)
return this.buildFilter(currentUser.getId(), ctx.Model)
.then(filter => {
debug('original query: %o', JSON.stringify(ctx.query, null, 4))
const where = ctx.query.where ? {
and: [ ctx.query.where, filter ],
} : filter
const roleName = this.extractRoleName(role)
const GroupAccess = this.app.models[this.options.groupAccessModel]
const scope = { }
debug(`Role resolver for ${role}: evaluate ${modelClass.modelName} with id: ${modelId} for user: ${userId}`)
// No userId is present
if (!userId) {
process.nextTick(() => {
debug('Deny access for anonymous user')
cb(null, false)
})
return cb.promise
}
LoopBackContext.getCurrentContext({ bind: true }).set('groupAccessApplied', true)
/**
* Basic application that does not cover static methods. Similar to $owner. (RECOMMENDED)
*/
if (!this.options.applyToStatic) {
if (!context || !modelClass || !modelId) {
process.nextTick(() => {
debug('Deny access (context: %s, context.model: %s, context.modelId: %s)',
Boolean(context), Boolean(modelClass), Boolean(modelId))
cb(null, false)
})
return cb.promise
}
this.isGroupMemberWithRole(modelClass, modelId, userId, roleName)
.then(res => cb(null, res))
Model.getCurrentUser = function getCurrentUser() {
const ctx = LoopBackContext.getCurrentContext({ bind: true })
const currentUser = (ctx && ctx.get('currentUser')) || null
if (ctx) {
debug(`${Model.definition.name}.getCurrentUser() - currentUser: %o`, currentUser)
}
else {
// this means its a server-side logic call w/o any HTTP req/resp aspect to it.
debug(`${Model.definition.name}.getCurrentUser() - no loopback context`)
}
return currentUser
}
}
getCurrentUserGroups() {
const ctx = LoopBackContext.getCurrentContext({ bind: true })
const currentUserGroups = (ctx && ctx.get('currentUserGroups')) || []
return currentUserGroups
}
return function userContext(req, res, next) {
const loopbackContext = LoopBackContext.getCurrentContext({ bind: true })
next = loopbackContext.bind(next)
if (!loopbackContext) {
debug('No user context (loopback current context not found)')
return next()
}
if (!req.accessToken) {
debug('No user context (access token not found)')
return next()
}
const { app } = req
const UserModel = app.accessUtils.options.userModel || 'User'
getCurrentUser() {
const ctx = LoopBackContext.getCurrentContext({ bind: true })
const currentUser = (ctx && ctx.get('currentUser')) || null
return currentUser
}
return function accessLogger(req, res, next) {
const loopbackContext = LoopBackContext.getCurrentContext({ bind: true })
next = loopbackContext.bind(next)
if (req.accessToken) {
debug('req: %s %s, token: %o', req.method, req.originalUrl, req.accessToken)
}
else {
debug('req', req.method, req.originalUrl)
}
const start = new Date()
if (res._responseTime) {
return next()
}
res._responseTime = true