Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
internals.canAssign = function(permissionId, userScope, mongoose, Log) {
const Permission = mongoose.model('permission');
return RestHapi.find(Permission, permissionId, {}, Log)
.then(function (result) {
let assignScope = result.assignScope;
// EXPL: Check if the user scope intersects (contains values of) the assign scope.
let canAssign = !!userScope.filter(scope => assignScope.indexOf(scope) > -1)[0]
return canAssign
})
.catch(function(error) {
Log.error("ERROR:", error)
return Boom.badRequest(error)
})
}
internals.canAssign = function(groupId, userScope, mongoose, Log) {
const Group = mongoose.model('group');
return RestHapi.find(Group, groupId, { $embed: ['permissions'], $flatten: true }, Log)
.then(function (result) {
for (let permission of result.permissions) {
// EXPL: Check if the user scope intersects (contains values of) the assign scope.
if (!userScope.filter(scope => permission.assignScope.indexOf(scope) > -1)[0]) {
return false
}
}
return true
})
.catch(function(error) {
Log.error("ERROR:", error)
return Boom.badRequest(error)
})
}
const getConversationHandler = function (request, reply) {
const Conversation = mongoose.model('conversation');
const User = mongoose.model('user');
let promise = {};
let conversation = {};
let newConversation = false;
const query = {
$embed: ['messages.user', 'users', 'userData', 'lastMessage.user']
};
// EXPL: Find the conversation by _id if provided
if (request.query.conversation) {
promise = RestHapi.find(Conversation, request.query.conversation, query , Log);
}
else if (request.query.user) {
if (request.query.user === request.auth.credentials.user._id.toString()) {
return reply(Boom.badRequest('No chatting with yourself.'))
}
// EXPL: The query below searches for the direct chat conversation between the current user and the user provided
query.$where = {
$and: [
{ users: { $elemMatch: { $eq: request.auth.credentials.user._id } } },
{ users: { $elemMatch: { $eq: request.query.user } } },
{ chatType: { $eq: CHAT_TYPES.DIRECT } }
]
};
const connectionUpdateAuth = function connectionAuth(request, reply, next) {
let Log = request.logger.bind("connectionAuth");
try {
const Connection = mongoose.model('connection');
let userId = request.auth.credentials.user._id;
return RestHapi.find(Connection, request.params._id, {}, Log)
.then(function (result) {
// EXPL: Only the primary user and those with root permissions can update the connection
if (userId === result.primaryUser.toString() || request.auth.credentials.scope.includes('root')) {
return next(null, true);
}
else {
return next(Boom.forbidden("Not primary user."), false);
}
})
}
catch (err) {
Log.error("ERROR:", err);
return next(null, true);
}
};
const notificationUpdateAuth = function notificationAuth(request, reply, next) {
let Log = request.logger.bind("notificationAuth");
try {
const Connection = mongoose.model('notification');
let userId = request.auth.credentials.user._id;
return RestHapi.find(Connection, request.params._id, {}, Log)
.then(function (result) {
// EXPL: Only the primary user and those with root permissions can update the notification
if (userId === result.primaryUser.toString() || request.auth.credentials.scope.includes('root')) {
return next(null, true);
}
else {
return next(Boom.forbidden("Not primary user."), false);
}
})
}
catch (err) {
Log.error("ERROR:", err);
return next(null, true);
}
};
pre: async function(payload, request, Log) {
try {
const Document = mongoose.model('document')
const Notification = mongoose.model('notification')
let document = await RestHapi.find(
Document,
request.params.ownerId,
{},
Log
)
const scope = document.scope
// Add permissions for shared users to either edit or view the document
payload.forEach(function(userDocument) {
// Remove any previous permissions before adding new ones
Document.removeDocumentPermissions(scope, userDocument.childId)
if (userDocument.canEdit) {
scope.updateScope = scope.updateScope || []
scope.updateScope.push('user-' + userDocument.childId)
}
scope.readScope = scope.readScope || []
scope.readScope.push('user-' + userDocument.childId)
const postMessageHandler = function (request, reply) {
const Message = mongoose.model('message');
const Conversation = mongoose.model('conversation');
const User = mongoose.model('user');
const promises = [];
const payload = {
text: request.payload.text,
conversation: request.params.conversationId,
user: request.auth.credentials.user._id
}
promises.push(RestHapi.find(Conversation, payload.conversation, {}, Log));
promises.push(RestHapi.create(Message, payload, Log));
return Q.all(promises)
.then(function (result) {
let conversation = result[0];
let message = result[1];
Log.debug("MESSAGE:", message);
conversation.users.forEach(function(userId) {
server.publish('/chat/' + userId, message);
})
return reply('published');
})
.catch(function (error) {
Log.error(error);
return reply(RestHapi.errorHelper.formatResponse(error));
});
secondaryPayload.primaryUser = payload.connectedUser
}
if (payload.primaryUser) {
secondaryPayload.connectedUser = payload.primaryUser
}
if (payload.isContact) {
secondaryPayload.isContact = payload.isContact
}
if (payload.isFollowed) {
secondaryPayload.isFollowing = payload.isFollowed
}
if (payload.isFollowing) {
secondaryPayload.isFollowed = payload.isFollowing
}
let primaryConnection = await RestHapi.find(
Connection,
_id,
{},
Log
)
if (!primaryConnection) {
throw Boom.badRequest('Connection not found.')
}
let result = await RestHapi.list(
Connection,
{
primaryUser: primaryConnection.connectedUser,
connectedUser: primaryConnection.primaryUser
},
Log
)
internals.canEdit = function(userId, request, mongoose, Log) {
const User = mongoose.model('user');
return RestHapi.find(User, userId, {}, Log)
.then(function(result) {
const currentUserRank = request.auth.credentials.user.roleRank;
const affectedUserRank = result.roleRank;
return currentUserRank < affectedUserRank
})
.catch(function(error) {
Log.error("ERROR:", error)
return Boom.badRequest(error)
})
}
const promoteAuth = function promoteAuth(request, reply, next) {
let Log = request.logger.bind("promoteAuth");
try {
const Role = mongoose.model("role");
if (request.payload.role) {
return RestHapi.find(Role, request.payload.role, {}, Log)
.then(function (result) {
let updatedRank = result.rank;
let currentRank = request.auth.credentials.user.roleRank;
if (updatedRank < currentRank) {
return next(Boom.forbidden("Can't promote user to a higher role than yours"), false);
}
else {
return next(null, true);
}
})
}
else {
return next(null, true);
}
}