10007299807

Committed 19 Jul 2024 11:27AM UTC coverage: 31.929% (+0.07%) from 31.861%

Build # 10007299807

Build Type

Pull #9508

github

Committed by

Will-Howard

Commit Message

make displayName rate limit a setting

Pull Request Pull Request #9508: [EA] Allow users to change their displayName with a rate limit

Run Details

4910 of 40210 branches covered (12.21%)

Branch coverage included in aggregate %.

26 of 29 new or added lines in 3 files covered. (89.66%)

2 existing lines in 1 file now uncovered.

28630 of 64834 relevant lines covered (44.16%)

181.07 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

75.55

/packages/lesswrong/lib/vulcan-users/permissions.ts

import intersection from 'lodash/intersection';
import moment from 'moment';
import * as _ from 'underscore';
import { isLW } from '../instanceSettings';
import { getSchema } from'../utils/getSchema';
import { hideUnreviewedAuthorCommentsSettings } from '../publicSettings';

class Group {
  actions: Array<string>

  constructor() {
    this.actions = [];
  }

  can(actions: string|string[]) {
    actions = Array.isArray(actions) ? actions : [actions];
    this.actions = this.actions.concat(actions);
  }

  cannot(actions: string|string[]) {
    actions = Array.isArray(actions) ? actions : [actions];
    this.actions = _.difference(this.actions, actions);
  }
}

export const userGroups: Record<string,Group> = {};


// Create a new group
export const createGroup = (groupName: string): Group => {
  userGroups[groupName] = new Group();
  return userGroups[groupName];
};

export type PermissionableUser = UsersMinimumInfo & Pick<DbUser,
  "groups" |
  "banned" |
  "allCommentingDisabled" |
  "isAdmin" |
  "reviewedByUserId"
>;

// get a list of a user's groups
export const userGetGroups = (user: PermissionableUser|DbUser|null): Array<string> => {
  if (!user) { // guests user
    return ['guests'];
  }
  if (user.banned && user.banned > moment().toDate()) { // banned users have no membership permissions
    return ['guests'];
  }
  let userGroups: Array<string> = ['members'];

  if (user.groups) { // custom groups
    userGroups = userGroups.concat(user.groups);
  }

  if (userIsAdmin(user)) { // admin
    userGroups.push('admins');
  }
  
  return userGroups;
};

// Get a list of all the actions a user can perform
export const userGetActions = (user: UsersProfile|DbUser|null): Array<string> => {
  let groups = userGetGroups(user);
  if (!groups.includes('guests')) {
    // always give everybody permission for guests actions, too
    groups.push('guests');
  }
  let groupActions = groups.map(groupName => {
    // note: make sure groupName corresponds to an actual group
    const group = userGroups[groupName];
    return group && group.actions;
  });
  return _.unique(_.flatten(groupActions));
};

// Check if a user is a member of a group
export const userIsMemberOf = (user: PermissionableUser|DbUser|null, group: PermissionGroups): boolean => {
  const userGroups = userGetGroups(user);
  for (let userGroup of userGroups) {
    if (userGroup === group)
      return true;
  }
  return false;
};


export const userIsPodcaster = (user: UsersProfile|UsersProfile|DbUser|null): boolean => {
  return userIsMemberOf(user, 'podcasters');
};

// Check if a user can perform at least one of the specified actions
export const userCanDo = (user: UsersProfile|DbUser|null, actionOrActions: string|Array<string>): boolean => {
  const authorizedActions = userGetActions(user);
  const actions = Array.isArray(actionOrActions) ? actionOrActions : [actionOrActions];
  return userIsAdmin(user) || intersection(authorizedActions, actions).length > 0;
};

export type OwnableDocument = HasUserIdType|DbUser|UsersMinimumInfo;

// Check if a user owns a document
export const userOwns = function (user: UsersMinimumInfo|DbUser|null, document: OwnableDocument): boolean {
  if (!user) {
    // not logged in
    return false;
  }
  if (!document) {
    // no document specified
    return false;
  }
  
  if ((document as HasUserIdType).userId) {
    // case 1: document is a post or a comment, use userId to check
    return user._id === (document as HasUserIdType).userId;
  } else {
    // case 2: document is a user, use _id or slug to check
    const documentUser = document as (DbUser|UsersMinimumInfo);
    return documentUser.slug ? user.slug === documentUser.slug : user._id === documentUser._id;
  }
};

export const userOwnsAndOnLW = function (user: UsersMinimumInfo|DbUser|null, document: OwnableDocument): boolean {
  return isLW && userOwns(user, document)
}

export const documentIsNotDeleted = (
  user: PermissionableUser|DbUser|null,
  document: OwnableDocument,
) => {
  // Admins and mods can see deleted content
  if (userIsAdminOrMod(user)) {
    return true;
  }
  // Authors can see their deleted content
  if (userOwns(user, document)) {
    return true;
  }
  // Unfortunately, different collections use different field names
  // to represent "deleted-ness"
  return !(
    (document as unknown as DbComment).deleted ||
    (document as unknown as DbPost).deletedDraft ||
    (document as unknown as DbSequence).isDeleted
  );
}

export const userCanComment = (user: PermissionableUser|DbUser|null): boolean => {
  if (!user) {
    return false;
  }
  if (userIsAdminOrMod(user)) {
    return true;
  }
  if (user.allCommentingDisabled) {
    return false;
  }
  if (hideUnreviewedAuthorCommentsSettings.get() && !user.reviewedByUserId) {
    return false;
  }
  return true;
}

export const userOverNKarmaFunc = (n: number) => {
    return (user: UsersMinimumInfo|DbUser|null): boolean => {
      if (!user) return false
      return ((user.karma) > n)
    }
}

export const userOverNKarmaOrApproved = (n: number) => {
  return (user: UsersMinimumInfo|DbUser|null): boolean => {
    if (!user) return false
    return ((user.karma) > n || !!user.reviewedByUserId)
  }
}

export const userHasntChangedName = (user: UsersMinimumInfo|DbUser|null, document: HasUserIdType|DbUser|UsersMinimumInfo|DbObject): boolean => {
  if (!user) return false
  return !user.previousDisplayName
}

// Check if a user is an admin
export const userIsAdmin = function <T extends UsersMinimumInfo|DbUser|null>(user: T): user is Exclude<T, null> & { isAdmin: true } {
  if (!user) return false;
  return user.isAdmin;
};

export const isAdmin = userIsAdmin;

export const userIsAdminOrMod = function <T extends PermissionableUser|DbUser|null> (user: T): boolean {
  if (!user) return false;
  return user.isAdmin || userIsMemberOf(user, 'sunshineRegiment');
};

// Check if a user can view a field
export const userCanReadField = <N extends CollectionNameString>(
  user: UsersCurrent|DbUser|null,
  field: CollectionFieldSpecification<N>,
  document: ObjectsByCollectionName[N],
): boolean => {
  const canRead = field.canRead;
  const userGroups = userGetGroups(user);
  if (canRead) {
    return userHasFieldPermissions(user, userGroups, canRead, document);
  }
  return false;
};

const userHasFieldPermissions = <T extends DbObject>(
  user: UsersCurrent|DbUser|null,
  userGroups: string[],
  canRead: FieldPermissions,
  document: T
): boolean => {
  if (typeof canRead === 'string') {
    // if canRead is just a string, we assume it's the name of a group and pass it to isMemberOf
    if (canRead === 'guests') return true;
    for (let group of userGroups) {
      if (group===canRead)
        return true;
    }
    return false;
  } else if (typeof canRead === 'function') {
    // if canRead is a function, execute it with user and document passed. it must return a boolean
    return canRead(user, document);
  } else if (Array.isArray(canRead) && canRead.length > 0) {
    // if canRead is an array, we do a recursion on every item and return true if one of the items return true
    for (const group of canRead) {
      if (userHasFieldPermissions(user, userGroups, group, document)) {
        return true;
      }
    }
    return false;
  } else {
    return false;
  }
}

// For a given document or list of documents, keep only fields viewable by current user
// @param {Object} user - The user performing the action
// @param {Object} collection - The collection
// @param {Object} document - The document being returned by the resolver
// TODO: Integrate permissions-filtered DbObjects into the type system
export function restrictViewableFields<N extends CollectionNameString>(
  user: UsersCurrent|DbUser|null,
  collection: CollectionBase<N>,
  docOrDocs: ObjectsByCollectionName[N] | undefined | null,
): Partial<ObjectsByCollectionName[N]>;
export function restrictViewableFields<N extends CollectionNameString>(
  user: UsersCurrent|DbUser|null,
  collection: CollectionBase<N>,
  docOrDocs: ObjectsByCollectionName[N][] | undefined | null,
): Partial<ObjectsByCollectionName[N]>[];
export function restrictViewableFields<N extends CollectionNameString>(
  user: UsersCurrent|DbUser|null,
  collection: CollectionBase<N>,
  docOrDocs?: ObjectsByCollectionName[N][] | undefined | null,
): Partial<ObjectsByCollectionName[N]> | Partial<ObjectsByCollectionName[N]>[] {
  if (Array.isArray(docOrDocs)) {
    return restrictViewableFieldsMultiple(user, collection, docOrDocs);
  } else {
    return restrictViewableFieldsSingle(user, collection, docOrDocs);
  }
};

export const restrictViewableFieldsMultiple = function <N extends CollectionNameString>(
  user: UsersCurrent|DbUser|null,
  collection: CollectionBase<N>,
  docs: ObjectsByCollectionName[N][],
): Partial<ObjectsByCollectionName[N]>[] {
  if (!docs) return [];
  return docs.map(doc => restrictViewableFieldsSingle(user, collection, doc));
};

export const restrictViewableFieldsSingle = function <N extends CollectionNameString>(
  user: UsersCurrent|DbUser|null,
  collection: CollectionBase<N>,
  doc: ObjectsByCollectionName[N] | undefined | null,
): Partial<ObjectsByCollectionName[N]> {
  if (!doc) return {};
  const schema = getSchema(collection);
  const restrictedDocument: Partial<ObjectsByCollectionName[N]> = {};
  const userGroups = userGetGroups(user);

  for (const fieldName in doc) {
    const fieldSchema = schema[fieldName];
    if (fieldSchema) {
      const canRead = fieldSchema.canRead;
      if (canRead && userHasFieldPermissions(user, userGroups, canRead, doc)) {
        restrictedDocument[fieldName] = doc[fieldName];
      }
    }
  }

  return restrictedDocument;
}

// Check if a user can submit a field
export const userCanCreateField = <N extends CollectionNameString>(
  user: DbUser|UsersCurrent|null,
  field: CollectionFieldSpecification<N>,
): boolean => {
  const canCreate = field.canCreate; //OpenCRUD backwards compatibility
  if (canCreate) {
    if (typeof canCreate === 'function') {
      // if canCreate is a function, execute it with user and document passed. it must return a boolean
      return canCreate(user);
    } else if (typeof canCreate === 'string') {
      // if canCreate is just a string, we assume it's the name of a group and pass it to isMemberOf
      // note: if canCreate is 'guests' then anybody can create it
      return canCreate === 'guests' || userIsMemberOf(user, canCreate);
    } else if (Array.isArray(canCreate) && canCreate.length > 0) {
      // if canCreate is an array, we do a recursion on every item and return true if one of the items return true
      return canCreate.some(group => userCanCreateField(user, { canCreate: group }));
    }
  }
  return false;
};

// Check if a user can edit a field
export const userCanUpdateField = <N extends CollectionNameString>(
  user: DbUser|UsersCurrent|null,
  field: CollectionFieldSpecification<N>,
  document: Partial<ObjectsByCollectionName[N]>,
): boolean => {
  const canUpdate = field.canUpdate;

  if (canUpdate) {
    if (typeof canUpdate === 'function') {
      // if canUpdate is a function, execute it with user and document passed. it must return a boolean
      return canUpdate(user, document);
    } else if (typeof canUpdate === 'string') {
      // if canUpdate is just a string, we assume it's the name of a group and pass it to isMemberOf
      // note: if canUpdate is 'guests' then anybody can create it
      return canUpdate === 'guests' || userIsMemberOf(user, canUpdate);
    } else if (Array.isArray(canUpdate) && canUpdate.length > 0) {
      // if canUpdate is an array, we look at every item and return true if one of the items return true
      return canUpdate.some(group => userCanUpdateField(user, { canUpdate: group }, document));

    }
  }
  return false;
};

////////////////////
// Initialize     //
////////////////////

// initialize the 3 out-of-the-box groups
export const guestsGroup = createGroup('guests'); // non-logged-in users
export const membersGroup = createGroup('members'); // regular users

const membersActions = [
  'user.create',
  'user.update.own',
  // OpenCRUD backwards compatibility
  'users.new',
  'users.edit.own',
  'users.remove.own',
];
userGroups.members.can(membersActions);

export const adminsGroup = createGroup('admins'); // admin users

const adminActions = [
  'user.create',
  'user.update.all',
  'user.delete.all',
  'setting.update',
  // OpenCRUD backwards compatibility
  'users.new',
  'users.edit.all',
  'users.remove.all',
  'settings.edit',
];
userGroups.admins.can(adminActions);

1	import intersection from 'lodash/intersection';	12,265✔
2	import moment from 'moment';	43✔
3	import * as _ from 'underscore';	43✔
4	import { isLW } from '../instanceSettings';	43✔
5	import { getSchema } from'../utils/getSchema';	43✔
6	import { hideUnreviewedAuthorCommentsSettings } from '../publicSettings';	43✔
7
8	class Group {
9	actions: Array<string>
10
11	constructor() {
12	this.actions = [];	426✔
13	}
14
15	can(actions: string\|string[]) {
16	actions = Array.isArray(actions) ? actions : [actions];	1,254!
17	this.actions = this.actions.concat(actions);	1,254✔
18	}
19
20	cannot(actions: string\|string[]) {
21	actions = Array.isArray(actions) ? actions : [actions];	×
22	this.actions = _.difference(this.actions, actions);	×
23	}
24	}
25
26	export const userGroups: Record<string,Group> = {};	43✔
27
28
29	// Create a new group
30	export const createGroup = (groupName: string): Group => {	43✔
31	userGroups[groupName] = new Group();	426✔
32	return userGroups[groupName];	426✔
33	};
34
35	export type PermissionableUser = UsersMinimumInfo & Pick<DbUser,
36	"groups" \|
37	"banned" \|
38	"allCommentingDisabled" \|
39	"isAdmin" \|
40	"reviewedByUserId"
41	>;
42
43	// get a list of a user's groups
44	export const userGetGroups = (user: PermissionableUser\|DbUser\|null): Array<string> => {	43✔
45	if (!user) { // guests user	1,383✔
46	return ['guests'];	2✔
47	}
48	if (user.banned && user.banned > moment().toDate()) { // banned users have no membership permissions	1,381✔
49	return ['guests'];	1✔
50	}
51	let userGroups: Array<string> = ['members'];	1,380✔
52
53	if (user.groups) { // custom groups	1,380✔
54	userGroups = userGroups.concat(user.groups);	173✔
55	}
56
57	if (userIsAdmin(user)) { // admin	1,380✔
58	userGroups.push('admins');	7✔
59	}
60
61	return userGroups;	1,380✔
62	};
63
64	// Get a list of all the actions a user can perform
65	export const userGetActions = (user: UsersProfile\|DbUser\|null): Array<string> => {	43✔
66	let groups = userGetGroups(user);	789✔
67	if (!groups.includes('guests')) {	789✔
68	// always give everybody permission for guests actions, too
69	groups.push('guests');	786✔
70	}
71	let groupActions = groups.map(groupName => {	789✔
72	// note: make sure groupName corresponds to an actual group
73	const group = userGroups[groupName];	1,726✔
74	return group && group.actions;	1,726✔
75	});
76	return _.unique(_.flatten(groupActions));	789✔
77	};
78
79	// Check if a user is a member of a group
80	export const userIsMemberOf = (user: PermissionableUser\|DbUser\|null, group: PermissionGroups): boolean => {	43✔
81	const userGroups = userGetGroups(user);	472✔
82	for (let userGroup of userGroups) {	472✔
83	if (userGroup === group)	492✔
84	return true;	27✔
85	}
86	return false;	445✔
87	};
88
89
90	export const userIsPodcaster = (user: UsersProfile\|UsersProfile\|DbUser\|null): boolean => {	43✔
91	return userIsMemberOf(user, 'podcasters');	2✔
92	};
93
94	// Check if a user can perform at least one of the specified actions
95	export const userCanDo = (user: UsersProfile\|DbUser\|null, actionOrActions: string\|Array<string>): boolean => {	43✔
96	const authorizedActions = userGetActions(user);	789✔
97	const actions = Array.isArray(actionOrActions) ? actionOrActions : [actionOrActions];	789✔
98	return userIsAdmin(user) \|\| intersection(authorizedActions, actions).length > 0;	789✔
99	};
100
101	export type OwnableDocument = HasUserIdType\|DbUser\|UsersMinimumInfo;
102
103	// Check if a user owns a document
104	export const userOwns = function (user: UsersMinimumInfo\|DbUser\|null, document: OwnableDocument): boolean {	43✔
105	if (!user) {	719!
106	// not logged in
107	return false;	×
108	}
109	if (!document) {	719!
110	// no document specified
111	return false;	×
112	}
113
114	if ((document as HasUserIdType).userId) {	719✔
115	// case 1: document is a post or a comment, use userId to check
116	return user._id === (document as HasUserIdType).userId;	485✔
117	} else {
118	// case 2: document is a user, use _id or slug to check
119	const documentUser = document as (DbUser\|UsersMinimumInfo);	234✔
120	return documentUser.slug ? user.slug === documentUser.slug : user._id === documentUser._id;	234!
121	}
122	};
123
124	export const userOwnsAndOnLW = function (user: UsersMinimumInfo\|DbUser\|null, document: OwnableDocument): boolean {	43✔
125	return isLW && userOwns(user, document)	×
126	}
127
128	export const documentIsNotDeleted = (	43✔
129	user: PermissionableUser\|DbUser\|null,
130	document: OwnableDocument,
131	) => {
132	// Admins and mods can see deleted content
133	if (userIsAdminOrMod(user)) {	400✔
134	return true;	6✔
135	}
136	// Authors can see their deleted content
137	if (userOwns(user, document)) {	394✔
138	return true;	139✔
139	}
140	// Unfortunately, different collections use different field names
141	// to represent "deleted-ness"
142	return !(	255✔
143	(document as unknown as DbComment).deleted \|\|	759✔
144	(document as unknown as DbPost).deletedDraft \|\|
145	(document as unknown as DbSequence).isDeleted
146	);
147	}
148
149	export const userCanComment = (user: PermissionableUser\|DbUser\|null): boolean => {	43✔
150	if (!user) {	×
151	return false;	×
152	}
153	if (userIsAdminOrMod(user)) {	×
154	return true;	×
155	}
156	if (user.allCommentingDisabled) {	×
157	return false;	×
158	}
159	if (hideUnreviewedAuthorCommentsSettings.get() && !user.reviewedByUserId) {	×
160	return false;	×
161	}
162	return true;	×
163	}
164
165	export const userOverNKarmaFunc = (n: number) => {	43✔
166	return (user: UsersMinimumInfo\|DbUser\|null): boolean => {	×
167	if (!user) return false	×
168	return ((user.karma) > n)	×
169	}
170	}
171
172	export const userOverNKarmaOrApproved = (n: number) => {	43✔
173	return (user: UsersMinimumInfo\|DbUser\|null): boolean => {	48✔
174	if (!user) return false	×
175	return ((user.karma) > n \|\| !!user.reviewedByUserId)	×
176	}
177	}
178
179	export const userHasntChangedName = (user: UsersMinimumInfo\|DbUser\|null, document: HasUserIdType\|DbUser\|UsersMinimumInfo\|DbObject): boolean => {	43✔
UNCOV 180	if (!user) return false	×
UNCOV 181	return !user.previousDisplayName	×
182	}
183
184	// Check if a user is an admin
185	export const userIsAdmin = function <T extends UsersMinimumInfo\|DbUser\|null>(user: T): user is Exclude<T, null> & { isAdmin: true } {	43✔
186	if (!user) return false;	2,203✔
187	return user.isAdmin;	2,201✔
188	};
189
190	export const isAdmin = userIsAdmin;	43✔
191
192	export const userIsAdminOrMod = function <T extends PermissionableUser\|DbUser\|null> (user: T): boolean {	43✔
193	if (!user) return false;	402!
194	return user.isAdmin \|\| userIsMemberOf(user, 'sunshineRegiment');	402✔
195	};
196
197	// Check if a user can view a field
198	export const userCanReadField = <N extends CollectionNameString>(	43✔
199	user: UsersCurrent\|DbUser\|null,
200	field: CollectionFieldSpecification<N>,
201	document: ObjectsByCollectionName[N],
202	): boolean => {
203	const canRead = field.canRead;	90✔
204	const userGroups = userGetGroups(user);	90✔
205	if (canRead) {	90!
206	return userHasFieldPermissions(user, userGroups, canRead, document);	90✔
207	}
208	return false;	×
209	};
210
211	const userHasFieldPermissions = <T extends DbObject>(	43✔
212	user: UsersCurrent\|DbUser\|null,
213	userGroups: string[],
214	canRead: FieldPermissions,
215	document: T
216	): boolean => {
217	if (typeof canRead === 'string') {	10,574✔
218	// if canRead is just a string, we assume it's the name of a group and pass it to isMemberOf
219	if (canRead === 'guests') return true;	4,845✔
220	for (let group of userGroups) {	810✔
221	if (group===canRead)	840✔
222	return true;	158✔
223	}
224	return false;	652✔
225	} else if (typeof canRead === 'function') {	5,729✔
226	// if canRead is a function, execute it with user and document passed. it must return a boolean
227	return canRead(user, document);	654✔
228	} else if (Array.isArray(canRead) && canRead.length > 0) {	5,075!
229	// if canRead is an array, we do a recursion on every item and return true if one of the items return true
230	for (const group of canRead) {	5,075✔
231	if (userHasFieldPermissions(user, userGroups, group, document)) {	5,425✔
232	return true;	4,575✔
233	}
234	}
235	return false;	500✔
236	} else {
237	return false;	×
238	}
239	}
240
241	// For a given document or list of documents, keep only fields viewable by current user
242	// @param {Object} user - The user performing the action
243	// @param {Object} collection - The collection
244	// @param {Object} document - The document being returned by the resolver
245	// TODO: Integrate permissions-filtered DbObjects into the type system
246	export function restrictViewableFields<N extends CollectionNameString>(
247	user: UsersCurrent\|DbUser\|null,
248	collection: CollectionBase<N>,
249	docOrDocs: ObjectsByCollectionName[N] \| undefined \| null,
250	): Partial<ObjectsByCollectionName[N]>;
251	export function restrictViewableFields<N extends CollectionNameString>(
252	user: UsersCurrent\|DbUser\|null,
253	collection: CollectionBase<N>,
254	docOrDocs: ObjectsByCollectionName[N][] \| undefined \| null,
255	): Partial<ObjectsByCollectionName[N]>[];
256	export function restrictViewableFields<N extends CollectionNameString>(
257	user: UsersCurrent\|DbUser\|null,
258	collection: CollectionBase<N>,
259	docOrDocs?: ObjectsByCollectionName[N][] \| undefined \| null,
260	): Partial<ObjectsByCollectionName[N]> \| Partial<ObjectsByCollectionName[N]>[] {
261	if (Array.isArray(docOrDocs)) {	×
262	return restrictViewableFieldsMultiple(user, collection, docOrDocs);	×
263	} else {
264	return restrictViewableFieldsSingle(user, collection, docOrDocs);	×
265	}
266	};
267
268	export const restrictViewableFieldsMultiple = function <N extends CollectionNameString>(	43✔
269	user: UsersCurrent\|DbUser\|null,
270	collection: CollectionBase<N>,
271	docs: ObjectsByCollectionName[N][],
272	): Partial<ObjectsByCollectionName[N]>[] {
273	if (!docs) return [];	9!
274	return docs.map(doc => restrictViewableFieldsSingle(user, collection, doc));	23✔
275	};
276
277	export const restrictViewableFieldsSingle = function <N extends CollectionNameString>(	43✔
278	user: UsersCurrent\|DbUser\|null,
279	collection: CollectionBase<N>,
280	doc: ObjectsByCollectionName[N] \| undefined \| null,
281	): Partial<ObjectsByCollectionName[N]> {
282	if (!doc) return {};	32!
283	const schema = getSchema(collection);	32✔
284	const restrictedDocument: Partial<ObjectsByCollectionName[N]> = {};	32✔
285	const userGroups = userGetGroups(user);	32✔
286
287	for (const fieldName in doc) {	32✔
288	const fieldSchema = schema[fieldName];	5,120✔
289	if (fieldSchema) {	5,120✔
290	const canRead = fieldSchema.canRead;	5,093✔
291	if (canRead && userHasFieldPermissions(user, userGroups, canRead, doc)) {	5,093✔
292	restrictedDocument[fieldName] = doc[fieldName];	4,523✔
293	}
294	}
295	}
296
297	return restrictedDocument;	32✔
298	}
299
300	// Check if a user can submit a field
301	export const userCanCreateField = <N extends CollectionNameString>(	43✔
302	user: DbUser\|UsersCurrent\|null,
303	field: CollectionFieldSpecification<N>,
304	): boolean => {
305	const canCreate = field.canCreate; //OpenCRUD backwards compatibility	16✔
306	if (canCreate) {	16!
307	if (typeof canCreate === 'function') {	16!
308	// if canCreate is a function, execute it with user and document passed. it must return a boolean
309	return canCreate(user);	×
310	} else if (typeof canCreate === 'string') {	16✔
311	// if canCreate is just a string, we assume it's the name of a group and pass it to isMemberOf
312	// note: if canCreate is 'guests' then anybody can create it
313	return canCreate === 'guests' \|\| userIsMemberOf(user, canCreate);	8✔
314	} else if (Array.isArray(canCreate) && canCreate.length > 0) {	8!
315	// if canCreate is an array, we do a recursion on every item and return true if one of the items return true
316	return canCreate.some(group => userCanCreateField(user, { canCreate: group }));	8✔
317	}
318	}
319	return false;	×
320	};
321
322	// Check if a user can edit a field
323	export const userCanUpdateField = <N extends CollectionNameString>(	43✔
324	user: DbUser\|UsersCurrent\|null,
325	field: CollectionFieldSpecification<N>,
326	document: Partial<ObjectsByCollectionName[N]>,
327	): boolean => {
328	const canUpdate = field.canUpdate;	65✔
329
330	if (canUpdate) {	65!
331	if (typeof canUpdate === 'function') {	65✔
332	// if canUpdate is a function, execute it with user and document passed. it must return a boolean
333	return canUpdate(user, document);	11✔
334	} else if (typeof canUpdate === 'string') {	54✔
335	// if canUpdate is just a string, we assume it's the name of a group and pass it to isMemberOf
336	// note: if canUpdate is 'guests' then anybody can create it
337	return canUpdate === 'guests' \|\| userIsMemberOf(user, canUpdate);	28✔
338	} else if (Array.isArray(canUpdate) && canUpdate.length > 0) {	26!
339	// if canUpdate is an array, we look at every item and return true if one of the items return true
340	return canUpdate.some(group => userCanUpdateField(user, { canUpdate: group }, document));	36✔
341
342	}
343	}
344	return false;	×
345	};
346
347	////////////////////
348	// Initialize //
349	////////////////////
350
351	// initialize the 3 out-of-the-box groups
352	export const guestsGroup = createGroup('guests'); // non-logged-in users	43✔
353	export const membersGroup = createGroup('members'); // regular users	43✔
354
355	const membersActions = [	43✔
356	'user.create',
357	'user.update.own',
358	// OpenCRUD backwards compatibility
359	'users.new',
360	'users.edit.own',
361	'users.remove.own',
362	];
363	userGroups.members.can(membersActions);	43✔
364
365	export const adminsGroup = createGroup('admins'); // admin users	43✔
366
367	const adminActions = [	43✔
368	'user.create',
369	'user.update.all',
370	'user.delete.all',
371	'setting.update',
372	// OpenCRUD backwards compatibility
373	'users.new',
374	'users.edit.all',
375	'users.remove.all',
376	'settings.edit',
377	];
378	userGroups.admins.can(adminActions);	43✔

ForumMagnum / ForumMagnum / 10007299807

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous