11564891391

Committed 29 Oct 2024 12:21AM UTC coverage: 31.349% (-0.008%) from 31.357%

Build # 11564891391

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #9903 from ForumMagnum/new-users-can-shortform

New users can quick take

Run Details

5031 of 42352 branches covered (11.88%)

Branch coverage included in aggregate %.

6 of 23 new or added lines in 8 files covered. (26.09%)

3 existing lines in 3 files now uncovered.

29646 of 68264 relevant lines covered (43.43%)

173.93 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

74.32

/packages/lesswrong/lib/vulcan-users/permissions.ts

import intersection from 'lodash/intersection';
import moment from 'moment';
import * as _ from 'underscore';
import { isLW } from '../instanceSettings';
import { getSchema } from'../utils/getSchema';
import { hideUnreviewedAuthorCommentsSettings } from '../publicSettings';

class Group {
  actions: Array<string>

  constructor() {
    this.actions = [];
  }

  can(actions: string|string[]) {
    actions = Array.isArray(actions) ? actions : [actions];
    this.actions = this.actions.concat(actions);
  }

  cannot(actions: string|string[]) {
    actions = Array.isArray(actions) ? actions : [actions];
    this.actions = _.difference(this.actions, actions);
  }
}

export const userGroups: Record<string,Group> = {};


// Create a new group
export const createGroup = (groupName: string): Group => {
  userGroups[groupName] = new Group();
  return userGroups[groupName];
};

export type PermissionableUser = UsersMinimumInfo & Pick<DbUser,
  "groups" |
  "banned" |
  "allCommentingDisabled" |
  "isAdmin" |
  "reviewedByUserId"
>;

// get a list of a user's groups
export const userGetGroups = (user: PermissionableUser|DbUser|null): Array<string> => {
  if (!user) { // guests user
    return ['guests'];
  }
  if (user.banned && user.banned > moment().toDate()) { // banned users have no membership permissions
    return ['guests'];
  }
  let userGroups: Array<string> = ['members'];

  if (user.groups) { // custom groups
    userGroups = userGroups.concat(user.groups);
  }

  if (userIsAdmin(user)) { // admin
    userGroups.push('admins');
  }
  
  return userGroups;
};

// Get a list of all the actions a user can perform
export const userGetActions = (user: UsersProfile|DbUser|null): Array<string> => {
  let groups = userGetGroups(user);
  if (!groups.includes('guests')) {
    // always give everybody permission for guests actions, too
    groups.push('guests');
  }
  let groupActions = groups.map(groupName => {
    // note: make sure groupName corresponds to an actual group
    const group = userGroups[groupName];
    return group && group.actions;
  });
  return _.unique(_.flatten(groupActions));
};

// Check if a user is a member of a group
export const userIsMemberOf = (user: PermissionableUser|DbUser|null, group: PermissionGroups): boolean => {
  const userGroups = userGetGroups(user);
  for (let userGroup of userGroups) {
    if (userGroup === group)
      return true;
  }
  return false;
};


export const userIsPodcaster = (user: UsersProfile|UsersProfile|DbUser|null): boolean => {
  return userIsMemberOf(user, 'podcasters');
};

// Check if a user can perform at least one of the specified actions
export const userCanDo = (user: UsersProfile|DbUser|null, actionOrActions: string|Array<string>): boolean => {
  const authorizedActions = userGetActions(user);
  const actions = Array.isArray(actionOrActions) ? actionOrActions : [actionOrActions];
  return userIsAdmin(user) || intersection(authorizedActions, actions).length > 0;
};

export type OwnableDocument = HasUserIdType|DbUser|UsersMinimumInfo;

// Check if a user owns a document
export const userOwns = function (user: UsersMinimumInfo|DbUser|null, document: OwnableDocument): boolean {
  if (!user) {
    // not logged in
    return false;
  }
  if (!document) {
    // no document specified
    return false;
  }
  
  if ((document as HasUserIdType).userId) {
    // case 1: document is a post or a comment, use userId to check
    return user._id === (document as HasUserIdType).userId;
  } else {
    // case 2: document is a user, use _id or slug to check
    const documentUser = document as (DbUser|UsersMinimumInfo);
    const idsExistAndMatch = !!user._id && !!documentUser._id && user._id === documentUser._id;
    const slugsExistAndMatch = !!user.slug && !!documentUser.slug && user.slug === documentUser.slug;
    return idsExistAndMatch || slugsExistAndMatch;
  }
};

export const userOwnsAndOnLW = function (user: UsersMinimumInfo|DbUser|null, document: OwnableDocument): boolean {
  return isLW && userOwns(user, document)
}

export const documentIsNotDeleted = (
  user: PermissionableUser|DbUser|null,
  document: OwnableDocument,
) => {
  // Admins and mods can see deleted content
  if (userIsAdminOrMod(user)) {
    return true;
  }
  // Authors can see their deleted content
  if (userOwns(user, document)) {
    return true;
  }
  // Unfortunately, different collections use different field names
  // to represent "deleted-ness"
  return !(
    (document as unknown as DbComment).deleted ||
    (document as unknown as DbPost).deletedDraft ||
    (document as unknown as DbSequence).isDeleted
  );
}

export const userCanComment = (user: PermissionableUser|DbUser|null): boolean => {
  if (!user) {
    return false;
  }
  if (userIsAdminOrMod(user)) {
    return true;
  }
  if (user.allCommentingDisabled) {
    return false;
  }
  if (hideUnreviewedAuthorCommentsSettings.get() && !user.reviewedByUserId) {
    return false;
  }
  return true;
}

// Same as userCanComment, but without the unreviewed author check
export const userCanQuickTake = (user: PermissionableUser|DbUser|null): boolean => {
  if (!user) {
    return false;
  }

  if (userIsAdminOrMod(user)) {
    return true;
  }

  if (user.allCommentingDisabled) {
    return false;
  }

  return true;
}

export const userOverNKarmaFunc = (n: number) => {
    return (user: UsersMinimumInfo|DbUser|null): boolean => {
      if (!user) return false
      return ((user.karma) > n)
    }
}

export const userOverNKarmaOrApproved = (n: number) => {
  return (user: UsersMinimumInfo|DbUser|null): boolean => {
    if (!user) return false
    return ((user.karma) > n || !!user.reviewedByUserId)
  }
}

export const userHasntChangedName = (user: UsersMinimumInfo|DbUser|null, document: HasUserIdType|DbUser|UsersMinimumInfo|DbObject): boolean => {
  if (!user) return false
  return !user.previousDisplayName
}

// Check if a user is an admin
export const userIsAdmin = function <T extends UsersMinimumInfo|DbUser|null>(user: T): user is Exclude<T, null> & { isAdmin: true } {
  if (!user) return false;
  return user.isAdmin;
};

export const isAdmin = userIsAdmin;

export const userIsAdminOrMod = function <T extends PermissionableUser|DbUser|null> (user: T): boolean {
  if (!user) return false;
  return user.isAdmin || userIsMemberOf(user, 'sunshineRegiment');
};

// Check if a user can view a field
export const userCanReadField = <N extends CollectionNameString>(
  user: UsersCurrent|DbUser|null,
  field: CollectionFieldSpecification<N>,
  document: ObjectsByCollectionName[N],
): boolean => {
  const canRead = field.canRead;
  const userGroups = userGetGroups(user);
  if (canRead) {
    return userHasFieldPermissions(user, userGroups, canRead, document);
  }
  return false;
};

const userHasFieldPermissions = <T extends DbObject>(
  user: UsersCurrent|DbUser|null,
  userGroups: string[],
  canRead: FieldPermissions,
  document: T
): boolean => {
  if (typeof canRead === 'string') {
    // if canRead is just a string, we assume it's the name of a group and pass it to isMemberOf
    if (canRead === 'guests') return true;
    for (let group of userGroups) {
      if (group===canRead)
        return true;
    }
    return false;
  } else if (typeof canRead === 'function') {
    // if canRead is a function, execute it with user and document passed. it must return a boolean
    return canRead(user, document);
  } else if (Array.isArray(canRead) && canRead.length > 0) {
    // if canRead is an array, we do a recursion on every item and return true if one of the items return true
    for (const group of canRead) {
      if (userHasFieldPermissions(user, userGroups, group, document)) {
        return true;
      }
    }
    return false;
  } else {
    return false;
  }
}

// For a given document or list of documents, keep only fields viewable by current user
// @param {Object} user - The user performing the action
// @param {Object} collection - The collection
// @param {Object} document - The document being returned by the resolver
// TODO: Integrate permissions-filtered DbObjects into the type system
export function restrictViewableFields<N extends CollectionNameString>(
  user: UsersCurrent|DbUser|null,
  collection: CollectionBase<N>,
  docOrDocs: ObjectsByCollectionName[N] | undefined | null,
): Partial<ObjectsByCollectionName[N]>;
export function restrictViewableFields<N extends CollectionNameString>(
  user: UsersCurrent|DbUser|null,
  collection: CollectionBase<N>,
  docOrDocs: ObjectsByCollectionName[N][] | undefined | null,
): Partial<ObjectsByCollectionName[N]>[];
export function restrictViewableFields<N extends CollectionNameString>(
  user: UsersCurrent|DbUser|null,
  collection: CollectionBase<N>,
  docOrDocs?: ObjectsByCollectionName[N][] | undefined | null,
): Partial<ObjectsByCollectionName[N]> | Partial<ObjectsByCollectionName[N]>[] {
  if (Array.isArray(docOrDocs)) {
    return restrictViewableFieldsMultiple(user, collection, docOrDocs);
  } else {
    return restrictViewableFieldsSingle(user, collection, docOrDocs);
  }
};

export const restrictViewableFieldsMultiple = function <N extends CollectionNameString, DocType extends ObjectsByCollectionName[N]>(
  user: UsersCurrent|DbUser|null,
  collection: CollectionBase<N>,
  docs: DocType[],
): Partial<DocType>[] {
  if (!docs) return [];
  return docs.map(doc => restrictViewableFieldsSingle(user, collection, doc));
};

export const restrictViewableFieldsSingle = function <N extends CollectionNameString, DocType extends ObjectsByCollectionName[N]>(
  user: UsersCurrent|DbUser|null,
  collection: CollectionBase<N>,
  doc: DocType | undefined | null,
): Partial<DocType> {
  if (!doc) return {};
  const schema = getSchema(collection);
  const restrictedDocument: Partial<DocType> = {};
  const userGroups = userGetGroups(user);

  for (const fieldName in doc) {
    const fieldSchema = schema[fieldName];
    if (fieldSchema) {
      const canRead = fieldSchema.canRead;
      if (canRead && userHasFieldPermissions(user, userGroups, canRead, doc)) {
        restrictedDocument[fieldName] = doc[fieldName];
      }
    }
  }

  return restrictedDocument;
}

// Check if a user can submit a field
export const userCanCreateField = <N extends CollectionNameString>(
  user: DbUser|UsersCurrent|null,
  field: CollectionFieldSpecification<N>,
): boolean => {
  const canCreate = field.canCreate; //OpenCRUD backwards compatibility
  if (canCreate) {
    if (typeof canCreate === 'function') {
      // if canCreate is a function, execute it with user and document passed. it must return a boolean
      return canCreate(user);
    } else if (typeof canCreate === 'string') {
      // if canCreate is just a string, we assume it's the name of a group and pass it to isMemberOf
      // note: if canCreate is 'guests' then anybody can create it
      return canCreate === 'guests' || userIsMemberOf(user, canCreate);
    } else if (Array.isArray(canCreate) && canCreate.length > 0) {
      // if canCreate is an array, we do a recursion on every item and return true if one of the items return true
      return canCreate.some(group => userCanCreateField(user, { canCreate: group }));
    }
  }
  return false;
};

// Check if a user can edit a field
export const userCanUpdateField = <N extends CollectionNameString>(
  user: DbUser|UsersCurrent|null,
  field: CollectionFieldSpecification<N>,
  document: Partial<ObjectsByCollectionName[N]>,
): boolean => {
  const canUpdate = field.canUpdate;

  if (canUpdate) {
    if (typeof canUpdate === 'function') {
      // if canUpdate is a function, execute it with user and document passed. it must return a boolean
      return canUpdate(user, document);
    } else if (typeof canUpdate === 'string') {
      // if canUpdate is just a string, we assume it's the name of a group and pass it to isMemberOf
      // note: if canUpdate is 'guests' then anybody can create it
      return canUpdate === 'guests' || userIsMemberOf(user, canUpdate);
    } else if (Array.isArray(canUpdate) && canUpdate.length > 0) {
      // if canUpdate is an array, we look at every item and return true if one of the items return true
      return canUpdate.some(group => userCanUpdateField(user, { canUpdate: group }, document));

    }
  }
  return false;
};

////////////////////
// Initialize     //
////////////////////

// initialize the 3 out-of-the-box groups
export const guestsGroup = createGroup('guests'); // non-logged-in users
export const membersGroup = createGroup('members'); // regular users

const membersActions = [
  'user.create',
  'user.update.own',
  // OpenCRUD backwards compatibility
  'users.new',
  'users.edit.own',
  'users.remove.own',
];
userGroups.members.can(membersActions);

export const adminsGroup = createGroup('admins'); // admin users

const adminActions = [
  'user.create',
  'user.update.all',
  'user.delete.all',
  'setting.update',
  // OpenCRUD backwards compatibility
  'users.new',
  'users.edit.all',
  'users.remove.all',
  'settings.edit',
];
userGroups.admins.can(adminActions);

1	import intersection from 'lodash/intersection';	13,594✔
2	import moment from 'moment';	44✔
3	import * as _ from 'underscore';	44✔
4	import { isLW } from '../instanceSettings';	44✔
5	import { getSchema } from'../utils/getSchema';	44✔
6	import { hideUnreviewedAuthorCommentsSettings } from '../publicSettings';	44✔
7
8	class Group {
9	actions: Array<string>
10
11	constructor() {
12	this.actions = [];	439✔
13	}
14
15	can(actions: string\|string[]) {
16	actions = Array.isArray(actions) ? actions : [actions];	1,269!
17	this.actions = this.actions.concat(actions);	1,269✔
18	}
19
20	cannot(actions: string\|string[]) {
21	actions = Array.isArray(actions) ? actions : [actions];	×
22	this.actions = _.difference(this.actions, actions);	×
23	}
24	}
25
26	export const userGroups: Record<string,Group> = {};	44✔
27
28
29	// Create a new group
30	export const createGroup = (groupName: string): Group => {	44✔
31	userGroups[groupName] = new Group();	439✔
32	return userGroups[groupName];	439✔
33	};
34
35	export type PermissionableUser = UsersMinimumInfo & Pick<DbUser,
36	"groups" \|
37	"banned" \|
38	"allCommentingDisabled" \|
39	"isAdmin" \|
40	"reviewedByUserId"
41	>;
42
43	// get a list of a user's groups
44	export const userGetGroups = (user: PermissionableUser\|DbUser\|null): Array<string> => {	44✔
45	if (!user) { // guests user	1,731✔
46	return ['guests'];	267✔
47	}
48	if (user.banned && user.banned > moment().toDate()) { // banned users have no membership permissions	1,464✔
49	return ['guests'];	1✔
50	}
51	let userGroups: Array<string> = ['members'];	1,463✔
52
53	if (user.groups) { // custom groups	1,463✔
54	userGroups = userGroups.concat(user.groups);	173✔
55	}
56
57	if (userIsAdmin(user)) { // admin	1,463✔
58	userGroups.push('admins');	7✔
59	}
60
61	return userGroups;	1,463✔
62	};
63
64	// Get a list of all the actions a user can perform
65	export const userGetActions = (user: UsersProfile\|DbUser\|null): Array<string> => {	44✔
66	let groups = userGetGroups(user);	962✔
67	if (!groups.includes('guests')) {	962✔
68	// always give everybody permission for guests actions, too
69	groups.push('guests');	817✔
70	}
71	let groupActions = groups.map(groupName => {	962✔
72	// note: make sure groupName corresponds to an actual group
73	const group = userGroups[groupName];	1,930✔
74	return group && group.actions;	1,930✔
75	});
76	return _.unique(_.flatten(groupActions));	962✔
77	};
78
79	// Check if a user is a member of a group
80	export const userIsMemberOf = (user: PermissionableUser\|DbUser\|null, group: PermissionGroups): boolean => {	44✔
81	const userGroups = userGetGroups(user);	531✔
82	for (let userGroup of userGroups) {	531✔
83	if (userGroup === group)	551✔
84	return true;	28✔
85	}
86	return false;	503✔
87	};
88
89
90	export const userIsPodcaster = (user: UsersProfile\|UsersProfile\|DbUser\|null): boolean => {	44✔
91	return userIsMemberOf(user, 'podcasters');	27✔
92	};
93
94	// Check if a user can perform at least one of the specified actions
95	export const userCanDo = (user: UsersProfile\|DbUser\|null, actionOrActions: string\|Array<string>): boolean => {	44✔
96	const authorizedActions = userGetActions(user);	962✔
97	const actions = Array.isArray(actionOrActions) ? actionOrActions : [actionOrActions];	962✔
98	return userIsAdmin(user) \|\| intersection(authorizedActions, actions).length > 0;	962✔
99	};
100
101	export type OwnableDocument = HasUserIdType\|DbUser\|UsersMinimumInfo;
102
103	// Check if a user owns a document
104	export const userOwns = function (user: UsersMinimumInfo\|DbUser\|null, document: OwnableDocument): boolean {	44✔
105	if (!user) {	3,866✔
106	// not logged in
107	return false;	3,096✔
108	}
109	if (!document) {	770!
110	// no document specified
111	return false;	×
112	}
113
114	if ((document as HasUserIdType).userId) {	770✔
115	// case 1: document is a post or a comment, use userId to check
116	return user._id === (document as HasUserIdType).userId;	529✔
117	} else {
118	// case 2: document is a user, use _id or slug to check
119	const documentUser = document as (DbUser\|UsersMinimumInfo);	241✔
120	const idsExistAndMatch = !!user._id && !!documentUser._id && user._id === documentUser._id;	241✔
121	const slugsExistAndMatch = !!user.slug && !!documentUser.slug && user.slug === documentUser.slug;	241✔
122	return idsExistAndMatch \|\| slugsExistAndMatch;	241✔
123	}
124	};
125
126	export const userOwnsAndOnLW = function (user: UsersMinimumInfo\|DbUser\|null, document: OwnableDocument): boolean {	44✔
127	return isLW && userOwns(user, document)	×
128	}
129
130	export const documentIsNotDeleted = (	44✔
131	user: PermissionableUser\|DbUser\|null,
132	document: OwnableDocument,
133	) => {
134	// Admins and mods can see deleted content
135	if (userIsAdminOrMod(user)) {	835✔
136	return true;	6✔
137	}
138	// Authors can see their deleted content
139	if (userOwns(user, document)) {	829✔
140	return true;	169✔
141	}
142	// Unfortunately, different collections use different field names
143	// to represent "deleted-ness"
144	return !(	660✔
145	(document as unknown as DbComment).deleted \|\|	1,974✔
146	(document as unknown as DbPost).deletedDraft \|\|
147	(document as unknown as DbSequence).isDeleted
148	);
149	}
150
151	export const userCanComment = (user: PermissionableUser\|DbUser\|null): boolean => {	44✔
152	if (!user) {	×
153	return false;	×
154	}
155	if (userIsAdminOrMod(user)) {	×
156	return true;	×
157	}
158	if (user.allCommentingDisabled) {	×
159	return false;	×
160	}
161	if (hideUnreviewedAuthorCommentsSettings.get() && !user.reviewedByUserId) {	×
162	return false;	×
163	}
164	return true;	×
165	}
166
167	// Same as userCanComment, but without the unreviewed author check
168	export const userCanQuickTake = (user: PermissionableUser\|DbUser\|null): boolean => {	44✔
NEW 169	if (!user) {	×
NEW 170	return false;	×
171	}
172
NEW 173	if (userIsAdminOrMod(user)) {	×
NEW 174	return true;	×
175	}
176
NEW 177	if (user.allCommentingDisabled) {	×
NEW 178	return false;	×
179	}
180
NEW 181	return true;	×
182	}
183
184	export const userOverNKarmaFunc = (n: number) => {	44✔
185	return (user: UsersMinimumInfo\|DbUser\|null): boolean => {	×
186	if (!user) return false	×
187	return ((user.karma) > n)	×
188	}
189	}
190
191	export const userOverNKarmaOrApproved = (n: number) => {	44✔
192	return (user: UsersMinimumInfo\|DbUser\|null): boolean => {	50✔
193	if (!user) return false	×
194	return ((user.karma) > n \|\| !!user.reviewedByUserId)	×
195	}
196	}
197
198	export const userHasntChangedName = (user: UsersMinimumInfo\|DbUser\|null, document: HasUserIdType\|DbUser\|UsersMinimumInfo\|DbObject): boolean => {	44✔
199	if (!user) return false	×
200	return !user.previousDisplayName	×
201	}
202
203	// Check if a user is an admin
204	export const userIsAdmin = function <T extends UsersMinimumInfo\|DbUser\|null>(user: T): user is Exclude<T, null> & { isAdmin: true } {	44✔
205	if (!user) return false;	2,531✔
206	return user.isAdmin;	2,315✔
207	};
208
209	export const isAdmin = userIsAdmin;	44✔
210
211	export const userIsAdminOrMod = function <T extends PermissionableUser\|DbUser\|null> (user: T): boolean {	44✔
212	if (!user) return false;	838✔
213	return user.isAdmin \|\| userIsMemberOf(user, 'sunshineRegiment');	433✔
214	};
215
216	// Check if a user can view a field
217	export const userCanReadField = <N extends CollectionNameString>(	44✔
218	user: UsersCurrent\|DbUser\|null,
219	field: CollectionFieldSpecification<N>,
220	document: ObjectsByCollectionName[N],
221	): boolean => {
222	const canRead = field.canRead;	127✔
223	const userGroups = userGetGroups(user);	127✔
224	if (canRead) {	127!
225	return userHasFieldPermissions(user, userGroups, canRead, document);	127✔
226	}
227	return false;	×
228	};
229
230	const userHasFieldPermissions = <T extends DbObject>(	44✔
231	user: UsersCurrent\|DbUser\|null,
232	userGroups: string[],
233	canRead: FieldPermissions,
234	document: T
235	): boolean => {
236	if (typeof canRead === 'string') {	37,215✔
237	// if canRead is just a string, we assume it's the name of a group and pass it to isMemberOf
238	if (canRead === 'guests') return true;	17,191✔
239	for (let group of userGroups) {	5,646✔
240	if (group===canRead)	5,676✔
241	return true;	141✔
242	}
243	return false;	5,505✔
244	} else if (typeof canRead === 'function') {	20,024✔
245	// if canRead is a function, execute it with user and document passed. it must return a boolean
246	return canRead(user, document);	3,769✔
247	} else if (Array.isArray(canRead) && canRead.length > 0) {	16,255!
248	// if canRead is an array, we do a recursion on every item and return true if one of the items return true
249	for (const group of canRead) {	16,255✔
250	if (userHasFieldPermissions(user, userGroups, group, document)) {	20,449✔
251	return true;	12,478✔
252	}
253	}
254	return false;	3,777✔
255	} else {
256	return false;	×
257	}
258	}
259
260	// For a given document or list of documents, keep only fields viewable by current user
261	// @param {Object} user - The user performing the action
262	// @param {Object} collection - The collection
263	// @param {Object} document - The document being returned by the resolver
264	// TODO: Integrate permissions-filtered DbObjects into the type system
265	export function restrictViewableFields<N extends CollectionNameString>(
266	user: UsersCurrent\|DbUser\|null,
267	collection: CollectionBase<N>,
268	docOrDocs: ObjectsByCollectionName[N] \| undefined \| null,
269	): Partial<ObjectsByCollectionName[N]>;
270	export function restrictViewableFields<N extends CollectionNameString>(
271	user: UsersCurrent\|DbUser\|null,
272	collection: CollectionBase<N>,
273	docOrDocs: ObjectsByCollectionName[N][] \| undefined \| null,
274	): Partial<ObjectsByCollectionName[N]>[];
275	export function restrictViewableFields<N extends CollectionNameString>(
276	user: UsersCurrent\|DbUser\|null,
277	collection: CollectionBase<N>,
278	docOrDocs?: ObjectsByCollectionName[N][] \| undefined \| null,
279	): Partial<ObjectsByCollectionName[N]> \| Partial<ObjectsByCollectionName[N]>[] {
280	if (Array.isArray(docOrDocs)) {	×
281	return restrictViewableFieldsMultiple(user, collection, docOrDocs);	×
282	} else {
283	return restrictViewableFieldsSingle(user, collection, docOrDocs);	×
284	}
285	};
286
287	export const restrictViewableFieldsMultiple = function <N extends CollectionNameString, DocType extends ObjectsByCollectionName[N]>(	44✔
288	user: UsersCurrent\|DbUser\|null,
289	collection: CollectionBase<N>,
290	docs: DocType[],
291	): Partial<DocType>[] {
292	if (!docs) return [];	110!
293	return docs.map(doc => restrictViewableFieldsSingle(user, collection, doc));	110✔
294	};
295
296	export const restrictViewableFieldsSingle = function <N extends CollectionNameString, DocType extends ObjectsByCollectionName[N]>(	44✔
297	user: UsersCurrent\|DbUser\|null,
298	collection: CollectionBase<N>,
299	doc: DocType \| undefined \| null,
300	): Partial<DocType> {
301	if (!doc) return {};	111!
302	const schema = getSchema(collection);	111✔
303	const restrictedDocument: Partial<DocType> = {};	111✔
304	const userGroups = userGetGroups(user);	111✔
305
306	for (const fieldName in doc) {	111✔
307	const fieldSchema = schema[fieldName];	17,064✔
308	if (fieldSchema) {	17,064✔
309	const canRead = fieldSchema.canRead;	16,802✔
310	if (canRead && userHasFieldPermissions(user, userGroups, canRead, doc)) {	16,802✔
311	restrictedDocument[fieldName] = doc[fieldName];	12,443✔
312	}
313	}
314	}
315
316	return restrictedDocument;	111✔
317	}
318
319	// Check if a user can submit a field
320	export const userCanCreateField = <N extends CollectionNameString>(	44✔
321	user: DbUser\|UsersCurrent\|null,
322	field: CollectionFieldSpecification<N>,
323	): boolean => {
324	const canCreate = field.canCreate; //OpenCRUD backwards compatibility	16✔
325	if (canCreate) {	16!
326	if (typeof canCreate === 'function') {	16!
327	// if canCreate is a function, execute it with user and document passed. it must return a boolean
328	return canCreate(user);	×
329	} else if (typeof canCreate === 'string') {	16✔
330	// if canCreate is just a string, we assume it's the name of a group and pass it to isMemberOf
331	// note: if canCreate is 'guests' then anybody can create it
332	return canCreate === 'guests' \|\| userIsMemberOf(user, canCreate);	8✔
333	} else if (Array.isArray(canCreate) && canCreate.length > 0) {	8!
334	// if canCreate is an array, we do a recursion on every item and return true if one of the items return true
335	return canCreate.some(group => userCanCreateField(user, { canCreate: group }));	8✔
336	}
337	}
338	return false;	×
339	};
340
341	// Check if a user can edit a field
342	export const userCanUpdateField = <N extends CollectionNameString>(	44✔
343	user: DbUser\|UsersCurrent\|null,
344	field: CollectionFieldSpecification<N>,
345	document: Partial<ObjectsByCollectionName[N]>,
346	): boolean => {
347	const canUpdate = field.canUpdate;	69✔
348
349	if (canUpdate) {	69!
350	if (typeof canUpdate === 'function') {	69✔
351	// if canUpdate is a function, execute it with user and document passed. it must return a boolean
352	return canUpdate(user, document);	11✔
353	} else if (typeof canUpdate === 'string') {	58✔
354	// if canUpdate is just a string, we assume it's the name of a group and pass it to isMemberOf
355	// note: if canUpdate is 'guests' then anybody can create it
356	return canUpdate === 'guests' \|\| userIsMemberOf(user, canUpdate);	31✔
357	} else if (Array.isArray(canUpdate) && canUpdate.length > 0) {	27!
358	// if canUpdate is an array, we look at every item and return true if one of the items return true
359	return canUpdate.some(group => userCanUpdateField(user, { canUpdate: group }, document));	39✔
360
361	}
362	}
363	return false;	×
364	};
365
366	////////////////////
367	// Initialize //
368	////////////////////
369
370	// initialize the 3 out-of-the-box groups
371	export const guestsGroup = createGroup('guests'); // non-logged-in users	44✔
372	export const membersGroup = createGroup('members'); // regular users	44✔
373
374	const membersActions = [	44✔
375	'user.create',
376	'user.update.own',
377	// OpenCRUD backwards compatibility
378	'users.new',
379	'users.edit.own',
380	'users.remove.own',
381	];
382	userGroups.members.can(membersActions);	44✔
383
384	export const adminsGroup = createGroup('admins'); // admin users	44✔
385
386	const adminActions = [	44✔
387	'user.create',
388	'user.update.all',
389	'user.delete.all',
390	'setting.update',
391	// OpenCRUD backwards compatibility
392	'users.new',
393	'users.edit.all',
394	'users.remove.all',
395	'settings.edit',
396	];
397	userGroups.admins.can(adminActions);	44✔

ForumMagnum / ForumMagnum / 11564891391

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous