pangolin_mirror/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-02-27 23:36:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

rename super user to admin and middleware refactoring

Browse Source
This commit is contained in:
Milo Schwartz
2024-11-05 22:38:57 -05:00
parent 7b755a273c
commit 03051878ef
26 changed files with 790 additions and 529 deletions
Download Patch File Download Diff File Expand all files Collapse all files

96
server/routers/auth/verifySiteAccess.ts
View File

@@ -1,42 +1,81 @@
import { Request, Response, NextFunction } from 'express';
import { db } from '@server/db';
import { sites, userOrgs, userSites, roleSites, roles } from '@server/db/schema';
import { and, eq, or } from 'drizzle-orm';
import createHttpError from 'http-errors';
import HttpCode from '@server/types/HttpCode';
import { Request, Response, NextFunction } from "express";
import { db } from "@server/db";
import {
sites,
userOrgs,
userSites,
roleSites,
roles,
} from "@server/db/schema";
import { and, eq, or } from "drizzle-orm";
import createHttpError from "http-errors";
import HttpCode from "@server/types/HttpCode";
export async function verifySiteAccess(req: Request, res: Response, next: NextFunction) {
export async function verifySiteAccess(
req: Request,
res: Response,
next: NextFunction
) {
const userId = req.user!.userId; // Assuming you have user information in the request
const siteId = parseInt(req.params.siteId || req.body.siteId || req.query.siteId);
const siteId = parseInt(
req.params.siteId || req.body.siteId || req.query.siteId
);
if (!userId) {
return next(createHttpError(HttpCode.UNAUTHORIZED, 'User not authenticated'));
return next(
createHttpError(HttpCode.UNAUTHORIZED, "User not authenticated")
);
}
if (isNaN(siteId)) {
return next(createHttpError(HttpCode.BAD_REQUEST, 'Invalid site ID'));
return next(createHttpError(HttpCode.BAD_REQUEST, "Invalid site ID"));
}
try {
// Get the site
const site = await db.select().from(sites).where(eq(sites.siteId, siteId)).limit(1);
const site = await db
.select()
.from(sites)
.where(eq(sites.siteId, siteId))
.limit(1);
if (site.length === 0) {
return next(createHttpError(HttpCode.NOT_FOUND, `Site with ID ${siteId} not found`));
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Site with ID ${siteId} not found`
)
);
}
if (!site[0].orgId) {
return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, `Site with ID ${siteId} does not have an organization ID`));
return next(
createHttpError(
HttpCode.INTERNAL_SERVER_ERROR,
`Site with ID ${siteId} does not have an organization ID`
)
);
}
// Get user's role ID in the organization
const userOrgRole = await db.select()
const userOrgRole = await db
.select()
.from(userOrgs)
.where(and(eq(userOrgs.userId, userId), eq(userOrgs.orgId, site[0].orgId)))
.where(
and(
eq(userOrgs.userId, userId),
eq(userOrgs.orgId, site[0].orgId)
)
)
.limit(1);
if (userOrgRole.length === 0) {
return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have access to this organization'));
return next(
createHttpError(
HttpCode.FORBIDDEN,
"User does not have access to this organization"
)
);
}
const userOrgRoleId = userOrgRole[0].roleId;
@@ -44,7 +83,8 @@ export async function verifySiteAccess(req: Request, res: Response, next: NextFu
req.userOrgId = site[0].orgId;
// Check role-based site access first
const roleSiteAccess = await db.select()
const roleSiteAccess = await db
.select()
.from(roleSites)
.where(
and(
@@ -60,9 +100,12 @@ export async function verifySiteAccess(req: Request, res: Response, next: NextFu
}
// If role doesn't have access, check user-specific site access
const userSiteAccess = await db.select()
const userSiteAccess = await db
.select()
.from(userSites)
.where(and(eq(userSites.userId, userId), eq(userSites.siteId, siteId)))
.where(
and(eq(userSites.userId, userId), eq(userSites.siteId, siteId))
)
.limit(1);
if (userSiteAccess.length > 0) {
@@ -71,9 +114,18 @@ export async function verifySiteAccess(req: Request, res: Response, next: NextFu
}
// If we reach here, the user doesn't have access to the site
return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have access to this site'));
return next(
createHttpError(
HttpCode.FORBIDDEN,
"User does not have access to this site"
)
);
} catch (error) {
return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, 'Error verifying site access'));
return next(
createHttpError(
HttpCode.INTERNAL_SERVER_ERROR,
"Error verifying site access"
)
);
}
}