calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-23 01:05:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Support multiple roles

Browse Source
This commit is contained in:
Owen
2026-05-04 14:54:20 -07:00
parent 660197eef1
commit a80ae49a33
5 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
server/middlewares/verifyResourcePolicyAccess.ts
View File

@@ -5,6 +5,7 @@ import { and, eq } from "drizzle-orm";
import createHttpError from "http-errors"; import createHttpError from "http-errors";
import HttpCode from "@server/types/HttpCode"; import HttpCode from "@server/types/HttpCode";
import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy"; import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
export async function verifyResourcePolicyAccess( export async function verifyResourcePolicyAccess(
req: Request, req: Request,
@@ -16,10 +17,8 @@ export async function verifyResourcePolicyAccess(
req.params?.resourcePolicyId || req.params?.resourcePolicyId ||
req.body?.resourcePolicyId || req.body?.resourcePolicyId ||
req.query?.resourcePolicyId; req.query?.resourcePolicyId;
const niceId = const niceId = req.params?.niceId || req.body?.niceId || req.query?.niceId;
req.params?.niceId || req.body?.niceId || req.query?.niceId; const orgId = req.params?.orgId || req.body?.orgId || req.query?.orgId;
const orgId =
req.params?.orgId || req.body?.orgId || req.query?.orgId;
try { try {
if (!userId) { if (!userId) {
@@ -110,7 +109,10 @@ export async function verifyResourcePolicyAccess(
} }
} }
req.userOrgRoleId = req.userOrg.roleId; req.userOrgRoleIds = await getUserOrgRoleIds(
req.userOrg.userId,
orgId!
);
req.userOrgId = policy.orgId; req.userOrgId = policy.orgId;
return next(); return next();

7
server/private/routers/policy/createResourcePolicy.ts
View File

@@ -143,7 +143,7 @@ export async function createResourcePolicy(
} }
const { orgId } = parsedParams.data; const { orgId } = parsedParams.data;
if (req.user && !req.userOrgRoleId) { if (req.user && req.userOrgRoleIds?.length === 0) {
return next( return next(
createHttpError(HttpCode.FORBIDDEN, "User does not have a role") createHttpError(HttpCode.FORBIDDEN, "User does not have a role")
); );
@@ -304,7 +304,10 @@ export async function createResourcePolicy(
const usersToAdd: InferInsertModel<typeof userPolicies>[] = []; const usersToAdd: InferInsertModel<typeof userPolicies>[] = [];
if (req.user && req.userOrgRoleId != adminRole[0].roleId) { if (
req.user &&
!req.userOrgRoleIds?.includes(adminRole[0].roleId)
) {
// make sure the user can access the policy // make sure the user can access the policy
usersToAdd.push({ usersToAdd.push({
userId: req.user?.userId!, userId: req.user?.userId!,

2
server/private/routers/policy/listResourcePolicies.ts
View File

@@ -145,7 +145,7 @@ export async function listResourcePolicies(
.where( .where(
or( or(
eq(userPolicies.userId, req.user!.userId), eq(userPolicies.userId, req.user!.userId),
eq(rolePolicies.roleId, req.userOrgRoleId!) inArray(rolePolicies.roleId, req.userOrgRoleIds || [])
) )
); );
} else { } else {

2
server/routers/policy/updateResourcePolicy.ts
View File

@@ -54,7 +54,7 @@ export async function updateResourcePolicy(
); );
} }
if (req.user && !req.userOrgRoleId) { if (req.user && req.userOrgRoleIds?.length === 0) {
return next( return next(
createHttpError(HttpCode.FORBIDDEN, "User does not have a role") createHttpError(HttpCode.FORBIDDEN, "User does not have a role")
); );

4
server/routers/resource/createResource.ts
View File

@@ -353,7 +353,7 @@ async function createHttpResource(
}); });
// make this policy visible by the current user // make this policy visible by the current user
if (req.user && req.userOrgRoleId !== adminRole[0].roleId) { if (req.user && !req.userOrgRoleIds?.includes(adminRole[0].roleId)) {
await trx.insert(userPolicies).values({ await trx.insert(userPolicies).values({
userId: req.user?.userId!, userId: req.user?.userId!,
resourcePolicyId: defaultPolicy.resourcePolicyId resourcePolicyId: defaultPolicy.resourcePolicyId
@@ -479,7 +479,7 @@ async function createRawResource(
}); });
// make this policy visible by the current user // make this policy visible by the current user
if (req.user && req.userOrgRoleId != adminRole[0].roleId) { if (req.user && !req.userOrgRoleIds?.includes(adminRole[0].roleId)) {
await trx.insert(userPolicies).values({ await trx.insert(userPolicies).values({
userId: req.user?.userId!, userId: req.user?.userId!,
resourcePolicyId: defaultPolicy.resourcePolicyId resourcePolicyId: defaultPolicy.resourcePolicyId