All files / lib/hooks/authorize authorize.hook.after.ts

0% Statements 0/39
0% Branches 0/26
0% Functions 0/3
0% Lines 0/34

Press n or j to go to the next uncovered block, b, p or k for the previous block.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84                                                                                                                                                                       
import { getItems, replaceItems } from "feathers-hooks-common";
import { permittedFieldsOf } from "@casl/ability/extra";
import _pick from "lodash/pick";
 
import { shouldSkip, mergeArrays } from "@artesa/feathers-utils";
 
import {
  makeDefaultOptions,
  getPersistedConfig,
  restore$select,
  getAbility
} from "./authorize.hook.utils";
 
import {
  AuthorizeHookOptions
} from "../../types";
import { HookContext } from "@feathersjs/feathers";
 
const HOOKNAME = "authorize";
 
export default (options: AuthorizeHookOptions): ((context: HookContext) => Promise<HookContext>) => {
  options = makeDefaultOptions(options);
  return async (context: HookContext): Promise<HookContext> => {
    const $select = restore$select(context);
 
    if (
      shouldSkip(HOOKNAME, context) ||
      context.type !== "after" ||
      !context.params
    ) { return context; }
 
    const { params } = context;
 
    const { subjectHelper, getModelName } = options;
 
    const modelName = getModelName(context);
    if (!modelName) { return context; }
 
    const skipCheckConditions = getPersistedConfig(context, "skipRestrictingRead.conditions");
    const skipCheckFields = getPersistedConfig(context, "skipRestrictingRead.fields");
 
    if (skipCheckConditions && skipCheckFields) {
      return context;
    }
 
    params.ability = await getAbility(context, options);
    if (!params.ability) {
      // Interne Anfrage oder nicht authentifiziert -> Ignorieren
      return context;
    }
 
    const { ability } = params;
    const items = getItems(context);
 
    const forOneEl = (item: Record<string, unknown>) => {
      if (!skipCheckConditions && !ability.can("read", subjectHelper(modelName, item))) { return undefined; }
      let fields = permittedFieldsOf(ability, "read", subjectHelper(modelName, item));
      if (skipCheckFields || (fields.length === 0 && !$select)) {
        return item;
      }
      fields = mergeArrays(fields, $select, "intersectOrFull") as string[];
      //TODO: replace _pick with native
      return _pick(item, fields);
    };
 
    let result;
    if (Array.isArray(items)) {
      result = [];
      for (let i = 0, n = items.length; i < n; i++) {
        const item = forOneEl(items[i]);
 
        if (item) { result.push(item); }
      }
 
    } else {
      result = forOneEl(items);
    }
 
    replaceItems(context, result);
 
    return context;
  };
};