cloudron-box/src/accesscontrol.js

'use strict';

exports = module.exports = {
    PERMISSION_ADMIN: 'admin', // not a real permission, but a role
    PERMISSION_MANAGE_USERS: 'manage_users',

    verifyToken: verifyToken,
    hasPermission: hasPermission,
    validatePermissions: validatePermissions
};

var assert = require('assert'),
    BoxError = require('./boxerror.js'),
    tokendb = require('./tokendb.js'),
    users = require('./users.js');

function hasPermission(user, requiredPermission) {
    assert.strictEqual(typeof user, 'object');
    assert.strictEqual(typeof requiredPermission, 'string');

    if (user.admin) return null;
    if (user.permissions && user.permissions.includes(requiredPermission)) return null;

    return new BoxError(BoxError.ACCESS_DENIED, 'Not permitted');
}

function validatePermissions(permissions) {
    assert(permissions === null || Array.isArray(permissions));

    if (permissions === null || permissions.length === 0) return null;
    if (permissions.length === 1 && permissions[0] === exports.PERMISSION_MANAGE_USERS) return null;

    // here for completeness
    if (permissions.includes(exports.PERMISSION_ADMIN)) return new BoxError(BoxError.BAD_FIELD, 'admin is not a permission');

    return new BoxError(BoxError.BAD_FIELD, 'Invalid permissions');
}

function verifyToken(accessToken, callback) {
    assert.strictEqual(typeof accessToken, 'string');
    assert.strictEqual(typeof callback, 'function');

    tokendb.getByAccessToken(accessToken, function (error, token) {
        if (error && error.reason === BoxError.NOT_FOUND) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
        if (error) return callback(error);

        users.get(token.identifier, function (error, user) {
            if (error && error.reason === BoxError.NOT_FOUND) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
            if (error) return callback(error);

            if (!user.active) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));

            callback(null, user);
        });
    });
}