'use strict' ; import { Entity } from '@Entities/Entity' ; import { Accounts } from '@Entities/Accounts' ; import { AccountEntity } from '@Entities/AccountEntity' ; import { Domains } from '@Entities/Domains' ; import { DomainEntity } from '@Entities/DomainEntity' ; import { AuthToken } from '@Entities/AuthToken' ; import { Tokens , TokenScope } from '@Entities/Tokens' ; import { Perm } from '@Route-Tools/Perm' ; import { SArray , VKeyedCollection } from '@Tools/vTypes' ; import { IsNotNullOrEmpty , IsNullOrEmpty } from '@Tools/Misc' ; import { Logger } from '@Tools/Logging' ; import { Availability } from '@Entities/Sets/Availability' ; export async function checkAccessToEntity ( pAuthToken , pTargetEntity , pRequiredAccess , pRequestingAccount ? ) { let requestingAccount = pRequestingAccount ; let canAccess = false ; if ( IsNotNullOrEmpty ( pTargetEntity ) ) { for ( const perm of pRequiredAccess ) { Logger . cdebug ( 'field-setting' , `checkAccessToEntity: checking ${ perm }` ) ; switch ( perm ) { case Perm . ALL : canAccess = true ; break ; case Perm . PUBLIC : if ( pTargetEntity . hasOwnProperty ( 'availability' ) ) { if ( ( pTargetEntity as AccountEntity ) . availability . includes ( Availability . ALL ) ) { canAccess = true ; } ; } ; break ; case Perm . DOMAIN : if ( pAuthToken && SArray . has ( pAuthToken . scope , TokenScope . DOMAIN ) ) { if ( pTargetEntity . hasOwnProperty ( 'sponsorAccountId' ) ) { Logger . cdebug ( 'field-setting' , `checkAccessToEntity: authToken is domain. auth.AccountId=${ pAuthToken . accountId }, sponsor=${ ( pTargetEntity as any ) . sponsorAccountId }` ) ; canAccess = pAuthToken . accountId === ( pTargetEntity as any ) . sponsorAccountId ; } else { if ( pTargetEntity . hasOwnProperty ( 'apiKey' ) ) { canAccess = pAuthToken . accountId === ( pTargetEntity as any ) . apiKey ; } ; } ; } ; break ; case Perm . OWNER : if ( pAuthToken && pTargetEntity . hasOwnProperty ( 'id' ) ) { canAccess = pAuthToken . accountId === ( pTargetEntity as AccountEntity ) . id ; } ; if ( ! canAccess && pTargetEntity . hasOwnProperty ( 'accountId' ) ) { canAccess = pAuthToken . accountId === ( pTargetEntity as any ) . accountId ; } ; break ; case Perm . FRIEND : if ( pAuthToken && pTargetEntity . hasOwnProperty ( 'friends' ) ) { const targetFriends = ( pTargetEntity as AccountEntity ) . friends ; if ( targetFriends ) { requestingAccount = requestingAccount ?? await Accounts . getAccountWithId ( pAuthToken . accountId ) ; canAccess = SArray . hasNoCase ( targetFriends , requestingAccount . username ) ; } ; } ; break ; case Perm . CONNECTION : if ( pAuthToken && pTargetEntity . hasOwnProperty ( 'connections' ) ) { const targetConnections = ( pTargetEntity as AccountEntity ) . connections ; if ( targetConnections ) { requestingAccount = requestingAccount ?? await Accounts . getAccountWithId ( pAuthToken . accountId ) ; canAccess = SArray . hasNoCase ( targetConnections , requestingAccount . username ) ; } ; } ; break ; case Perm . ADMIN : if ( pAuthToken && Tokens . isSpecialAdminToken ( pAuthToken ) ) { Logger . cdebug ( 'field-setting' , `checkAccessToEntity: isSpecialAdminToken` ) ; canAccess = true ; } else { if ( pAuthToken && SArray . has ( pAuthToken . scope , TokenScope . OWNER ) ) { Logger . cdebug ( 'field-setting' , `checkAccessToEntity: admin. auth.AccountId=${ pAuthToken . accountId }` ) ; requestingAccount = requestingAccount ?? await Accounts . getAccountWithId ( pAuthToken . accountId ) ; canAccess = Accounts . isAdmin ( requestingAccount ) ; } ; } ; break ; case Perm . SPONSOR : if ( pAuthToken && SArray . has ( pAuthToken . scope , TokenScope . OWNER ) ) { if ( pTargetEntity . hasOwnProperty ( 'sponsorAccountId' ) ) { Logger . cdebug ( 'field-setting' , `checkAccessToEntity: authToken is domain. auth.AccountId=${ pAuthToken . accountId }, sponsor=${ ( pTargetEntity as any ) . sponsorAccountId }` ) ; canAccess = pAuthToken . accountId === ( pTargetEntity as DomainEntity ) . sponsorAccountId ; } ; } ; break ; case Perm . MANAGER : if ( pAuthToken && SArray . has ( pAuthToken . scope , TokenScope . OWNER ) ) { if ( pTargetEntity . hasOwnProperty ( 'managers' ) ) { requestingAccount = requestingAccount ?? await Accounts . getAccountWithId ( pAuthToken . accountId ) ; if ( requestingAccount ) { const managers = ( pTargetEntity as DomainEntity ) . managers ; if ( managers && managers . includes ( requestingAccount . username . toLowerCase ( ) ) ) { canAccess = true ; } ; } ; } ; } ; break ; case Perm . DOMAINACCESS : if ( pAuthToken && pTargetEntity . hasOwnProperty ( 'domainId' ) ) { const aDomain = await Domains . getDomainWithId ( ( pTargetEntity as any ) . domainId ) ; if ( aDomain ) { canAccess = aDomain . sponsorAccountId === pAuthToken . accountId ; } ; } ; break ; default : canAccess = false ; break ; } ; if ( canAccess ) break ; } ; } ; return canAccess ; } ;