wieerwill/platform
1
0
Fork 0
mirror of https://github.com/hcengineering/platform.git synced 2025-04-03 06:21:28 +00:00
Code Issues Actions 7 Packages Projects Releases Wiki Activity

UBERF-8445: More smart admin mode (#6897)

Browse Source 
Signed-off-by: Andrey Sobolev <haiodo@gmail.com>
This commit is contained in:
Andrey Sobolev 2024-10-13 00:34:33 +07:00 committed by Andrey Sobolev
parent 765043d7ff
commit 0d0c410b86
No known key found for this signature in database
GPG Key ID: BD80F68D68D8F7F2
3 changed files with 43 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
server/middleware/src/spaceSecurity.ts
View File

@ -503,6 +503,14 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
const isSpace = this.context.hierarchy.isDerived(_class, core.class.Space)
const field = this.getKey(domain)
if (
ctx.contextData.admin === true &&
this.context.hierarchy.isDerived(_class, core.class.Space) &&
(newQuery as DocumentQuery<Space>).members !== undefined
) {
delete (newQuery as any).members
}
let clientFilterSpaces: Set<Ref<Space>> | undefined
if (!this.skipFindCheck && !isSystem(account) && account.role !== AccountRole.DocGuest && domain !== DOMAIN_MODEL) {
@ -558,6 +566,12 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
}
}
}
if (ctx.contextData.admin === true && this.context.hierarchy.isDerived(_class, core.class.Space)) {
// We need to add amin to all spaces.
for (const d of findResult) {
;(d as unknown as Space).members = [...((d as unknown as Space).members ?? []), ctx.contextData.account._id]
}
}
return findResult
}

2
server/middleware/src/utils.ts
View File

@ -20,5 +20,5 @@ export function isOwner (account: Account, ctx: MeasureContext<SessionData>): bo
}
export function isSystem (account: Account): boolean {
return account._id === core.account.System
return account._id === core.account.System || account._id.startsWith('system:')
}

52
server/server/src/client.ts
View File

@ -108,34 +108,37 @@ export class ClientSession implements Session {
async getAccount (ctx: ClientSessionCtx): Promise<void> {
const account = this._pipeline.context.modelDb.getAccountByEmail(this.token.email)
if (account === undefined && this.token.extra?.admin === 'true') {
const systemAccount = this._pipeline.context.modelDb.findObject(this.token.email as Ref<Account>)
if (systemAccount === undefined) {
// Generate account for admin user
const factory = new TxFactory(core.account.System)
const email = `system:${this.token.email}`
const createTx = factory.createTxCreateDoc(
core.class.Account,
core.space.Model,
{
role: AccountRole.Owner,
email
},
this.token.email as Ref<Account>
)
this.includeSessionContext(ctx.ctx)
await this._pipeline.tx(ctx.ctx, [createTx])
const acc = TxProcessor.createDoc2Doc(createTx)
await ctx.sendResponse(acc)
return
} else {
await ctx.sendResponse(systemAccount)
return
}
await ctx.sendResponse(this.getSystemAccount())
return
}
await ctx.sendResponse(account)
}
private getSystemAccount (): Account {
// Generate account for admin user
const factory = new TxFactory(core.account.System)
const email = `system:${this.token.email}`
const createTx = factory.createTxCreateDoc(
core.class.Account,
core.space.Model,
{
role: AccountRole.Owner,
email
},
email as Ref<Account>
)
return TxProcessor.createDoc2Doc(createTx)
}
includeSessionContext (ctx: MeasureContext): void {
let account: Account | undefined
if (this.token.extra?.admin === 'true') {
account = this._pipeline.context.modelDb.getAccountByEmail(this.token.email)
if (account === undefined) {
account = this.getSystemAccount()
}
}
const contextData = new SessionDataImpl(
this.token.email,
this.sessionId,
@ -149,7 +152,8 @@ export class ClientSession implements Session {
false,
new Map(),
new Map(),
this._pipeline.context.modelDb
this._pipeline.context.modelDb,
account
)
ctx.contextData = contextData
}