Allow parents to upload profile images for their child

Author: Wardormeur

config/perm/profiles.js

@@ -85,7 +85,14 @@ module.exports = function(){
         customValidator: [{
           role: 'cd-profiles',
           cmd: 'is_own_profile'
-      }]}],
+        }]
+      },
+      { role: 'basic-user',
+        customValidator: [{
+          role: 'cd-users',
+          cmd: 'is_parent_of'
+        }]
+      }],
       'get_avatar': [{
         role: 'none',
       }],

lib/users/is-parent-of.js

@@ -8,19 +8,39 @@ function isParentOf (args, cb) {
   var plugin = args.role;
   var userId = args.user.id;
   var childrenId = args.params.userId;
+  var childrenProfileId;
   if(_.isUndefined(childrenId) && args.params.profile) childrenId = args.params.profile.userId;
   if(_.isUndefined(childrenId) && args.params.query) childrenId = args.params.query.userId;
+  if(_.isUndefined(childrenId) && args.params.profileId) childrenProfileId = args.params.profileId;
   var isParent = false;
+  var getChildrenUserId = function (wfCb) {
+    if (!childrenId && childrenProfileId) {
+      seneca.act({role: 'cd-profiles', cmd: 'load', id: childrenProfileId}, function (err, profile) {
+        if (err) return cb(null, {'allowed': false});
+        childrenId = profile.userId;
+        wfCb();
+      });
+    } else {
+      wfCb();
+    }
+  };
+  var checkChildrenBelongsToUser = function (wfCb) {
+    seneca.act({role: 'cd-profiles', cmd: 'load_user_profile', userId: userId},
+      function (err, user) {
+        if (err) {
+          seneca.log.error(seneca.customValidatorLogFormatter('cd-profiles', 'isParentOf', err, {userId: userId, childrenId: childrenId}));
+          return cb(null, {'allowed': false});
+        }
+        if (_.includes(user.children, childrenId )) isParent = true;
+        return cb(null, {'allowed': isParent});
+    });
+  };
+
   //  Could also check the opposite way, from child to Parent
-  seneca.act({role: 'cd-profiles', cmd: 'load_user_profile', userId: userId},
-    function (err, user) {
-      if (err) {
-        seneca.log.error(seneca.customValidatorLogFormatter('cd-profiles', 'isParentOf', err, {userId: userId, childrenId: childrenId}));
-        return cb(null, {'allowed': false});
-      }
-      if (_.includes(user.children, childrenId )) isParent = true;
-      return cb(null, {'allowed': isParent});
-  });
+  async.waterfall([
+    getChildrenUserId,
+    checkChildrenBelongsToUser
+  ]);
 }
 
 module.exports = isParentOf;