@@ -4,15 +4,15 @@ import { getUserAttributes } from "./middlewares/keycloak-middleware.js";
44/**
55 * hasAllRoles(req, ["teacher", "student", "admin", "gluppy"])
66 */
7- export async function hasAllRoles ( req , clientRoles , override = false ) {
8- return hasRoles ( req , clientRoles , true , override ) ;
7+ export async function hasAllRoles ( req , clientRoles , allowOverride = false ) {
8+ return hasRoles ( req , clientRoles , true , allowOverride ) ;
99}
1010
1111/**
1212 * hasSomeRoles(req, ["teacher", "student", "admin", "gluppy"])
1313 */
14- export async function hasSomeRoles ( req , clientRoles , override = false ) {
15- return hasRoles ( req , clientRoles , false , override ) ;
14+ export async function hasSomeRoles ( req , clientRoles , allowOverride = false ) {
15+ return hasRoles ( req , clientRoles , false , allowOverride ) ;
1616}
1717
1818/**
@@ -84,84 +84,89 @@ async function hasClientRoles(req, clientRoles, all) {
8484/**
8585 * Fetches all Keycloak roles of the client and all LDAP roles of the user, previously calculated in the Keycloak-middleware and checks for permissions.
8686 */
87- async function hasRoles ( req , clientRoles , all , override ) {
87+ async function hasRoles ( req , clientRoles , all , allowOverride ) {
8888 try {
89+ //console.log("Checking roles", clientRoles, "all", all, "allowOverride", allowOverride);
90+ // The roles to check are empty. So we return true.
8991 if (
9092 clientRoles === undefined ||
9193 clientRoles === null ||
9294 clientRoles . length == 0
9395 ) {
9496 return true ;
9597 }
98+
9699 let clientAccess = null ;
97100 const attributes = await getUserAttributes ( req ) ;
98101 const ccr = await getClientRoles ( req , clientRoles ) ;
99102 // console.log("Client roles", ccr);
100103 // console.log("Request user rolesCalculated", req.user.rolesCalculated);
101- if (
102- req . user . rolesCalculated !== undefined &&
103- req . user . rolesCalculated !== null
104- ) {
105- // console.log("attributes", attributes);
106- if ( attributes && attributes . attributes && attributes . attributes . config ) {
107- const a = JSON . parse ( attributes . attributes . config ) ;
108- let r = JSON . parse ( req . user . rolesCalculated ) ;
109- // console.log("Roles Calculated", r);
110- if ( r === undefined || r === null ) {
111- r = { } ;
112- }
113- let name = req . user . name
114- name = name . trim ( )
115- name = name . toLowerCase ( )
116- r [ name ] = true ;
117- const cr = await getClientRoles ( req , clientRoles ) ;
118- if ( cr ) {
119- for ( const role of cr ) {
120- r [ role ] = "cr" ;
121- }
122- }
123- const clientViews = clientRoles . filter ( ( role ) => role . startsWith ( "#" ) ) ;
124- clientRoles = clientRoles . filter ( ( role ) => ! role . startsWith ( "#" ) ) ;
125- if ( ( r . admin || r . teacher ) && override && a . vt == 0 ) {
126- // Downgrade teacher and admin to student.
127- r . admin = false ;
128- r . teacher = false ;
129- }
130- if ( r . admin ) {
131- clientAccess = true ;
104+ // console.log("attributes", attributes);
105+ let a = { ve : 0 , vt : 0 , va : 0 } ;
106+ if ( attributes ?. attributes ?. config ) {
107+ a = JSON . parse ( attributes . attributes . config ) ;
108+ }
109+ let r = JSON . parse ( req . user . rolesCalculated ) ;
110+ // console.log("Roles Calculated", r);
111+ if ( r === undefined || r === null ) {
112+ r = { } ;
113+ }
114+ let name = req . user . name
115+ name = name . trim ( )
116+ name = name . toLowerCase ( )
117+ r [ name ] = true ;
118+ const cr = await getClientRoles ( req , clientRoles ) ;
119+ if ( cr ) {
120+ for ( const role of cr ) {
121+ r [ role ] = true ;
122+ }
123+ }
124+ const clientViews = clientRoles . filter ( ( role ) => role . startsWith ( "#" ) ) ;
125+ clientRoles = clientRoles . filter ( ( role ) => ! role . startsWith ( "#" ) ) ;
126+ let isAdmin = r . admin || clientRoles . includes ( "admin" ) ;
127+ let isTeacher = r . teacher || clientRoles . includes ( "teacher" ) ;
128+ if ( isTeacher ) {
129+ r . teachers = true ;
130+ }
131+ if ( ( isAdmin || isTeacher ) && allowOverride && a . vt == 0 ) {
132+ // Downgrade teacher and admin to student.
133+ isAdmin = false ;
134+ isTeacher = false ;
135+ delete r [ "teacher" ] ;
136+ }
137+ if ( isAdmin ) {
138+ clientAccess = true ;
139+ } else {
140+ if ( clientRoles . length > 0 ) {
141+ if ( all ) {
142+ clientAccess = clientRoles . every ( ( role ) => r [ role ] ) ;
132143 } else {
133- if ( ! clientRoles . includes ( "admin" ) && r . teacher ) {
134- clientAccess = true ;
135- } else {
136- if ( clientRoles . length > 0 ) {
137- if ( all ) {
138- clientAccess = clientRoles . every ( ( role ) => r [ role ] ) ;
139- } else {
140- clientAccess = clientRoles . some ( ( role ) => r [ role ] ) ;
141- }
142- }
143- }
144+ clientAccess = clientRoles . some ( ( role ) => r [ role ] ) ;
144145 }
145- if ( clientAccess === null || clientAccess ) {
146- for ( const view of clientViews ) {
147- const viewRole = view . substring ( 1 ) ;
148- switch ( viewRole ) {
149- case "exam" :
150- // For security reasons hardcoded to only allow teachers and admins to view exam-questions.
151- clientAccess = a . ve == 1 && ( r . admin || r . teacher ) ;
152- break ;
153- case "practice" :
154- clientAccess = a . ve == 0 ;
155- break ;
156- case "answer" :
157- clientAccess = a . va == 1 ;
158- break ;
159- }
160- }
146+ }
147+ }
148+ if ( clientAccess === null || clientAccess ) {
149+ for ( const view of clientViews ) {
150+ const viewRole = view . substring ( 1 ) ;
151+ switch ( viewRole ) {
152+ case "exam" :
153+ // For security reasons hardcoded to only allow teachers and admins to view exam-questions.
154+ clientAccess = a . ve == 1 && ( isAdmin || isTeacher ) ;
155+ break ;
156+ case "practice" :
157+ clientAccess = a . ve == 0 ;
158+ break ;
159+ case "answer" :
160+ clientAccess = a . va == 1 ;
161+ break ;
161162 }
162163 }
163164 }
164- return clientAccess || false ;
165+ console . log ( "Checking roles:" , clientRoles , "all:" , all , "allowOverride:" , allowOverride , "isAdmin:" , isAdmin , "isTeacher:" , isTeacher , "studOvr:" , a . vt == 0 , "Client access:" , clientAccess ) ;
166+ if ( clientAccess === null ) {
167+ clientAccess = false ;
168+ }
169+ return clientAccess ;
165170 } catch ( error ) {
166171 console . error ( `Error checking client roles: ${ error } ) ;
167172 return null ;
0 commit comments