|
| 1 | +/*global navigator: false */ |
| 2 | +(function(root) { |
| 3 | + root.AV = root.AV || {}; |
| 4 | + var AV = root.AV; |
| 5 | + var _ = AV._; |
| 6 | + |
| 7 | + var PUBLIC_KEY = "*"; |
| 8 | + |
| 9 | + /** |
| 10 | + * Creates a new ACL. |
| 11 | + * If no argument is given, the ACL has no permissions for anyone. |
| 12 | + * If the argument is a AV.User, the ACL will have read and write |
| 13 | + * permission for only that user. |
| 14 | + * If the argument is any other JSON object, that object will be interpretted |
| 15 | + * as a serialized ACL created with toJSON(). |
| 16 | + * @see AV.Object#setACL |
| 17 | + * @class |
| 18 | + * |
| 19 | + * <p>An ACL, or Access Control List can be added to any |
| 20 | + * <code>AV.Object</code> to restrict access to only a subset of users |
| 21 | + * of your application.</p> |
| 22 | + */ |
| 23 | + AV.ACL = function(arg1) { |
| 24 | + var self = this; |
| 25 | + self.permissionsById = {}; |
| 26 | + if (_.isObject(arg1)) { |
| 27 | + if (arg1 instanceof AV.User) { |
| 28 | + self.setReadAccess(arg1, true); |
| 29 | + self.setWriteAccess(arg1, true); |
| 30 | + } else { |
| 31 | + if (_.isFunction(arg1)) { |
| 32 | + throw "AV.ACL() called with a function. Did you forget ()?"; |
| 33 | + } |
| 34 | + AV._objectEach(arg1, function(accessList, userId) { |
| 35 | + if (!_.isString(userId)) { |
| 36 | + throw "Tried to create an ACL with an invalid userId."; |
| 37 | + } |
| 38 | + self.permissionsById[userId] = {}; |
| 39 | + AV._objectEach(accessList, function(allowed, permission) { |
| 40 | + if (permission !== "read" && permission !== "write") { |
| 41 | + throw "Tried to create an ACL with an invalid permission type."; |
| 42 | + } |
| 43 | + if (!_.isBoolean(allowed)) { |
| 44 | + throw "Tried to create an ACL with an invalid permission value."; |
| 45 | + } |
| 46 | + self.permissionsById[userId][permission] = allowed; |
| 47 | + }); |
| 48 | + }); |
| 49 | + } |
| 50 | + } |
| 51 | + }; |
| 52 | + |
| 53 | + /** |
| 54 | + * Returns a JSON-encoded version of the ACL. |
| 55 | + * @return {Object} |
| 56 | + */ |
| 57 | + AV.ACL.prototype.toJSON = function() { |
| 58 | + return _.clone(this.permissionsById); |
| 59 | + }; |
| 60 | + |
| 61 | + AV.ACL.prototype._setAccess = function(accessType, userId, allowed) { |
| 62 | + if (userId instanceof AV.User) { |
| 63 | + userId = userId.id; |
| 64 | + } else if (userId instanceof AV.Role) { |
| 65 | + userId = "role:" + userId.getName(); |
| 66 | + } |
| 67 | + if (!_.isString(userId)) { |
| 68 | + throw "userId must be a string."; |
| 69 | + } |
| 70 | + if (!_.isBoolean(allowed)) { |
| 71 | + throw "allowed must be either true or false."; |
| 72 | + } |
| 73 | + var permissions = this.permissionsById[userId]; |
| 74 | + if (!permissions) { |
| 75 | + if (!allowed) { |
| 76 | + // The user already doesn't have this permission, so no action needed. |
| 77 | + return; |
| 78 | + } else { |
| 79 | + permissions = {}; |
| 80 | + this.permissionsById[userId] = permissions; |
| 81 | + } |
| 82 | + } |
| 83 | + |
| 84 | + if (allowed) { |
| 85 | + this.permissionsById[userId][accessType] = true; |
| 86 | + } else { |
| 87 | + delete permissions[accessType]; |
| 88 | + if (_.isEmpty(permissions)) { |
| 89 | + delete permissions[userId]; |
| 90 | + } |
| 91 | + } |
| 92 | + }; |
| 93 | + |
| 94 | + AV.ACL.prototype._getAccess = function(accessType, userId) { |
| 95 | + if (userId instanceof AV.User) { |
| 96 | + userId = userId.id; |
| 97 | + } else if (userId instanceof AV.Role) { |
| 98 | + userId = "role:" + userId.getName(); |
| 99 | + } |
| 100 | + var permissions = this.permissionsById[userId]; |
| 101 | + if (!permissions) { |
| 102 | + return false; |
| 103 | + } |
| 104 | + return permissions[accessType] ? true : false; |
| 105 | + }; |
| 106 | + |
| 107 | + /** |
| 108 | + * Set whether the given user is allowed to read this object. |
| 109 | + * @param userId An instance of AV.User or its objectId. |
| 110 | + * @param {Boolean} allowed Whether that user should have read access. |
| 111 | + */ |
| 112 | + AV.ACL.prototype.setReadAccess = function(userId, allowed) { |
| 113 | + this._setAccess("read", userId, allowed); |
| 114 | + }; |
| 115 | + |
| 116 | + /** |
| 117 | + * Get whether the given user id is *explicitly* allowed to read this object. |
| 118 | + * Even if this returns false, the user may still be able to access it if |
| 119 | + * getPublicReadAccess returns true or a role that the user belongs to has |
| 120 | + * write access. |
| 121 | + * @param userId An instance of AV.User or its objectId, or a AV.Role. |
| 122 | + * @return {Boolean} |
| 123 | + */ |
| 124 | + AV.ACL.prototype.getReadAccess = function(userId) { |
| 125 | + return this._getAccess("read", userId); |
| 126 | + }; |
| 127 | + |
| 128 | + /** |
| 129 | + * Set whether the given user id is allowed to write this object. |
| 130 | + * @param userId An instance of AV.User or its objectId, or a AV.Role.. |
| 131 | + * @param {Boolean} allowed Whether that user should have write access. |
| 132 | + */ |
| 133 | + AV.ACL.prototype.setWriteAccess = function(userId, allowed) { |
| 134 | + this._setAccess("write", userId, allowed); |
| 135 | + }; |
| 136 | + |
| 137 | + /** |
| 138 | + * Get whether the given user id is *explicitly* allowed to write this object. |
| 139 | + * Even if this returns false, the user may still be able to write it if |
| 140 | + * getPublicWriteAccess returns true or a role that the user belongs to has |
| 141 | + * write access. |
| 142 | + * @param userId An instance of AV.User or its objectId, or a AV.Role. |
| 143 | + * @return {Boolean} |
| 144 | + */ |
| 145 | + AV.ACL.prototype.getWriteAccess = function(userId) { |
| 146 | + return this._getAccess("write", userId); |
| 147 | + }; |
| 148 | + |
| 149 | + /** |
| 150 | + * Set whether the public is allowed to read this object. |
| 151 | + * @param {Boolean} allowed |
| 152 | + */ |
| 153 | + AV.ACL.prototype.setPublicReadAccess = function(allowed) { |
| 154 | + this.setReadAccess(PUBLIC_KEY, allowed); |
| 155 | + }; |
| 156 | + |
| 157 | + /** |
| 158 | + * Get whether the public is allowed to read this object. |
| 159 | + * @return {Boolean} |
| 160 | + */ |
| 161 | + AV.ACL.prototype.getPublicReadAccess = function() { |
| 162 | + return this.getReadAccess(PUBLIC_KEY); |
| 163 | + }; |
| 164 | + |
| 165 | + /** |
| 166 | + * Set whether the public is allowed to write this object. |
| 167 | + * @param {Boolean} allowed |
| 168 | + */ |
| 169 | + AV.ACL.prototype.setPublicWriteAccess = function(allowed) { |
| 170 | + this.setWriteAccess(PUBLIC_KEY, allowed); |
| 171 | + }; |
| 172 | + |
| 173 | + /** |
| 174 | + * Get whether the public is allowed to write this object. |
| 175 | + * @return {Boolean} |
| 176 | + */ |
| 177 | + AV.ACL.prototype.getPublicWriteAccess = function() { |
| 178 | + return this.getWriteAccess(PUBLIC_KEY); |
| 179 | + }; |
| 180 | + |
| 181 | + /** |
| 182 | + * Get whether users belonging to the given role are allowed |
| 183 | + * to read this object. Even if this returns false, the role may |
| 184 | + * still be able to write it if a parent role has read access. |
| 185 | + * |
| 186 | + * @param role The name of the role, or a AV.Role object. |
| 187 | + * @return {Boolean} true if the role has read access. false otherwise. |
| 188 | + * @throws {String} If role is neither a AV.Role nor a String. |
| 189 | + */ |
| 190 | + AV.ACL.prototype.getRoleReadAccess = function(role) { |
| 191 | + if (role instanceof AV.Role) { |
| 192 | + // Normalize to the String name |
| 193 | + role = role.getName(); |
| 194 | + } |
| 195 | + if (_.isString(role)) { |
| 196 | + return this.getReadAccess("role:" + role); |
| 197 | + } |
| 198 | + throw "role must be a AV.Role or a String"; |
| 199 | + }; |
| 200 | + |
| 201 | + /** |
| 202 | + * Get whether users belonging to the given role are allowed |
| 203 | + * to write this object. Even if this returns false, the role may |
| 204 | + * still be able to write it if a parent role has write access. |
| 205 | + * |
| 206 | + * @param role The name of the role, or a AV.Role object. |
| 207 | + * @return {Boolean} true if the role has write access. false otherwise. |
| 208 | + * @throws {String} If role is neither a AV.Role nor a String. |
| 209 | + */ |
| 210 | + AV.ACL.prototype.getRoleWriteAccess = function(role) { |
| 211 | + if (role instanceof AV.Role) { |
| 212 | + // Normalize to the String name |
| 213 | + role = role.getName(); |
| 214 | + } |
| 215 | + if (_.isString(role)) { |
| 216 | + return this.getWriteAccess("role:" + role); |
| 217 | + } |
| 218 | + throw "role must be a AV.Role or a String"; |
| 219 | + }; |
| 220 | + |
| 221 | + /** |
| 222 | + * Set whether users belonging to the given role are allowed |
| 223 | + * to read this object. |
| 224 | + * |
| 225 | + * @param role The name of the role, or a AV.Role object. |
| 226 | + * @param {Boolean} allowed Whether the given role can read this object. |
| 227 | + * @throws {String} If role is neither a AV.Role nor a String. |
| 228 | + */ |
| 229 | + AV.ACL.prototype.setRoleReadAccess = function(role, allowed) { |
| 230 | + if (role instanceof AV.Role) { |
| 231 | + // Normalize to the String name |
| 232 | + role = role.getName(); |
| 233 | + } |
| 234 | + if (_.isString(role)) { |
| 235 | + this.setReadAccess("role:" + role, allowed); |
| 236 | + return; |
| 237 | + } |
| 238 | + throw "role must be a AV.Role or a String"; |
| 239 | + }; |
| 240 | + |
| 241 | + /** |
| 242 | + * Set whether users belonging to the given role are allowed |
| 243 | + * to write this object. |
| 244 | + * |
| 245 | + * @param role The name of the role, or a AV.Role object. |
| 246 | + * @param {Boolean} allowed Whether the given role can write this object. |
| 247 | + * @throws {String} If role is neither a AV.Role nor a String. |
| 248 | + */ |
| 249 | + AV.ACL.prototype.setRoleWriteAccess = function(role, allowed) { |
| 250 | + if (role instanceof AV.Role) { |
| 251 | + // Normalize to the String name |
| 252 | + role = role.getName(); |
| 253 | + } |
| 254 | + if (_.isString(role)) { |
| 255 | + this.setWriteAccess("role:" + role, allowed); |
| 256 | + return; |
| 257 | + } |
| 258 | + throw "role must be a AV.Role or a String"; |
| 259 | + }; |
| 260 | + |
| 261 | +}(this)); |
0 commit comments