🕹 Manage root users

🕹 Manage root users

tdrive/backend/node/src/services/documents/services/access-check.ts

@@ -61,6 +61,26 @@ export const isCompanyGuest = async (context: CompanyExecutionContext): Promise<
   return userRole === "guest" || !userRole;
 };
 
+/**
+ * checks the current user is a member
+ * Company members can access shared drive
+ *
+ * @param {CompanyExecutionContext} context
+ * @returns {Promise<boolean>}
+ */
+export const isCompanyMember = async (context: CompanyExecutionContext): Promise<boolean> => {
+  if (await isCompanyApplication(context)) {
+    return false;
+  }
+
+  const userRole = await globalResolver.services.companies.getUserRole(
+    context.company.id,
+    context.user?.id,
+  );
+
+  return userRole === "member" || !userRole;
+};
+
 /**
  * checks the current user is a admin
  *
@@ -149,8 +169,15 @@ export const getAccessLevel = async (
   repository: Repository<DriveFile>,
   context: CompanyExecutionContext & { public_token?: string; tdrive_tab_token?: string },
 ): Promise<DriveFileAccessLevel | "none"> => {
-  if (!id || id === "root")
-    return !context?.user?.id || (await isCompanyGuest(context)) ? "none" : "manage";
+  const isMember = !context?.user?.id || (await isCompanyMember(context));
+  if (!id || id === "root") {
+    if (!context?.user?.id || (await isCompanyGuest(context))) {
+      return "none";
+    } else {
+      if (isMember) return "read";
+      return "manage";
+    }
+  }
   if (id === "trash")
     return (await isCompanyGuest(context)) || !context?.user?.id
       ? "none"
@@ -182,6 +209,9 @@ export const getAccessLevel = async (
     }
 
     if (await isCompanyApplication(context)) {
+      if (!id.startsWith("user_") && isMember && item.creator != context.user.id) {
+        return "read";
+      }
       return "manage";
     }
 

tdrive/backend/node/src/services/documents/web/controllers/documents.ts

@@ -5,7 +5,11 @@ import { CrudException, ListResult } from "../../../../core/platform/framework/a
 import { File } from "../../../../services/files/entities/file";
 import { UploadOptions } from "../../../../services/files/types";
 import globalResolver from "../../../../services/global-resolver";
-import { PaginationQueryParameters, ResourceWebsocket } from "../../../../utils/types";
+import {
+  PaginationQueryParameters,
+  ResourceWebsocket,
+  CompanyUserRole,
+} from "../../../../utils/types";
 import { DriveFile } from "../../entities/drive-file";
 import { FileVersion } from "../../entities/file-version";
 import {
@@ -21,9 +25,21 @@ import {
 } from "../../types";
 import { DriveFileDTO } from "../dto/drive-file-dto";
 import { DriveFileDTOBuilder } from "../../services/drive-file-dto-builder";
+import { ExecutionContext } from "../../../../core/platform/framework/api/crud-service";
+import gr from "../../../global-resolver";
+import config from "config";
 
 export class DocumentsController {
   private driveFileDTOBuilder = new DriveFileDTOBuilder();
+  private rootAdmins: string[] = config.has("drive.rootAdmins")
+    ? config.get("drive.rootAdmins")
+    : [];
+
+  private getCompanyUserRole(companyId: string, userId: string, context?: ExecutionContext) {
+    return gr.services.companies
+      .getCompanyUser({ id: companyId }, { id: userId }, context)
+      .then(a => (a ? a.level : null));
+  }
 
   /**
    * Creates a DriveFile item
@@ -166,7 +182,7 @@ export class DocumentsController {
       onlyUploadedNotByMe: true,
     };
 
-    return {
+    const data = {
       ...(await globalResolver.services.documents.documents.browse(id, options, context)),
       websockets: request.currentUser?.id
         ? globalResolver.platformServices.realtime.sign(
@@ -175,6 +191,8 @@ export class DocumentsController {
           )
         : [],
     };
+
+    return data;
   };
 
   sharedWithMe = async (
@@ -257,6 +275,45 @@ export class DocumentsController {
     return await globalResolver.services.documents.documents.update(id, update, context);
   };
 
+  updateLevel = async (
+    request: FastifyRequest<{
+      Params: ItemRequestParams;
+      Body: Partial<DriveFile> | any;
+      Querystring: { public_token?: string };
+    }>,
+  ): Promise<any> => {
+    const { id } = request.params;
+    const update = request.body;
+
+    if (!id) throw new CrudException("Missing id", 400);
+
+    if (!this.rootAdmins.includes(request.currentUser.email)) {
+      throw new CrudException("Unauthorized access. User is not a root admin.", 401);
+    }
+
+    if (id == "root") {
+      const companyUser = await globalResolver.services.companies.getCompanyUser(
+        { id: update.company_id },
+        { id: update.user_id },
+      );
+      if (companyUser) {
+        let level = CompanyUserRole.member;
+        if (update.level == "manage") {
+          level = CompanyUserRole.admin;
+        }
+        await globalResolver.services.companies.setUserRole(
+          update.company_id,
+          update.user_id,
+          companyUser.role,
+          level,
+        );
+      } else {
+        throw new CrudException("User is not part of this company.", 406);
+      }
+    }
+    return {};
+  };
+
   /**
    * Create a drive file version.
    *

tdrive/backend/node/src/services/documents/web/routes.ts

@@ -37,6 +37,13 @@ const routes: FastifyPluginCallback = (fastify: FastifyInstance, _options, next)
     handler: documentsController.update.bind(documentsController),
   });
 
+  fastify.route({
+    method: "POST",
+    url: `${serviceUrl}/:id/level`,
+    preValidation: [fastify.authenticateOptional],
+    handler: documentsController.updateLevel.bind(documentsController),
+  });
+
   fastify.route({
     method: "DELETE",
     url: `${serviceUrl}/:id`,