From ac6f7cad34731ae31c01ed97bdfc078d72d86cd5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Toma=C5=BE=20Jerman?= Date: Tue, 24 Sep 2019 13:06:27 +0200 Subject: [PATCH] Allow assignee to read/update not owned reminders --- system/service/access_control.go | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/system/service/access_control.go b/system/service/access_control.go index b0aa18374..cdf067842 100644 --- a/system/service/access_control.go +++ b/system/service/access_control.go @@ -3,6 +3,7 @@ package service import ( "context" + intAuth "github.com/cortezaproject/corteza-server/internal/auth" "github.com/cortezaproject/corteza-server/internal/permissions" "github.com/cortezaproject/corteza-server/pkg/automation" "github.com/cortezaproject/corteza-server/system/types" @@ -152,12 +153,20 @@ func (svc accessControl) CanCreateReminder(ctx context.Context) bool { return svc.can(ctx, types.SystemPermissionResource, "reminder.create") } func (svc accessControl) CanReadReminder(ctx context.Context, rm *types.Reminder) bool { - // @todo if user is assignee, then they should be able to perform these operations - return svc.can(ctx, types.ReminderPermissionResource.AppendID(rm.ID), "read") + return svc.can(ctx, types.ReminderPermissionResource.AppendID(rm.ID), "read", func() permissions.Access { + if rm.AssignedTo == intAuth.GetIdentityFromContext(ctx).Identity() { + return permissions.Allow + } + return permissions.Deny + }) } func (svc accessControl) CanUpdateReminder(ctx context.Context, rm *types.Reminder) bool { - // @todo if user is assignee, then they should be able to perform these operations - return svc.can(ctx, types.ReminderPermissionResource.AppendID(rm.ID), "update") + return svc.can(ctx, types.ReminderPermissionResource.AppendID(rm.ID), "update", func() permissions.Access { + if rm.AssignedTo == intAuth.GetIdentityFromContext(ctx).Identity() { + return permissions.Allow + } + return permissions.Deny + }) } func (svc accessControl) CanDeleteReminder(ctx context.Context, rm *types.Reminder) bool { return svc.can(ctx, types.ReminderPermissionResource.AppendID(rm.ID), "delete") @@ -240,5 +249,12 @@ func (svc accessControl) Whitelist() permissions.Whitelist { "run", ) + wl.Set( + types.ReminderPermissionResource, + "read", + "update", + "delete", + ) + return wl }