From 07f3c8b023baae54fb009705a8b72bd9fe9b396b Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Thu, 31 Dec 2020 15:00:02 -0500
Subject: [PATCH] Permission based on owners of groups

---
 nodejs/routes/group.js     | 41 +++++++++++++++++++-------------------
 nodejs/utils/permission.js | 28 ++++++++++++++++++--------
 2 files changed, 40 insertions(+), 29 deletions(-)

diff --git a/nodejs/routes/group.js b/nodejs/routes/group.js
index bedf8c1..a7f0f49 100644
--- a/nodejs/routes/group.js
+++ b/nodejs/routes/group.js
@@ -42,81 +42,80 @@ router.get('/:name', async function(req, res, next){
 	}
 });
 
-router.put('/owner/:name/:uid', async function(req, res, next){
+router.put('/owner/:group/:uid', async function(req, res, next){
 	try{
 
-		// await permission.byGroup(req.user, ['app_sso_admin']);
+		await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
 
-		var group = await Group.get(req.params.name);
+		var group = await Group.get(req.params.group);
 		var user = await User.get(req.params.uid);
 		return res.json({
 			results: group.addOwner(user),
-			message: `Added owner ${req.params.uid} to ${req.params.name} group.`
+			message: `Added owner ${req.params.uid} to ${req.params.group} group.`
 		});
 	}catch(error){
 		next(error);
 	}
 });
 
-router.delete('/owner/:name/:uid', async function(req, res, next){
+router.delete('/owner/:group/:uid', async function(req, res, next){
 	try{
 
-		await permission.byGroup(req.user, ['app_sso_admin']);
+		await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
 
-		var group = await Group.get(req.params.name);
+		var group = await Group.get(req.params.group);
 		var user = await User.get(req.params.uid);
 		return res.json({
 			results: group.removeOwner(user),
-			message: `Removed Owner ${req.params.uid} from ${req.params.name} group.`
+			message: `Removed Owner ${req.params.uid} from ${req.params.group} group.`
 		});
 	}catch(error){
 		next(error);
 	}
 });
 
-
-router.put('/:name/:uid', async function(req, res, next){
+router.put('/:group/:uid', async function(req, res, next){
 	try{
 
-		// await permission.byGroup(req.user, ['app_sso_admin']);
+		await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
 
-		var group = await Group.get(req.params.name);
+		var group = await Group.get(req.params.group);
 		var user = await User.get(req.params.uid);
 		return res.json({
 			results: group.addMember(user),
-			message: `Added user ${req.params.uid} to ${req.params.name} group.`
+			message: `Added user ${req.params.uid} to ${req.params.group} group.`
 		});
 	}catch(error){
 		next(error);
 	}
 });
 
-router.delete('/:name/:uid', async function(req, res, next){
+router.delete('/:group/:uid', async function(req, res, next){
 	try{
 
-		await permission.byGroup(req.user, ['app_sso_admin']);
+		await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
 
-		var group = await Group.get(req.params.name);
+		var group = await Group.get(req.params.group);
 		var user = await User.get(req.params.uid);
 		return res.json({
 			results: group.removeMember(user),
-			message: `Removed user ${req.params.uid} from ${req.params.name} group.`
+			message: `Removed user ${req.params.uid} from ${req.params.group} group.`
 		});
 	}catch(error){
 		next(error);
 	}
 });
 
-router.delete('/:name', async function(req, res, next){
+router.delete('/:group', async function(req, res, next){
 	try{
 
-		await permission.byGroup(req.user, ['app_sso_admin']);
+		await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
 
-		var group = await Group.get(req.params.name);
+		var group = await Group.get(req.params.group);
 		return res.json({
 			removed: await group.remove(),
 			results: group,
-			message: `Group ${req.params.name} Deleted`
+			message: `Group ${req.params.group} Deleted`
 		});
 	}catch(error){
 		next(error);
diff --git a/nodejs/utils/permission.js b/nodejs/utils/permission.js
index 0c7569b..d0872cb 100644
--- a/nodejs/utils/permission.js
+++ b/nodejs/utils/permission.js
@@ -2,21 +2,33 @@
 
 const {Group} = require('../models/group_ldap');
 
-let byGroup = async function(user, groups){
+let byGroup = async function(user, groups, ownerOf){
 	for(let group of groups){
 		try{
+			console.log('checking group', group, 'for access', groups, ownerOf)
 			group = await Group.get(group);
 			if(group.member.includes(user.dn)) return true
 		}catch(error){
-			throw error;
+			console.error('Error byGroup', groups, ownerOf);
 		}
-
-		let error = new Error('Insufficient Permission');
-		error.name = 'Insufficient Permission';
-		error.message = `You do not have permission to perform this action.`;
-		error.status = 401;
-		throw error;
 	}
+
+	for(let group of ownerOf || []){
+		try{
+			console.log('checking group owners', group, 'for access', groups, ownerOf)
+
+			group = await Group.get(group);
+			if(group.owner.includes(user.dn)) return true
+		}catch(error){
+			console.error('Error byGroup', groups, ownerOf);
+		}
+	}
+
+	let error = new Error('Insufficient Permission');
+	error.name = 'Insufficient Permission';
+	error.message = `You do not have permission to perform this action.`;
+	error.status = 401;
+	throw error;
 }
 
 module.exports = {byGroup};