add acl to idx management in Odmdb

apxtri/models/Odmdb.js

@@ -544,6 +544,76 @@ Odmdb.accessright = (apxaccessrights, role, properties) => {
   });
   return accessright;
 };
+
+Odmdb.getIndexAccess = (objectPathname, indexName) => {
+  const normalized = String(indexName || "")
+    .replace(/\.json$/, "")
+    .trim();
+  if (!/^[A-Za-z0-9_-]+$/.test(normalized)) {
+    return {
+      status: 404,
+      ref: "Odmdb",
+      msg: "indexnotdeclared",
+      data: { indexname: normalized, objectPathname },
+    };
+  }
+  let getschema;
+  try {
+    getschema = Odmdb.Schema(objectPathname, true);
+  } catch (err) {
+    return {
+      status: 500,
+      ref: "Odmdb",
+      msg: "schemainvalid",
+      data: { objectPathname, error: err.message },
+    };
+  }
+  if (getschema.status != 200) return getschema;
+  const indexes = (getschema.data.schema.apxidx || []).filter(
+    (idx) => idx.name === normalized
+  );
+  if (indexes.length == 0) {
+    return {
+      status: 404,
+      ref: "Odmdb",
+      msg: "indexnotdeclared",
+      data: { indexname: normalized, objectPathname },
+    };
+  }
+  if (indexes.length > 1) {
+    return {
+      status: 403,
+      ref: "Odmdb",
+      msg: "indexambiguous",
+      data: { indexname: normalized, objectPathname },
+    };
+  }
+  const index = indexes[0];
+  const acl =
+    index.apxaccess && Array.isArray(index.apxaccess.R)
+      ? index.apxaccess.R
+      : [];
+  return {
+    status: 200,
+    ref: "Odmdb",
+    msg: "indexaccess",
+    data: {
+      indexname: normalized,
+      acl,
+    },
+  };
+};
+
+Odmdb.indexAllowed = (indexaccess, role) => {
+  const acl =
+    indexaccess && Array.isArray(indexaccess.acl) ? indexaccess.acl : [];
+  if (acl.length == 0) return false;
+  if (acl.includes("*")) return true;
+  const profils =
+    role && Array.isArray(role.xprofils) ? role.xprofils : [];
+  return profils.some((profil) => acl.includes(profil));
+};
+
 /**
  * CUD a data itm into objectPathname if checkJson is valid
  *  and update idx

apxtri/routes/odmdb.js

@@ -105,13 +105,14 @@ router.get(
  * @api {get} adminapi/odmdb/idx/:tribe/:objectname/:indexname - index Get
  * @apiGroup Odmdb
  * @apiName getIndexbyindexname
- * @apiDescription Get index file for an object
+ * @apiDescription Get index file for an object. Access is controlled by the index apxaccess.R profiles. Authentication is always required.
  *
  * @apiParams {string} tribe if common adminapi or tribename 
  * @apiParams {string} objectname  If in conf.nationObjects then object is into nationchains/ else in tribes/xtribe/objectname/idx/indexname indexname
  * @apiParams {String} indexname  name of index file in /idx/indexnamme.json 
  *
  * 
+ * @apiError {json} profilnotallow the authenticated user profile cannot read this index
  * @apiError {json} objectNotfound the file does not exist 
  * @apiErrorExample {json}
  * HTTP/1.1 404 Not Found
@@ -127,25 +128,71 @@ router.get(
   checkHeaders,
   isAuthenticated,
   (req, res) => {
-    console.log("passe");
+    const tribeids = Array.isArray(req.app.locals.tribeids)
-    const indexpath = `../${req.params.tribe}/objects/${req.params.objectname}/idx/${req.params.indexname}`;
+      ? req.app.locals.tribeids
-    console.log(indexpath);
+      : [];
-    if (fs.existsSync(indexpath)) {
+    if (
-      res.status(200).json({
+      !["town", "adminapi", ...tribeids].includes(req.params.tribe) ||
+      !/^[A-Za-z0-9_-]+$/.test(req.params.objectname)
+    ) {
+      return res.status(404).json({
+        status: 404,
         ref: "Odmdb",
-        msg: "indexexist",
+        msg: "pathnamedoesnotexist",
         data: {
-          indexname: req.params.indexname,
+          tribe: req.params.tribe,
-          content: fs.readJsonSync(indexpath),
+          objectname: req.params.objectname,
         },
       });
-    } else {
+    }
-      res.status(404).json({
+    const objectPathname = `../${req.params.tribe}/objects/${req.params.objectname}`;
+    const indexaccess = Odmdb.getIndexAccess(
+      objectPathname,
+      req.params.indexname
+    );
+    if (indexaccess.status != 200) {
+      return res.status(indexaccess.status).json(indexaccess);
+    }
+    if (!Odmdb.indexAllowed(indexaccess.data, req.session.header)) {
+      return res.status(403).json({
+        status: 403,
+        ref: "Odmdb",
+        msg: "profilnotallow",
+        data: {
+          indexname: indexaccess.data.indexname,
+          profils: req.session.header.xprofils,
+        },
+      });
+    }
+    const indexpath = `../${req.params.tribe}/objects/${req.params.objectname}/idx/${indexaccess.data.indexname}.json`;
+    if (!fs.existsSync(indexpath)) {
+      return res.status(404).json({
+        status: 404,
         ref: "Odmdb",
         msg: "pathnamedoesnotexist",
         data: { indexpath },
       });
     }
+    let content;
+    try {
+      content = fs.readJsonSync(indexpath);
+    } catch (err) {
+      return res.status(500).json({
+        status: 500,
+        ref: "Odmdb",
+        msg: "indexinvalid",
+        data: { indexpath, error: err.message },
+      });
+    }
+    res.status(200).json({
+      status: 200,
+      ref: "Odmdb",
+      msg: "indexexist",
+      data: {
+        indexname: indexaccess.data.indexname,
+        content,
+      },
+    });
   }
 );
 

schema/articles.json

@@ -149,12 +149,22 @@
     {
       "name": "lst_articleid",
       "type": "array",
-      "keyval": "articleid"
+      "keyval": "articleid",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "lst_author",
       "type": "array",
-      "keyval": "author"
+      "keyval": "author",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "articleid",
@@ -173,19 +183,34 @@
         "manualkeywords",
         "autokeywords"
       ],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "author_articleid",
       "type": "distribution",
       "keyval": "author",
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "manualkeywords_articleid",
       "type": "distribution",
       "keyval": "manualkeywords",
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {

schema/contracts.json

@@ -20,7 +20,12 @@
       "title": "Contract status",
       "description": "todo = pending execution, done = successfully executed, error = failed, cancelled = manually stopped",
       "type": "string",
-      "enum": ["todo", "done", "error", "cancelled"]
+      "enum": [
+        "todo",
+        "done",
+        "error",
+        "cancelled"
+      ]
     },
     "tribe": {
       "title": "Tribe",
@@ -131,17 +136,32 @@
     {
       "name": "lst_contractid",
       "type": "array",
-      "keyval": "contractid"
+      "keyval": "contractid",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "lst_owner",
       "type": "array",
-      "keyval": "owner"
+      "keyval": "owner",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "lst_tribe",
       "type": "array",
-      "keyval": "tribe"
+      "keyval": "tribe",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "contractid",
@@ -169,7 +189,12 @@
         "dt_create",
         "dt_update"
       ],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "status_scheduledDay",
@@ -187,19 +212,34 @@
         "payload",
         "owner"
       ],
-      "filter": "status=todo"
+      "filter": "status=todo",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "tribe_status",
       "type": "distribution",
       "keyval": "tribe",
-      "filter": "status"
+      "filter": "status",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "status_contractid",
       "type": "distribution",
       "keyval": "status",
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     }
   ],
   "apxaccessrights": {

schema/devices.json

@@ -56,7 +56,8 @@
         "mobile",
         "windows",
         "mac",
-        "linux",""
+        "linux",
+        ""
       ]
     },
     "ip": {
@@ -109,7 +110,12 @@
         "type",
         "os"
       ],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {

schema/frenchlocation.json

@@ -57,13 +57,13 @@
       "properties": {
         "latitude": {
           "type": "number",
-          "minimum": -90.0,
+          "minimum": -90,
-          "maximum": 90.0
+          "maximum": 90
         },
         "longitude": {
           "type": "number",
-          "minimum": -180.0,
+          "minimum": -180,
-          "maximum": 180.0
+          "maximum": 180
         }
       }
     },
@@ -85,7 +85,12 @@
     {
       "name": "lst_locationid",
       "type": "array",
-      "keyval": "locationid"
+      "keyval": "locationid",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "frenchlocation",
@@ -96,7 +101,12 @@
         "city",
         "label"
       ],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {

schema/nations.json

@@ -25,15 +25,44 @@
       "format": "uri"
     }
   },
-  "required": ["nationId", "dtcreate","contracts"],
+  "required": [
+    "nationId",
+    "dtcreate",
+    "contracts"
+  ],
   "additionalProperties": false,
   "apxid": "nationId",
-  "apxuniquekey":["nationId"],
+  "apxuniquekey": [
+    "nationId"
+  ],
   "apxidx": [
-    { "name":"lst_nationId","type":"array","keyval": "nationId"},
+    {
-    { "name":"nations","type":"view","keyval":"nationId","objkey":[],"filter":""}
+      "name": "lst_nationId",
+      "type": "array",
+      "keyval": "nationId",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
+    },
+    {
+      "name": "nations",
+      "type": "view",
+      "keyval": "nationId",
+      "objkey": [],
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
+    }
   ],
   "apxaccessrights": {
-    "pagan":{"C":[],"R":[]}
+    "pagan": {
+      "C": [],
+      "R": []
+    }
   }
 }

schema/pagans.json

@@ -30,23 +30,62 @@
       "type": "string"
     }
   },
-  "required": ["publickey", "alias"],
+  "required": [
+    "publickey",
+    "alias"
+  ],
   "apxid": "alias",
-  "apxuniquekey": ["publickey"],
+  "apxuniquekey": [
+    "publickey"
+  ],
   "apxidx": [
-    { "name": "lst_alias", "type": "array", "keyval": "alias" },
+    {
+      "name": "lst_alias",
+      "type": "array",
+      "keyval": "alias",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
+    },
     {
       "name": "alias",
       "type": "view",
       "keyval": "alias",
-      "objkey": [],
+      "objkey": [
-      "filter": ""
+        "alias",
+        "publickey"
+      ],
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {
-    "owner": { "R": [], "U": [], "D": [] },
+    "owner": {
-    "anonymous": { "C": [], "R": ["alias"] },
+      "R": [],
-    "pagans": { "R": ["alias", "publickey"] },
+      "U": [],
-    "mayor": { "R": [], "D": [] }
+      "D": []
+    },
+    "anonymous": {
+      "C": [],
+      "R": [
+        "alias"
+      ]
+    },
+    "pagans": {
+      "R": [
+        "alias",
+        "publickey"
+      ]
+    },
+    "mayor": {
+      "R": [],
+      "D": []
+    }
   }
 }

schema/persons.json

@@ -9,13 +9,17 @@
       "title": "alias",
       "description": "A unique string identifying a unique public key",
       "type": "string",
-        "options": { "$ref": "adminapi/objects/pagans/idx/lst_alias" }
+      "options": {
+        "$ref": "adminapi/objects/pagans/idx/lst_alias"
+      }
     },
     "owner": {
       "title": "Owner of this person",
       "description": "For accessright purpose this is always equal as alias",
       "type": "string",
-        "options": { "$ref": "adminapi/objects/pagans/idx/lst_alias" }
+      "options": {
+        "$ref": "adminapi/objects/pagans/idx/lst_alias"
+      }
     },
     "dt_create": {
       "title": "Creation date",
@@ -69,7 +73,10 @@
     "imgbase64_imgavatar": {
       "title": "Temporary img to update or create",
       "description": "image will be store in /objects/persons/{alias}_imgavatar.webp",
-        "sizeHW": [80, 80],
+      "sizeHW": [
+        80,
+        80
+      ],
       "type": "string",
       "format": "imgbase64"
     },
@@ -85,25 +92,44 @@
       "type": "array",
       "items": {
         "type": "string",
-          "options": { "$ref": "smatchit/objects/options/profil" }
+        "options": {
+          "$ref": "smatchit/objects/options/profil"
+        }
       }
     }
   },
-    "required": ["alias", "profils"],
+  "required": [
+    "alias",
+    "profils"
+  ],
   "additionalProperties": true,
   "apxref": [],
   "apxid": "alias",
-    "apxuniquekey": ["alias"],
+  "apxuniquekey": [
+    "alias"
+  ],
   "apxidx": [
     {
       "name": "lst_alias",
       "type": "array",
-        "keyval": "alias"
+      "keyval": "alias",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
     },
     {
       "name": "lst_profils",
       "type": "array",
-        "keyval": "profils"
+      "keyval": "profils",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
     },
     {
       "name": "alias",
@@ -121,25 +147,49 @@
         "imgavatar",
         "profils"
       ],
-        "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
     },
     {
       "name": "profils_alias",
       "type": "distribution",
       "keyval": "profils",
-        "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
     },
     {
       "name": "emailcom_alias",
       "type": "distribution",
       "keyval": "emailcom",
-        "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
     },
     {
       "name": "hobbies_alias",
       "type": "distribution",
       "keyval": "hobbies",
-        "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
     }
   ],
   "commentaccessrights": "only a pagans can create a persons by joining the tribe smatchit. An adminrecruiters can Read person and update only profil by adding value recruiters or interviewers, that will create for this alias a recruiters itm or interviewers itm, use /api/smatchit/profilmanagers/join/:profils/:recruiteralias",
@@ -174,12 +224,15 @@
     },
     "mayors": {
       "D": [],
-        "R": ["alias"]
+      "R": [
+        "alias"
+      ]
     },
     "druids": {
       "D": [],
-        "R": ["alias"]
+      "R": [
+        "alias"
+      ]
     }
   }
 }
-  

schema/screens.json

@@ -28,17 +28,25 @@
     "formcontrol": {
       "title": "A key word to presents this content",
       "type": "string",
-        "enum":["squarebluebtn","listbtn","form"]
+      "enum": [
+        "squarebluebtn",
+        "listbtn",
+        "form"
+      ]
     },
     "forms": {
       "title": "Liste of data collection element into the screen",
       "type": "array",
-        "items":{"type":"objects"}
+      "items": {
+        "type": "objects"
+      }
     },
     "action": {
       "title": "List of possible action on this element",
       "type": "string",
-        "enum":["onclick"]
+      "enum": [
+        "onclick"
+      ]
     },
     "function": {
       "title": "Function name to call, if action",
@@ -53,17 +61,39 @@
     "nextlevel": {
       "title": "List of new screens to show if function is nextlevel $ref:# means it same current schema",
       "type": "array",
-        "items":{"$ref":"#"}
+      "items": {
+        "$ref": "#"
+      }
     }
   },
-    "required": ["screenid", "title"],
+  "required": [
+    "screenid",
+    "title"
+  ],
   "apxid": "screenid",
-    "apxuniquekey": ["screenid"],
+  "apxuniquekey": [
+    "screenid"
+  ],
   "apxidx": [
-      { "name": "lst_screens", "type": "array", "keyval": "screenid" },
+    {
+      "name": "lst_screens",
+      "type": "array",
+      "keyval": "screenid",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
+    }
   ],
   "apxaccessrights": {
-      "owner": { "R": [], "U": [], "D": [] },
+    "owner": {
-      "anonymous": { "R": [] },
+      "R": [],
+      "U": [],
+      "D": []
+    },
+    "anonymous": {
+      "R": []
+    }
   }
 }

schema/towns.json

@@ -62,14 +62,24 @@
     {
       "name": "lst_townId",
       "type": "array",
-      "keyval": "townId"
+      "keyval": "townId",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "towns",
       "keyval": "townId",
       "type": "view",
       "objkey": [],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {

schema/tribes.json

@@ -52,14 +52,24 @@
     {
       "name": "lst_tribeId",
       "keyval": "tribeId",
-      "type": "array"
+      "type": "array",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "tribes",
       "keyval": "tribeId",
       "type": "view",
       "objkey": [],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "owner_tribeId",
@@ -67,7 +77,12 @@
       "keyval": "owner",
       "objkey": [
         "tribeId"
+      ],
+      "apxaccess": {
+        "R": [
+          "*"
         ]
+      }
     },
     {
       "name": "dns_tribeId",
@@ -75,7 +90,12 @@
       "keyval": "dns",
       "objkey": [
         "tribeId"
+      ],
+      "apxaccess": {
+        "R": [
+          "*"
         ]
+      }
     },
     {
       "name": "tribes_dns",
@@ -84,7 +104,12 @@
       "objkey": [
         "dns"
       ],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxacceesrights": {

schema/wco.json

@@ -52,7 +52,12 @@
     {
       "name": "lst_wconame",
       "type": "array",
-  "keyval": "wconame"
+      "keyval": "wconame",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {

schema/wwws.json

@@ -98,7 +98,12 @@
     {
       "name": "lst_website",
       "type": "array",
-      "keyval": "website"
+      "keyval": "website",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {