fix(authentication): getTeam checks not working correctly

fix(database): temporary patch for schema cloning on view creation
ConduitPlatform · Jun 16, 2023 · c0ef200 · c0ef200
1 parent ba7f1fd
commit c0ef200
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 12 deletions.
diff --git a/modules/authentication/src/handlers/team.ts b/modules/authentication/src/handlers/team.ts
@@ -330,17 +330,24 @@ export class TeamsHandler implements IAuthenticationStrategy {
   async getTeam(call: ParsedRouterRequest): Promise<UnparsedRouterResponse> {
     const { user } = call.request.context;
     const { teamId, populate } = call.request.params;
-    const relations = await this.grpcSdk.authorization!.findRelation({
+    const allowed = await this.grpcSdk.authorization?.can({
       subject: 'User:' + user._id,
+      actions: ['read'],
       resource: 'Team:' + teamId,
-      skip: 0,
-      limit: 1,
     });
-    if (!relations || relations.relations.length === 0) {
-      throw new GrpcError(
-        status.PERMISSION_DENIED,
-        'User does not have permission to view team',
-      );
+    if (!allowed || !allowed.allow) {
+      const relations = await this.grpcSdk.authorization!.findRelation({
+        subject: 'User:' + user._id,
+        resource: 'Team:' + teamId,
+        skip: 0,
+        limit: 1,
+      });
+      if (!relations || relations.relations.length === 0) {
+        throw new GrpcError(
+          status.PERMISSION_DENIED,
+          'User does not have permission to view team',
+        );
+      }
     }
     const team: Team | null = await Team.getInstance().findOne(
       { _id: teamId },

diff --git a/modules/database/src/adapters/mongoose-adapter/MongooseSchema.ts b/modules/database/src/adapters/mongoose-adapter/MongooseSchema.ts
@@ -44,16 +44,16 @@ export class MongooseSchema extends SchemaAdapter<Model<any>> {
     } else {
       (schema as _ConduitSchema).collectionName = schema.name; //restore collectionName
     }
-    const mongooseSchema = new Schema(schema.fields as Indexable, {
-      ...schema.modelOptions,
+    const mongooseSchema = new Schema(cloneDeep(schema.fields as Indexable), {
+      ...cloneDeep(schema.modelOptions),
       ...(isView
         ? {
             autoCreate: false,
             autoIndex: false,
           }
         : {}),
     });
-    this.model = mongoose.model(schema.name, mongooseSchema);
+    this.model = mongoose.model(cloneDeep(schema.name), mongooseSchema);
   }
 
   parseStringToQuery(

diff --git a/modules/database/src/adapters/mongoose-adapter/index.ts b/modules/database/src/adapters/mongoose-adapter/index.ts
@@ -80,8 +80,10 @@ export class MongooseAdapter extends DatabaseAdapter<MongooseSchema> {
       return;
     }
     const model = this.models[modelName];
-    const newSchema = JSON.parse(JSON.stringify(model.schema));
+    let newSchema = model.schema;
+    //@ts-ignore
     newSchema.name = viewName;
+    //@ts-ignore
     newSchema.collectionName = viewName;
     const viewModel = new MongooseSchema(
       this.grpcSdk,