Feat/um 114 roles and permissions (#1683)

* Auth checkpoint.

* Merge branch 'dev' into feat/um-114-roles-and-permissions

pages/api/teams/[id]/index.ts

@@ -1,7 +1,6 @@
 import { Team } from '@prisma/client';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canDeleteTeam, canUpdateTeam, canViewTeam } from 'lib/auth';
 import { useAuth } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { methodNotAllowed, ok, unauthorized } from 'next-basics';
@@ -21,12 +20,16 @@ export default async (
 ) => {
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
   const { id: teamId } = req.query;
 
   if (req.method === 'GET') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.Team))) {
+    if (await canViewTeam(userId, teamId)) {
       return unauthorized(res);
     }
+
     const user = await getTeam({ id: teamId });
 
     return ok(res, user);
@@ -35,7 +38,7 @@ export default async (
   if (req.method === 'POST') {
     const { name } = req.body;
 
-    if (!(await allowQuery(req, UmamiApi.AuthType.TeamOwner))) {
+    if (await canUpdateTeam(userId, teamId)) {
       return unauthorized(res, 'You must be the owner of this team.');
     }
 
@@ -45,7 +48,7 @@ export default async (
   }
 
   if (req.method === 'DELETE') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.TeamOwner))) {
+    if (await canDeleteTeam(userId, teamId)) {
       return unauthorized(res, 'You must be the owner of this team.');
     }
 

pages/api/teams/[id]/user.ts

@@ -1,6 +1,5 @@
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canUpdateTeam, canViewTeam } from 'lib/auth';
 import { useAuth } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { badRequest, methodNotAllowed, ok, unauthorized } from 'next-basics';
@@ -22,10 +21,13 @@ export default async (
 ) => {
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
   const { id: teamId } = req.query;
 
   if (req.method === 'GET') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.Team))) {
+    if (await canViewTeam(userId, teamId)) {
       return unauthorized(res);
     }
 
@@ -35,7 +37,7 @@ export default async (
   }
 
   if (req.method === 'POST') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.TeamOwner))) {
+    if (await canUpdateTeam(userId, teamId)) {
       return unauthorized(res, 'You must be the owner of this team.');
     }
 
@@ -54,7 +56,7 @@ export default async (
   }
 
   if (req.method === 'DELETE') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.TeamOwner))) {
+    if (await canUpdateTeam(userId, teamId)) {
       return unauthorized(res, 'You must be the owner of this team.');
     }
     const { team_user_id } = req.body;

pages/api/teams/[id]/website.ts

@@ -1,6 +1,5 @@
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canViewTeam } from 'lib/auth';
 import { useAuth } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { methodNotAllowed, ok, unauthorized } from 'next-basics';
@@ -21,10 +20,13 @@ export default async (
 ) => {
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
   const { id: teamId } = req.query;
 
   if (req.method === 'GET') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.Team))) {
+    if (await canViewTeam(userId, teamId)) {
       return unauthorized(res);
     }
 

pages/api/teams/index.ts

@@ -1,9 +1,10 @@
 import { Team } from '@prisma/client';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
+import { canCreateTeam } from 'lib/auth';
 import { uuid } from 'lib/crypto';
 import { useAuth } from 'lib/middleware';
 import { NextApiResponse } from 'next';
-import { badRequest, methodNotAllowed, ok } from 'next-basics';
+import { badRequest, methodNotAllowed, ok, unauthorized } from 'next-basics';
 import { createTeam, getTeam, getTeamsByUserId } from 'queries';
 export interface TeamsRequestBody {
   name: string;
@@ -17,16 +18,20 @@ export default async (
   await useAuth(req, res);
 
   const {
-    user: { id },
+    user: { id: userId },
   } = req.auth;
 
   if (req.method === 'GET') {
-    const teams = await getTeamsByUserId(id);
+    const teams = await getTeamsByUserId(userId);
 
     return ok(res, teams);
   }
 
   if (req.method === 'POST') {
+    if (await canCreateTeam(userId)) {
+      return unauthorized(res);
+    }
+
     const { name } = req.body;
 
     const team = await getTeam({ name });
@@ -36,7 +41,7 @@ export default async (
     }
 
     const created = await createTeam({
-      id: id || uuid(),
+      id: uuid(),
       name,
     });
 

pages/api/users/[id]/index.ts

@@ -1,6 +1,5 @@
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { checkPermission } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canDeleteUser, canUpdateUser, canViewUser, checkAdmin } from 'lib/auth';
 import { useAuth } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { badRequest, hashPassword, methodNotAllowed, ok, unauthorized } from 'next-basics';
@@ -27,7 +26,7 @@ export default async (
   const { id } = req.query;
 
   if (req.method === 'GET') {
-    if (id !== userId) {
+    if (await canViewUser(userId, id)) {
       return unauthorized(res);
     }
 
@@ -37,12 +36,12 @@ export default async (
   }
 
   if (req.method === 'POST') {
-    const { username, password } = req.body;
-
-    if (id !== userId) {
+    if (await canUpdateUser(userId, id)) {
       return unauthorized(res);
     }
 
+    const { username, password } = req.body;
+
     const user = await getUser({ id });
 
     const data: any = {};
@@ -52,7 +51,7 @@ export default async (
     }
 
     // Only admin can change these fields
-    if (!(await checkPermission(req, UmamiApi.Permission.Admin))) {
+    if (username && (await checkAdmin(userId))) {
       data.username = username;
     }
 
@@ -71,12 +70,12 @@ export default async (
   }
 
   if (req.method === 'DELETE') {
-    if (id === userId) {
-      return badRequest(res, 'You cannot delete your own user.');
+    if (canDeleteUser(userId)) {
+      return unauthorized(res);
     }
 
-    if (!(await checkPermission(req, UmamiApi.Permission.Admin))) {
-      return unauthorized(res);
+    if (id === userId) {
+      return badRequest(res, 'You cannot delete your own user.');
     }
 
     await deleteUser(id);

pages/api/users/[id]/password.ts

@@ -1,6 +1,5 @@
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canUpdateUser } from 'lib/auth';
 import { useAuth } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import {
@@ -30,12 +29,15 @@ export default async (
 
   const { current_password, new_password } = req.body;
   const { id } = req.query;
-
-  if (!(await allowQuery(req, UmamiApi.AuthType.User))) {
-    return unauthorized(res);
-  }
+  const {
+    user: { id: userId },
+  } = req.auth;
 
   if (req.method === 'POST') {
+    if (canUpdateUser(userId, id)) {
+      return unauthorized(res);
+    }
+
     const user = await getUser({ id });
 
     if (!checkPassword(current_password, user.password)) {

pages/api/users/[id]/role.ts

@@ -1,20 +1,17 @@
 import { UserRole } from '@prisma/client';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { checkPermission } from 'lib/auth';
+import { canUpdateUserRole } from 'lib/auth';
 import { UmamiApi } from 'lib/constants';
-import { uuid } from 'lib/crypto';
 import { useAuth } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { badRequest, methodNotAllowed, ok, unauthorized } from 'next-basics';
-import { createUserRole, deleteUserRole, getUserRole, getUserRoles } from 'queries';
+import { deleteUserRole, getUserRole, getUserRoles, updateUserRole } from 'queries';
 
 export interface UserRoleRequestQuery {
   id: string;
 }
-
 export interface UserRoleRequestBody {
-  roleId: string;
-  teamId?: string;
+  role: UmamiApi.Role;
   userRoleId?: string;
 }
 
@@ -29,7 +26,7 @@ export default async (
   } = req.auth;
   const { id } = req.query;
 
-  if (id !== userId || !(await checkPermission(req, UmamiApi.Permission.Admin))) {
+  if (await canUpdateUserRole(userId)) {
     return unauthorized(res);
   }
 
@@ -40,17 +37,17 @@ export default async (
   }
 
   if (req.method === 'POST') {
-    const { roleId, teamId } = req.body;
+    const { role } = req.body;
 
-    const userRole = getUserRole({ userId: id, roleId, teamId });
+    const userRole = await getUserRole({ userId: id });
 
-    if (userRole) {
+    if (userRole && userRole.role === role) {
       return badRequest(res, 'Role already exists for User.');
+    } else {
+      const updated = await updateUserRole({ role }, { id: userRole.id });
+
+      return ok(res, updated);
     }
-
-    const updated = await createUserRole({ id: uuid(), userId: id, roleId, teamId });
-
-    return ok(res, updated);
   }
 
   if (req.method === 'DELETE') {

pages/api/users/index.ts

@@ -1,6 +1,5 @@
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { checkPermission } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canCreateUser, canViewUsers } from 'lib/auth';
 import { uuid } from 'lib/crypto';
 import { useAuth } from 'lib/middleware';
 import { NextApiResponse } from 'next';
@@ -19,17 +18,25 @@ export default async (
 ) => {
   await useAuth(req, res);
 
-  if (!(await checkPermission(req, UmamiApi.Permission.Admin))) {
-    return unauthorized(res);
-  }
+  const {
+    user: { id: userId },
+  } = req.auth;
 
   if (req.method === 'GET') {
+    if (canViewUsers(userId)) {
+      return unauthorized(res);
+    }
+
     const users = await getUsers();
 
     return ok(res, users);
   }
 
   if (req.method === 'POST') {
+    if (canCreateUser(userId)) {
+      return unauthorized(res);
+    }
+
     const { username, password, id } = req.body;
 
     const user = await getUser({ username });

pages/api/websites/[id]/active.ts

@@ -1,7 +1,6 @@
 import { WebsiteActive } from 'interface/api/models';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canViewWebsite } from 'lib/auth';
 import { useAuth, useCors } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { methodNotAllowed, ok, unauthorized } from 'next-basics';
@@ -18,13 +17,16 @@ export default async (
   await useCors(req, res);
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
+  const { id: websiteId } = req.query;
+
   if (req.method === 'GET') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.Website))) {
+    if (await canViewWebsite(userId, websiteId)) {
       return unauthorized(res);
     }
 
-    const { id: websiteId } = req.query;
-
     const result = await getActiveVisitors(websiteId);
 
     return ok(res, result);

pages/api/websites/[id]/eventdata.ts

@@ -1,7 +1,6 @@
 import { WebsiteMetric } from 'interface/api/models';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canViewWebsite } from 'lib/auth';
 import { useAuth, useCors } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { methodNotAllowed, ok, unauthorized } from 'next-basics';
@@ -26,13 +25,16 @@ export default async (
   await useCors(req, res);
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
+  const { id: websiteId } = req.query;
+
   if (req.method === 'POST') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.Website))) {
+    if (canViewWebsite(userId, websiteId)) {
       return unauthorized(res);
     }
 
-    const { id: websiteId } = req.query;
-
     const { start_at, end_at, event_name: eventName, columns, filters } = req.body;
 
     const startDate = new Date(+start_at);

pages/api/websites/[id]/events.ts

@@ -1,7 +1,6 @@
 import { WebsiteMetric } from 'interface/api/models';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canViewWebsite } from 'lib/auth';
 import { useAuth, useCors } from 'lib/middleware';
 import moment from 'moment-timezone';
 import { NextApiResponse } from 'next';
@@ -27,13 +26,16 @@ export default async (
   await useCors(req, res);
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
+  const { id: websiteId, start_at, end_at, unit, tz, url, event_name } = req.query;
+
   if (req.method === 'GET') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.Website))) {
+    if (canViewWebsite(userId, websiteId)) {
       return unauthorized(res);
     }
 
-    const { id: websiteId, start_at, end_at, unit, tz, url, event_name } = req.query;
-
     if (!moment.tz.zone(tz) || !unitTypes.includes(unit)) {
       return badRequest(res);
     }

pages/api/websites/[id]/index.ts

@@ -1,6 +1,6 @@
 import { Website } from 'interface/api/models';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { canViewWebsite, canUpdateWebsite } from 'lib/auth';
+import { canViewWebsite, canUpdateWebsite, canDeleteWebsite } from 'lib/auth';
 import { useAuth, useCors } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { methodNotAllowed, ok, serverError, unauthorized } from 'next-basics';
@@ -23,10 +23,13 @@ export default async (
   await useCors(req, res);
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
   const { id: websiteId } = req.query;
 
   if (req.method === 'GET') {
-    if (!(await canViewWebsite(req.auth.user.id, websiteId))) {
+    if (!(await canViewWebsite(userId, websiteId))) {
       return unauthorized(res);
     }
 
@@ -36,7 +39,7 @@ export default async (
   }
 
   if (req.method === 'POST') {
-    if (!(await canUpdateWebsite(req.auth.user.id, websiteId))) {
+    if (!(await canUpdateWebsite(userId, websiteId))) {
       return unauthorized(res);
     }
 
@@ -54,6 +57,10 @@ export default async (
   }
 
   if (req.method === 'DELETE') {
+    if (!(await canDeleteWebsite(userId, websiteId))) {
+      return unauthorized(res);
+    }
+
     await deleteWebsite(websiteId);
 
     return ok(res);

pages/api/websites/[id]/metrics.ts

@@ -1,7 +1,7 @@
 import { WebsiteMetric } from 'interface/api/models';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { FILTER_IGNORED, UmamiApi } from 'lib/constants';
+import { canViewWebsite } from 'lib/auth';
+import { FILTER_IGNORED } from 'lib/constants';
 import { useAuth, useCors } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { badRequest, methodNotAllowed, ok, unauthorized } from 'next-basics';
@@ -56,24 +56,27 @@ export default async (
   await useCors(req, res);
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
+  const {
+    id: websiteId,
+    type,
+    start_at,
+    end_at,
+    url,
+    referrer,
+    os,
+    browser,
+    device,
+    country,
+  } = req.query;
+
   if (req.method === 'GET') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.Website))) {
+    if (!(await canViewWebsite(userId, websiteId))) {
       return unauthorized(res);
     }
 
-    const {
-      id: websiteId,
-      type,
-      start_at,
-      end_at,
-      url,
-      referrer,
-      os,
-      browser,
-      device,
-      country,
-    } = req.query;
-
     const startDate = new Date(+start_at);
     const endDate = new Date(+end_at);
 

pages/api/websites/[id]/pageviews.ts

@@ -1,7 +1,6 @@
 import { WebsitePageviews } from 'interface/api/models';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canViewWebsite } from 'lib/auth';
 import { useAuth, useCors } from 'lib/middleware';
 import moment from 'moment-timezone';
 import { NextApiResponse } from 'next';
@@ -32,25 +31,28 @@ export default async (
   await useCors(req, res);
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
+  const {
+    id: websiteId,
+    start_at,
+    end_at,
+    unit,
+    tz,
+    url,
+    referrer,
+    os,
+    browser,
+    device,
+    country,
+  } = req.query;
+
   if (req.method === 'GET') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.Website))) {
+    if (!(await canViewWebsite(userId, websiteId))) {
       return unauthorized(res);
     }
 
-    const {
-      id: websiteId,
-      start_at,
-      end_at,
-      unit,
-      tz,
-      url,
-      referrer,
-      os,
-      browser,
-      device,
-      country,
-    } = req.query;
-
     const startDate = new Date(+start_at);
     const endDate = new Date(+end_at);
 

pages/api/websites/[id]/reset.ts

@@ -1,6 +1,5 @@
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canViewWebsite } from 'lib/auth';
 import { useAuth, useCors } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { methodNotAllowed, ok, unauthorized } from 'next-basics';
@@ -17,10 +16,13 @@ export default async (
   await useCors(req, res);
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
   const { id: websiteId } = req.query;
 
   if (req.method === 'POST') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.Website))) {
+    if (!(await canViewWebsite(userId, websiteId))) {
       return unauthorized(res);
     }
 

pages/api/websites/[id]/stats.ts

@@ -1,7 +1,6 @@
 import { WebsiteStats } from 'interface/api/models';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { allowQuery } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
+import { canViewWebsite } from 'lib/auth';
 import { useAuth, useCors } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { methodNotAllowed, ok, unauthorized } from 'next-basics';
@@ -27,23 +26,26 @@ export default async (
   await useCors(req, res);
   await useAuth(req, res);
 
+  const {
+    user: { id: userId },
+  } = req.auth;
+  const {
+    id: websiteId,
+    start_at,
+    end_at,
+    url,
+    referrer,
+    os,
+    browser,
+    device,
+    country,
+  } = req.query;
+
   if (req.method === 'GET') {
-    if (!(await allowQuery(req, UmamiApi.AuthType.Website))) {
+    if (!(await canViewWebsite(userId, websiteId))) {
       return unauthorized(res);
     }
 
-    const {
-      id: websiteId,
-      start_at,
-      end_at,
-      url,
-      referrer,
-      os,
-      browser,
-      device,
-      country,
-    } = req.query;
-
     const startDate = new Date(+start_at);
     const endDate = new Date(+end_at);
 

pages/api/websites/index.ts

@@ -1,12 +1,11 @@
 import { Prisma } from '@prisma/client';
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
+import { checkAdmin } from 'lib/auth';
 import { uuid } from 'lib/crypto';
 import { useAuth, useCors } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import { methodNotAllowed, ok } from 'next-basics';
 import { createWebsite, getAllWebsites, getWebsitesByUserId } from 'queries';
-import { checkPermission } from 'lib/auth';
-import { UmamiApi } from 'lib/constants';
 
 export interface WebsitesRequestQuery {
   include_all?: boolean;
@@ -33,7 +32,7 @@ export default async (
   if (req.method === 'GET') {
     const { include_all } = req.query;
 
-    const isAdmin = await checkPermission(req, UmamiApi.Permission.Admin);
+    const isAdmin = await checkAdmin(userId);
 
     const websites =
       isAdmin && include_all ? await getAllWebsites() : await getWebsitesByUserId(userId);
@@ -44,7 +43,7 @@ export default async (
   if (req.method === 'POST') {
     const { name, domain, shareId, teamId } = req.body;
 
-    const data: Prisma.WebsiteCreateInput = {
+    const data: Prisma.WebsiteUncheckedCreateInput = {
       id: uuid(),
       name,
       domain,