watson/umami
1
0
Fork 0
mirror of https://github.com/umami-software/umami.git synced 2026-02-08 06:37:18 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Pixel/links development. New validations folder. More refactoring.

Browse source
This commit is contained in:
Mike Cao 2025-08-14 23:48:11 -07:00
parent 88639dfe83
commit 247e14646b
136 changed files with 1395 additions and 516 deletions
Download patch file Download diff file Expand all files Collapse all files

251
src/lib/auth.ts
View file

@ -1,16 +1,13 @@
import bcrypt from 'bcryptjs';
import { Report } from '@prisma/client';
import redis from '@/lib/redis';
import debug from 'debug';
import { PERMISSIONS, ROLE_PERMISSIONS, ROLES, SHARE_TOKEN_HEADER } from '@/lib/constants';
import { ROLE_PERMISSIONS, ROLES, SHARE_TOKEN_HEADER } from '@/lib/constants';
import { secret, getRandomChars } from '@/lib/crypto';
import { createSecureToken, parseSecureToken, parseToken } from '@/lib/jwt';
import { ensureArray } from '@/lib/utils';
import { getTeamUser, getUser, getWebsite } from '@/queries';
import { Auth } from './types';
import { getUser } from '@/queries';
const log = debug('umami:auth');
const cloudMode = process.env.CLOUD_MODE;
const SALT_ROUNDS = 10;
export function hashPassword(password: string, rounds = SALT_ROUNDS) {
@ -75,6 +72,10 @@ export async function saveAuth(data: any, expire = 0) {
return createSecureToken({ authKey }, secret());
}
export async function hasPermission(role: string, permission: string | string[]) {
return ensureArray(permission).some(e => ROLE_PERMISSIONS[role]?.includes(e));
}
export function parseShareToken(headers: Headers) {
try {
return parseToken(headers.get(SHARE_TOKEN_HEADER), secret());
@ -83,243 +84,3 @@ export function parseShareToken(headers: Headers) {
return null;
}
}
export async function canViewWebsite({ user, shareToken }: Auth, websiteId: string) {
if (user?.isAdmin) {
return true;
}
if (shareToken?.websiteId === websiteId) {
return true;
}
const website = await getWebsite(websiteId);
if (website.userId) {
return user.id === website.userId;
}
if (website.teamId) {
const teamUser = await getTeamUser(website.teamId, user.id);
return !!teamUser;
}
return false;
}
export async function canViewAllWebsites({ user }: Auth) {
return user.isAdmin;
}
export async function canCreateWebsite({ user, grant }: Auth) {
if (cloudMode) {
return !!grant?.find(a => a === PERMISSIONS.websiteCreate);
}
if (user.isAdmin) {
return true;
}
return hasPermission(user.role, PERMISSIONS.websiteCreate);
}
export async function canUpdateWebsite({ user }: Auth, websiteId: string) {
if (user.isAdmin) {
return true;
}
const website = await getWebsite(websiteId);
if (website.userId) {
return user.id === website.userId;
}
if (website.teamId) {
const teamUser = await getTeamUser(website.teamId, user.id);
return teamUser && hasPermission(teamUser.role, PERMISSIONS.websiteUpdate);
}
return false;
}
export async function canTransferWebsiteToUser({ user }: Auth, websiteId: string, userId: string) {
const website = await getWebsite(websiteId);
if (website.teamId && user.id === userId) {
const teamUser = await getTeamUser(website.teamId, userId);
return teamUser && hasPermission(teamUser.role, PERMISSIONS.websiteTransferToUser);
}
return false;
}
export async function canTransferWebsiteToTeam({ user }: Auth, websiteId: string, teamId: string) {
const website = await getWebsite(websiteId);
if (website.userId && website.userId === user.id) {
const teamUser = await getTeamUser(teamId, user.id);
return teamUser && hasPermission(teamUser.role, PERMISSIONS.websiteTransferToTeam);
}
return false;
}
export async function canDeleteWebsite({ user }: Auth, websiteId: string) {
if (user.isAdmin) {
return true;
}
const website = await getWebsite(websiteId);
if (website.userId) {
return user.id === website.userId;
}
if (website.teamId) {
const teamUser = await getTeamUser(website.teamId, user.id);
return teamUser && hasPermission(teamUser.role, PERMISSIONS.websiteDelete);
}
return false;
}
export async function canViewReport(auth: Auth, report: Report) {
if (auth.user.isAdmin) {
return true;
}
if (auth.user.id == report.userId) {
return true;
}
return !!(await canViewWebsite(auth, report.websiteId));
}
export async function canUpdateReport({ user }: Auth, report: Report) {
if (user.isAdmin) {
return true;
}
return user.id == report.userId;
}
export async function canDeleteReport(auth: Auth, report: Report) {
return canUpdateReport(auth, report);
}
export async function canCreateTeam({ user, grant }: Auth) {
if (cloudMode) {
return !!grant?.find(a => a === PERMISSIONS.teamCreate);
}
if (user.isAdmin) {
return true;
}
return !!user;
}
export async function canViewTeam({ user }: Auth, teamId: string) {
if (user.isAdmin) {
return true;
}
return getTeamUser(teamId, user.id);
}
export async function canUpdateTeam({ user, grant }: Auth, teamId: string) {
if (user.isAdmin) {
return true;
}
if (cloudMode) {
return !!grant?.find(a => a === PERMISSIONS.teamUpdate);
}
const teamUser = await getTeamUser(teamId, user.id);
return teamUser && hasPermission(teamUser.role, PERMISSIONS.teamUpdate);
}
export async function canAddUserToTeam({ user, grant }: Auth) {
if (cloudMode) {
return !!grant?.find(a => a === PERMISSIONS.teamUpdate);
}
return user.isAdmin;
}
export async function canDeleteTeam({ user }: Auth, teamId: string) {
if (user.isAdmin) {
return true;
}
const teamUser = await getTeamUser(teamId, user.id);
return teamUser && hasPermission(teamUser.role, PERMISSIONS.teamDelete);
}
export async function canDeleteTeamUser({ user }: Auth, teamId: string, removeUserId: string) {
if (user.isAdmin) {
return true;
}
if (removeUserId === user.id) {
return true;
}
const teamUser = await getTeamUser(teamId, user.id);
return teamUser && hasPermission(teamUser.role, PERMISSIONS.teamUpdate);
}
export async function canCreateTeamWebsite({ user }: Auth, teamId: string) {
if (user.isAdmin) {
return true;
}
const teamUser = await getTeamUser(teamId, user.id);
return teamUser && hasPermission(teamUser.role, PERMISSIONS.websiteCreate);
}
export async function canViewAllTeams({ user }: Auth) {
return user.isAdmin;
}
export async function canCreateUser({ user }: Auth) {
return user.isAdmin;
}
export async function canViewUser({ user }: Auth, viewedUserId: string) {
if (user.isAdmin) {
return true;
}
return user.id === viewedUserId;
}
export async function canViewUsers({ user }: Auth) {
return user.isAdmin;
}
export async function canUpdateUser({ user }: Auth, viewedUserId: string) {
if (user.isAdmin) {
return true;
}
return user.id === viewedUserId;
}
export async function canDeleteUser({ user }: Auth) {
return user.isAdmin;
}
export async function hasPermission(role: string, permission: string | string[]) {
return ensureArray(permission).some(e => ROLE_PERMISSIONS[role]?.includes(e));
}