From 135ab4fb2011bc1407ce06c7012c361ab3f78362 Mon Sep 17 00:00:00 2001 From: Miroslav Prasil Date: Wed, 30 May 2018 17:12:18 +0100 Subject: [PATCH] Clean up organizations.rs with new request guards --- src/api/core/organizations.rs | 120 ++++++---------------------------- 1 file changed, 21 insertions(+), 99 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 4cba294..bf14189 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -55,7 +55,7 @@ fn create_organization(headers: Headers, data: Json, conn: DbConn) -> J } #[post("/organizations//delete", data = "")] -fn delete_organization(org_id: String, data: Json, headers: Headers, conn: DbConn) -> EmptyResult { +fn delete_organization(org_id: String, data: Json, headers: OwnerHeaders, conn: DbConn) -> EmptyResult { let data: PasswordData = data.into_inner(); let password_hash = data.masterPasswordHash; @@ -63,15 +63,6 @@ fn delete_organization(org_id: String, data: Json, headers: Header err!("Invalid password") } - let org_user = match UserOrganization::find_by_user_and_org(&headers.user.uuid, &org_id, &conn) { - Some(user) => user, - None => err!("The current user isn't member of the organization") - }; - - if org_user.type_ != UserOrgType::Owner as i32 { - err!("Only owner is able to delete organization") - } - match Organization::find_by_uuid(&org_id, &conn) { None => err!("Organization not found"), Some(org) => match org.delete(&conn) { @@ -90,16 +81,9 @@ fn get_organization(org_id: String, headers: OwnerHeaders, conn: DbConn) -> Json } #[post("/organizations/", data = "")] -fn post_organization(org_id: String, headers: Headers, data: Json, conn: DbConn) -> JsonResult { +fn post_organization(org_id: String, headers: OwnerHeaders, data: Json, conn: DbConn) -> JsonResult { let data: OrganizationUpdateData = data.into_inner(); - match UserOrganization::find_by_user_and_org( &headers.user.uuid, &org_id, &conn) { - None => err!("User not in Organization or Organization doesn't exist"), - Some(org_user) => if org_user.type_ != 0 { // not owner - err!("Only owner can change Organization details") - } - }; - let mut org = match Organization::find_by_uuid(&org_id, &conn) { Some(organization) => organization, None => err!("Can't find organization details") @@ -141,18 +125,9 @@ fn get_org_collections(org_id: String, headers: AdminHeaders, conn: DbConn) -> J } #[post("/organizations//collections", data = "")] -fn post_organization_collections(org_id: String, headers: Headers, data: Json, conn: DbConn) -> JsonResult { +fn post_organization_collections(org_id: String, headers: AdminHeaders, data: Json, conn: DbConn) -> JsonResult { let data: NewCollectionData = data.into_inner(); - let org_user = match UserOrganization::find_by_user_and_org( &headers.user.uuid, &org_id, &conn) { - None => err!("User not in Organization or Organization doesn't exist"), - Some(org_user) => if org_user.type_ == UserOrgType::User as i32 { - err!("Only Organization owner and admin can add Collection") - } else { - org_user - } - }; - let org = match Organization::find_by_uuid(&org_id, &conn) { Some(organization) => organization, None => err!("Can't find organization details") @@ -166,16 +141,9 @@ fn post_organization_collections(org_id: String, headers: Headers, data: Json/collections/", data = "")] -fn post_organization_collection_update(org_id: String, col_id: String, headers: Headers, data: Json, conn: DbConn) -> JsonResult { +fn post_organization_collection_update(org_id: String, col_id: String, headers: AdminHeaders, data: Json, conn: DbConn) -> JsonResult { let data: NewCollectionData = data.into_inner(); - match UserOrganization::find_by_user_and_org( &headers.user.uuid, &org_id, &conn) { - None => err!("User not in Organization or Organization doesn't exist"), - Some(org_user) => if org_user.type_ > 1 { // not owner or admin - err!("Only Organization owner and admin can update Collection") - } - }; - let org = match Organization::find_by_uuid(&org_id, &conn) { Some(organization) => organization, None => err!("Can't find organization details") @@ -227,23 +195,16 @@ struct DeleteCollectionData { } #[post("/organizations//collections//delete", data = "")] -fn post_organization_collection_delete(org_id: String, col_id: String, headers: Headers, data: Json, conn: DbConn) -> EmptyResult { - match UserOrganization::find_by_user_and_org(&headers.user.uuid, &org_id, &conn) { - None => err!("Not a member of Organization"), - Some(user_org) => if user_org.has_full_access() { - match Collection::find_by_uuid(&col_id, &conn) { - None => err!("Collection not found"), - Some(collection) => if collection.org_uuid == org_id { - match collection.delete(&conn) { - Ok(()) => Ok(()), - Err(_) => err!("Failed deleting collection") - } - } else { - err!("Collection and Organization id do not match") - } +fn post_organization_collection_delete(org_id: String, col_id: String, headers: AdminHeaders, data: Json, conn: DbConn) -> EmptyResult { + match Collection::find_by_uuid(&col_id, &conn) { + None => err!("Collection not found"), + Some(collection) => if collection.org_uuid == org_id { + match collection.delete(&conn) { + Ok(()) => Ok(()), + Err(_) => err!("Failed deleting collection") } } else { - err!("Not enought rights to delete Collection") + err!("Collection and Organization id do not match") } } } @@ -329,25 +290,16 @@ struct InviteData { } #[post("/organizations//users/invite", data = "")] -fn send_invite(org_id: String, data: Json, headers: Headers, conn: DbConn) -> EmptyResult { +fn send_invite(org_id: String, data: Json, headers: AdminHeaders, conn: DbConn) -> EmptyResult { let data: InviteData = data.into_inner(); - let current_user = match UserOrganization::find_by_user_and_org(&headers.user.uuid, &org_id, &conn) { - Some(user) => user, - None => err!("The current user isn't member of the organization") - }; - - if current_user.type_ == UserOrgType::User as i32 { - err!("Users can't invite other people. Ask an Admin or Owner") - } - let new_type = match UserOrgType::from_str(&data.type_.to_string()) { Some(new_type) => new_type as i32, None => err!("Invalid type") }; if new_type != UserOrgType::User as i32 && - current_user.type_ != UserOrgType::Owner as i32 { + headers.org_user_type != UserOrgType::Owner as i32 { err!("Only Owners can invite Admins or Owners") } @@ -389,24 +341,14 @@ fn send_invite(org_id: String, data: Json, headers: Headers, conn: D } #[post("/organizations//users//confirm", data = "")] -fn confirm_invite(org_id: String, user_id: String, data: Json, headers: Headers, conn: DbConn) -> EmptyResult { - let current_user = match UserOrganization::find_by_user_and_org( - &headers.user.uuid, &org_id, &conn) { - Some(user) => user, - None => err!("The current user isn't member of the organization") - }; - - if current_user.type_ == UserOrgType::User as i32 { - err!("Users can't confirm other people. Ask an Admin or Owner") - } - +fn confirm_invite(org_id: String, user_id: String, data: Json, headers: AdminHeaders, conn: DbConn) -> EmptyResult { let mut user_to_confirm = match UserOrganization::find_by_uuid(&user_id, &conn) { Some(user) => user, None => err!("User to confirm isn't member of the organization") }; if user_to_confirm.type_ != UserOrgType::User as i32 && - current_user.type_ != UserOrgType::Owner as i32 { + headers.org_user_type != UserOrgType::Owner as i32 { err!("Only Owners can confirm Admins or Owners") } @@ -445,15 +387,9 @@ struct EditUserData { } #[post("/organizations//users/", data = "", rank = 1)] -fn edit_user(org_id: String, user_id: String, data: Json, headers: Headers, conn: DbConn) -> EmptyResult { +fn edit_user(org_id: String, user_id: String, data: Json, headers: AdminHeaders, conn: DbConn) -> EmptyResult { let data: EditUserData = data.into_inner(); - let current_user = match UserOrganization::find_by_user_and_org( - &headers.user.uuid, &org_id, &conn) { - Some(user) => user, - None => err!("The current user isn't member of the organization") - }; - let new_type = match UserOrgType::from_str(&data.type_.to_string()) { Some(new_type) => new_type as i32, None => err!("Invalid type") @@ -464,17 +400,13 @@ fn edit_user(org_id: String, user_id: String, data: Json, headers: None => err!("The specified user isn't member of the organization") }; - if current_user.type_ == UserOrgType::User as i32 { - err!("Users can't edit users. Ask an Admin or Owner") - } - if new_type != UserOrgType::User as i32 && - current_user.type_ != UserOrgType::Owner as i32 { + headers.org_user_type != UserOrgType::Owner as i32 { err!("Only Owners can grant Admin or Owner type") } if user_to_edit.type_ != UserOrgType::User as i32 && - current_user.type_ != UserOrgType::Owner as i32 { + headers.org_user_type != UserOrgType::Owner as i32 { err!("Only Owners can edit Admin or Owner") } @@ -523,24 +455,14 @@ fn edit_user(org_id: String, user_id: String, data: Json, headers: } #[post("/organizations//users//delete")] -fn delete_user(org_id: String, user_id: String, headers: Headers, conn: DbConn) -> EmptyResult { - let current_user = match UserOrganization::find_by_user_and_org( - &headers.user.uuid, &org_id, &conn) { - Some(user) => user, - None => err!("The current user isn't member of the organization") - }; - - if current_user.type_ == UserOrgType::User as i32 { - err!("Users can't delete other people. Ask an Admin or Owner") - } - +fn delete_user(org_id: String, user_id: String, headers: AdminHeaders, conn: DbConn) -> EmptyResult { let user_to_delete = match UserOrganization::find_by_uuid(&user_id, &conn) { Some(user) => user, None => err!("User to delete isn't member of the organization") }; if user_to_delete.type_ != UserOrgType::User as i32 && - current_user.type_ != UserOrgType::Owner as i32 { + headers.org_user_type != UserOrgType::Owner as i32 { err!("Only Owners can delete Admins or Owners") }