Skip to content

Commit 07d1f5c

Browse files
hargatahargata
authored
Merge pull request #1146 from hargata/Hargata/565
add permissions at household level
2 parents d09d10a + 61bbfb8 commit 07d1f5c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+584
-337
lines changed

‎Controllers/APIController.cs‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ public IActionResult VehicleInfo(int vehicleId)
175175
List<Vehicle> vehicles = new List<Vehicle>();
176176
if (vehicleId != default)
177177
{
178-
if (_userLogic.UserCanEditVehicle(GetUserID(), vehicleId))
178+
if (_userLogic.UserCanEditVehicle(GetUserID(), vehicleId, HouseholdPermission.View))
179179
{
180180
vehicles.Add(_dataAccess.GetVehicleById(vehicleId));
181181
} else
@@ -351,7 +351,7 @@ public IActionResult DeletePlanRecord(int id)
351351
return Json(OperationResponse.Failed("Invalid Record Id"));
352352
}
353353
//security check.
354-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
354+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
355355
{
356356
Response.StatusCode = 401;
357357
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -419,7 +419,7 @@ public IActionResult UpdatePlanRecord(PlanRecordExportModel input)
419419
if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
420420
{
421421
//check if user has access to the vehicleId
422-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
422+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
423423
{
424424
Response.StatusCode = 401;
425425
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -567,7 +567,7 @@ public IActionResult DeleteServiceRecord(int id)
567567
return Json(OperationResponse.Failed("Invalid Record Id"));
568568
}
569569
//security check.
570-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
570+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
571571
{
572572
Response.StatusCode = 401;
573573
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -616,7 +616,7 @@ public IActionResult UpdateServiceRecord(GenericRecordExportModel input)
616616
if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
617617
{
618618
//check if user has access to the vehicleId
619-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
619+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
620620
{
621621
Response.StatusCode = 401;
622622
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -764,7 +764,7 @@ public IActionResult DeleteRepairRecord(int id)
764764
return Json(OperationResponse.Failed("Invalid Record Id"));
765765
}
766766
//security check.
767-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
767+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
768768
{
769769
Response.StatusCode = 401;
770770
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -813,7 +813,7 @@ public IActionResult UpdateRepairRecord(GenericRecordExportModel input)
813813
if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
814814
{
815815
//check if user has access to the vehicleId
816-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
816+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
817817
{
818818
Response.StatusCode = 401;
819819
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -961,7 +961,7 @@ public IActionResult DeleteUpgradeRecord(int id)
961961
return Json(OperationResponse.Failed("Invalid Record Id"));
962962
}
963963
//security check.
964-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
964+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
965965
{
966966
Response.StatusCode = 401;
967967
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1010,7 +1010,7 @@ public IActionResult UpdateUpgradeRecord(GenericRecordExportModel input)
10101010
if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
10111011
{
10121012
//check if user has access to the vehicleId
1013-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
1013+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
10141014
{
10151015
Response.StatusCode = 401;
10161016
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1180,7 +1180,7 @@ public IActionResult DeleteTaxRecord(int id)
11801180
return Json(OperationResponse.Failed("Invalid Record Id"));
11811181
}
11821182
//security check.
1183-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
1183+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
11841184
{
11851185
Response.StatusCode = 401;
11861186
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1223,7 +1223,7 @@ public IActionResult UpdateTaxRecord(TaxRecordExportModel input)
12231223
if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
12241224
{
12251225
//check if user has access to the vehicleId
1226-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
1226+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
12271227
{
12281228
Response.StatusCode = 401;
12291229
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1373,7 +1373,7 @@ public IActionResult DeleteOdometerRecord(int id)
13731373
return Json(OperationResponse.Failed("Invalid Record Id"));
13741374
}
13751375
//security check.
1376-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
1376+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
13771377
{
13781378
Response.StatusCode = 401;
13791379
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1416,7 +1416,7 @@ public IActionResult UpdateOdometerRecord(OdometerRecordExportModel input)
14161416
if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
14171417
{
14181418
//check if user has access to the vehicleId
1419-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
1419+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
14201420
{
14211421
Response.StatusCode = 401;
14221422
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1583,7 +1583,7 @@ public IActionResult DeleteGasRecord(int id)
15831583
return Json(OperationResponse.Failed("Invalid Record Id"));
15841584
}
15851585
//security check.
1586-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
1586+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
15871587
{
15881588
Response.StatusCode = 401;
15891589
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1629,7 +1629,7 @@ public IActionResult UpdateGasRecord(GasRecordExportModel input)
16291629
if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
16301630
{
16311631
//check if user has access to the vehicleId
1632-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
1632+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
16331633
{
16341634
Response.StatusCode = 401;
16351635
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1823,7 +1823,7 @@ public IActionResult UpdateReminderRecord(ReminderExportModel input)
18231823
if (existingRecord != null && existingRecord.Id == int.Parse(input.Id))
18241824
{
18251825
//check if user has access to the vehicleId
1826-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
1826+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
18271827
{
18281828
Response.StatusCode = 401;
18291829
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));
@@ -1861,7 +1861,7 @@ public IActionResult DeleteReminderRecord(int id)
18611861
return Json(OperationResponse.Failed("Invalid Record Id"));
18621862
}
18631863
//security check.
1864-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
1864+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
18651865
{
18661866
Response.StatusCode = 401;
18671867
return Json(OperationResponse.Failed("Access Denied, you don't have access to this vehicle."));

‎Controllers/AdminController.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,5 +104,11 @@ public IActionResult AddUserToHousehold(int parentUserId, string username)
104104
var result = _userLogic.AddUserToHousehold(parentUserId, username);
105105
return Json(result);
106106
}
107+
[HttpPost]
108+
public IActionResult ModifyUserHouseholdPermissions(int parentUserId, int childUserId, List<HouseholdPermission> permissions)
109+
{
110+
var result = _userLogic.UpdateUserHousehold(parentUserId, childUserId, permissions);
111+
return Json(result);
112+
}
107113
}
108114
}

‎Controllers/HomeController.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -302,6 +302,12 @@ public IActionResult RemoveUserFromHousehold(int userId)
302302
return Json(result);
303303
}
304304
[HttpPost]
305+
public IActionResult ModifyUserHouseholdPermissions(int userId, List<HouseholdPermission> permissions)
306+
{
307+
var result = _userLogic.UpdateUserHousehold(GetUserID(), userId, permissions);
308+
return Json(result);
309+
}
310+
[HttpPost]
305311
public IActionResult AddUserToHousehold(string username)
306312
{
307313
var result = _userLogic.AddUserToHousehold(GetUserID(), username);

‎Controllers/MigrationController.cs‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ private void InitializeTables(NpgsqlDataSource conn)
5555
"CREATE TABLE IF NOT EXISTS app.extrafields (id INT primary key, data jsonb not null)",
5656
"CREATE TABLE IF NOT EXISTS app.inspectionrecords (id INT GENERATED BY DEFAULT AS IDENTITY primary key, vehicleId INT not null, data jsonb not null)",
5757
"CREATE TABLE IF NOT EXISTS app.inspectionrecordtemplates (id INT GENERATED BY DEFAULT AS IDENTITY primary key, vehicleId INT not null, data jsonb not null)",
58-
"CREATE TABLE IF NOT EXISTS app.userhouseholdrecords (parentUserId INT, childUserId INT, PRIMARY KEY(parentUserId, childUserId))"
58+
"CREATE TABLE IF NOT EXISTS app.userhouseholdrecords (parentUserId INT, childUserId INT, data jsonb not null, PRIMARY KEY(parentUserId, childUserId))"
5959
};
6060
foreach(string cmd in cmds)
6161
{
@@ -457,20 +457,13 @@ public IActionResult Export()
457457
table.Upsert(record);
458458
};
459459
}
460-
cmd = $"SELECT parentUserId, childUserId FROM app.userhouseholdrecords";
460+
cmd = $"SELECT data FROM app.userhouseholdrecords";
461461
using (var ctext = pgDataSource.CreateCommand(cmd))
462462
{
463463
using (NpgsqlDataReader reader = ctext.ExecuteReader())
464464
while (reader.Read())
465465
{
466-
UserHousehold result = new UserHousehold()
467-
{
468-
Id = new HouseholdAccess
469-
{
470-
ParentUserId = int.Parse(reader["parentUserId"].ToString()),
471-
ChildUserId = int.Parse(reader["childUserId"].ToString())
472-
}
473-
};
466+
UserHousehold result = JsonSerializer.Deserialize<UserHousehold>(reader["data"] as string);
474467
userhouseholdrecords.Add(result);
475468
}
476469
}
@@ -853,11 +846,12 @@ public IActionResult Import(string fileName)
853846
;
854847
foreach (var record in userhouseholdrecords)
855848
{
856-
string cmd = $"INSERT INTO app.userhouseholdrecords (parentUserId, childUserId) VALUES(@parentUserId, @childUserId)";
849+
string cmd = $"INSERT INTO app.userhouseholdrecords (parentUserId, childUserId, data) VALUES(@parentUserId, @childUserId, CAST(@data AS jsonb))";
857850
using (var ctext = pgDataSource.CreateCommand(cmd))
858851
{
859852
ctext.Parameters.AddWithValue("parentUserId", record.Id.ParentUserId);
860853
ctext.Parameters.AddWithValue("childUserId", record.Id.ChildUserId);
854+
ctext.Parameters.AddWithValue("data", JsonSerializer.Serialize(record));
861855
ctext.ExecuteNonQuery();
862856
}
863857
}

‎Controllers/Vehicle/GasController.cs‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,9 @@ public IActionResult GetGasRecordsByVehicleId(int vehicleId)
3636
public IActionResult SaveGasRecordToVehicleId(GasRecordInput gasRecord)
3737
{
3838
//security check.
39-
if (!_userLogic.UserCanEditVehicle(GetUserID(), gasRecord.VehicleId))
39+
if (!_userLogic.UserCanEditVehicle(GetUserID(), gasRecord.VehicleId, HouseholdPermission.Edit))
4040
{
41-
return Json(false);
41+
return Json(OperationResponse.Failed("Access Denied"));
4242
}
4343
gasRecord.Files = gasRecord.Files.Select(x => { return new UploadedFiles { Name = x.Name, Location = _fileHelper.MoveFileFromTemp(x.Location, "documents/") }; }).ToList();
4444
var convertedRecord = gasRecord.ToGasRecord();
@@ -58,7 +58,7 @@ public IActionResult SaveGasRecordToVehicleId(GasRecordInput gasRecord)
5858
Files = StaticHelper.CreateAttachmentFromRecord(ImportMode.GasRecord, convertedRecord.Id, $"Gas Record - {gasRecord.Mileage.ToString()}")
5959
});
6060
}
61-
return Json(result);
61+
return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
6262
}
6363
[TypeFilter(typeof(CollaboratorFilter))]
6464
[HttpGet]
@@ -74,7 +74,7 @@ public IActionResult GetGasRecordForEditById(int gasRecordId)
7474
{
7575
var result = _gasRecordDataAccess.GetGasRecordById(gasRecordId);
7676
//security check.
77-
if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId))
77+
if (!_userLogic.UserCanEditVehicle(GetUserID(), result.VehicleId, HouseholdPermission.View))
7878
{
7979
return Redirect("/Error/Unauthorized");
8080
}
@@ -104,20 +104,20 @@ public IActionResult GetGasRecordForEditById(int gasRecordId)
104104
};
105105
return PartialView("Gas/_GasModal", viewModel);
106106
}
107-
private bool DeleteGasRecordWithChecks(int gasRecordId)
107+
private OperationResponse DeleteGasRecordWithChecks(int gasRecordId)
108108
{
109109
var existingRecord = _gasRecordDataAccess.GetGasRecordById(gasRecordId);
110110
//security check.
111-
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId))
111+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Delete))
112112
{
113-
return false;
113+
return OperationResponse.Failed("Access Denied");
114114
}
115115
var result = _gasRecordDataAccess.DeleteGasRecordById(existingRecord.Id);
116116
if (result)
117117
{
118118
StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.FromGasRecord(existingRecord, "gasrecord.delete", User.Identity.Name));
119119
}
120-
return result;
120+
return OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage);
121121
}
122122
[HttpPost]
123123
public IActionResult DeleteGasRecordById(int gasRecordId)
@@ -163,6 +163,11 @@ public IActionResult SaveMultipleGasRecords(GasRecordEditModel editModel)
163163
foreach (int recordId in editModel.RecordIds)
164164
{
165165
var existingRecord = _gasRecordDataAccess.GetGasRecordById(recordId);
166+
//security check
167+
if (!_userLogic.UserCanEditVehicle(GetUserID(), existingRecord.VehicleId, HouseholdPermission.Edit))
168+
{
169+
return Json(OperationResponse.Failed("Access Denied"));
170+
}
166171
if (dateIsEdited)
167172
{
168173
existingRecord.Date = editModel.EditRecord.Date;
@@ -205,7 +210,7 @@ public IActionResult SaveMultipleGasRecords(GasRecordEditModel editModel)
205210
}
206211
result = _gasRecordDataAccess.SaveGasRecordToVehicle(existingRecord);
207212
}
208-
return Json(result);
213+
return Json(OperationResponse.Conditional(result, string.Empty, StaticHelper.GenericErrorMessage));
209214
}
210215
}
211216
}

‎Controllers/Vehicle/ImportController.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ public IActionResult GenerateCsvSample(ImportMode mode)
186186
return Json(OperationResponse.Failed($"An error has occurred while generating CSV sample: {ex.Message}"));
187187
}
188188
}
189-
[TypeFilter(typeof(CollaboratorFilter))]
189+
[TypeFilter(typeof(CollaboratorFilter), Arguments = new object[] { false, true, HouseholdPermission.View })]
190190
[HttpGet]
191191
public IActionResult ExportFromVehicleToCsv(int vehicleId, ImportMode mode)
192192
{
@@ -408,9 +408,9 @@ public IActionResult ExportFromVehicleToCsv(int vehicleId, ImportMode mode)
408408
}
409409
return Json($"/{fileNameToExport}");
410410
}
411-
return Json(false);
411+
return Json(OperationResponse.Failed(StaticHelper.GenericErrorMessage));
412412
}
413-
[TypeFilter(typeof(CollaboratorFilter))]
413+
[TypeFilter(typeof(CollaboratorFilter), Arguments = new object[] { false, true, HouseholdPermission.Edit })]
414414
[HttpPost]
415415
public IActionResult ImportToVehicleIdFromCsv(int vehicleId, ImportMode mode, string fileName)
416416
{

0 commit comments

Comments
 (0)