n8n/dist/permissions/checkAccess.js

n8n Workflow Automation Tool

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.userHasScope = void 0;
const typedi_1 = require("typedi");
const typeorm_1 = require("@n8n/typeorm");
const role_service_1 = require("../services/role.service");
const sharedCredentials_repository_1 = require("../databases/repositories/sharedCredentials.repository");
const sharedWorkflow_repository_1 = require("../databases/repositories/sharedWorkflow.repository");
const project_repository_1 = require("../databases/repositories/project.repository");
const n8n_workflow_1 = require("n8n-workflow");
const userHasScope = async (user, scopes, globalOnly, { credentialId, workflowId, projectId, }) => {
    if (user.hasGlobalScope(scopes, { mode: 'allOf' })) {
        return true;
    }
    else if (globalOnly) {
        return false;
    }
    const roleService = typedi_1.Container.get(role_service_1.RoleService);
    const projectRoles = roleService.rolesWithScope('project', scopes);
    const userProjectIds = (await typedi_1.Container.get(project_repository_1.ProjectRepository).find({
        where: {
            projectRelations: {
                userId: user.id,
                role: (0, typeorm_1.In)(projectRoles),
            },
        },
        select: ['id'],
    })).map((p) => p.id);
    if (credentialId) {
        const exists = await typedi_1.Container.get(sharedCredentials_repository_1.SharedCredentialsRepository).find({
            where: {
                projectId: (0, typeorm_1.In)(userProjectIds),
                credentialsId: credentialId,
                role: (0, typeorm_1.In)(roleService.rolesWithScope('credential', scopes)),
            },
        });
        if (!exists.length) {
            return false;
        }
        return true;
    }
    if (workflowId) {
        const exists = await typedi_1.Container.get(sharedWorkflow_repository_1.SharedWorkflowRepository).find({
            where: {
                projectId: (0, typeorm_1.In)(userProjectIds),
                workflowId,
                role: (0, typeorm_1.In)(roleService.rolesWithScope('workflow', scopes)),
            },
        });
        if (!exists.length) {
            return false;
        }
        return true;
    }
    if (projectId) {
        if (!userProjectIds.includes(projectId)) {
            return false;
        }
        return true;
    }
    throw new n8n_workflow_1.ApplicationError("@ProjectScope decorator was used but does not have a credentialId, workflowId, or projectId in it's URL parameters. This is likely an implementation error. If you're a developer, please check you're URL is correct or that this should be using @GlobalScope.");
};
exports.userHasScope = userHasScope;
//# sourceMappingURL=checkAccess.js.map