Function checkFilterAccess

server/api/ChartRoute.js:283–402

(req, res, next)

  };

  const checkFilterAccess = async (req, res, next) => {
    try {
      const project = await projectController.findById(req.params.project_id);
      if (!project) {
        return res.status(404).json({ message: "Project not found" });
      }

      const chart = await chartController.findById(req.params.chart_id);
      if (!chart) {
        return res.status(404).json({ message: "Chart not found" });
      }

      if (`${chart.project_id}` !== `${project.id}`) {
        return res.status(403).json({ message: "Access denied" });
      }

      if (req.user?.id) {
        const teamRole = await teamController.getTeamRole(project.team_id, req.user.id);
        if (teamRole?.role) {
          req.user.teamRole = teamRole;

          const permission = accessControl.can(teamRole.role).readOwn("chart");
          if (permission.granted) {
            if (["teamOwner", "teamAdmin"].includes(teamRole.role)) {
              return next();
            }

            if (teamRole?.projects?.length > 0) {
              const hasProjectAccess = teamRole.projects.some((projectId) => `${projectId}` === `${project.id}`);
              if (hasProjectAccess || project.ghost) {
                req.user.projects = teamRole.projects;
                return next();
              }
            }
          }
        }
      }

      const snapshotAccessToken = req.query.accessToken || req.body?.accessToken;
      if (snapshotAccessToken) {
        try {
          const decodedAccessToken = jwt.verify(snapshotAccessToken, settings.encryptionKey);
          if (`${decodedAccessToken?.project_id}` === `${project.id}`) {
            return next();
          }
        } catch (error) {
          // Continue to other auth mechanisms.
        }
      }

      const shareToken = req.query.token || req.body?.token;
      if (!shareToken) {
        const passwordInput = req.query.pass || req.headers.pass || req.body?.password;
        const allowPublicAccess = await isPublicProjectFilterAllowed(project, chart, passwordInput);
        if (allowPublicAccess) {
          return next();
        }
        return res.status(401).json({ message: "Not authorized" });