Function checkPermissions

server/api/ChartRoute.js:179–250

(actionType = "readOwn", entity = "chart")

  };

  const checkPermissions = (actionType = "readOwn", entity = "chart") => {
    return async (req, res, next) => {
      const projectId = req.params.project_id || req.body?.project_id;
      const chartId = req.params.chart_id || req.body?.chart_id;

      const project = await projectController.findById(projectId);
      if (!project) {
        return res.status(404).json({ message: "Project not found" });
      }

      const teamRole = await teamController.getTeamRole(project.team_id, req.user.id);

      req.user.teamRole = teamRole;

      if (!teamRole?.role) {
        return res.status(403).json({ message: "Access denied" });
      }

      // check if the chart is part of the right project
      if (chartId && projectId) {
        const chart = await chartController.findById(req.params.chart_id);
        if (chart.project_id.toString() !== projectId.toString()) {
          return res.status(403).json({ message: "Access denied" });
        }
      }

      // check if the alert is part of a chart in the right project
      if (chartId && req.params.alert_id) {
        const alert = await alertController.findById(req.params.alert_id);
        if (alert.chart_id.toString() !== chartId.toString()) {
          return res.status(403).json({ message: "Access denied" });
        }
      }

      // check if the cdc is part of a chart in the right project
      if (chartId && req.params.cdc_id) {
        const cdc = await db.ChartDatasetConfig.findByPk(req.params.cdc_id);
        if (cdc.chart_id.toString() !== chartId.toString()) {
          return res.status(403).json({ message: "Access denied" });
        }
      }

      if (["teamOwner", "teamAdmin"].includes(teamRole.role)) {
        const permission = accessControl.can(teamRole.role)[actionType](entity);
        if (!permission.granted) {
          return res.status(403).json({ message: "Access denied" });
        }

        return next();
      }

      if (teamRole?.projects?.length > 0) {
        if (projectId) {
          const filteredProjects = teamRole.projects.filter((o) => `${o}` === `${projectId}`);
          if (filteredProjects.length === 0 && !project.ghost) {
            return res.status(403).json({ message: "Access denied" });
          }
        }