Function checkPermissions

server/api/ProjectRoute.js:28–80

(actionType = "readOwn")

  const teamController = new TeamController();

  const checkPermissions = (actionType = "readOwn") => {
    return async (req, res, next) => {
      const projectId = req.params.id;
      const teamId = req.params.team_id || req.body?.team_id;

      let teamRole;
      let project;

      if (projectId) {
        project = await projectController.findById(projectId);
        if (!project) return res.status(404).json({ message: "Project not found" });
      }

      if (teamId) {
        teamRole = await teamController.getTeamRole(teamId, req.user.id);
      } else {
        teamRole = await teamController.getTeamRole(project.team_id, req.user.id);
      }

      if (!teamRole?.role) {
        return res.status(403).json({ message: "Access denied" });
      }

      if (["teamOwner", "teamAdmin"].includes(teamRole.role)) {
        const permission = accessControl.can(teamRole.role)[actionType]("project");
        if (!permission.granted) {
          return res.status(403).json({ message: "Access denied" });
        }

        return next();
      }

      if (teamRole?.projects?.length > 0) {
        if (projectId) {
          const filteredProjects = teamRole.projects.filter((o) => `${o}` === `${projectId}`);
          if (filteredProjects.length === 0) {
            return res.status(403).json({ message: "Access denied" });
          }
        }

        const permission = accessControl.can(teamRole.role)[actionType]("project");
        if (!permission.granted) {
          return res.status(403).json({ message: "Access denied" });
        }

        req.user.projects = teamRole.projects;

        return next();
      }

      return res.status(403).json({ message: "Access denied" });
    };
  };

  /*
  ** [MASTER] Route to get all the projects