Function checkOwnership

common/models/role.js:350–397

(inst)

    }

    function checkOwnership(inst) {
      const ownerRelations = inst.constructor.settings.ownerRelations;
      // collecting related users
      const relWithUsers = [];
      for (const r in modelClass.relations) {
        const rel = modelClass.relations[r];
        // relation should be belongsTo and target a User based class
        if (rel.type !== 'belongsTo' || !isUserClass(rel.modelTo)) {
          continue;
        }

        // checking related user
        const relatedUser = rel.modelTo;
        const userModelName = relatedUser.modelName;
        const isMultipleUsers = _isMultipleUsers(relatedUser);
        // a relation can be considered for isOwner resolution if:
        // 1. the app has a single user model and principalType is 'USER'
        // 2. the app has multiple user models and principalType is the related user model name
        // In addition, if an array of relations if provided with the ownerRelations option,
        // then the given relation name is further checked against this array
        if ((!isMultipleUsers && principalType === Principal.USER) ||
            (isMultipleUsers && principalType === userModelName)) {
          debug('Checking relation %s to %s: %j', r, userModelName, rel);
          if (ownerRelations === true) {
            relWithUsers.push(r);
          } else if (Array.isArray(ownerRelations) && ownerRelations.indexOf(r) !== -1) {
            relWithUsers.push(r);
          }
        }
      }
      if (relWithUsers.length === 0) {
        debug('No matching belongsTo relation found for model %j and user: %j principalType: %j',
          modelId, userId, principalType);
        return callback(null, false);
      }

      // check related users: someSeries is used to avoid spamming the db
      async.someSeries(relWithUsers, processRelation, callback);

      function processRelation(r, cb) {
        inst[r](function processRelatedUser(err, user) {
          if (err || !user) return cb(err, false);

          debug('User found: %j (through %j)', user.id, r);
          cb(null, matches(user.id, userId));
        });
      }
    }

    // A helper function to check if the app user config is multiple users or
    // single user. It can be used with or without a reference user model.