Class: ACLUtils

Defined in: service-core/src/security/ACLUtils.ts:22

Common utility functions for working with AccessControlList objects and validating user permissions.

Constructors

Constructor

new ACLUtils(): ACLUtils

Returns

ACLUtils

Properties

enabled

enabled: boolean = true

Defined in: service-core/src/security/ACLUtils.ts:24

Methods

checkRequestPerms()

checkRequestPerms(uid, user, req): Promise<boolean>

Defined in: service-core/src/security/ACLUtils.ts:90

Validates that the user has permission to perform the request operation against the URL path for the provided request. If ACLUtils has not been initialized or the acl datastore has not been configured then always returns true.

Parameters

uid

string

The uid of the access control list to verify against.

user

JWTUser | undefined

The user to validate.

req

HttpRequest

The request whose URL path and method will be verified.

Returns

Promise<boolean>

---

findACL()

findACL(entityId, parentUids?, reqCache?): Promise<AccessControlList | undefined>

Defined in: service-core/src/security/ACLUtils.ts:183

Retrieves the access control list with the associated identifier and populates the parent(s).

Parameters

entityId

string

The unique identifier of the ACL to retrieve.

parentUids?

string[] = []

The list of already found parent UIDs. This is used to break circular dependencies.

reqCache?

Map<string, AccessControlList | undefined>

Returns

Promise<AccessControlList | undefined>

---

getRecord()

getRecord(acl, user): ACLRecord | null

Defined in: service-core/src/security/ACLUtils.ts:464

Retrieves the first available record in the provided ACL associated with the provided user.

Parameters

acl

AccessControlList

The access control list that will be searched.

user

JWTUser | undefined

The user to find a record for.

Returns

ACLRecord | null

The ACL record associated with the given user if found, otherwise undefined.

---

hasPermission()

hasPermission(user, acl, action, reqCache?): Promise<boolean>

Defined in: service-core/src/security/ACLUtils.ts:147

Validates that the user has permission to perform the provided action using the given access control list.

Parameters

user

JWTUser | undefined

The user to validate permissions of.

acl

string | AccessControlList

The ACL or uid of an ACL to validate permissions against.

action

string

The action that the user desires permission for.

reqCache?

Map<string, AccessControlList | undefined>

Optional request-scoped cache (see findACL) to avoid redundant Redis/DB round trips when the same ACL uid — typically a shared parent — is checked repeatedly within one request, such as once per record when filtering a page of search results.

Returns

Promise<boolean>

true if the user has at least one of the permissions granted for the given entity, otherwise false.

---

populateParent()

populateParent(acl, parentUids?): Promise<void>

Defined in: service-core/src/security/ACLUtils.ts:484

Attempts to retrieve the parent access control list for the given ACL object.

Parameters

acl

AccessControlList

The access control list whose parents will be populated.

parentUids?

string[] = []

The list of already found parent UIDs. This is used to break circular dependencies.

Returns

Promise<void>

---

removeACL()

removeACL(uid): Promise<void>

Defined in: service-core/src/security/ACLUtils.ts:248

Deletes the ACL with the given identifier from the database.

Parameters

uid

string

The unique identifier of the ACL to remove.

Returns

Promise<void>

---

saveACL()

saveACL(acl): Promise<AccessControlList | null>

Defined in: service-core/src/security/ACLUtils.ts:338

Stores the given access control list into the ACL database.

Parameters

acl

AccessControlList

The ACL to store.

Returns

Promise<AccessControlList | null>

Returns the ACL that was stored in the database.

---

saveDefaultACL()

saveDefaultACL(acl): Promise<AccessControlList | null>

Defined in: service-core/src/security/ACLUtils.ts:404

Stores the given default access control list into the ACL database. A default ACL is a special type of ACL that is primarily defined and maintained within the code but allows for user-specific overrides. To accomplish this, the provided ACL is split in two. A new record is automatically created with the uid of the form default_<uid> that stores the exact record as provided by code. Then a second ACL record is created with the uid being that of what is passed as the argument. This second ACL is used to store user-defined overrides. As the default_<uid> record is always overwritten with the lastest version of the code, any user-defined changes made to it are lost on service restart.

Parameters

acl

AccessControlList

Returns

Promise<AccessControlList | null>