Start to make ACL to work

common/models/category.json

@@ -27,6 +27,31 @@
       "foreignKey": "id"
     }
   },
-  "acls": [],
+  "acls": [
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    },
+    {
+      "accessType": "READ",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "admin",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "count",
+      "principalType": "ROLE",
+      "principalId": "$authenticated",
+      "permission": "ALLOW"
+    }
+  ],
   "methods": {}
 }

common/models/end_user.json

@@ -36,6 +36,31 @@
       "foreignKey": "id"
     }
   },
-  "acls": [],
+  "acls": [
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    },
+    {
+      "accessType": "READ",
+      "principalType": "ROLE",
+      "principalId": "$owner",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "EXECUTE",
+      "principalType": "ROLE",
+      "principalId": "$owner",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "admin",
+      "permission": "ALLOW"
+    }
+  ],
   "methods": {}
 }

common/models/geolocation.json

@@ -17,17 +17,17 @@
     },
     "latitude": {
       "type": "number",
+      "required": true,
       "postgresql": {
         "dataType": "float"
-      },
-      "required": true
+      }
     },
     "longitude": {
       "type": "number",
+      "required": true,
       "postgresql": {
         "dataType": "float"
-      },
-      "required": true
+      }
     },
     "android_id": {
       "type": "string"
@@ -56,6 +56,31 @@
       "foreignKey": "id"
     }
   },
-  "acls": [],
+  "acls": [
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    },
+    {
+      "accessType": "WRITE",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "READ",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "admin",
+      "permission": "ALLOW"
+    }
+  ],
   "methods": {}
 }

server/boot/access-control.js

@@ -43,24 +43,32 @@ module.exports = function(app) {
         if (!userId) {
           return reject();
         }
+        else{
+            console.log("USER ID ::",userId)
+        }
+    
+        console.log("ROLE ::", role)
+
+        console.log("CONTEXT MODEL ::", context.model)
+        console.log("CONTEXT ID ::", context.id)
   
         // check if userId is in team table for the given project id
-        context.model.findById(context.modelId, function(err, model) {
-            if (err || !model)
-                return reject();
+        context.model.findById(userId, function(err, model) {
 
-            var EndUser = app.models.EndUser;
-            EndUser.count({
-                ownerId: model.ownerId,
-                memberId: userId
-            }, function(err, count) {
-                if (err) {
-                    console.log(err);
-                    return cb(null, false);
-                }
+            app.models.EndUser.findById(userId, function(err2, user){
+                console.log("ERR ::", err)
+                console.log("ERR 2::", err2)
+                console.log("MODEL ::", model)
 
-                cb(null, count > 0); // true = is a team member
-            });
+                console.log("ENDUSER MODEL", user)
+
+                if (err || err2 || !user || !model)
+                    return reject();
+                if(user.permission !== role)
+                    return reject();
+                else 
+                    return cb(null,true)
+            })            
         });
     });
 

server/boot/authentication.js

@@ -2,5 +2,5 @@
 
 module.exports = function enableAuthentication(server) {
   // enable authentication
-  // server.enableAuth();
+  server.enableAuth();
 };