CoreID/app/routing/middleware/api/Permission.middleware.js

const { Middleware } = require('libflitter')

class PermissionMiddleware extends Middleware {
    static get services() {
        return [...super.services, 'models', 'activity']
    }

    async test(req, res, next, { check }) {
        const Policy = this.models.get('iam:Policy')

        if ( !req.additional_api_log_data ) req.additional_api_log_data = {}
        req.additional_api_log_data.permission_check = check

        // If the request was authorized using an OAuth2 bearer token,
        // make sure the associated client has permission to access this endpoint.
        if ( req?.oauth?.client ) {
            if ( !req.oauth.client.can(check) ) {
                const reason = 'oauth-permission-fail'
                const fail_activity = await this.activity.api_access_denial({
                    req,
                    reason,
                    check,
                    oauth_client_id: req.oauth.client.uuid,
                })

                req.additional_api_log_data.permission_check_succeeded = false
                req.additional_api_log_data.permission_check_activity_id = fail_activity.id

                return res.status(401)
                    .message('Insufficient permissions (OAuth2 Client).')
                    .api()
            }

            req.additional_api_log_data.permission_check_succeeded = true

            // If the oauth2 client has this permission, then allow the request to continue,
            // even if the user does not.
            // OAuth2Clients need to be able to query users via the API.
            return next()
        }

        const policy_denied = await Policy.check_user_denied(req.user, check)
        const policy_access = await Policy.check_user_access(req.user, check)

        // Make sure the user has permission
        if ( policy_denied || (!req.user.can(check) && !policy_access) ) {
            // Record the failed API access
            const reason = policy_denied ? 'iam-denial' : (!req.user.can(check) ? 'user-permission-fail' : 'iam-not-granted')
            const fail_activity = await this.activity.api_access_denial({ req, reason, check })

            req.additional_api_log_data.permission_check_succeeded = false
            req.additional_api_log_data.permission_check_reason = reason
            req.additional_api_log_data.permission_check_activity_id = fail_activity.id

            return res.status(401)
                .message('Insufficient permissions.')
                .api()
        }

        req.additional_api_log_data.permission_check_succeeded = true
        return next()
    }
}

module.exports = exports = PermissionMiddleware