server/src/bl/thingsMngr.js
async function getThing(user, thingId, deletedStatus, userRole, userStatus, userVisibility) {

	if (!thingId)
		throw new utils.ErrorCustom(httpStatusCodes.BAD_REQUEST, "Thing's Id not valid", 37);

	let thing = await findThingById(thingId);
	if (!thing)
	{
		// Returns httpStatusCodes.UNAUTHORIZED to Reset Some Malicious Logon Access
		if (!user)
			throw new utils.ErrorCustom(httpStatusCodes.UNAUTHORIZED, "Unauthorized user", 38);
		throw new utils.ErrorCustom(httpStatusCodes.NOT_FOUND, "Thing not found", 39);
	}

	if (deletedStatus != thConstants.ThingDeletedStates.NoMatter && thing.deletedStatus != deletedStatus)
		throw new utils.ErrorCustom(httpStatusCodes.BAD_REQUEST, "Thing's Deletedstatus not valid", 40);

	if ((thing.publicReadClaims & thConstants.ThingUserReadClaims.AllClaims) != 0 
		|| (thing.publicChangeClaims & thConstants.ThingUserChangeClaims.AllClaims) != 0)
	{
		// This is a condition I do not remember why it was put on. I consider it important.
		// At this time it is commented why when I try to assign a pos to Thing
		// for an unnamed user who does not have a relationship with Thing the condition does not let me pass.
		// if (user == null && userRole == ThingUserRoles.NoMatter && userStatus == ThingUserStates.NoMatter && userVisibility == thConstants.ThingUserVisibility.NoMatter)
		return thing;
	}

	if (!user)
		throw new utils.ErrorCustom(httpStatusCodes.UNAUTHORIZED, "Unauthorized user", 41);

	// If User is Super Administrator returns Thing whatever filters(userRole) are passed as parameters
	if (user.isSuperAdministrator)
		return thing;

	if ((thing.everyoneReadClaims & thConstants.ThingUserReadClaims.AllClaims) != 0 
		|| (thing.everyoneChangeClaims & thConstants.ThingUserChangeClaims.AllClaims) != 0)
		return thing;

	var thingUserRights = getThingUserRights(user._id, user.username, thing);
	if (thingUserRights)
	{
		if (userStatus != thConstants.ThingUserStates.NoMatter && ((thingUserRights.userStatus & userStatus) == 0))
			throw new utils.ErrorCustom(httpStatusCodes.FORBIDDEN, "Unauthorized user", 42);

		if (userRole != thConstants.ThingUserRoles.NoMatter && ((thingUserRights.userRole & userRole) == 0))
			throw new utils.ErrorCustom(httpStatusCodes.FORBIDDEN, "Unauthorized user", 43);

		if (userVisibility != thConstants.ThingUserVisibility.NoMatter && ((thingUserRights.userVisibility & userVisibility) == 0))
			throw new utils.ErrorCustom(httpStatusCodes.FORBIDDEN, "Unauthorized user", 48);

		return thing;
	}

	throw new utils.ErrorCustom(httpStatusCodes.FORBIDDEN, "Unauthorized user", 44);
}
async function getThing(user, thingId, deletedStatus, userRole, userStatus, userVisibility) {

	if (!thingId)
		throw new utils.ErrorCustom(httpStatusCodes.BAD_REQUEST, "Thing's Id not valid", 37);

	let thing = await findThingById(thingId);
	if (!thing)
	{
		// Returns httpStatusCodes.UNAUTHORIZED to Reset Some Malicious Logon Access
		if (!user)
			throw new utils.ErrorCustom(httpStatusCodes.UNAUTHORIZED, "Unauthorized user", 38);
		throw new utils.ErrorCustom(httpStatusCodes.NOT_FOUND, "Thing not found", 39);
	}

	if (deletedStatus != thConstants.ThingDeletedStates.NoMatter && thing.deletedStatus != deletedStatus)
		throw new utils.ErrorCustom(httpStatusCodes.BAD_REQUEST, "Thing's Deletedstatus not valid", 40);

	if ((thing.publicReadClaims & thConstants.ThingUserReadClaims.AllClaims) != 0 
		|| (thing.publicChangeClaims & thConstants.ThingUserChangeClaims.AllClaims) != 0)
	{
		// This is a condition I do not remember why it was put on. I consider it important.
		// At this time it is commented why when I try to assign a pos to Thing
		// for an unnamed user who does not have a relationship with Thing the condition does not let me pass.
		// if (user == null && userRole == ThingUserRoles.NoMatter && userStatus == ThingUserStates.NoMatter && userVisibility == thConstants.ThingUserVisibility.NoMatter)
		return thing;
	}

	if (!user)
		throw new utils.ErrorCustom(httpStatusCodes.UNAUTHORIZED, "Unauthorized user", 41);

	// If User is Super Administrator returns Thing whatever filters(userRole) are passed as parameters
	if (user.isSuperAdministrator)
		return thing;

	if ((thing.everyoneReadClaims & thConstants.ThingUserReadClaims.AllClaims) != 0 
		|| (thing.everyoneChangeClaims & thConstants.ThingUserChangeClaims.AllClaims) != 0)
		return thing;

	var thingUserRights = getThingUserRights(user._id, user.username, thing);
	if (thingUserRights)
	{
		if (userStatus != thConstants.ThingUserStates.NoMatter && ((thingUserRights.userStatus & userStatus) == 0))
			throw new utils.ErrorCustom(httpStatusCodes.FORBIDDEN, "Unauthorized user", 42);

		if (userRole != thConstants.ThingUserRoles.NoMatter && ((thingUserRights.userRole & userRole) == 0))
			throw new utils.ErrorCustom(httpStatusCodes.FORBIDDEN, "Unauthorized user", 43);

		if (userVisibility != thConstants.ThingUserVisibility.NoMatter && ((thingUserRights.userVisibility & userVisibility) == 0))
			throw new utils.ErrorCustom(httpStatusCodes.FORBIDDEN, "Unauthorized user", 48);

		return thing;
	}

	throw new utils.ErrorCustom(httpStatusCodes.FORBIDDEN, "Unauthorized user", 44);
}
async function getThing ( user , thingId , deletedStatus , userRole , userStatus , userVisibility ) { if ( ! thingId ) throw new utils . ErrorCustom ( httpStatusCodes . BAD_REQUEST , "Thing's Id not valid" , 37 ) ; let thing = await findThingById ( thingId ) ; if ( ! thing ) { // Returns httpStatusCodes.UNAUTHORIZED to Reset Some Malicious Logon Access if ( ! user ) throw new utils . ErrorCustom ( httpStatusCodes . UNAUTHORIZED , "Unauthorized user" , 38 ) ; throw new utils . ErrorCustom ( httpStatusCodes . NOT_FOUND , "Thing not found" , 39 ) ; } if ( deletedStatus != thConstants . ThingDeletedStates . NoMatter && thing . deletedStatus != deletedStatus ) throw new utils . ErrorCustom ( httpStatusCodes . BAD_REQUEST , "Thing's Deletedstatus not valid" , 40 ) ; if ( ( thing . publicReadClaims & thConstants . ThingUserReadClaims . AllClaims ) != 0 || ( thing . publicChangeClaims & thConstants . ThingUserChangeClaims . AllClaims ) != 0 ) { // This is a condition I do not remember why it was put on. I consider it important. // At this time it is commented why when I try to assign a pos to Thing // for an unnamed user who does not have a relationship with Thing the condition does not let me pass. // if (user == null && userRole == ThingUserRoles.NoMatter && userStatus == ThingUserStates.NoMatter && userVisibility == thConstants.ThingUserVisibility.NoMatter) return thing ; } if ( ! user ) throw new utils . ErrorCustom ( httpStatusCodes . UNAUTHORIZED , "Unauthorized user" , 41 ) ; // If User is Super Administrator returns Thing whatever filters(userRole) are passed as parameters if ( user . isSuperAdministrator ) return thing ; if ( ( thing . everyoneReadClaims & thConstants . ThingUserReadClaims . AllClaims ) != 0 || ( thing . everyoneChangeClaims & thConstants . ThingUserChangeClaims . AllClaims ) != 0 ) return thing ; var thingUserRights = getThingUserRights ( user . _id , user . username , thing ) ; if ( thingUserRights ) { if ( userStatus != thConstants . ThingUserStates . NoMatter && ( ( thingUserRights . userStatus & userStatus ) == 0 ) ) throw new utils . ErrorCustom ( httpStatusCodes . FORBIDDEN , "Unauthorized user" , 42 ) ; if ( userRole != thConstants . ThingUserRoles . NoMatter && ( ( thingUserRights . userRole & userRole ) == 0 ) ) throw new utils . ErrorCustom ( httpStatusCodes . FORBIDDEN , "Unauthorized user" , 43 ) ; if ( userVisibility != thConstants . ThingUserVisibility . NoMatter && ( ( thingUserRights . userVisibility & userVisibility ) == 0 ) ) throw new utils . ErrorCustom ( httpStatusCodes . FORBIDDEN , "Unauthorized user" , 48 ) ; return thing ; } throw new utils . ErrorCustom ( httpStatusCodes . FORBIDDEN , "Unauthorized user" , 44 ) ; }
Not optimized using the CheckThingAccess function. It does not get optimized because staying so you have a capillary control of where it eventually snaps the error
Not optimized using the CheckThingAccess function . It does not get optimized because staying so you have a capillary control of where it eventually snaps the error