Ryan/docmost
1
0
Fork 0
mirror of https://github.com/docmost/docmost.git synced 2026-07-27 13:54:45 +10:00
Code Issues Packages Projects Releases Wiki Activity

refactor(base): use PageAccessService for BaseRowController

Browse Source
This commit is contained in:
Philipinho
2026-04-27 01:28:59 +01:00
parent 43cf1665f5
commit 2e7fe5bbb4
1 changed files with 19 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/server/src/core/base/controllers/base-row.controller.ts
+19 -48
View File
@@ -1,7 +1,6 @@
import { import {
Body, Body,
Controller, Controller,
ForbiddenException,
HttpCode, HttpCode,
HttpStatus, HttpStatus,
NotFoundException, NotFoundException,
@@ -25,11 +24,7 @@ import { AuthWorkspace } from '../../../common/decorators/auth-workspace.decorat
import { JwtAuthGuard } from '../../../common/guards/jwt-auth.guard'; import { JwtAuthGuard } from '../../../common/guards/jwt-auth.guard';
import { PaginationOptions } from '@docmost/db/pagination/pagination-options'; import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
import { User, Workspace } from '@docmost/db/types/entity.types'; import { User, Workspace } from '@docmost/db/types/entity.types';
import { import { PageAccessService } from '../../page/page-access/page-access.service';
SpaceCaslAction,
SpaceCaslSubject,
} from '../../casl/interfaces/space-ability.type';
import SpaceAbilityFactory from '../../casl/abilities/space-ability.factory';
@UseGuards(JwtAuthGuard) @UseGuards(JwtAuthGuard)
@Controller('bases/rows') @Controller('bases/rows')
@@ -37,7 +32,7 @@ export class BaseRowController {
constructor( constructor(
private readonly baseRowService: BaseRowService, private readonly baseRowService: BaseRowService,
private readonly baseRepo: BaseRepo, private readonly baseRepo: BaseRepo,
private readonly spaceAbility: SpaceAbilityFactory, private readonly pageAccessService: PageAccessService,
) {} ) {}
@HttpCode(HttpStatus.OK) @HttpCode(HttpStatus.OK)
@@ -47,15 +42,12 @@ export class BaseRowController {
@AuthUser() user: User, @AuthUser() user: User,
@AuthWorkspace() workspace: Workspace, @AuthWorkspace() workspace: Workspace,
) { ) {
const base = await this.baseRepo.findById(dto.baseId); const base = await this.baseRepo.findById(dto.pageId);
if (!base) { if (!base) {
throw new NotFoundException('Base not found'); throw new NotFoundException('Base not found');
} }
const ability = await this.spaceAbility.createForUser(user, base.spaceId); await this.pageAccessService.validateCanEdit(base, user);
if (ability.cannot(SpaceCaslAction.Create, SpaceCaslSubject.Base)) {
throw new ForbiddenException();
}
return this.baseRowService.create(user.id, workspace.id, dto); return this.baseRowService.create(user.id, workspace.id, dto);
} }
@@ -67,17 +59,14 @@ export class BaseRowController {
@AuthUser() user: User, @AuthUser() user: User,
@AuthWorkspace() workspace: Workspace, @AuthWorkspace() workspace: Workspace,
) { ) {
const base = await this.baseRepo.findById(dto.baseId); const base = await this.baseRepo.findById(dto.pageId);
if (!base) { if (!base) {
throw new NotFoundException('Base not found'); throw new NotFoundException('Base not found');
} }
const ability = await this.spaceAbility.createForUser(user, base.spaceId); await this.pageAccessService.validateCanView(base, user);
if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Base)) {
throw new ForbiddenException();
}
return this.baseRowService.getRowInfo(dto.rowId, dto.baseId, workspace.id); return this.baseRowService.getRowInfo(dto.rowId, dto.pageId, workspace.id);
} }
@HttpCode(HttpStatus.OK) @HttpCode(HttpStatus.OK)
@@ -87,15 +76,12 @@ export class BaseRowController {
@AuthUser() user: User, @AuthUser() user: User,
@AuthWorkspace() workspace: Workspace, @AuthWorkspace() workspace: Workspace,
) { ) {
const base = await this.baseRepo.findById(dto.baseId); const base = await this.baseRepo.findById(dto.pageId);
if (!base) { if (!base) {
throw new NotFoundException('Base not found'); throw new NotFoundException('Base not found');
} }
const ability = await this.spaceAbility.createForUser(user, base.spaceId); await this.pageAccessService.validateCanEdit(base, user);
if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Base)) {
throw new ForbiddenException();
}
return this.baseRowService.update(dto, workspace.id, user.id); return this.baseRowService.update(dto, workspace.id, user.id);
} }
@@ -107,15 +93,12 @@ export class BaseRowController {
@AuthUser() user: User, @AuthUser() user: User,
@AuthWorkspace() workspace: Workspace, @AuthWorkspace() workspace: Workspace,
) { ) {
const base = await this.baseRepo.findById(dto.baseId); const base = await this.baseRepo.findById(dto.pageId);
if (!base) { if (!base) {
throw new NotFoundException('Base not found'); throw new NotFoundException('Base not found');
} }
const ability = await this.spaceAbility.createForUser(user, base.spaceId); await this.pageAccessService.validateCanEdit(base, user);
if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Base)) {
throw new ForbiddenException();
}
await this.baseRowService.delete(dto, workspace.id, user.id); await this.baseRowService.delete(dto, workspace.id, user.id);
} }
@@ -127,15 +110,12 @@ export class BaseRowController {
@AuthUser() user: User, @AuthUser() user: User,
@AuthWorkspace() workspace: Workspace, @AuthWorkspace() workspace: Workspace,
) { ) {
const base = await this.baseRepo.findById(dto.baseId); const base = await this.baseRepo.findById(dto.pageId);
if (!base) { if (!base) {
throw new NotFoundException('Base not found'); throw new NotFoundException('Base not found');
} }
const ability = await this.spaceAbility.createForUser(user, base.spaceId); await this.pageAccessService.validateCanEdit(base, user);
if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Base)) {
throw new ForbiddenException();
}
await this.baseRowService.deleteMany(dto, workspace.id, user.id); await this.baseRowService.deleteMany(dto, workspace.id, user.id);
} }
@@ -148,15 +128,12 @@ export class BaseRowController {
@AuthUser() user: User, @AuthUser() user: User,
@AuthWorkspace() workspace: Workspace, @AuthWorkspace() workspace: Workspace,
) { ) {
const base = await this.baseRepo.findById(dto.baseId); const base = await this.baseRepo.findById(dto.pageId);
if (!base) { if (!base) {
throw new NotFoundException('Base not found'); throw new NotFoundException('Base not found');
} }
const ability = await this.spaceAbility.createForUser(user, base.spaceId); await this.pageAccessService.validateCanView(base, user);
if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Base)) {
throw new ForbiddenException();
}
return this.baseRowService.list(dto, pagination, workspace.id); return this.baseRowService.list(dto, pagination, workspace.id);
} }
@@ -168,15 +145,12 @@ export class BaseRowController {
@AuthUser() user: User, @AuthUser() user: User,
@AuthWorkspace() workspace: Workspace, @AuthWorkspace() workspace: Workspace,
) { ) {
const base = await this.baseRepo.findById(dto.baseId); const base = await this.baseRepo.findById(dto.pageId);
if (!base) { if (!base) {
throw new NotFoundException('Base not found'); throw new NotFoundException('Base not found');
} }
const ability = await this.spaceAbility.createForUser(user, base.spaceId); await this.pageAccessService.validateCanView(base, user);
if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Base)) {
throw new ForbiddenException();
}
return this.baseRowService.count(dto, workspace.id); return this.baseRowService.count(dto, workspace.id);
} }
@@ -188,15 +162,12 @@ export class BaseRowController {
@AuthUser() user: User, @AuthUser() user: User,
@AuthWorkspace() workspace: Workspace, @AuthWorkspace() workspace: Workspace,
) { ) {
const base = await this.baseRepo.findById(dto.baseId); const base = await this.baseRepo.findById(dto.pageId);
if (!base) { if (!base) {
throw new NotFoundException('Base not found'); throw new NotFoundException('Base not found');
} }
const ability = await this.spaceAbility.createForUser(user, base.spaceId); await this.pageAccessService.validateCanEdit(base, user);
if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Base)) {
throw new ForbiddenException();
}
await this.baseRowService.reorder(dto, workspace.id, user.id); await this.baseRowService.reorder(dto, workspace.id, user.id);
} }