diff --git a/services/utils-service/uploadService.js b/services/utils-service/uploadService.js index 1da44ac2..84300ee4 100644 --- a/services/utils-service/uploadService.js +++ b/services/utils-service/uploadService.js @@ -90,7 +90,7 @@ app.post("/upload", upload.array("uploads[]", 12), function (req, res) { app.post('/upload/stakeholder/:id', upload.single('photo'), (req, res) => { sendFile(req, res, (result) => { - return isAdminOrCurator(result.edu_person_entitlements); + return isMonitorCurator(result.edu_person_entitlements); }); }); @@ -116,32 +116,16 @@ app.get('/tiny', function (req, res) { }); }); +app.delete('/delete/stakeholder/:filename', function (req, res) { + deleteFileSend(req, res, (result) => { + return isMonitorCurator(result.edu_person_entitlements); + }) +}); + app.delete('/delete/:filename', function (req, res) { - const token = req.cookies['AccessToken']; - if (!token) { - res.status(401).send(getResponse(401, "Unauthorized")); - } else { - http.get(auth + token, function (resp) { - var responseString = ""; - resp.on("data", function (data) { - responseString += data; - }); - resp.on("end", function () { - var result = JSON.parse(responseString); - if (result.error) { - res.status(401).send(getResponse(401, "Unauthorized")); - } else { - // if user id is on filename or is Admin delete file else unauthorized. - if (result.sub.indexOf(req.params.filename.split('-')[0]) !== -1 || isAdminOrCurator(result.edu_person_entitlements)) { - deleteFile('./uploads/' + req.params.filename); - return res.status(200).send(getResponse(200, "File Deleted Successfully")); - } else { - res.status(401).send(getResponse(401, "Unauthorized")); - } - } - }); - }); - } + deleteFileSend(req, res, (result) => { + return result.sub.indexOf(req.params.filename.split('-')[0]) !== -1 || isAdminOrCurator(result.edu_person_entitlements); + }) }); const server = app.listen(8000, function () { @@ -185,6 +169,34 @@ function sendFile(req, res, authorized) { } } +function deleteFileSend(req, res, authorized) { + const token = req.cookies['AccessToken']; + if (!token) { + res.status(401).send(getResponse(401, "Unauthorized")); + } else { + http.get(auth + token, function (resp) { + var responseString = ""; + resp.on("data", function (data) { + responseString += data; + }); + resp.on("end", function () { + var result = JSON.parse(responseString); + if (result.error) { + res.status(401).send(getResponse(401, "Unauthorized")); + } else { + // if user id is on filename or is Admin delete file else unauthorized. + if (authorized) { + deleteFile('./uploads/' + req.params.filename); + return res.status(200).send(getResponse(200, "File Deleted Successfully")); + } else { + res.status(401).send(getResponse(401, "Unauthorized")); + } + } + }); + }); + } +} + function getResponse(code, message) { var response = {}; response["code"] = code; @@ -208,6 +220,20 @@ function deleteFile(filepath) { }); } +function isMonitorCurator(roles) { + var isAdmin = false; + var isCurator = false; + for (var i = 0; i < roles.length; i++) { + if (roles[i] === 'urn:geant:openaire.eu:group:Portal+Administrator#aai.openaire.eu') { + isAdmin = true; + } + if (roles[i] === 'urn:geant:openaire.eu:group:Curator+-+Funder#aai.openaire.eu') { + isCurator = true; + } + } + return isAdmin || isCurator; +} + function isAdminOrCurator(roles) { var isAdmin = false; var isCurator = false;