352Media
diff --git a/.eslintrc.json b/.eslintrc.json
@@ -0,0 +1,7 @@
+{
+    "extends": "airbnb-base",
+    "rules": {
+        "no-underscore-dangle": ["error", { "allow": ["_conditions", "_fields", "_update", "_doc", "_id"] }],
+        "no-param-reassign": ["error", { "props": false }]
+    }
+}
diff --git a/.gitignore b/.gitignore
@@ -1 +1,2 @@
-.idea/
+.idea/
+node_modules/
diff --git a/.jscsrc b/.jscsrc
@@ -0,0 +1,7 @@
+{
+  "preset": "google",
+  "fileExtensions": [".js", "jscs"],
+  "excludeFiles": [],
+  "maximumLineLength": 1000,
+  "requireCamelCaseOrUpperCaseIdentifiers": "ignoreProperties"
+}
diff --git a/.npmignore b/.npmignore
@@ -0,0 +1,4 @@
+test/
+README.md
+.gitignore
+.travis.yml
diff --git a/.travis.yml b/.travis.yml
@@ -0,0 +1,10 @@
+language: node_js
+services:
+  - mongodb
+node_js:
+  - "8.3.0"
+before_script:
+  - sleep 15
+script:
+  - eslint .
+  - npm test
diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -0,0 +1,10 @@
+{
+  "cSpell.words": [
+    "adhoc",
+    "authz",
+    "nodeunit",
+    "permissioned",
+    "subpath",
+    "upsert"
+  ]
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,7 @@
+# 2.0.0
+
+- Removing the ability to call Model.remove() and Model.create() since those aren't compatible with how this library works.
+- Muuuuch better tests
+- Embedded permissions object cannot be overwritten
+- When a document has embedded permissions, those permissions will be checks when a save or remove is being done. That way someone cannot write to an object in a way that changes their permissions and then try to save it.
+- Does not add permissions when a doc is empty
diff --git a/README.md b/README.md
@@ -1 +1,207 @@
-# mongoose-authorization
+# mongoose-authz
+[![Build Status](https://travis-ci.org/devcolor/mongoose-authz.svg)](https://travis-ci.org/devcolor/mongoose-authz)
+
+This plugin allows you to define a custom authorization scheme on your mongoose models.
+
+`npm install --save mongoose-authz`
+
+
+## Getting Started
+
+```javascript
+'use strict';
+var mongoose = require('mongoose');
+var authz = require('mongoose-authz');
+
+var userSchema = new mongoose.Schema({
+  email: {
+    type: String,
+    required: true,
+    unique: true
+  },
+  first_name: {
+    type: String,
+    required: true
+  },
+  last_name: {
+    type: String,
+    required: true
+  },
+  avatar: {
+    type: String
+  },
+  last_login_date: {
+    type: Date
+  },
+  status: {
+    type: String,
+    required: true,
+    default: 'active'
+  }
+});
+
+/*
+ * Make sure you add this before compiling your model
+ */
+userSchema.permissions = {
+  defaults: {
+    read: ['email', 'first_name', 'last_name', 'avatar']
+  },
+  admin: {
+    read: ['status'],
+    write: ['status'],
+    create: true,
+    actions: ['merge'],
+  },
+  owner: {
+    read: ['status'],
+    write: ['email', 'first_name', 'last_name', 'avatar'],
+    remove: true
+  }
+};
+
+userSchema.plugin(authz);
+
+module.exports = mongoose.model('users', userSchema);
+```
+
+In the example above we extended the **userSchema** by adding a *permissions* object. This will not persist to your documents.
+
+The permissions object consists of properties that represent your authorization levels (or groups). For each group, there are 4 permissions you can configure.
+* `create` - Boolean
+* `remove` - Boolean
+* `write` - [array of fields] *NOTE: if `upsert: true`, the group will need to have `create` permissions too*
+* `read` - [array of fields]
+* `actions` - An array or arbitrary strings that lets you define more complicated actions (usually involving multiple fields or documents) that are allowed. Your own application code will need to handle the updates (likely disabling field level checking for those updates).
+
+You can also specify a `defaults` group, which represents permissions that are available to all groups.
+
+If you need the document in order to determine the correct authorization level for an action, you can place a static `getAuthLevel` function directly in your schema. For applicable actions, this function will be called with a specific document and a payload of data specified in the query. This is useful when the authorization level depends on matching properties of a user with properties of a specific document to determine if *that* user can modify *that* document.
+
+###### *NOTE: The `getAuthLevel` approach does not work for update or remove queries since the document is not loaded into memory.*
+
+```javascript
+var mongoose = require('mongoose');
+
+var carSchema = new mongoose.Schema({
+    make: {
+        type: String,
+        required: true,
+        unique: true
+      },
+    model: {
+        type: String,
+        required: true
+      },
+    year: {
+        type: Number
+      },
+    plate: {
+        type: String
+      }
+  });
+
+/*
+ * Make sure you add this before compiling your model
+ */
+carSchema.permissions = {
+    defaults: {
+        read: ['_id', 'make', 'model', 'year']
+      },
+    maker: {
+        write: ['make', 'model', 'year'],
+        remove: true
+      },
+    dealer: {
+        read: ['plate'],
+        write: ['plate']
+      }
+  };
+
+carSchema.getAuthLevel = function (payload, doc) {
+    if (payload && doc && payload.companyName === doc.make) {
+        return 'maker';
+    }
+
+    return 'dealer';
+}
+```
+
+In you application code, you could then do the following:
+
+```javascript
+Car.find({}, null, { authPayload: { companyName: 'Toyota' } }).exec(...);
+
+// or
+
+myCar.save({ authPayload: { companyName: 'Honda' } });
+```
+
+You can also have the permissions for a specific document injected into the document when returned from a find query using the `permissions` option on the query. The permissions will be inserted into the object using the key `permissions` unless you specify the desired key name as the permissions option.
+
+```javascript
+const user = await User.find().setOptions({ authLevel: 'admin': permissions: true }).exec();
+
+console.log(user.permissions);
+// Outputs:
+// {
+//   read: [...],
+//   write: [...],
+//   remove: [boolean],
+//   actions: [...],
+// }
+
+// OR
+const user = await User.find().setOptions({ authLevel: 'admin': permissions: 'foo' }).exec();
+
+console.log(user.foo);
+// Outputs:
+// {
+//   read: [...],
+//   write: [...],
+//   remove: [boolean],
+//   actions: [...],
+// }
+```
+
+#### Example Uses
+
+###### NOTE: If no authLevel is able to be determined, permission to perform the action will be denied. If you would like to circumvent authorization, pass `false` as the authLevel (e.g. `myModel.find().setAuhtLevel(false).exec();`, which will disable authorization for that specific query).
+
+***example update***
+
+You can also specify an array of authentication levels. This would merge the settings of each auth level.
+
+```javascript
+users.update({user_id: userUpdate.user_id}, userUpdate, {
+  authLevel: 'admin'
+}, function(err, doc) {
+  if (err) {
+    //handle error
+  } else {
+    //success
+  }
+});
+```
+
+
+###### *NOTE: When using `findOneAndUpdate`, the return document will be sanitized based on the group's permissions for `read`*
+
+```javascript
+await users.findOneAndUpdate(
+  { user_id: userUpdate.user_id },
+  userUpdate,
+  { authLevel: 'admin'}
+);
+```
+
+
+***example find***
+
+```javascript
+await users.find(
+  { user_id: userUpdate.user_id },
+  null,
+  { authLevel: 'admin' }
+);
+```
diff --git a/__tests__/authIsDisabled.test.js b/__tests__/authIsDisabled.test.js
@@ -0,0 +1,19 @@
+const test = require('ava');
+const authIsDisabled = require('../src/authIsDisabled');
+
+test.todo('Create tests for authIsDisabled');
+test('works with no options', (t) => {
+  t.false(authIsDisabled(), 'should handle undefined input');
+  t.false(authIsDisabled(false), 'should handle false input');
+  t.false(authIsDisabled(''), 'should handle empty string input');
+  t.false(authIsDisabled({}), 'should handle empty object input');
+});
+
+test('handles authLevel correctly', (t) => {
+  t.true(authIsDisabled({ authLevel: false }), 'false AuthLevel should disable authorization');
+  t.false(authIsDisabled({ authLevel: 0 }), 'authLevel of 0 should not disable authorization');
+  t.false(
+    authIsDisabled({ authLevel: '' }),
+    'authLevel of empty string should not disable authorization',
+  );
+});
diff --git a/__tests__/cleanAuthLevels.test.js b/__tests__/cleanAuthLevels.test.js
@@ -0,0 +1,78 @@
+const test = require('ava');
+const mongoose = require('mongoose');
+const cleanAuthLevels = require('../src/cleanAuthLevels');
+
+test.before((t) => {
+  const schema = new mongoose.Schema({ friend: String });
+  schema.permissions = { default: {}, manager: {}, report: {} };
+  t.context.schema = schema;
+});
+
+test('Schema passed in is not valid', (t) => {
+  t.deepEqual(
+    cleanAuthLevels(false, ['foo']),
+    [],
+    'should return empty list when schema is falsy',
+  );
+
+  t.deepEqual(
+    cleanAuthLevels(false, []),
+    [],
+    'should return empty list when schema is falsy and there are no authLevels',
+  );
+
+  t.deepEqual(
+    cleanAuthLevels({}, ['foo']),
+    [],
+    'should return empty list when schema is empty object',
+  );
+
+  t.deepEqual(
+    cleanAuthLevels({}, []),
+    [],
+    'should return empty list when schema is empty object & there are no authLevels',
+  );
+});
+
+test('Falsey authLevel value', (t) => {
+  t.deepEqual(cleanAuthLevels(t.context.schema, false), []);
+  t.deepEqual(cleanAuthLevels(t.context.schema, 0), []);
+});
+
+test('Empty array authLevel value', (t) => {
+  t.deepEqual(cleanAuthLevels(t.context.schema, []), []);
+});
+
+test('Remove duplicate entries', (t) => {
+  t.deepEqual(cleanAuthLevels(t.context.schema, ['manager', 'manager']), ['manager']);
+});
+
+test('Remove false entries', (t) => {
+  t.deepEqual(cleanAuthLevels(t.context.schema, [0, 'manager', false]), ['manager']);
+});
+
+test('Remove entries that are not in the permissions object', (t) => {
+  t.deepEqual(cleanAuthLevels(t.context.schema, ['fake', 'manager', 'notthere']), ['manager']);
+  t.deepEqual(cleanAuthLevels(t.context.schema, ['fake', 'notthere']), []);
+});
+
+test('authLevel with no issues', (t) => {
+  t.deepEqual(
+    cleanAuthLevels(t.context.schema, ['manager']),
+    ['manager'],
+    'should handle single item array',
+  );
+
+  t.deepEqual(
+    cleanAuthLevels(t.context.schema, ['manager', 'report']),
+    ['manager', 'report'],
+    'should handle mutliple item array',
+  );
+
+  t.deepEqual(
+    cleanAuthLevels(t.context.schema, 'manager'),
+    ['manager'],
+    'should handle single level, not in array',
+  );
+});
+