salix/back/models/notificationSubscription.js

const UserError = require('vn-loopback/util/user-error');

module.exports = Self => {
    Self.observe('before save', async function(ctx) {
        const models = Self.app.models;
        const userId = ctx.options.accessToken.userId;
        const user = await ctx.instance.userFk;
        const modifiedUser = await getUserToModify(user, models);

        if (userId == modifiedUser.id || userId == modifiedUser.bossFk)
            return;
        else
            throw new UserError('You dont have permission to modify this user');
    });

    Self.remoteMethod('deleteNotification', {
        description: 'Deletes a notification subscription',
        accepts: [
            {
                arg: 'ctx',
                type: 'object',
                http: {source: 'context'}
            },
            {
                arg: 'notificationId',
                type: 'number',
                required: true
            },
        ],
        returns: {
            type: 'object',
            root: true
        },
        http: {
            verb: 'POST',
            path: '/deleteNotification'
        }
    });

    Self.deleteNotification = async function(ctx, notificationId) {
        const models = Self.app.models;
        const user = ctx.req.accessToken.userId;
        const modifiedUser = await getUserToModify(notificationId, models);

        if (user == modifiedUser.id || modifiedUser.bossFk == user) {
            await models.NotificationSubscription.destroyById(notificationId);
            return;
        } else
            throw new UserError('You dont have permission to modify this user');
    };

    async function getUserToModify(notificationId = null, userFk = null, models) {
        if (notificationId != null) {
            const subscription = await models.NotificationSubscription.findById(notificationId);
            const user = await subscription.userFk;
            return await models.Worker.findOne({
                fields: ['id', 'bossFk'],
                where: {
                    id: user
                }
            });
        } else {
            return await models.Worker.findOne({
                fields: ['id', 'bossFk'],
                where: {
                    id: userFk
                }
            });
        }
    }
};