salix/modules/ticket/back/methods/sale/canEdit.js

const UserError = require('vn-loopback/util/user-error');
const loopBackCtx = require('vn-loopback/server/server');

module.exports = Self => {
    Self.remoteMethodCtx('canEdit', {
        description: 'Check if all the received sales are aditable',
        accessType: 'READ',
        accepts: [{
            arg: 'sales',
            type: ['object'],
            required: true
        }],
        returns: {
            type: 'boolean',
            root: true
        },
        http: {
            path: `/canEdit`,
            verb: 'get'
        }
    });

    Self.canEdit = async(ctx, sales, options) => {
        const models = Self.app.models;
        const myOptions = {};

        if (typeof options == 'object')
            Object.assign(myOptions, options);

        console.log(ctx.req.accessToken);
        const token = ctx.req.accessToken;
        let canEditTracked = await models.ACL.checkAccessForToken(token, models.Sale, null, 'refund');
        // const newCtx = ctx;
        // newCtx.property = 'refund';
        // newCtx.accessType = 'WRITE';
        // newCtx.methodNames = ['refund'];
        // newCtx.model = await models.Sale;

        // let canEditTracked = await models.ACL.checkAccessForContext(newCtx);
        console.log(canEditTracked);

        // let canEditTracked2 = await models.ACL.checkPermission('USER', 'developer', 'Sale', 'editTracked', 'READ');
        /* const array = ['editTracked'];
        const AccessContext = loopBackCtx.AccessContext;
        const toFind = {
            principals: [{
                type: 'ROLE',
                id: 'employee'
            }],
            model: 'Sale',
            property: 'editTracked',
            methodNames: ['editTracked'],
            accessType: 'WRITE'
        };
        const newContext = new AccessContext(toFind);
        newContext.methodNames = ['editTracked'];

        let canEditTracked3 = await models.ACL.checkAccessForContext(newContext);

        let canEditTracked4 = await models.ACL.checkAccessForContext({
            principals: [{
                type: 'ROLE',
                id: 'developer'
            }],
            model: 'Sale',
            property: 'editTracked',
            methodName: 'editTracked',
            methodNames: ['editTracked'],
            accessType: 'WRITE'
        });
        // console.log(canEditTracked);
        // canEditTracked = await models.ACL.resolvePermission(canEditTracked);
        // let canEditCloned = await models.ACL.checkPermission('ROLE', 'employee', 'Sale', 'editCloned', '*');
        // let canEditWeekly = await models.ACL.checkPermission('ROLE', 'employee', 'Ticket', 'editWeekly', '*');

        // console.log(canEditTracked, canEditTracked2);
        console.log('DENY: ', canEditTracked3.permission);
        console.log('ALLOW: ', canEditTracked4.permission);
        const shouldEditTracked = canEditTracked || !hasSaleTracking;
        const shouldEditCloned = canEditCloned || !hasSaleCloned;
        const shouldEditWeekly = canEditWeekly || !isTicketWeekly;

        const canEdit = shouldEditTracked && shouldEditCloned && shouldEditWeekly;

        if (canEdit)
            return true;

        return false;*/
    };
};