salix/modules/ticket/back/methods/sale/canEdit.js

const UserError = require('vn-loopback/util/user-error');
const loopBackCtx = require('vn-loopback/server/server');

module.exports = Self => {
    Self.remoteMethodCtx('canEdit', {
        description: 'Check if all the received sales are aditable',
        accessType: 'READ',
        accepts: [{
            arg: 'sales',
            type: ['object'],
            required: true
        }],
        returns: {
            type: 'boolean',
            root: true
        },
        http: {
            path: `/canEdit`,
            verb: 'get'
        }
    });

    Self.canEdit = async(ctx, sales, options) => {
        const models = Self.app.models;
        const myOptions = {};

        if (typeof options == 'object')
            Object.assign(myOptions, options);

        const firstSale = await models.Sale.findById(sales[0], null, myOptions);
        const isTicketEditable = await models.Ticket.isEditable(ctx, firstSale.ticketFk, myOptions);
        if (!isTicketEditable)
            throw new UserError(`The sales of this ticket can't be modified`);

        const saleTracking = await models.SaleTracking.find({where: {saleFk: {inq: sales}}}, myOptions);
        const hasSaleTracking = saleTracking.length;

        const saleCloned = await models.SaleCloned.find({where: {saleClonedFk: {inq: sales}}}, myOptions);
        const hasSaleCloned = saleCloned.length;

        const isTicketWeekly =
            await models.TicketWeekly.findOne({where: {ticketFk: firstSale.ticketFk}}, myOptions);

        // (principalType, principalId,model, property, accessType,callback);
        // let canEditTracked = await models.ACL.checkPermission('ROLE', 'employee', 'Sale', 'editTracked', 'WRITE');

        // let canEditTracked2 = await models.ACL.checkPermission('USER', 'developer', 'Sale', 'editTracked', 'READ');
        const array = ['editTracked'];
        const AccessContext = loopBackCtx.AccessContext;
        const toFind = {
            principals: [{
                type: 'ROLE',
                id: 'employee'
            }],
            model: 'Sale',
            property: 'editTracked',
            methodNames: ['editTracked'],
            accessType: 'WRITE'
        };
        const newContext = new AccessContext(toFind);
        newContext.methodNames = ['editTracked'];

        let canEditTracked3 = await models.ACL.checkAccessForContext(newContext);

        let canEditTracked4 = await models.ACL.checkAccessForContext({
            principals: [{
                type: 'ROLE',
                id: 'developer'
            }],
            model: 'Sale',
            property: 'editTracked',
            methodName: 'editTracked',
            methodNames: ['editTracked'],
            accessType: 'WRITE'
        });
        // console.log(canEditTracked);
        // canEditTracked = await models.ACL.resolvePermission(canEditTracked);
        // let canEditCloned = await models.ACL.checkPermission('ROLE', 'employee', 'Sale', 'editCloned', '*');
        // let canEditWeekly = await models.ACL.checkPermission('ROLE', 'employee', 'Ticket', 'editWeekly', '*');

        // console.log(canEditTracked, canEditTracked2);
        console.log('DENY: ', canEditTracked3.permission);
        console.log('ALLOW: ', canEditTracked4.permission);
        const shouldEditTracked = canEditTracked || !hasSaleTracking;
        const shouldEditCloned = canEditCloned || !hasSaleCloned;
        const shouldEditWeekly = canEditWeekly || !isTicketWeekly;

        const canEdit = shouldEditTracked && shouldEditCloned && shouldEditWeekly;

        if (canEdit)
            return true;

        return false;
    };
};