* fix(server): restrict partner timeline requests to timeline assets * test(server): update medium timeline tests for consolidated check (cherry picked from commit e9fb180f466a687cebda9b7e17cef403de4b81fa)
81 lines
2.9 KiB
TypeScript
81 lines
2.9 KiB
TypeScript
import { BadRequestException, Injectable } from '@nestjs/common';
|
|
import { AuthDto, isMetadataHidden } from 'src/dtos/auth.dto.js';
|
|
import { TimeBucketAssetDto, TimeBucketDto, TimeBucketsResponseDto } from 'src/dtos/time-bucket.dto.js';
|
|
import { AssetVisibility, Permission } from 'src/enum.js';
|
|
import { TimeBucketOptions } from 'src/repositories/asset.repository.js';
|
|
import { BaseService } from 'src/services/base.service.js';
|
|
import { requireElevatedPermission } from 'src/utils/access.js';
|
|
import { getMyPartnerIds } from 'src/utils/asset.util.js';
|
|
|
|
@Injectable()
|
|
export class TimelineService extends BaseService {
|
|
async getTimeBuckets(auth: AuthDto, dto: TimeBucketDto): Promise<TimeBucketsResponseDto[]> {
|
|
await this.timeBucketChecks(auth, dto);
|
|
const timeBucketOptions = await this.buildTimeBucketOptions(auth, dto);
|
|
return await this.assetRepository.getTimeBuckets(timeBucketOptions, auth);
|
|
}
|
|
|
|
// pre-jsonified response
|
|
async getTimeBucket(auth: AuthDto, dto: TimeBucketAssetDto): Promise<string> {
|
|
await this.timeBucketChecks(auth, dto);
|
|
const timeBucketOptions = await this.buildTimeBucketOptions(auth, { ...dto });
|
|
|
|
// TODO: use id cursor for pagination
|
|
const bucket = await this.assetRepository.getTimeBucket(dto.timeBucket, timeBucketOptions, auth);
|
|
return bucket.assets;
|
|
}
|
|
|
|
private async buildTimeBucketOptions(auth: AuthDto, dto: TimeBucketDto): Promise<TimeBucketOptions> {
|
|
const { userId, ...options } = dto;
|
|
let userIds: string[] | undefined;
|
|
|
|
if (userId) {
|
|
userIds = [userId];
|
|
if (dto.withPartners) {
|
|
const partnerIds = await getMyPartnerIds({
|
|
userId: auth.user.id,
|
|
repository: this.partnerRepository,
|
|
timelineEnabled: !options.personId || undefined,
|
|
});
|
|
userIds.push(...partnerIds);
|
|
}
|
|
}
|
|
|
|
return { ...options, userIds };
|
|
}
|
|
|
|
private async timeBucketChecks(auth: AuthDto, dto: TimeBucketDto) {
|
|
if (dto.visibility === AssetVisibility.Locked) {
|
|
requireElevatedPermission(auth);
|
|
}
|
|
|
|
if (dto.albumId) {
|
|
await this.requireAccess({ auth, permission: Permission.AlbumRead, ids: [dto.albumId] });
|
|
} else {
|
|
dto.userId ||= auth.user.id;
|
|
}
|
|
|
|
if (dto.userId) {
|
|
await this.requireAccess({ auth, permission: Permission.TimelineRead, ids: [dto.userId] });
|
|
}
|
|
|
|
const includesOtherUsers = dto.withPartners || (dto.userId && dto.userId !== auth.user.id);
|
|
if (includesOtherUsers) {
|
|
dto.visibility ??= AssetVisibility.Timeline;
|
|
if (dto.visibility !== AssetVisibility.Timeline || dto.isTrashed || dto.isFavorite !== undefined) {
|
|
throw new BadRequestException(
|
|
'Only non-archived, non-trashed, non-favorited, non-locked assets can be requested for other users',
|
|
);
|
|
}
|
|
}
|
|
|
|
if (dto.tagId) {
|
|
await this.requireAccess({ auth, permission: Permission.TagRead, ids: [dto.tagId] });
|
|
}
|
|
|
|
if (isMetadataHidden(auth)) {
|
|
dto.withCoordinates = false;
|
|
}
|
|
}
|
|
}
|