Fixing animals acl permissions

src/middlewares/acl/CheckAclAnimalsPermission.ts

@@ -0,0 +1,24 @@
+import { NextFunction } from "express";
+import { AuthenticatedRequest } from "../../..";
+import { Request, Response } from 'express';
+import { Roles } from "../../enums/Roles";
+import Animal from "../../database/models/Animal";
+
+export default function CheckAclAnimalsPermission(role: Roles) {
+    return async function (req: Request, res: Response, next: NextFunction) {
+        const authenticatedRequest = req as unknown as AuthenticatedRequest;
+        const { userRoles } = authenticatedRequest.user!;
+        const id = req.params.id || req.body.id;
+
+        const animal = await Animal.findByPk(id);
+        if (userRoles.some(x => 
+                x.idRole && x.idRole >= role && 
+                x.idInstitution?.toString() === animal?.idInstitution
+            )) {
+            return next();
+        }
+
+        return res.status(401).json({ message: 'Not allowed profile!' });
+    }
+};
+

src/middlewares/acl/CheckAclPermission.ts

@@ -7,12 +7,8 @@ export default function CheckAclPermission(role: Roles) {
     return function (req: Request, res: Response, next: NextFunction) {
         const authenticatedRequest = req as unknown as AuthenticatedRequest;
         const { userRoles } = authenticatedRequest.user!;
-        let id = req.params.id || req.body.id;
-
-        if(!req.path.includes('/institution')){
-            id = req.params.idInstitution || req.body.idInstitution;
-        }
-
+        const id = req.params.id || req.body.id;
+
         if (userRoles.some(x => 
                 x.idRole && x.idRole >= role && 
                 x.idInstitution?.toString() === id

src/routes.ts

@@ -13,6 +13,7 @@ import BreedController from "./controllers/BreedController";
 import ColorController from "./controllers/ColorController";
 import BehavioralProfileController from "./controllers/BehavioralProfileController";
 import AnimalController from "./controllers/AnimalController";
+import CheckAclAnimalsPermission from "./middlewares/acl/CheckAclAnimalsPermission";
 const routes = Router();
 
 const globalErrorHandler = (err: Error, req: Request, res: Response, next: NextFunction) => {
@@ -98,16 +99,16 @@ routes.post('/animal/save', upload.any(), (req, res) => {
 });
 
 routes.post('/animal/saveFiles', upload.any(), (req, res) => {
-    CheckUserPermission(Roles.Volunteer)
+    CheckAclAnimalsPermission(Roles.Volunteer)
     return AnimalController.saveFiles(req, res)
 });
 
 routes.post('/temporaryHome/save', (req, res) => {
-    CheckUserPermission(Roles.Volunteer)
+    CheckAclAnimalsPermission(Roles.Volunteer)
     return EntityTemporaryHomeController.save(req, res)
 });
 
-routes.get('/animal/:id', CheckUserPermission(Roles.Volunteer), (req, res) => {
+routes.get('/animal/:id', CheckAclAnimalsPermission(Roles.Volunteer), (req, res) => {
     return AnimalController.detail(req, res)
 });