upstream-rocketchat/apps/meteor/server/services/authorization/service.ts

import type { IAuthorization, RoomAccessValidator, UserWithRoles } from '@rocket.chat/core-services';
import { License, ServiceClass } from '@rocket.chat/core-services';
import type { IUser, IRole, IRoom, ISubscription } from '@rocket.chat/core-typings';
import { Subscriptions, Rooms, Users, Roles, Permissions } from '@rocket.chat/models';
import mem from 'mem';

import { canAccessRoom } from './canAccessRoom';
import { canReadRoom } from './canReadRoom';
import { AuthorizationUtils } from '../../../app/authorization/lib/AuthorizationUtils';

import './canAccessRoomLivechat';

// Register as class
export class Authorization extends ServiceClass implements IAuthorization {
	protected name = 'authorization';

	private getRolesCached = mem(this.getRoles.bind(this), {
		maxAge: 1000,
		cacheKey: (args: unknown[]) => {
			const [user, scope] = args as [string | UserWithRoles, IRoom['_id']?];
			return typeof user === 'string' ? `${user}/${scope ?? ''}` : `${user._id}/${scope ?? ''}/${JSON.stringify(user.roles ?? [])}`;
		},
	});

	private rolesHasPermissionCached = mem(this.rolesHasPermission.bind(this), {
		cacheKey: JSON.stringify,
		...((process.env.TEST_MODE === 'true' || process.env.TEST_MODE === 'api') && { maxAge: 1 }),
	});

	constructor() {
		super();

		const clearCache = (): void => {
			mem.clear(this.getRolesCached);
			mem.clear(this.rolesHasPermissionCached);
		};

		this.onEvent('watch.roles', clearCache);
		this.onEvent('permission.changed', clearCache);
		this.onEvent('authorization.guestPermissions', (permissions: string[]) => {
			AuthorizationUtils.addRolePermissionWhiteList('guest', permissions);
		});
	}

	override async started(): Promise<void> {
		try {
			if (!(await License.hasValidLicense())) {
				return;
			}

			const permissions = await License.getGuestPermissions();
			if (!permissions) {
				return;
			}

			AuthorizationUtils.addRolePermissionWhiteList('guest', permissions);
		} catch (error) {
			console.error('Authorization Service did not start correctly', error);
		}
	}

	async hasAllPermission(userId: string | UserWithRoles, permissions: string[], scope?: string): Promise<boolean> {
		if (!userId) {
			return false;
		}
		return this.all(userId, permissions, scope);
	}

	async hasPermission(userId: string | UserWithRoles, permissionId: string, scope?: string): Promise<boolean> {
		if (!userId) {
			return false;
		}
		return this.all(userId, [permissionId], scope);
	}

	async hasAtLeastOnePermission(userId: string | UserWithRoles, permissions: string[], scope?: string): Promise<boolean> {
		if (!userId) {
			return false;
		}
		return this.atLeastOne(userId, permissions, scope);
	}

	async canAccessRoom(...args: Parameters<RoomAccessValidator>): Promise<boolean> {
		return canAccessRoom(...args);
	}

	async canReadRoom(...args: Parameters<RoomAccessValidator>): Promise<boolean> {
		return canReadRoom(...args);
	}

	async canAccessRoomId(rid: IRoom['_id'], user: IUser['_id']): Promise<boolean> {
		const room = await Rooms.findOneById<Pick<IRoom, '_id' | 't' | 'teamId' | 'prid' | 'abacAttributes'>>(rid, {
			projection: {
				_id: 1,
				t: 1,
				teamId: 1,
				prid: 1,
				abacAttributes: 1,
			},
		});

		if (!room) {
			return false;
		}

		return this.canAccessRoom(room, { _id: user });
	}

	async canAccessRoomIds(rids: IRoom['_id'][], user: UserWithRoles): Promise<boolean> {
		const uniqueRids = [...new Set(rids)];

		if (!uniqueRids.length) {
			return false;
		}

		if (!user) {
			return false;
		}

		const rooms = await Rooms.findByIds<Pick<IRoom, '_id' | 't' | 'teamId' | 'prid' | 'abacAttributes'>>(uniqueRids, {
			projection: {
				_id: 1,
				t: 1,
				teamId: 1,
				prid: 1,
				abacAttributes: 1,
			},
		}).toArray();

		if (rooms.length !== uniqueRids.length) {
			return false;
		}

		const allowed = await Promise.all(rooms.map((room) => this.canAccessRoom(room, user)));

		return allowed.every(Boolean);
	}

	async getUsersFromPublicRoles(): Promise<
		{
			_id: string;
			username: string;
			roles: string[];
		}[]
	> {
		const roleIds = await this.getPublicRoles();

		return this.getUserFromRoles(roleIds);
	}

	private getPublicRoles = mem(
		async (): Promise<string[]> => {
			const roles = Roles.find<Pick<IRole, '_id'>>({ scope: 'Users', description: { $exists: true, $ne: '' } }, { projection: { _id: 1 } });

			return roles.map(({ _id }) => _id).toArray();
		},
		{ maxAge: 10000 },
	);

	private getUserFromRoles = mem(
		async (roleIds: string[]) => {
			const users = Users.findUsersInRoles<Pick<Required<IUser>, '_id' | 'username' | 'roles'>>(roleIds, null, {
				sort: {
					username: 1,
				},
				projection: {
					_id: 1,
					username: 1,
					roles: 1,
				},
			});

			return users
				.map((user) => ({
					...user,
					roles: user.roles.filter((roleId: string) => roleIds.includes(roleId)),
				}))
				.toArray();
		},
		{ maxAge: 10000 },
	);

	private async rolesHasPermission(permission: string, roles: IRole['_id'][]): Promise<boolean> {
		if (AuthorizationUtils.isPermissionRestrictedForRoleList(permission, roles)) {
			return false;
		}

		const result = await Permissions.findOne({ _id: permission, roles: { $in: roles } }, { projection: { _id: 1 } });
		return !!result;
	}

	private async getRoles(user: string | UserWithRoles, scope?: IRoom['_id']): Promise<string[]> {
		const { roles: userRoles = [] } = typeof user === 'string' ? (await Users.findOneById(user, { projection: { roles: 1 } })) || {} : user;
		const { roles: subscriptionsRoles = [] } =
			(scope &&
				(await Subscriptions.findOne<Pick<ISubscription, 'roles'>>(
					{ 'rid': scope, 'u._id': typeof user === 'string' ? user : user._id },
					{ projection: { roles: 1 } },
				))) ||
			{};
		return [...userRoles, ...subscriptionsRoles].sort((a, b) => a.localeCompare(b));
	}

	private async resolveRoles(user: string | UserWithRoles, scope?: IRoom['_id']): Promise<string[]> {
		if (typeof user !== 'string' && !scope) {
			return [...(user.roles ?? [])].sort((a, b) => a.localeCompare(b));
		}
		return this.getRolesCached(user, scope);
	}

	private async atLeastOne(user: string | UserWithRoles, permissions: string[] = [], scope?: string): Promise<boolean> {
		const sortedRoles = await this.resolveRoles(user, scope);
		for await (const permission of permissions) {
			if (await this.rolesHasPermissionCached(permission, sortedRoles)) {
				return true;
			}
		}

		return false;
	}

	private async all(user: string | UserWithRoles, permissions: string[] = [], scope?: string): Promise<boolean> {
		const sortedRoles = await this.resolveRoles(user, scope);
		for await (const permission of permissions) {
			if (!(await this.rolesHasPermissionCached(permission, sortedRoles))) {
				return false;
			}
		}

		return true;
	}

	async hasAnyRole(userId: IUser['_id'], roleIds: IRole['_id'][], scope?: IRoom['_id']): Promise<boolean> {
		if (!Array.isArray(roleIds)) {
			throw new Error('error-invalid-arguments');
		}

		if (!userId) {
			return false;
		}

		return Roles.isUserInRoles(userId, roleIds, scope);
	}
}