Use new creator middleware in mapping service (#122)

gbv · Nov 13, 2020 · 165dda6 · 165dda6
1 parent d7d76b5
commit 165dda6
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 35 deletions.
diff --git a/routes/mappings.js b/routes/mappings.js
@@ -79,6 +79,7 @@ if (config.mappings.update) {
         _id: req.params._id,
         body: req.body,
         user: req.user,
+        existing: req.existing,
       })
     }),
     utils.adjust,
@@ -94,6 +95,7 @@ if (config.mappings.update) {
         _id: req.params._id,
         body: req.body,
         user: req.user,
+        existing: req.existing,
       })
     }),
     utils.adjust,
@@ -108,8 +110,9 @@ if (config.mappings.delete) {
     utils.bodyParser,
     utils.wrappers.async(async (req) => {
       return await mappingService.deleteMapping({
-        uri: req.params._id,
+        _id: req.params._id,
         user: req.user,
+        existing: req.existing,
       })
     }),
     (req, res) => res.sendStatus(204),

diff --git a/services/mappings.js b/services/mappings.js
@@ -7,7 +7,7 @@ const escapeStringRegexp = require("escape-string-regexp")
 
 const Mapping = require("../models/mappings")
 const Annotation = require("../models/annotations")
-const { MalformedBodyError, MalformedRequestError, EntityNotFoundError, InvalidBodyError, DatabaseAccessError, CreatorDoesNotMatchError } = require("../errors")
+const { MalformedBodyError, MalformedRequestError, EntityNotFoundError, InvalidBodyError, DatabaseAccessError } = require("../errors")
 
 module.exports = class MappingService {
 
@@ -401,7 +401,7 @@ module.exports = class MappingService {
     return isMultiple ? response : response[0]
   }
 
-  async putMapping({ _id, body, user }) {
+  async putMapping({ body, existing }) {
     let mapping = body
     if (!mapping) {
       throw new InvalidBodyError()
@@ -420,50 +420,35 @@ module.exports = class MappingService {
     }
     this.checkWhitelists(mapping)
 
-    // Replace current mapping in database
-    const existingMapping = await this.getMapping(_id)
-
-    // Check if authorized user matches creator
-    if (!utils.matchesCreator(user, existingMapping, "mappings", "update")) {
-      throw new CreatorDoesNotMatchError()
-    }
     // Override _id, uri, and created properties
-    mapping._id = existingMapping._id
-    mapping.uri = existingMapping.uri
-    mapping.created = existingMapping.created
+    mapping._id = existing._id
+    mapping.uri = existing.uri
+    mapping.created = existing.created
 
-    const result = await Mapping.replaceOne({ _id: existingMapping._id }, mapping)
+    const result = await Mapping.replaceOne({ _id: existing._id }, mapping)
     if (result.n && result.ok) {
       return mapping
     } else {
       throw new DatabaseAccessError()
     }
   }
 
-  async patchMapping({ _id, body, user }) {
+  async patchMapping({ body, existing }) {
     let mapping = body
     if (!mapping) {
       throw new InvalidBodyError()
     }
     // Add modified date.
     mapping.modified = (new Date()).toISOString()
 
-    // Adjust current mapping in database
-    const existingMapping = await this.getMapping(_id)
-
-    // Check if authorized user matches creator
-    if (!utils.matchesCreator(user, existingMapping, "mappings", "update")) {
-      throw new CreatorDoesNotMatchError()
-    }
-
     _.unset(mapping, "_id")
     _.unset(mapping, "uri")
     _.unset(mapping, "created")
     // Use lodash merge to merge mappings
-    _.merge(existingMapping, mapping)
+    _.merge(existing, mapping)
 
     // Validate mapping after merge
-    if (!validate.mapping(existingMapping)) {
+    if (!validate.mapping(existing)) {
       throw new InvalidBodyError()
     }
     if (mapping.partOf) {
@@ -474,22 +459,16 @@ module.exports = class MappingService {
     }
     this.checkWhitelists(mapping)
 
-    const result = await Mapping.replaceOne({ _id: existingMapping._id }, existingMapping)
+    const result = await Mapping.replaceOne({ _id: existing._id }, existing)
     if (result.ok) {
-      return existingMapping
+      return existing
     } else {
       throw new DatabaseAccessError()
     }
   }
 
-  async deleteMapping({ uri, user }) {
-    const existingMapping = await this.getMapping(uri)
-
-    if (!utils.matchesCreator(user, existingMapping, "mappings", "delete")) {
-      throw new CreatorDoesNotMatchError()
-    }
-
-    const result = await Mapping.deleteOne({ _id: existingMapping._id })
+  async deleteMapping({ existing }) {
+    const result = await Mapping.deleteOne({ _id: existing._id })
     if (result.n && result.ok && result.deletedCount) {
       return
     } else {