Allowing only copilots and above role users to add/update/delete phase/products

Author: Vikas Agarwal

src/permissions/copilotAndAbove.js

@@ -0,0 +1,18 @@
+import util from '../util';
+import { MANAGER_ROLES, USER_ROLE } from '../constants';
+
+
+/**
+ * Permission to alloow copilot and above roles to perform certain operations
+ * @param {Object}    req         the express request instance
+ * @return {Promise}              returns a promise
+ */
+module.exports = req => new Promise((resolve, reject) => {
+  const hasAccess = util.hasRoles(req, [...MANAGER_ROLES, USER_ROLE.COPILOT]);
+
+  if (!hasAccess) {
+    return reject(new Error('You do not have permissions to perform this action'));
+  }
+
+  return resolve(true);
+});

src/permissions/index.js

@@ -7,6 +7,7 @@ const projectDelete = require('./project.delete');
 const projectMemberDelete = require('./projectMember.delete');
 const projectAdmin = require('./admin.ops');
 const connectManagerOrAdmin = require('./connectManagerOrAdmin.ops');
+const copilotAndAbove = require('./copilotAndAbove');
 
 module.exports = () => {
   Authorizer.setDeniedStatusCode(403);
@@ -35,12 +36,12 @@ module.exports = () => {
   Authorizer.setPolicy('productTemplate.delete', connectManagerOrAdmin);
   Authorizer.setPolicy('productTemplate.view', true);
 
-  Authorizer.setPolicy('project.addProjectPhase', projectEdit);
-  Authorizer.setPolicy('project.updateProjectPhase', projectEdit);
-  Authorizer.setPolicy('project.deleteProjectPhase', projectEdit);
-  Authorizer.setPolicy('project.addPhaseProduct', projectEdit);
-  Authorizer.setPolicy('project.updatePhaseProduct', projectEdit);
-  Authorizer.setPolicy('project.deletePhaseProduct', projectEdit);
+  Authorizer.setPolicy('project.addProjectPhase', copilotAndAbove);
+  Authorizer.setPolicy('project.updateProjectPhase', copilotAndAbove);
+  Authorizer.setPolicy('project.deleteProjectPhase', copilotAndAbove);
+  Authorizer.setPolicy('project.addPhaseProduct', copilotAndAbove);
+  Authorizer.setPolicy('project.updatePhaseProduct', copilotAndAbove);
+  Authorizer.setPolicy('project.deletePhaseProduct', copilotAndAbove);
 
   Authorizer.setPolicy('projectType.create', projectAdmin);
   Authorizer.setPolicy('projectType.edit', projectAdmin);