root
22 lines
931 B
JavaScript
22 lines
931 B
JavaScript
"use strict";
|
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
exports.requireCompanyPolicy = requireCompanyPolicy;
|
|
const authHelpers_1 = require("./authHelpers");
|
|
const companyPolicy_1 = require("../security/policies/companyPolicy");
|
|
function requireCompanyPolicy(action) {
|
|
return (req, res, next) => {
|
|
const employee = req.employee;
|
|
if (!employee)
|
|
return (0, authHelpers_1.sendUnauthorized)(res, 'unauthenticated', 'Authentication required');
|
|
const allowedRoles = companyPolicy_1.CompanyPolicy[action];
|
|
if (!allowedRoles.includes(employee.role)) {
|
|
return (0, authHelpers_1.sendForbidden)(res, 'forbidden', 'You do not have permission to perform this action', {
|
|
action,
|
|
allowedRoles,
|
|
yourRole: employee.role,
|
|
});
|
|
}
|
|
next();
|
|
};
|
|
}
|
|
//# sourceMappingURL=requireCompanyPolicy.js.map
|