Merge pull request #148 from dadosfera/fix/data-asset-sharing-permission

FIX: no permission needed for sharing data assets

src/modules/catalog/catalog.controller.ts

@@ -2,6 +2,7 @@ import {
   Body,
   Controller,
   Delete,
+  ForbiddenException,
   Get,
   HttpException,
   Inject,
@@ -21,6 +22,7 @@ import { RequestUser, User } from 'src/authentication/user.decorator';
 @ApiTags('Catalog')
 @Controller('catalog')
 @AuthenticateCondition((req, user) => {
+  if (req.path.includes('/manage_permissions/')) return true;
   let action;
 
   switch (req.method) {
@@ -196,6 +198,8 @@ export class CatalogController {
 
     const dashboard = res.dashboard;
 
+    if (dashboard.owner === username) has_permission = true;
+
     for (const role of user_roles) {
       if (dashboard.p_roles.includes(role)) has_permission = true;
     }
@@ -203,8 +207,8 @@ export class CatalogController {
     if (dashboard.p_users.includes(user_id)) has_permission = true;
 
     if (is_data_manager || has_permission) {
-      delete res[0].p_roles;
-      delete res[0].p_users;
+      delete dashboard.p_roles;
+      delete dashboard.p_users;
       return res;
     }
 
@@ -224,7 +228,7 @@ export class CatalogController {
       user: user.user_id,
       customer: user.customer_name,
     });
-    const { user_id, customer_name, customer_id, permissions } = user;
+    const { user_id, customer_name, customer_id, permissions, username } = user;
     const is_data_manager = permissions.includes(
       PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER.seqid,
     );
@@ -248,6 +252,8 @@ export class CatalogController {
       );
       const table = res[0];
 
+      if (table.owner === username) has_permission = true;
+
       for (const role of user_roles) {
         if (table.p_roles.includes(role)) has_permission = true;
       }
@@ -255,14 +261,13 @@ export class CatalogController {
       if (table.p_users.includes(user_id)) has_permission = true;
 
       if (is_data_manager || has_permission) {
-        delete res[0].p_roles;
-        delete res[0].p_users;
+        delete table.p_roles;
+        delete table.p_users;
         return res;
       }
 
-      throw new HttpException(
+      throw new ForbiddenException(
         'You do not have permission to access this data asset.',
-        403,
       );
     }
   }