diff --git a/apps/api/src/app/endpoints/asset-profiles/asset-profiles.controller.ts b/apps/api/src/app/endpoints/asset-profiles/asset-profiles.controller.ts index 2024902e7f..7e8ae19812 100644 --- a/apps/api/src/app/endpoints/asset-profiles/asset-profiles.controller.ts +++ b/apps/api/src/app/endpoints/asset-profiles/asset-profiles.controller.ts @@ -132,9 +132,12 @@ export class AssetProfilesController { @Param('dataSource') dataSource: DataSource, @Param('symbol') symbol: string ): Promise { - const { id: symbolProfileId } = await this.validateCanManageSplits({ + const { id: symbolProfileId } = await this.validateAccessToSplits({ dataSource, - symbol + symbol, + permission: permissions.createAssetProfileSplit, + permissionOfOwnAssetProfile: + permissions.createAssetProfileSplitOfOwnAssetProfile }); return this.assetProfilesService.createSplit({ @@ -151,9 +154,12 @@ export class AssetProfilesController { @Param('id') id: string, @Param('symbol') symbol: string ): Promise { - const { id: symbolProfileId } = await this.validateCanManageSplits({ + const { id: symbolProfileId } = await this.validateAccessToSplits({ dataSource, - symbol + symbol, + permission: permissions.deleteAssetProfileSplit, + permissionOfOwnAssetProfile: + permissions.deleteAssetProfileSplitOfOwnAssetProfile }); return this.assetProfilesService.deleteSplit({ id, symbolProfileId }); @@ -180,11 +186,15 @@ export class AssetProfilesController { ); } - private async validateCanManageSplits({ + private async validateAccessToSplits({ dataSource, + permission, + permissionOfOwnAssetProfile, symbol }: { dataSource: DataSource; + permission: string; + permissionOfOwnAssetProfile: string; symbol: string; }) { const [assetProfile] = await this.symbolProfileService.getSymbolProfiles([ @@ -198,28 +208,16 @@ export class AssetProfilesController { ); } - const canManageAllAssetProfiles = - hasPermission( - this.request.user.permissions, - permissions.createMarketData - ) && - hasPermission( - this.request.user.permissions, - permissions.updateMarketData - ); + const canAccessAllAssetProfiles = hasPermission( + this.request.user.permissions, + permission + ); - const canManageOwnAssetProfile = + const canAccessOwnAssetProfile = assetProfile.userId === this.request.user.id && - hasPermission( - this.request.user.permissions, - permissions.createMarketDataOfOwnAssetProfile - ) && - hasPermission( - this.request.user.permissions, - permissions.updateMarketDataOfOwnAssetProfile - ); + hasPermission(this.request.user.permissions, permissionOfOwnAssetProfile); - if (!canManageAllAssetProfiles && !canManageOwnAssetProfile) { + if (!canAccessAllAssetProfiles && !canAccessOwnAssetProfile) { throw new HttpException( getReasonPhrase(StatusCodes.FORBIDDEN), StatusCodes.FORBIDDEN diff --git a/apps/api/src/app/user/user.service.ts b/apps/api/src/app/user/user.service.ts index b706e47023..5d60c571df 100644 --- a/apps/api/src/app/user/user.service.ts +++ b/apps/api/src/app/user/user.service.ts @@ -549,9 +549,11 @@ export class UserService { currentPermissions, permissions.accessHoldingsChart, permissions.createAccess, + permissions.createAssetProfileSplitOfOwnAssetProfile, permissions.createMarketDataOfOwnAssetProfile, permissions.createOwnTag, permissions.createWatchlistItem, + permissions.deleteAssetProfileSplitOfOwnAssetProfile, permissions.readAiPrompt, permissions.readMarketDataOfOwnAssetProfile, permissions.updateMarketDataOfOwnAssetProfile diff --git a/libs/common/src/lib/permissions.ts b/libs/common/src/lib/permissions.ts index 428de1788c..811ded68c5 100644 --- a/libs/common/src/lib/permissions.ts +++ b/libs/common/src/lib/permissions.ts @@ -12,6 +12,9 @@ export const permissions = { createAccountBalance: 'createAccountBalance', createActivity: 'createActivity', createApiKey: 'createApiKey', + createAssetProfileSplit: 'createAssetProfileSplit', + createAssetProfileSplitOfOwnAssetProfile: + 'createAssetProfileSplitOfOwnAssetProfile', createMarketData: 'createMarketData', createMarketDataOfOwnAssetProfile: 'createMarketDataOfOwnAssetProfile', createOwnTag: 'createOwnTag', @@ -23,6 +26,9 @@ export const permissions = { deleteAccount: 'deleteAccount', deleteAccountBalance: 'deleteAccountBalance', deleteActivity: 'deleteActivity', + deleteAssetProfileSplit: 'deleteAssetProfileSplit', + deleteAssetProfileSplitOfOwnAssetProfile: + 'deleteAssetProfileSplitOfOwnAssetProfile', deleteAuthDevice: 'deleteAuthDevice', deleteOwnUser: 'deleteOwnUser', deletePlatform: 'deletePlatform', @@ -80,6 +86,8 @@ export function getPermissions(aRole: Role): string[] { permissions.createWatchlistItem, permissions.deleteAccountBalance, permissions.deleteWatchlistItem, + permissions.createAssetProfileSplit, + permissions.createAssetProfileSplitOfOwnAssetProfile, permissions.createMarketData, permissions.createMarketDataOfOwnAssetProfile, permissions.createOwnTag, @@ -88,6 +96,8 @@ export function getPermissions(aRole: Role): string[] { permissions.deleteAccess, permissions.deleteAccount, permissions.deleteActivity, + permissions.deleteAssetProfileSplit, + permissions.deleteAssetProfileSplitOfOwnAssetProfile, permissions.deleteAuthDevice, permissions.deletePlatform, permissions.deleteTag, @@ -128,6 +138,7 @@ export function getPermissions(aRole: Role): string[] { permissions.createAccount, permissions.createAccountBalance, permissions.createActivity, + permissions.createAssetProfileSplitOfOwnAssetProfile, permissions.createMarketDataOfOwnAssetProfile, permissions.createOwnTag, permissions.createWatchlistItem, @@ -135,6 +146,7 @@ export function getPermissions(aRole: Role): string[] { permissions.deleteAccount, permissions.deleteAccountBalance, permissions.deleteActivity, + permissions.deleteAssetProfileSplitOfOwnAssetProfile, permissions.deleteAuthDevice, permissions.deleteWatchlistItem, permissions.readAiPrompt,