From 5a1ab3b059cea6dccf8a8f5ff9ddc40c939eace7 Mon Sep 17 00:00:00 2001
From: kodumbeats <brandon.leckemby@gmail.com>
Date: Wed, 11 Aug 2021 21:05:19 -0400
Subject: [PATCH] Add enforce param to collections

---
 app/controllers/api/database.php | 41 ++++++++++++++++++++++++++++++++
 composer.lock                    | 12 +++++-----
 2 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/app/controllers/api/database.php b/app/controllers/api/database.php
index dd275c9c2e..c02d8d1087 100644
--- a/app/controllers/api/database.php
+++ b/app/controllers/api/database.php
@@ -15,6 +15,7 @@ use Utopia\Database\Database;
 use Utopia\Database\Document;
 use Utopia\Database\Query;
 use Utopia\Database\Adapter\MariaDB;
+use Utopia\Database\Validator\Authorization;
 use Utopia\Database\Validator\Key;
 use Utopia\Database\Validator\Permissions;
 use Utopia\Database\Validator\QueryValidator;
@@ -1138,6 +1139,14 @@ App::post('/v1/database/collections/:collectionId/documents')
             throw new Exception('Collection not found', 404);
         }
 
+        // Check collection permissions when enforced
+        if ($collection->getAttribute('enforce') === 'collection') {
+            $validator = new Authorization($collection, 'write');
+            if (!$validator->isValid($collection->getWrite())) {
+                throw new Exception('Unauthorized permissions', 401);
+            }
+        }
+
         $data['$collection'] = $collection->getId(); // Adding this param to make API easier for developers
         $data['$id'] = $documentId == 'unique()' ? $dbForExternal->getId() : $documentId;
         $data['$read'] = (is_null($read) && !$user->isEmpty()) ? ['user:'.$user->getId()] : $read ?? []; //  By default set read permissions for user
@@ -1195,6 +1204,14 @@ App::get('/v1/database/collections/:collectionId/documents')
             throw new Exception('Collection not found', 404);
         }
 
+        // Check collection permissions when enforced
+        if ($collection->getAttribute('enforce') === 'collection') {
+            $validator = new Authorization($collection, 'read');
+            if (!$validator->isValid($collection->getRead())) {
+                throw new Exception('Unauthorized permissions', 401);
+            }
+        }
+
         $queries = \array_map(function ($query) {
             return Query::parse($query);
         }, $queries);
@@ -1247,6 +1264,14 @@ App::get('/v1/database/collections/:collectionId/documents/:documentId')
             throw new Exception('Collection not found', 404);
         }
 
+        // Check collection permissions when enforced
+        if ($collection->getAttribute('enforce') === 'collection') {
+            $validator = new Authorization($collection, 'read');
+            if (!$validator->isValid($collection->getRead())) {
+                throw new Exception('Unauthorized permissions', 401);
+            }
+        }
+
         $document = $dbForExternal->getDocument($collectionId, $documentId);
 
         if ($document->isEmpty()) {
@@ -1289,6 +1314,14 @@ App::patch('/v1/database/collections/:collectionId/documents/:documentId')
             throw new Exception('Collection not found', 404);
         }
 
+        // Check collection permissions when enforced
+        if ($collection->getAttribute('enforce') === 'collection') {
+            $validator = new Authorization($collection, 'write');
+            if (!$validator->isValid($collection->getWrite())) {
+                throw new Exception('Unauthorized permissions', 401);
+            }
+        }
+
         $document = $dbForExternal->getDocument($collectionId, $documentId);
 
         if ($document->isEmpty()) {
@@ -1361,6 +1394,14 @@ App::delete('/v1/database/collections/:collectionId/documents/:documentId')
             throw new Exception('Collection not found', 404);
         }
 
+        // Check collection permissions when enforced
+        if ($collection->getAttribute('enforce') === 'collection') {
+            $validator = new Authorization($collection, 'write');
+            if (!$validator->isValid($collection->getWrite())) {
+                throw new Exception('Unauthorized permissions', 401);
+            }
+        }
+
         $document = $dbForExternal->getDocument($collectionId, $documentId);
 
         if ($document->isEmpty()) {
diff --git a/composer.lock b/composer.lock
index a5f2a3e062..8dac7bcc6d 100644
--- a/composer.lock
+++ b/composer.lock
@@ -355,16 +355,16 @@
         },
         {
             "name": "composer/package-versions-deprecated",
-            "version": "1.11.99.2",
+            "version": "1.11.99.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/composer/package-versions-deprecated.git",
-                "reference": "c6522afe5540d5fc46675043d3ed5a45a740b27c"
+                "reference": "fff576ac850c045158a250e7e27666e146e78d18"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/composer/package-versions-deprecated/zipball/c6522afe5540d5fc46675043d3ed5a45a740b27c",
-                "reference": "c6522afe5540d5fc46675043d3ed5a45a740b27c",
+                "url": "https://api.github.com/repos/composer/package-versions-deprecated/zipball/fff576ac850c045158a250e7e27666e146e78d18",
+                "reference": "fff576ac850c045158a250e7e27666e146e78d18",
                 "shasum": ""
             },
             "require": {
@@ -408,7 +408,7 @@
             "description": "Composer plugin that provides efficient querying for installed package versions (no runtime IO)",
             "support": {
                 "issues": "https://github.com/composer/package-versions-deprecated/issues",
-                "source": "https://github.com/composer/package-versions-deprecated/tree/1.11.99.2"
+                "source": "https://github.com/composer/package-versions-deprecated/tree/1.11.99.3"
             },
             "funding": [
                 {
@@ -424,7 +424,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2021-05-24T07:46:03+00:00"
+            "time": "2021-08-17T13:49:14+00:00"
         },
         {
             "name": "dragonmantank/cron-expression",