From 8dc8779fe58040fb5c2a763d6519e57ddffc7ab7 Mon Sep 17 00:00:00 2001
From: Anton Tranelis <mail@antontranelis.de>
Date: Wed, 24 Jul 2024 15:16:40 +0200
Subject: [PATCH] fix permission logic

---
 .../Map/Subcomponents/ItemFormPopup.tsx       |  1 -
 .../ItemPopupComponents/HeaderView.tsx        |  2 +-
 src/Components/Map/hooks/usePermissions.tsx   | 53 ++++++++++++-------
 3 files changed, 34 insertions(+), 22 deletions(-)

diff --git a/src/Components/Map/Subcomponents/ItemFormPopup.tsx b/src/Components/Map/Subcomponents/ItemFormPopup.tsx
index 1f3237bc..5d266ec9 100644
--- a/src/Components/Map/Subcomponents/ItemFormPopup.tsx
+++ b/src/Components/Map/Subcomponents/ItemFormPopup.tsx
@@ -83,7 +83,6 @@ export function ItemFormPopup(props: ItemFormPopupProps) {
         }
         else {
             const item = items.find(i => i.user_created?.id === user?.id && i.layer?.itemType.name === props.layer.itemType.name);
-            console.log(item);
             
             const uuid = crypto.randomUUID();
             let success = false;
diff --git a/src/Components/Map/Subcomponents/ItemPopupComponents/HeaderView.tsx b/src/Components/Map/Subcomponents/ItemPopupComponents/HeaderView.tsx
index d8e90ba0..141151e4 100644
--- a/src/Components/Map/Subcomponents/ItemPopupComponents/HeaderView.tsx
+++ b/src/Components/Map/Subcomponents/ItemPopupComponents/HeaderView.tsx
@@ -91,7 +91,7 @@ export function HeaderView({ item, api, editCallback, deleteCallback, setPositio
                 </svg>
               </label>
               <ul tabIndex={0} className="tw-dropdown-content tw-menu tw-p-2 tw-shadow tw-bg-base-100 tw-rounded-box tw-z-1000">
-                {((api?.updateItem && hasUserPermission(api.collectionName!, "update", item)) || item.layer?.customEditLink) && editCallback && <li>
+                {((api?.updateItem && hasUserPermission(api.collectionName!, "update", item))) && editCallback && <li>
                   <a className="!tw-text-base-content tw-cursor-pointer" onClick={(e) => item.layer?.customEditLink ? navigate(`${item.layer.customEditLink}${item.layer.customEditParameter ? `/${getValue(item, item.layer.customEditParameter)}${params && "?"+params}` : ""} `) : editCallback(e)}>
                     <svg xmlns="http://www.w3.org/2000/svg" className="tw-h-5 tw-w-5" viewBox="0 0 20 20" fill="currentColor">
                       <path d="M13.586 3.586a2 2 0 112.828 2.828l-.793.793-2.828-2.828.793-.793zM11.379 5.793L3 14.172V17h2.828l8.38-8.379-2.83-2.828z" />
diff --git a/src/Components/Map/hooks/usePermissions.tsx b/src/Components/Map/hooks/usePermissions.tsx
index b4e65eac..d0dd9bbb 100644
--- a/src/Components/Map/hooks/usePermissions.tsx
+++ b/src/Components/Map/hooks/usePermissions.tsx
@@ -63,33 +63,46 @@ function usePermissionsManager(initialPermissions: Permission[]): {
   }, []);
 
   const hasUserPermission = useCallback(
-    (collectionName: string, action: PermissionAction, item?: Item, layer?: LayerProps) => {               
+    (
+      collectionName: string, 
+      action: PermissionAction, 
+      item?: Item, 
+      layer?: LayerProps
+    ) => {
+      const evaluateCondition = (condition: any) => {
+        if (condition.user_created?._eq === "$CURRENT_USER") {
+          return item?.user_created?.id === user?.id;
+        }
+        if (condition.public_edit?._eq === true) {
+          return item?.public_edit === true;
+        }
+        return false;
+      };
+  
+      const evaluatePermissions = (permissionConditions: any) => {
+        return permissionConditions._and?.every((andCondition: any) => 
+          andCondition._or 
+            ? andCondition._or.some((orCondition: any) => evaluateCondition(orCondition))
+            : evaluateCondition(andCondition)
+        );
+      };
+  
       if (permissions.length === 0) return true;
       else if (user && user.role === adminRole) return true;
       else {
         return permissions.some(p =>
           p.action === action &&
           p.collection === collectionName &&
-          p.role === user?.role &&
           (
-            // Wenn 'item' nicht gesetzt ist, ignorieren wir die Überprüfung von 'user_created'
-            !item || !p.permissions || !p.permissions._and ||
-            p.permissions._and.some(condition => 
-              condition.user_created &&
-              condition.user_created._eq === "$CURRENT_USER" &&
-              item.user_created?.id === user?.id
-            )
-          )
-          || 
-          (layer?.public_edit_items || item?.layer?.public_edit_items) &&
-          (
-            // Wenn 'item' nicht gesetzt ist, ignorieren wir die Überprüfung von 'public_edit'
-            !item || 
-            p.permissions?._and?.some(condition => 
-              condition.public_edit &&
-              condition.public_edit._eq == true &&
-              item.public_edit == true
-            )
+            (p.role === user?.role &&
+            (
+              !item || !p.permissions || evaluatePermissions(p.permissions)
+            )) ||
+            (p.role == null &&
+            (
+              (layer?.public_edit_items || item?.layer?.public_edit_items) &&
+              (!item || !p.permissions || evaluatePermissions(p.permissions))
+            ))
           )
         );
       }