diff --git a/app/client/views/users/users.coffee b/app/client/views/users/users.coffee index 5b6c56d..b062fdd 100644 --- a/app/client/views/users/users.coffee +++ b/app/client/views/users/users.coffee @@ -1,90 +1,95 @@ Template.users.helpers users: -> Meteor.users.find( ) usersReactiveTableSettings: -> useFontAwesome: true, rowsPerPage: 15, showFilter: true, fields: [ { key: 'profile.name', label: 'name' } 'username', { key: 'emails', label: 'eMail', fn: (v,o) -> o.emails[0].address } { key: 'emails', label: 'mongoDB username', fn: (v,o) -> if Roles.userIsInRole(o, "mongoRead") then __getMongodbUsername(o) else "" } { key: 'roles', label: 'roles', fn: (v,o) -> if v? then v.sort().join(', ') else "" } { key: 'status', label: 'online', tmpl: Template.userStatusTableCell } { key: 'buttons', label: '', tmpl: Template.usersTableButtons } ] Template.usersTableButtons.helpers systemRoles: -> __systemRoles + isInRole: (_id, role) -> + Roles.userIsInRole(_id, role) + + isCurrentUser: (_id) -> + _id is Meteor.userId() + + Template.usersTableButtons.events "click .addToRole": (evt)-> id = $(evt.target).closest("button").data().id role = $(evt.target).closest("button").data().role if role is "mongoRead" swal { title: 'Password' text: """Please provide a password for mongoDB access. Because you might type it into script files, it has to be different from your user password.""" type: 'input' showCancelButton: true confirmButtonText: 'Yes' inputPlaceholder: "Please provide a password, (min: 8 characters)." closeOnConfirm: false }, (confirmedWithPassword)-> if confirmedWithPassword is false #cancel swal.close() else if !confirmedWithPassword? or confirmedWithPassword.length is 0 or confirmedWithPassword.length < 8 swal.showInputError "Please provide a password, (min: 8 characters)." else Meteor.call "addUserToRole", id, role, confirmedWithPassword, (error) -> if error? throwError error else swal.close() return else Meteor.call "addUserToRole", id, role, (error) -> throwError error if error? return "click .removeFromRole": (evt)-> evt.stopImmediatePropagation() id = $(evt.target).closest("button").data().id role = $(evt.target).closest("button").data().role swal { title: 'Are you sure?' text: 'Do you want to remove the user from the role?' type: 'warning' showCancelButton: true confirmButtonText: 'Yes' }, -> Meteor.call "removeUserFromRole", id, role, (error) -> throwError error if error "click button.removeUser": (evt) -> id = @_id + if id is Meteor.userId() + return false swal { title: 'Are you sure?' text: 'Do you really want to delete this user?' type: 'warning' showCancelButton: true confirmButtonText: 'Yes' closeOnConfirm: false }, -> swal.close() Meteor.call "removeUser", id, (error) -> if error? throwError error else swal.close() return true return false - -Template.usersTableButtons.helpers - isInRole: (_id, role) -> - Roles.userIsInRole(_id, role) diff --git a/app/client/views/users/users.html b/app/client/views/users/users.html index fb16f7e..7f516f6 100644 --- a/app/client/views/users/users.html +++ b/app/client/views/users/users.html @@ -1,38 +1,41 @@ diff --git a/app/server/methods/users.coffee b/app/server/methods/users.coffee index c35c6a6..bb2918b 100644 --- a/app/server/methods/users.coffee +++ b/app/server/methods/users.coffee @@ -1,66 +1,69 @@ Future = Npm.require('fibers/future') Meteor.methods addUserToRole: (userId, role, password) -> check(userId, String) checkIfAdmin() user = Meteor.users.findOne userId throw new Meteor.Error(403, "user not found.") unless user? #check role found = false _.some __systemRoles, (r) -> if r.role is role found = true found throw new Meteor.Error(400, "role #{role} doesn't exist.") if !found if role.indexOf('mongoRead') > -1 check(password, String) if password.length < 8 throw new Meteor.Error(400, "password doesn't meet requirements.") result = Accounts._checkPassword(user, password) if !result.error? throw new Meteor.Error(400, "the password must not be the same as the users password.") username = __getMongodbUsername user db = Meteor.users.rawDatabase() #https://mongodb.github.io/node-mongodb-native/api-generated/admin.html#adduser future = new Future db.addUser username, password, roles: [ { role: "read", db: "epiph"} ] , (error, result) -> if error? future.throw new Meteor.Error(500, error.errmsg) else future.return result future.wait() Roles.addUsersToRoles(userId, role) removeUserFromRole: (userId, role) -> check(userId, String) checkIfAdmin() user = Meteor.users.findOne userId throw new Meteor.Error(403, "user not found.") unless user? if role.indexOf('mongoRead') > -1 #https://mongodb.github.io/node-mongodb-native/api-generated/admin.html#removeuser db = Meteor.users.rawDatabase() username = __getMongodbUsername user future = new Future db.removeUser username, (error, result) -> if error? future.throw new Meteor.Error(500, error.errmsg) else future.return result future.wait() Roles.removeUsersFromRoles(userId, role) removeUser: (userId) -> check(userId, String) checkIfAdmin() - # Logout user - Meteor.users.update(userId, {$set : { "services.resume.loginTokens" : [] }}, {multi:true}) - # Delete user - Meteor.users.remove(userId) + if Meteor.userId() is userId + throw new Meteor.Error(400, "unable to delete the logged in user.") + else + # Logout user + Meteor.users.update(userId, {$set : { "services.resume.loginTokens" : [] }}, {multi:true}) + # Delete user + Meteor.users.remove(userId)