|
| 1 | +import extendAbilityForRecords from '@security/extendAbilityForRecords'; |
| 2 | +import { transformRecord, getOwnership } from '@utils/form'; |
| 3 | +import { GraphQLID, GraphQLNonNull, GraphQLError } from 'graphql'; |
| 4 | +import { DraftRecordType } from '../types'; |
| 5 | +import { logger } from '@services/logger.service'; |
| 6 | +import { graphQLAuthCheck } from '@schema/shared'; |
| 7 | +import { Context } from '@server/apollo/context'; |
| 8 | +import GraphQLJSON from 'graphql-type-json'; |
| 9 | +import { DraftRecord, Form } from '@models'; |
| 10 | +import { Types } from 'mongoose'; |
| 11 | + |
| 12 | +/** Arguments for the addDraftRecord mutation */ |
| 13 | +type AddDraftRecordArgs = { |
| 14 | + form?: string | Types.ObjectId; |
| 15 | + data: any; |
| 16 | +}; |
| 17 | + |
| 18 | +/** |
| 19 | + * Add a record to a form, if user authorized. |
| 20 | + * Throw a GraphQL error if not logged or authorized, or form not found. |
| 21 | + * TODO: we have to check form by form for that. |
| 22 | + */ |
| 23 | +export default { |
| 24 | + type: DraftRecordType, |
| 25 | + args: { |
| 26 | + form: { type: GraphQLID }, |
| 27 | + data: { type: new GraphQLNonNull(GraphQLJSON) }, |
| 28 | + }, |
| 29 | + async resolve(parent, args: AddDraftRecordArgs, context: Context) { |
| 30 | + graphQLAuthCheck(context); |
| 31 | + try { |
| 32 | + const user = context.user; |
| 33 | + |
| 34 | + // Get the form |
| 35 | + const form = await Form.findById(args.form); |
| 36 | + if (!form) { |
| 37 | + throw new GraphQLError(context.i18next.t('common.errors.dataNotFound')); |
| 38 | + } |
| 39 | + // Check the ability with permissions for this form |
| 40 | + const ability = await extendAbilityForRecords(user, form); |
| 41 | + if (ability.cannot('create', 'Record')) { |
| 42 | + throw new GraphQLError( |
| 43 | + context.i18next.t('common.errors.permissionNotGranted') |
| 44 | + ); |
| 45 | + } |
| 46 | + |
| 47 | + // Create the record instance |
| 48 | + transformRecord(args.data, form.fields); |
| 49 | + const record = new DraftRecord({ |
| 50 | + form: args.form, |
| 51 | + data: args.data, |
| 52 | + resource: form.resource ? form.resource : null, |
| 53 | + createdBy: { |
| 54 | + user: user._id.toString(), |
| 55 | + roles: user.roles.map((x) => x._id), |
| 56 | + positionAttributes: user.positionAttributes.map((x) => { |
| 57 | + return { |
| 58 | + value: x.value, |
| 59 | + category: x.category._id, |
| 60 | + }; |
| 61 | + }), |
| 62 | + }, |
| 63 | + lastUpdateForm: form.id, |
| 64 | + _createdBy: { |
| 65 | + user: { |
| 66 | + _id: context.user._id, |
| 67 | + name: context.user.name, |
| 68 | + username: context.user.username, |
| 69 | + }, |
| 70 | + }, |
| 71 | + _form: { |
| 72 | + _id: form._id, |
| 73 | + name: form.name, |
| 74 | + }, |
| 75 | + _lastUpdateForm: { |
| 76 | + _id: form._id, |
| 77 | + name: form.name, |
| 78 | + }, |
| 79 | + }); |
| 80 | + // Update the createdBy property if we pass some owner data |
| 81 | + const ownership = getOwnership(form.fields, args.data); |
| 82 | + if (ownership) { |
| 83 | + record.createdBy = { ...record.createdBy, ...ownership }; |
| 84 | + } |
| 85 | + await record.save(); |
| 86 | + return record; |
| 87 | + } catch (err) { |
| 88 | + logger.error(err.message, { stack: err.stack }); |
| 89 | + if (err instanceof GraphQLError) { |
| 90 | + throw new GraphQLError(err.message); |
| 91 | + } |
| 92 | + throw new GraphQLError( |
| 93 | + context.i18next.t('common.errors.internalServerError') |
| 94 | + ); |
| 95 | + } |
| 96 | + }, |
| 97 | +}; |
0 commit comments