dougal-software/lib/www/server/api/middleware/auth/access.js

const { projectOrganisations, orgAccess } = require('../../../lib/db/project/organisations');

/** Second-order function.
 * Returns a middleware that checks if the user has access to
 * `operation` in the project identified by `req.params.project`
 */
function operation (operation) {
	return async function (req, res, next) {
		if (req.user) {
			if (req.params.project) {
				if (await orgAccess(req.user.organisations, req.params.project, operation)) {
					next();
					return;
				}
			} else {
				next();
				return;
			}
		}
		next({status: 403, message: "Access denied"});
	}
}

const read = operation('read');
const write = operation('write');
const edit = operation('edit');
const admin = edit;

module.exports = {
	read,
	write,
	edit,
	admin,
};