fix: remove data from ACS check

restorecommerce · Dec 11, 2024 · d561979 · d561979
1 parent 6b1ebe6
commit d561979
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/cfg/config.json b/cfg/config.json
@@ -66,6 +66,7 @@
         "items.[0].tokens",
         "messages.[0].tokens",
         "request.items.[0].tokens",
+        "request.items.[0].data",
         "response.payload.token",
         "response.payload.tokens",
         "request.subject.token",

diff --git a/src/schedulingService.ts b/src/schedulingService.ts
@@ -441,7 +441,7 @@ export class SchedulingService implements SchedulingServiceServiceImplementation
     try {
       if (!ctx) { ctx = {}; };
       ctx.subject = subject;
-      ctx.resources = request?.items;
+      ctx.resources = request?.items?.map((data, ...job) => job);
       acsResponse = await checkAccessRequest(ctx, [{
         resource: 'job',
         id: request.items.map(item => item.id)
@@ -1156,7 +1156,7 @@ export class SchedulingService implements SchedulingServiceServiceImplementation
     try {
       if (!ctx) { ctx = {}; };
       ctx.subject = subject;
-      ctx.resources = request?.items;
+      ctx.resources = request?.items?.map((data, ...obj) => obj);
       acsResponse = await checkAccessRequest(ctx,
         [{ resource: 'job', id: request.items.map(item => item.id) }],
         AuthZAction.MODIFY, Operation.isAllowed);
@@ -1240,7 +1240,7 @@ export class SchedulingService implements SchedulingServiceServiceImplementation
     try {
       if (!ctx) { ctx = {}; };
       ctx.subject = subject;
-      ctx.resources = request.items;
+      ctx.resources = request?.items?.map((data, ...job) => job);;
       acsResponse = await checkAccessRequest(ctx,
         [{ resource: 'job', id: request.items.map(item => item.id) }],
         AuthZAction.MODIFY, Operation.isAllowed);