data, logs, logs-content, story, story-content: Added permission check in UI to hide disallowed actions.

middleware/locals.js

@@ -1,3 +1,5 @@
+const config = require("../config")
+
 module.exports = (req, res, next) => {
   if (res.marko) {
     res.markoAsync = async(template, input) => {
@@ -10,6 +12,10 @@ module.exports = (req, res, next) => {
             locals[key] = await value
           }
         }
+
+        if (locals.user.permissions != null) {
+          locals.user.permissions = await locals.user.permissions
+        }
       } catch(err) {
         if (JSON.stringify(err) === "{}") {
           return next(err)
@@ -26,6 +32,7 @@ module.exports = (req, res, next) => {
     res.locals.user = {
       loggedIn: true,
       name: req.user._json.name,
+      permissions: getPermissions(req.user._json.name),
     }
   } else {
     res.locals.user = {
@@ -34,4 +41,32 @@ module.exports = (req, res, next) => {
   }
 
   next()
+}
+
+function getPermissions(user) {
+  return fetch(config.graphqlEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${generateToken(user, ["member"])}`,
+    },
+    body: '{"query":"query { token { user { permissions } } }", "variables": {}}',
+    credentials: "include",
+  }).then(res => {
+    return res.json()
+  }).then(json => {
+    return json.data.token.user.permissions
+  }).catch(err => {
+    console.error(err)
+    return []
+  })
+}
+
+const jwt = require("jsonwebtoken")
+/**
+ * @param {string} user 
+ * @param {string[]} permissions 
+ */
+function generateToken(user, permissions) {
+  return jwt.sign({user, permissions, exp: Math.floor((Date.now() / 1000) + 1200)}, config.backend.secret, {header: {kid: config.backend.kid}})
 }