From 13816f2e38776f620c9ffe1a0006a980a80611e3 Mon Sep 17 00:00:00 2001
From: Finley Ge <32237950+FinleyGe@users.noreply.github.com>
Date: Wed, 30 Oct 2024 11:50:25 +0800
Subject: [PATCH] fix: app/dataset auth (#3021)

---
 projects/app/src/pages/api/core/app/list.ts   | 44 +++++-------
 .../app/src/pages/api/core/dataset/list.ts    | 71 ++++++++-----------
 2 files changed, 48 insertions(+), 67 deletions(-)

diff --git a/projects/app/src/pages/api/core/app/list.ts b/projects/app/src/pages/api/core/app/list.ts
index 8b80b0b28..20c1328ce 100644
--- a/projects/app/src/pages/api/core/app/list.ts
+++ b/projects/app/src/pages/api/core/app/list.ts
@@ -120,47 +120,39 @@ async function handler(req: ApiRequestProps<ListAppBody>): Promise<AppListItemTy
   const filterApps = myApps
     .map((app) => {
       const { Per, privateApp } = (() => {
-        // Inherit app
-        if (app.inheritPermission && ParentApp && !AppFolderTypeList.includes(app.type)) {
-          const tmbPer = perList.find(
-            (item) => String(item.resourceId) === String(ParentApp._id) && !!item.tmbId
+        const myPerList = perList.filter(
+          (item) =>
+            String(item.tmbId) === String(tmbId) || myGroupIds.includes(String(item.groupId))
+        );
+        const getPer = (id: string) => {
+          const tmbPer = myPerList.find(
+            (item) => String(item.resourceId) === id && !!item.tmbId
           )?.permission;
           const groupPer = getGroupPer(
-            perList
+            myPerList
               .filter(
                 (item) =>
-                  String(item.resourceId) === String(ParentApp._id) &&
-                  myGroupIds.includes(String(item.groupId))
+                  String(item.resourceId) === id && myGroupIds.includes(String(item.groupId))
               )
               .map((item) => item.permission)
           );
 
+          const clbCount = perList.filter((item) => String(item.resourceId) === id).length;
+
           return {
             Per: new AppPermission({
               per: tmbPer ?? groupPer ?? AppDefaultPermissionVal,
               isOwner: String(app.tmbId) === String(tmbId) || myPer.isOwner
             }),
-            privateApp:
-              perList.filter((item) => String(item.resourceId) === String(app._id)).length <= 1
+            privateApp: AppFolderTypeList.includes(app.type) ? clbCount <= 1 : clbCount === 0
           };
+        };
+
+        // Inherit app
+        if (app.inheritPermission && ParentApp && !AppFolderTypeList.includes(app.type)) {
+          return getPer(String(ParentApp._id));
         } else {
-          const tmbPer = perList.find(
-            (item) => String(item.resourceId) === String(app._id) && !!item.tmbId
-          )?.permission;
-          const group = perList.filter(
-            (item) =>
-              String(item.resourceId) === String(app._id) &&
-              myGroupIds.includes(String(item.groupId))
-          );
-          const groupPer = getGroupPer(group.map((item) => item.permission));
-          return {
-            Per: new AppPermission({
-              per: tmbPer ?? groupPer ?? AppDefaultPermissionVal,
-              isOwner: String(app.tmbId) === String(tmbId) || myPer.isOwner
-            }),
-            privateApp:
-              perList.filter((item) => String(item.resourceId) === String(app._id)).length <= 1
-          };
+          return getPer(String(app._id));
         }
       })();
 
diff --git a/projects/app/src/pages/api/core/dataset/list.ts b/projects/app/src/pages/api/core/dataset/list.ts
index a231d74f2..40aaba81b 100644
--- a/projects/app/src/pages/api/core/dataset/list.ts
+++ b/projects/app/src/pages/api/core/dataset/list.ts
@@ -103,50 +103,39 @@ async function handler(req: ApiRequestProps<GetDatasetListBody>) {
   const filterDatasets = myDatasets
     .map((dataset) => {
       const { Per, privateDataset } = (() => {
+        const myPerList = perList.filter(
+          (item) =>
+            String(item.tmbId) === String(tmbId) || myGroupIds.includes(String(item.groupId))
+        );
+
+        const getPer = (id: string) => {
+          const tmbPer = myPerList.find(
+            (item) => String(item.resourceId) === id && !!item.tmbId
+          )?.permission;
+          const groupPer = getGroupPer(
+            myPerList
+              .filter(
+                (item) =>
+                  String(item.resourceId) === id && myGroupIds.includes(String(item.groupId))
+              )
+              .map((item) => item.permission)
+          );
+
+          const clbCount = perList.filter((item) => String(item.resourceId) === id).length;
+
+          return {
+            Per: new DatasetPermission({
+              per: tmbPer ?? groupPer ?? DatasetDefaultPermissionVal,
+              isOwner: String(dataset.tmbId) === String(tmbId) || myPer.isOwner
+            }),
+            privateDataset: dataset.type === 'folder' ? clbCount <= 1 : clbCount === 0
+          };
+        };
         // inherit
         if (dataset.inheritPermission && parentDataset && dataset.type !== DatasetTypeEnum.folder) {
-          const tmbPer = perList.find(
-            (item) => String(item.resourceId) === String(parentDataset._id) && !!item.tmbId
-          )?.permission;
-          const groupPer = getGroupPer(
-            perList
-              .filter(
-                (item) =>
-                  String(item.resourceId) === String(parentDataset._id) &&
-                  myGroupIds.includes(String(item.groupId))
-              )
-              .map((item) => item.permission)
-          );
-          return {
-            Per: new DatasetPermission({
-              per: tmbPer ?? groupPer ?? DatasetDefaultPermissionVal,
-              isOwner: String(parentDataset.tmbId) === tmbId || myPer.isOwner
-            }),
-            privateDataset:
-              perList.filter((item) => String(item.resourceId) === String(dataset._id)).length <= 1
-          };
+          return getPer(String(parentDataset._id));
         } else {
-          const tmbPer = perList.find(
-            (item) =>
-              String(item.resourceId) === String(dataset._id) && !!item.tmbId && !!item.permission
-          )?.permission;
-          const groupPer = getGroupPer(
-            perList
-              .filter(
-                (item) =>
-                  String(item.resourceId) === String(dataset._id) &&
-                  myGroupIds.includes(String(item.groupId))
-              )
-              .map((item) => item.permission)
-          );
-          return {
-            Per: new DatasetPermission({
-              per: tmbPer ?? groupPer ?? DatasetDefaultPermissionVal,
-              isOwner: String(dataset.tmbId) === tmbId || myPer.isOwner
-            }),
-            privateDataset:
-              perList.filter((item) => String(item.resourceId) === String(dataset._id)).length <= 1
-          };
+          return getPer(String(dataset._id));
         }
       })();