Fix logic error in permissions #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

ccev merged 18 commits into ccev:main from ComplementaryPogo:perms

Feb 1, 2026

src/hooks.server.ts

-Original file line number
+Diff line change
@@ Expand Up / @@ -24,6 +24,7 @@ setServerLoggerFactory((name) => { @@
     		info: (message, ...args) => winstonLogger.info(message, ...args),
     		warning: (message, ...args) => winstonLogger.warning(message, ...args),
     		error: (message, ...args) => winstonLogger.error(message, ...args),
+    		crit: (message, ...args) => winstonLogger.crit(message, ...args),
     	};
     });
@@ Expand Down @@

src/lib/services/user/checkPerm.ts

-Original file line number
+Diff line change
@@ -1,5 +1,12 @@
     import type { Bounds } from "@/lib/mapObjects/mapBounds";
-    import { bbox, feature as makeFeature, featureCollection, intersect, polygon } from "@turf/turf";
+    import {
+    	bbox,
+    	feature as makeFeature,
+    	featureCollection,
+    	intersect,
+    	polygon,
+    	union
+    } from "@turf/turf";
     import type { Feature, Polygon } from "geojson";
     import { Features, type FeaturesKey, type Perms } from "@/lib/utils/features";
     import { getLogger } from "@/lib/utils/logger";
@@ Expand All @@
     	return false;
     }
-    export function checkFeatureInBounds(perms: Perms, feature: FeaturesKey, bounds: Bounds): Bounds {
+    export function checkFeatureInBounds(
+    	perms: Perms,
+    	feature: FeaturesKey,
+    	bounds: Bounds
+    ): Bounds | null {
     	if (isFeatureInFeatureList(perms.everywhere, feature)) return bounds;
     	const start = performance.now();
-    	const allPolygons: Feature<Polygon>[] = [
-    		polygon([
-    			[
-    				[bounds.minLon, bounds.minLat],
-    				[bounds.minLon, bounds.maxLat],
-    				[bounds.maxLon, bounds.maxLat],
-    				[bounds.maxLon, bounds.minLat],
-    				[bounds.minLon, bounds.minLat]
-    			]
-    		])
-    	];
+    	const viewportPolygon = polygon([
+    		[
+    			[bounds.minLon, bounds.minLat],
+    			[bounds.minLon, bounds.maxLat],
+    			[bounds.maxLon, bounds.maxLat],
+    			[bounds.maxLon, bounds.minLat],
+    			[bounds.minLon, bounds.minLat]
+    		]
+    	]);
+    	const permittedPolygons: Feature<Polygon>[] = [];
     	for (const area of perms.areas) {
     		if (isFeatureInFeatureList(area.features, feature)) {
-    			allPolygons.push(makeFeature(area.polygon));
+    			if (area.polygon) {
+    				permittedPolygons.push(makeFeature(area.polygon));
+    			}
     		}
     	}
-    	if (allPolygons.length === 1) {
-    		return bounds;
+    	// If no permitted areas have this feature (or none have polygons), deny access
+    	if (permittedPolygons.length === 0) {
+    		return null;
     	}
-    	const intersection = intersect(featureCollection(allPolygons));
+    	// Find intersection of viewport with each permitted area and collect results
+    	let combinedIntersection: Feature<Polygon> | null = null;
+    	for (const permittedPolygon of permittedPolygons) {
+    		const areaIntersection = intersect(
+    			featureCollection([viewportPolygon, permittedPolygon])
+    		);
+    		if (areaIntersection) {
+    			if (!combinedIntersection) {
+    				combinedIntersection = areaIntersection as Feature<Polygon>;
+    			} else {
+    				combinedIntersection = union(
+    					featureCollection([combinedIntersection, areaIntersection as Feature<Polygon>])
+    				) as Feature<Polygon> | null;
+    			}
+    		}
+    	}
-    	console.debug(
-    		`CheckFeatureInBound for ${feature} with ${allPolygons.length} polygons took ${performance.now() - start} ms`
+    	log.debug(
+    		"calculated area intersections | areas: %d | feature: %s | any match permissions: %s | took: %fms",
+    		permittedPolygons.length,
+    		feature,
+    		Boolean(combinedIntersection),
+    		(performance.now() - start).toFixed(1)
     	);
-    	if (!intersection) return bounds;
+    	// If no intersection with any permitted area, deny access
+    	if (!combinedIntersection) {
+    		return null;
+    	}
-    	const result = bbox(intersection);
+    	const result = bbox(combinedIntersection);
     	return {
     		minLon: result[0],
@@ Expand Down @@

src/lib/utils/logger.ts

-Original file line number
+Diff line change
@@ Expand Up / @@ -7,12 +7,9 @@ export interface Logger { @@
     	info: LogFn;
     	warning: LogFn;
     	error: LogFn;
+    	crit: LogFn;
     }
-    export type DebugCategories = {
-    	permissions?: boolean;
-    };
     let serverLoggerFactory: ((name: string) => Logger) | null = null;
     export function setServerLoggerFactory(factory: (name: string) => Logger,) {
@@ Expand All / @@ -26,6 +23,7 @@ function createBrowserLogger(name: string): Logger { @@
     		info: (message, ...args) => console.info(prefix, message, ...args),
     		warning: (message, ...args) => console.warn(prefix, message, ...args),
     		error: (message, ...args) => console.error(prefix, message, ...args),
+    		crit: (message, ...args) => console.error(prefix, message, ...args),
     	};
     }
@@ Expand Down @@

src/routes/api/[queryMapObject=mapObject]/+server.ts

-Original file line number
+Diff line change
@@ Expand Up / @@ -18,6 +18,10 @@ export async function POST({ request, locals, params }) { @@
     	const type = params.queryMapObject as MapObjectType;
     	const bounds = checkFeatureInBounds(locals.perms, params.queryMapObject, data);
+    	if (!bounds) {
+    		return json({ data: [] });
+    	}
     	const queried = await queryMapObjects(type, bounds, data.filter);
     	log.info(
@@ Expand Down @@

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix logic error in permissions #71

Uh oh!

Diff view

Diff view

There are no files selected for viewing