Remove Authzforce references

Author: jason-fox

app/controllers/iot/command-listener.js

@@ -12,7 +12,6 @@ const Security = require('../security');
 const CONTEXT_BROKER = process.env.CONTEXT_BROKER || 'http://localhost:1026/ngsi-ld/v1';
 const DEVICE_BROKER = process.env.DEVICE_BROKER || CONTEXT_BROKER;
 const NGSI_LD_TENANT = process.env.NGSI_LD_TENANT !== undefined ? process.env.NGSI_LD_TENANT : 'openiot';
-const AUTHZFORCE_ENABLED = process.env.AUTHZFORCE_ENABLED || false;
 
 const port = process.env.WEB_APP_PORT || '3000';
 const devicesPort = process.env.DUMMY_DEVICES_PORT || 3001;
@@ -129,26 +128,16 @@ function sendCommand(req, res) {
         });
 }
 
-// Ringing the bell and unlocking the door are restricted actions, everything else
-// can be done by any user. This is a simple access control function to ensure
-// only users who are authorized can do certain things.
+// Tractor commands (start/stop) require equipment-supervisor; water commands (on/off) require livestock-supervisor.
+// All other actions require authentication only.
+const SUPERVISED_ACTIONS = new Set(['start', 'stop', 'on', 'off']);
+
 function accessControl(req, res, next) {
     debug('accessControl');
     const action = req.body.action;
-    if (action === 'ring') {
-        // LEVEL 2: BASIC AUTHORIZATION - Resources are accessible on a User/Verb/Resource basis
-        // LEVEL 3: ADVANCED AUTHORIZATION - Resources are accessible on XACML Rules
-        return AUTHZFORCE_ENABLED
-            ? Security.authorizeAdvancedXACML(req, res, next, '/bell/ring')
-            : Security.authorizeBasicPDP(req, res, next, '/bell/ring');
-    } else if (action === 'unlock') {
-        // LEVEL 2: BASIC AUTHORIZATION - Resources are accessible on a User/Verb/Resource basis
-        // LEVEL 3: ADVANCED AUTHORIZATION - Resources are accessible on XACML Rules
-        return AUTHZFORCE_ENABLED
-            ? Security.authorizeAdvancedXACML(req, res, next, '/door/unlock')
-            : Security.authorizeBasicPDP(req, res, next, '/door/unlock');
+    if (SUPERVISED_ACTIONS.has(action)) {
+        return Security.authorizeBasicPDP(req, res, next);
     }
-    // LEVEL 1: AUTHENTICATION ONLY - Every user is authorized, just ensure the user exists.
     return Security.authenticate(req, res, next);
 }
 

app/routes/index.js

@@ -31,7 +31,6 @@ const TRANSPORT = process.env.DUMMY_DEVICES_TRANSPORT || 'HTTP';
 const DEVICE_PAYLOAD = process.env.DUMMY_DEVICES_PAYLOAD || 'ultralight';
 const SECURE_ENDPOINTS = process.env.SECURE_ENDPOINTS || false;
 const ENTITY_LIMIT = process.env.ENTITY_LIMIT || 200;
-//const AUTHZFORCE_ENABLED = process.env.AUTHZFORCE_ENABLED || false;
 
 const NOTIFY_ATTRIBUTES = ['controlledAsset', 'type', 'filling', 'humidity', 'temperature'];
 
@@ -174,11 +173,9 @@ router.get('/device/monitor', function (req, res) {
 });
 
 // Access to IoT devices is secured by a Policy Decision Point (PDP).
-// LEVEL 1: AUTHENTICATION ONLY -  For most actions, any user is authorized, just ensure the user exists.
-// LEVEL 2: BASIC AUTHORIZATION -  Ringing the alarm bell and unlocking the Door are restricted to certain
-//                                 users.
-// LEVEL 3: XACML AUTHORIZATION -  Ringing the alarm bell and unlocking the Door are restricted via XACML
-//                                 rules to certain users at certain times of day.
+// LEVEL 1: AUTHENTICATION ONLY -  For most actions, any logged-in user is authorized.
+// LEVEL 2: BASIC AUTHORIZATION -  Tractor (start/stop) and water (on/off) commands require a
+//                                 supervisor role (equipment-supervisor or livestock-supervisor).
 router.post('/device/command', DeviceListener.accessControl, DeviceListener.sendCommand);
 
 // Retrieve Device History from STH-Comet

app/views/device-monitor.pug

@@ -11,11 +11,15 @@ block content
 
   - if (securityEnabled)
     p 
-    | A user must be logged in to activate devices, only security staff are able to  
-    strong unlock
-    |  doors and only security and managers can  
-    strong ring
-    |  the alarm bell. 
+    | A user must be logged in to activate devices, only equipment supervisors are able to  
+    strong start
+    |  and 
+    strong stop
+    |  tractors and only livestock supervisors can turn water sprinklers 
+    strong on
+    |  or 
+    strong off
+    | .