feat(core): add module tickets policy and routes of server side

modules/tickets/server/policies/tickets.server.policy.js

@@ -0,0 +1,50 @@
+'use strict';
+
+/**
+ * Module dependencies
+ */
+var acl = require('acl');
+
+// Using the memory backend
+acl = new acl(new acl.memoryBackend());
+
+/**
+ * Invoke Invitations Permissions
+ */
+exports.invokeRolesPolicies = function () {
+  acl.allow(
+    [
+      {
+        roles: ['admin', 'oper', 'user'],
+        allows: [
+          {resources: '/api/messageTickets', permissions: '*'},
+          {resources: '/api/messageTickets/:messageTicketId', permissions: '*'}
+        ]
+      }
+    ]
+  );
+};
+
+/**
+ * Check If Invitations Policy Allows
+ */
+exports.isAllowed = function (req, res, next) {
+  var roles = (req.user) ? req.user.roles : ['guest'];
+
+  // Check for user roles
+  acl.areAnyRolesAllowed(roles, req.route.path, req.method.toLowerCase(), function (err, isAllowed) {
+    if (err) {
+      // An authorization error occurred
+      return res.status(500).send('Unexpected authorization error');
+    } else {
+      if (isAllowed) {
+        // Access granted! Invoke next middleware
+        return next();
+      } else {
+        return res.status(403).json({
+          message: 'User is not authorized'
+        });
+      }
+    }
+  });
+};

modules/tickets/server/routes/tickets.server.routes.js

@@ -0,0 +1,21 @@
+'use strict';
+
+/**
+ * Module dependencies
+ */
+var ticketsPolicy = require('../policies/tickets.server.policy'),
+  tickets = require('../controllers/tickets.server.controller');
+
+module.exports = function (app) {
+  app.route('/api/messageTickets').all(ticketsPolicy.isAllowed)
+    .get(tickets.list)
+    .post(tickets.create)
+    .delete(tickets.delete);
+
+  app.route('/api/messageTickets/:messageTicketId').all(ticketsPolicy.isAllowed)
+    .delete(tickets.delete)
+    .put(tickets.update)
+    .post(tickets.createReply);
+
+  app.param('messageTicketId', tickets.messageTicketById);
+};