@ai0x0/utils 0.0.50 → 0.1.0

package/lib/backend/route-operation/write-operation-core.d.ts

@@ -2,15 +2,21 @@ import { NextRequest } from "next/server";
 import { TypedNextRequest } from "next-rest-framework";
 import { z, ZodSchema } from "zod";
 import { type RouteOpenApiOperation } from "./open-api-operation.js";
-import { ActionFactory, RouteCatch, SessionGetter } from "./operation-common.js";
+import { AccessOptions, ActionFactory, DefaultSession, RouteCatch, SessionGetter } from "./operation-common.js";
+import { ScopeArg } from "../scope.js";
 export type PostOperationParams<IB extends ZodSchema> = z.infer<IB> & Record<string, unknown> & {
     creatorId?: string;
 };
-export interface PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable> {
+export interface PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable, TSession = DefaultSession> {
     schemas: {
         body: IB;
         response?: OB;
     };
+    /**
+     * 新建时把归属列盖成这次请求的作用域值（默认就是 creatorId = 当前用户）。
+     * can 同样生效 —— 只读角色不能新建。
+     */
+    access?: AccessOptions<TSession>;
     contentType?: string;
     openApiOperation?: RouteOpenApiOperation;
     parseBody?: (_req: NextRequest) => Promise<Record<string, unknown>>;
@@ -26,21 +32,19 @@ export interface PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema
 export declare function createPostOperationFactory<TTable>({ createAction, getTableName, }: {
     createAction: ActionFactory<TTable, (_body: Record<string, unknown>) => Promise<unknown[]>>;
     getTableName(table: TTable): string;
-}): ({ db, getSession }: {
+}): <TSession = DefaultSession>({ db, getSession, }: {
     db?: unknown;
-    getSession: SessionGetter;
-}) => <IB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, OB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: PostOperationOptions<IB, OB, TTable>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
+    getSession: SessionGetter<TSession>;
+}) => <IB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, OB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: PostOperationOptions<IB, OB, TTable, TSession>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
 export type PutOperationParams<IB extends ZodSchema> = z.infer<IB> & Record<string, unknown> & {
     editorId?: string;
 };
-export interface PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable> {
+export interface PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable, TSession = DefaultSession> {
     schemas: {
         body: IB;
         response?: OB;
     };
-    access?: {
-        byCreator?: boolean;
-    };
+    access?: AccessOptions<TSession>;
     openApiOperation?: RouteOpenApiOperation;
     table?: TTable;
     setBody?: (_req: TypedNextRequest<"PUT", "application/json", z.infer<IB>>) => Promise<Partial<z.infer<IB>>>;
@@ -52,26 +56,24 @@ export interface PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema,
     catch?: RouteCatch;
 }
 export declare function createPutOperationFactory<TTable>({ createAction, getTableName, }: {
-    createAction: ActionFactory<TTable, (_body: Record<string, unknown>, _options?: {
-        byCreator?: boolean;
+    createAction: ActionFactory<TTable, (_body: Record<string, unknown>, _options: {
+        scope: ScopeArg;
     }) => Promise<unknown>>;
     getTableName(table: TTable): string;
-}): ({ db, getSession }: {
+}): <TSession = DefaultSession>({ db, getSession, }: {
     db?: unknown;
-    getSession: SessionGetter;
-}) => <IB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, OB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: PutOperationOptions<IB, OB, TTable>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
+    getSession: SessionGetter<TSession>;
+}) => <IB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, OB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: PutOperationOptions<IB, OB, TTable, TSession>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
 export type DeleteOperationParams<B extends ZodSchema> = z.infer<B> & Record<string, unknown> & {
     creatorId?: string;
     id: string;
 };
-export interface DeleteOperationOptions<TTable, B extends ZodSchema> {
+export interface DeleteOperationOptions<TTable, B extends ZodSchema, TSession = DefaultSession> {
     table?: TTable;
     schemas?: {
         body?: B;
     };
-    access?: {
-        byCreator?: boolean;
-    };
+    access?: AccessOptions<TSession>;
     openApiOperation?: RouteOpenApiOperation;
     handler?: (_payload: {
         params: DeleteOperationParams<B>;
@@ -83,12 +85,13 @@ export interface DeleteOperationOptions<TTable, B extends ZodSchema> {
 export declare function createDeleteOperationFactory<TTable>({ createAction, getTableName, }: {
     createAction: ActionFactory<TTable, (_params: {
         id: string;
-        creatorId?: string;
+    }, _options: {
+        scope: ScopeArg;
     }) => Promise<unknown>>;
     getTableName(table: TTable): string;
-}): ({ db, getSession }: {
+}): <TSession = DefaultSession>({ db, getSession, }: {
     db?: unknown;
-    getSession: SessionGetter;
+    getSession: SessionGetter<TSession>;
 }) => <B extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>> = z.ZodObject<{
     id: z.ZodString;
-}, z.core.$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: DeleteOperationOptions<TTable, B>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;
+}, z.core.$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: DeleteOperationOptions<TTable, B, TSession>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;

package/lib/backend/route-operation/write-operation-core.js

@@ -28,12 +28,17 @@ var import_next_rest_framework = require("next-rest-framework");
 var import_zod = require("zod");
 var import_open_api_operation = require("./open-api-operation");
 var import_operation_common = require("./operation-common");
+var import_scope = require("../scope");
 function createPostOperationFactory({
   createAction,
   getTableName
 }) {
-  return ({ db, getSession }) => ({
+  return ({
+    db,
+    getSession
+  }) => ({
     schemas,
+    access,
     contentType = "application/json",
     openApiOperation,
     parseBody,
@@ -58,10 +63,14 @@ function createPostOperationFactory({
     }
   ]).handler(async (req) => {
     try {
-      const { userId } = await getSession(req) || {};
+      const { scope } = await (0, import_operation_common.resolveAccess)({
+        access,
+        loadSession: (0, import_operation_common.sessionLoader)(getSession, req),
+        method: "POST"
+      });
       const body = await (0, import_operation_common.readPostBody)(req, { contentType, parseBody });
       const extraBody = await (setBody == null ? void 0 : setBody(req)) || {};
-      const params = { creatorId: userId, ...body, ...extraBody };
+      const params = { ...scopeStamp(scope), ...body, ...extraBody };
       const raw = table && db ? (await createAction({
         bodySchema: schemas.body,
         db,
@@ -82,7 +91,10 @@ function createPutOperationFactory({
   createAction,
   getTableName
 }) {
-  return ({ db, getSession }) => ({
+  return ({
+    db,
+    getSession
+  }) => ({
     schemas,
     access,
     openApiOperation,
@@ -106,18 +118,30 @@ function createPutOperationFactory({
       status: 200
     }
   ]).handler(async (req) => {
+    var _a;
     try {
-      const { userId } = await getSession(req) || {};
+      const loadSession = (0, import_operation_common.sessionLoader)(getSession, req);
+      const { scope } = await (0, import_operation_common.resolveAccess)({
+        access,
+        loadSession,
+        method: "PUT"
+      });
       const body = await req.json();
       const extraBody = await (setBody == null ? void 0 : setBody(
         req
       )) || {};
-      const params = { editorId: userId, ...body, ...extraBody };
+      const params = {
+        // 「谁改的」与「能不能改」是两件事，所以这里自己取一次 —— 取值器带缓存，
+        // 上面 resolveAccess 若已取过就不会再往返一次。
+        editorId: (_a = await loadSession()) == null ? void 0 : _a.userId,
+        ...body,
+        ...extraBody
+      };
       const raw = table && db ? await createAction({
         bodySchema: schemas.body,
         db,
         table
-      })(params, { byCreator: (access == null ? void 0 : access.byCreator) ?? true }) : params;
+      })(params, { scope }) : params;
       const data = handler ? await handler({
         data: raw,
         params,
@@ -136,7 +160,10 @@ function createDeleteOperationFactory({
   createAction,
   getTableName
 }) {
-  return ({ db, getSession }) => ({
+  return ({
+    db,
+    getSession
+  }) => ({
     table,
     schemas,
     access,
@@ -158,14 +185,12 @@ function createDeleteOperationFactory({
       const body = bodySchema.parse(
         await req.json()
       );
-      if ((access == null ? void 0 : access.byCreator) ?? true) {
-        const { userId } = await getSession(req) || {};
-        body.creatorId = userId;
-      }
-      const data = table && db ? await createAction({ db, table })({
-        creatorId: body.creatorId,
-        id: body.id
-      }) : body;
+      const { scope } = await (0, import_operation_common.resolveAccess)({
+        access,
+        loadSession: (0, import_operation_common.sessionLoader)(getSession, req),
+        method: "DELETE"
+      });
+      const data = table && db ? await createAction({ db, table })({ id: body.id }, { scope }) : body;
       await (handler == null ? void 0 : handler({ data, params: body, req }));
       return import_next_rest_framework.TypedNextResponse.json(data, { status: 200 });
     } catch (error) {
@@ -173,6 +198,17 @@ function createDeleteOperationFactory({
     }
   });
 }
+function scopeStamp(scope) {
+  if (scope === import_scope.NO_SCOPE) {
+    return {};
+  }
+  if (Array.isArray(scope.value)) {
+    throw new Error(
+      `新建操作的作用域不能是多值：一行只能属于一个 ${scope.column}。多值作用域只用于读。`
+    );
+  }
+  return { [scope.column]: scope.value };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createDeleteOperationFactory,