@byted-apaas/server-sdk-node 1.0.16 → 1.1.0-beta.11

package/context/db/impl/object.js

@@ -13,13 +13,15 @@ const common_1 = require("../../../application/impl/common");
 const logicV2_1 = require("../../../kunlun/operator/impl/logicV2");
 const operator_1 = require("../../../kunlun/operator/impl/operator");
 const constants_1 = require("@byted-apaas/server-common-node/constants/constants");
+const permissionUtils = require("@byted-apaas/server-common-node/utils/permissionUtils");
+const structs_1 = require("../../../common/structs");
 const queryPropertiesStore = new propertiesStore_1.default();
 // _KObject will be Mixin with [_KObjectSync, _KObjectAsync, _KObjectQuery]
 class _KObject {
     constructor(objectApiName) {
         this.apiName = '';
         if (!objectApiName) {
-            throw new server_common_node_1.exceptions.InvalidParamError("objectApiName is empty");
+            throw new server_common_node_1.exceptions.InvalidParamError('objectApiName is empty');
         }
         this.apiName = objectApiName;
     }
@@ -42,11 +44,12 @@ class _KObjectSync {
     // create, update, delete
     async create(recordMap) {
         if (!recordMap) {
-            throw new server_common_node_1.exceptions.InvalidParamError("record is empty");
+            throw new server_common_node_1.exceptions.InvalidParamError('record is empty');
         }
         if (server_common_node_1.checkUtils.isNotObject(recordMap)) {
-            throw new server_common_node_1.exceptions.InvalidParamError("record is not object");
+            throw new server_common_node_1.exceptions.InvalidParamError('record is not object');
         }
+        recordMap = permissionUtils.delUnauthField(recordMap).newRecord;
         if (this.appCtx && this.appCtx.mode == 'openSDK') {
             // request from OpenSDK
             return await (0, common_1.runCtxForOpenSDK)(this.appCtx, async () => {
@@ -59,7 +62,7 @@ class _KObjectSync {
     async delete(recordOrRecordID) {
         let recordID = 0;
         // 用户直接传入 record id 来进行删除的情况
-        if (typeof recordOrRecordID === "number") {
+        if (typeof recordOrRecordID === 'number') {
             recordID = recordOrRecordID;
         }
         else {
@@ -68,7 +71,7 @@ class _KObjectSync {
             if (server_common_node_1.checkUtils.isObject(record)) {
                 // 如果用户没有传入包含 id 的 record，则报错
                 if (!record._id) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("record._id is empty");
+                    throw new server_common_node_1.exceptions.InvalidParamError('record._id is empty');
                 }
                 recordID = record._id;
             }
@@ -82,14 +85,14 @@ class _KObjectSync {
             }
             return await Request.GetInstance().deleteRecordBySync(this.apiName, recordID, this.authType);
         }
-        throw new server_common_node_1.exceptions.InvalidParamError("record must be number or object");
+        throw new server_common_node_1.exceptions.InvalidParamError('record must be number or object');
     }
     ;
     async update(_idOrRecordMap, recordMap) {
         // record 必须包含 _id
         let record;
         // 用户显式传入 id 的情况
-        if (recordMap && typeof _idOrRecordMap === "number") {
+        if (recordMap && typeof _idOrRecordMap === 'number') {
             record = recordMap;
             record['_id'] = _idOrRecordMap;
         }
@@ -97,18 +100,19 @@ class _KObjectSync {
             // 用户隐式传入 id 的情况
             record = _idOrRecordMap;
             if (!record._id) {
-                throw new server_common_node_1.exceptions.InvalidParamError("record._id is empty");
+                throw new server_common_node_1.exceptions.InvalidParamError('record._id is empty');
             }
-            if (typeof record._id !== "number") {
-                throw new server_common_node_1.exceptions.InvalidParamError("the type of record._id is not number");
+            if (typeof record._id !== 'number') {
+                throw new server_common_node_1.exceptions.InvalidParamError('the type of record._id is not number');
             }
         }
         if (!record) {
-            throw new server_common_node_1.exceptions.InvalidParamError("param is empty");
+            throw new server_common_node_1.exceptions.InvalidParamError('param is empty');
         }
+        record = permissionUtils.delUnauthField(record).newRecord;
         let recordID = record['_id'];
         if (recordID <= 0) {
-            throw new server_common_node_1.exceptions.InvalidParamError("record._id must greater than 0");
+            throw new server_common_node_1.exceptions.InvalidParamError('record._id must greater than 0');
         }
         if (this.appCtx && this.appCtx.mode == 'openSDK') {
             // request from OpenSDK
@@ -123,23 +127,24 @@ class _KObjectSync {
     async batchCreate(recordMapList) {
         // 参数校验
         if (!this.apiName) {
-            throw new server_common_node_1.exceptions.InvalidParamError("objectApiName is empty");
+            throw new server_common_node_1.exceptions.InvalidParamError('objectApiName is empty');
         }
         if (!(recordMapList instanceof Array) || recordMapList.length === 0) {
-            throw new server_common_node_1.exceptions.InvalidParamError("param records is not an array or an empty array");
+            throw new server_common_node_1.exceptions.InvalidParamError('param records is not an array or an empty array');
         }
         for (let record of recordMapList) {
             if (server_common_node_1.checkUtils.isNotObject(record)) {
-                throw new server_common_node_1.exceptions.InvalidParamError("record is not object");
+                throw new server_common_node_1.exceptions.InvalidParamError('record is not object');
             }
         }
+        recordMapList = permissionUtils.batchDelUnauthField(recordMapList).newRecords;
         let data = (this.appCtx && this.appCtx.mode == 'openSDK') ?
             await (0, common_1.runCtxForOpenSDK)(this.appCtx, async () => {
                 return await Request.GetInstance().openSDKCreateRecordsBySync(this.apiName, recordMapList);
             }) : await Request.GetInstance().createRecordsBySync(this.apiName, recordMapList, this.authType);
         // todo: 确定函数返回值
-        if (!(data instanceof Array) && data["record_ids"]) {
-            return data["record_ids"];
+        if (!(data instanceof Array) && data.record_ids) {
+            return data.record_ids;
         }
         return data;
     }
@@ -147,10 +152,10 @@ class _KObjectSync {
     async batchDelete(idOrRecordList) {
         // 参数校验、组装
         if (!this.apiName) {
-            throw new server_common_node_1.exceptions.InvalidParamError("objectApiName is empty");
+            throw new server_common_node_1.exceptions.InvalidParamError('objectApiName is empty');
         }
         if (!(idOrRecordList instanceof Array) || idOrRecordList.length === 0) {
-            throw new server_common_node_1.exceptions.InvalidParamError("param records is not an array or an empty array");
+            throw new server_common_node_1.exceptions.InvalidParamError('param records is not an array or an empty array');
         }
         let recordIDs = [];
         for (let record of idOrRecordList) {
@@ -161,7 +166,7 @@ class _KObjectSync {
                 recordIDs.push(record._id);
             }
             else {
-                throw new server_common_node_1.exceptions.InvalidParamError("record must be number or object");
+                throw new server_common_node_1.exceptions.InvalidParamError('record must be number or object');
             }
         }
         if (this.appCtx && this.appCtx.mode == 'openSDK') {
@@ -170,23 +175,27 @@ class _KObjectSync {
                 return await Request.GetInstance().openSDKDeleteRecordsBySync(this.apiName, recordIDs);
             });
         }
-        return await Request.GetInstance().deleteRecordsBySync(this.apiName, recordIDs, this.authType);
+        const errMap = await Request.GetInstance().deleteRecordsBySync(this.apiName, recordIDs, this.authType);
+        return (0, structs_1.NewBatchResult)(recordIDs, errMap);
     }
     async batchUpdate(recordMapList) {
         // 参数校验、组装
         if (!this.apiName) {
-            throw new server_common_node_1.exceptions.InvalidParamError("objectApiName is empty");
+            throw new server_common_node_1.exceptions.InvalidParamError('objectApiName is empty');
         }
         if (!(recordMapList instanceof Array) || recordMapList.length === 0) {
-            throw new server_common_node_1.exceptions.InvalidParamError("param records is not an array or an empty array");
+            throw new server_common_node_1.exceptions.InvalidParamError('param records is not an array or an empty array');
         }
+        recordMapList = permissionUtils.batchDelUnauthField(recordMapList).newRecords;
+        const recordIDs = [];
         let recordMap = {};
         for (let record of recordMapList) {
             let recordID = record['_id'];
-            if ((typeof recordID !== "number") || recordID <= 0) {
-                throw new server_common_node_1.exceptions.InvalidParamError("record._id is empty");
+            if ((typeof recordID !== 'number') || recordID <= 0) {
+                throw new server_common_node_1.exceptions.InvalidParamError('record._id is empty');
             }
             recordMap[recordID] = record;
+            recordIDs.push(recordID);
         }
         if (this.appCtx && this.appCtx.mode == 'openSDK') {
             // request from OpenSDK
@@ -194,7 +203,8 @@ class _KObjectSync {
                 return await Request.GetInstance().openSDKUpdateRecordsBySync(this.apiName, recordMapList);
             });
         }
-        return await Request.GetInstance().updateRecordsBySync(this.apiName, recordMap, this.authType);
+        const errMap = await Request.GetInstance().updateRecordsBySync(this.apiName, recordMap, this.authType);
+        return (0, structs_1.NewBatchResult)(recordIDs, errMap);
     }
     ;
     useUserAuth() {
@@ -214,35 +224,36 @@ class _KObjectAsync {
     async batchCreateAsync(recordMapList) {
         // 参数校验
         if (!this.apiName) {
-            throw new server_common_node_1.exceptions.InvalidParamError("objectApiName is empty");
+            throw new server_common_node_1.exceptions.InvalidParamError('objectApiName is empty');
         }
         if (!(recordMapList instanceof Array) || recordMapList.length === 0) {
-            throw new server_common_node_1.exceptions.InvalidParamError("param records is not an array or an empty array");
+            throw new server_common_node_1.exceptions.InvalidParamError('param records is not an array or an empty array');
         }
         if (recordMapList.length > 1000) {
-            throw new server_common_node_1.exceptions.InvalidParamError("more than 1000 records in one operation");
+            throw new server_common_node_1.exceptions.InvalidParamError('more than 1000 records in one operation');
         }
         for (let record of recordMapList) {
             if (server_common_node_1.checkUtils.isNotObject(record)) {
-                throw new server_common_node_1.exceptions.InvalidParamError("record is not object");
+                throw new server_common_node_1.exceptions.InvalidParamError('record is not object');
             }
         }
         if (server_common_node_1.utils.stringify(recordMapList).length > 50 * 1024 * 1024) {
-            throw new server_common_node_1.exceptions.InvalidParamError("parameter records size exceeds 50MB");
+            throw new server_common_node_1.exceptions.InvalidParamError('parameter records size exceeds 50MB');
         }
+        recordMapList = permissionUtils.batchDelUnauthField(recordMapList).newRecords;
         return await Request.GetInstance().createRecordsByAsync(this.apiName, recordMapList, this.authType);
     }
     ;
     async batchDeleteAsync(recordOrIDList) {
         // 参数校验、组装
         if (!this.apiName) {
-            throw new server_common_node_1.exceptions.InvalidParamError("objectApiName is empty");
+            throw new server_common_node_1.exceptions.InvalidParamError('objectApiName is empty');
         }
         if (!(recordOrIDList instanceof Array) || recordOrIDList.length === 0) {
-            throw new server_common_node_1.exceptions.InvalidParamError("param records is not an array or an empty array");
+            throw new server_common_node_1.exceptions.InvalidParamError('param records is not an array or an empty array');
         }
         if (recordOrIDList.length > 1000) {
-            throw new server_common_node_1.exceptions.InvalidParamError("more than 1000 records in one operation");
+            throw new server_common_node_1.exceptions.InvalidParamError('more than 1000 records in one operation');
         }
         let recordIDs = [];
         for (let record of recordOrIDList) {
@@ -253,41 +264,42 @@ class _KObjectAsync {
                 recordIDs.push(record._id);
             }
             else {
-                throw new server_common_node_1.exceptions.InvalidParamError("record must be number or object");
+                throw new server_common_node_1.exceptions.InvalidParamError('record must be number or object');
             }
         }
         if (server_common_node_1.utils.stringify(recordIDs).length > 50 * 1024 * 1024) {
-            throw new server_common_node_1.exceptions.InvalidParamError("parameter records size exceeds 50MB");
+            throw new server_common_node_1.exceptions.InvalidParamError('parameter records size exceeds 50MB');
         }
         return await Request.GetInstance().deleteRecordsByAsync(this.apiName, recordIDs, this.authType);
     }
     async batchUpdateAsync(recordMapList) {
         // 参数校验、组装
         if (!this.apiName) {
-            throw new server_common_node_1.exceptions.InvalidParamError("objectApiName is empty");
+            throw new server_common_node_1.exceptions.InvalidParamError('objectApiName is empty');
         }
         if (!(recordMapList instanceof Array) || recordMapList.length === 0) {
-            throw new server_common_node_1.exceptions.InvalidParamError("param records is not an array or an empty array");
+            throw new server_common_node_1.exceptions.InvalidParamError('param records is not an array or an empty array');
         }
         if (recordMapList.length > 1000) {
-            throw new server_common_node_1.exceptions.InvalidParamError("more than 1000 records in one operation");
+            throw new server_common_node_1.exceptions.InvalidParamError('more than 1000 records in one operation');
         }
+        recordMapList = permissionUtils.batchDelUnauthField(recordMapList).newRecords;
         let recordMap = {};
         for (let record of recordMapList) {
             let recordID = record['_id'];
             if (recordID === undefined || recordID === null) {
-                throw new server_common_node_1.exceptions.InvalidParamError("record._id is empty");
+                throw new server_common_node_1.exceptions.InvalidParamError('record._id is empty');
             }
-            if (typeof recordID !== "number") {
-                throw new server_common_node_1.exceptions.InvalidParamError("the type of record._id is not number");
+            if (typeof recordID !== 'number') {
+                throw new server_common_node_1.exceptions.InvalidParamError('the type of record._id is not number');
             }
             if (recordID <= 0) {
-                throw new server_common_node_1.exceptions.InvalidParamError("record._id must greater than 0");
+                throw new server_common_node_1.exceptions.InvalidParamError('record._id must greater than 0');
             }
             recordMap[recordID] = record;
         }
         if (server_common_node_1.utils.stringify(recordMap).length > 50 * 1024 * 1024) {
-            throw new server_common_node_1.exceptions.InvalidParamError("parameter records size exceeds 50MB");
+            throw new server_common_node_1.exceptions.InvalidParamError('parameter records size exceeds 50MB');
         }
         return await Request.GetInstance().updateRecordsByAsync(this.apiName, recordMap, this.authType);
     }
@@ -373,7 +385,7 @@ class _KQuery {
             this.authType = authType;
         }
         if (!objectApiName) {
-            throw new server_common_node_1.exceptions.InvalidParamError("objectApiName is empty");
+            throw new server_common_node_1.exceptions.InvalidParamError('objectApiName is empty');
         }
         queryPropertiesStore.set(this, {
             apiName: objectApiName,
@@ -417,10 +429,10 @@ class _KQuery {
     async findAll() {
         const { queryBuilder, queryV2 } = queryPropertiesStore.get(this);
         if (queryBuilder.getOrder().length > 0) {
-            throw new server_common_node_1.exceptions.InvalidParamError("findAll does not support orderBy and orderByDesc");
+            throw new server_common_node_1.exceptions.InvalidParamError('findAll does not support orderBy and orderByDesc');
         }
         if (queryV2 && queryV2._order.length > 0) {
-            throw new server_common_node_1.exceptions.InvalidParamError("findAll does not support orderBy and orderByDesc");
+            throw new server_common_node_1.exceptions.InvalidParamError('findAll does not support orderBy and orderByDesc');
         }
         return await this.getRecordsByPage();
     }
@@ -485,7 +497,7 @@ class _KQuery {
             }
             else {
                 let criterion = (0, logic_1.buildCriterion)(queryBuilder.getLogic(), apiName, maxId);
-                rs = await Request.GetInstance().getRecordsOrCountByCriterion(apiName, await (0, logic_1.handleCriterion)(criterion), queryBuilder.fuzzySearch, [new order_1.Order("_id", "asc")], false, queryBuilder.getSelect(), 0, newLimit, false, this.authType);
+                rs = await Request.GetInstance().getRecordsOrCountByCriterion(apiName, await (0, logic_1.handleCriterion)(criterion), queryBuilder.fuzzySearch, [new order_1.Order('_id', 'asc')], false, queryBuilder.getSelect(), 0, newLimit, false, this.authType);
             }
             queryCount += rs.length;
             rs.forEach((r) => {
@@ -594,7 +606,7 @@ class _KQuery {
             else {
                 let criterion = (0, logic_1.buildCriterion)(queryBuilder.getLogic(), apiName, maxId);
                 rs = await Request.GetInstance().getRecordsOrCountByCriterion(apiName, await (0, logic_1.handleCriterion)(criterion), null, // FindAll 不再迭代
-                [new order_1.Order("_id", "asc")], false, queryBuilder.getSelect(), 0, queryBuilder_1.defaultLimit, false, this.authType);
+                [new order_1.Order('_id', 'asc')], false, queryBuilder.getSelect(), 0, queryBuilder_1.defaultLimit, false, this.authType);
             }
             rs.forEach((r) => {
                 maxId = r._id > maxId ? r._id : maxId;
@@ -762,4 +774,4 @@ function applyMixins(derivedCtor, constructors) {
     });
 }
 applyMixins(_KObject, [_KObjectSync, _KObjectAsync, _KObjectQuery]);
-applyMixins(_KApplicationObject, [_KObjectSync, _KObjectQuery]);
+applyMixins(_KApplicationObject, [_KObjectSync, _KObjectQuery]); // @ts-ignore

package/context/db/impl/oql/oql.d.ts

@@ -1,4 +1,4 @@
-import { IOql } from "./ioql";
+import { IOql } from './ioql';
 export declare class Oql implements IOql {
     oql: string;
     params: any[];

package/context/db/impl/oql/oql.js

@@ -27,7 +27,7 @@ class Oql {
         return this;
     }
     useUserAuth() {
-        this.authType = constants_1.AuthTypeUser;
+        this.authType = constants_1.AuthTypeMixUserSystem;
         return this;
     }
 }

package/context/db/impl/order.js

@@ -8,7 +8,7 @@ exports.DESC = 'desc';
 class Order {
     constructor(fieldApiName, direction) {
         this.field = fieldApiName;
-        this.type = "";
+        this.type = '';
         this.direction = direction;
     }
 }

package/context/db/impl/propertiesStore.js

@@ -9,7 +9,7 @@ class PropertiesStore {
     properties(obj) {
         const properties = this.get(obj);
         if (!properties) {
-            throw Error("Properties store error. ");
+            throw Error('Properties store error. ');
         }
         return properties;
     }

package/context/db/impl/transaction/index.d.ts

@@ -1,4 +1,4 @@
-import { ITransaction, ITransactionWithCurrentObject, TransactionObject } from "../transaction";
+import { ITransaction, ITransactionWithCurrentObject, TransactionObject } from '../transaction';
 import { TransactionOperation } from './operation';
 import { currentObjApiName } from '../../../../data';
 type uuidOrRecordIDResult = {

package/context/db/impl/transaction/index.js

@@ -7,8 +7,10 @@ const server_common_node_1 = require("@byted-apaas/server-common-node");
 const Request = require("../../../../request/interface");
 const operation_1 = require("./operation");
 const constants_1 = require("@byted-apaas/server-common-node/constants/constants");
+const permissionUtils = require("@byted-apaas/server-common-node/utils/permissionUtils");
 const assert = require('assert');
-const { v4: uuidv4 } = require("uuid");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { v4: uuidv4 } = require('uuid'); //nolint:byted_s_ts_no_require_imports
 class Transaction {
     constructor(objectApiName) {
         this.objectApiName = objectApiName;
@@ -35,15 +37,15 @@ class Transaction {
             // SDK 生成的 uuid 只是为了 Mock 住 ID 这个字段，在事务执行后并不会落库。
             registerCreate: (oldRecord) => {
                 if (this.isCommit) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("Committed transaction cannot register operations");
+                    throw new server_common_node_1.exceptions.InvalidParamError('Committed transaction cannot register operations');
                 }
                 if (!oldRecord) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("record is empty");
+                    throw new server_common_node_1.exceptions.InvalidParamError('record is empty');
                 }
                 if (server_common_node_1.checkUtils.isNotObject(oldRecord)) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("record is not object");
+                    throw new server_common_node_1.exceptions.InvalidParamError('record is not object');
                 }
-                let record = { ...oldRecord };
+                let record = permissionUtils.delUnauthField(oldRecord).newRecord;
                 let uuid = uuidv4();
                 let result = { _id: uuid };
                 record._id = uuid;
@@ -57,21 +59,22 @@ class Transaction {
             registerUpdate: (idOrRecord, record) => {
                 let recordMap;
                 if (this.isCommit) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("Committed transaction cannot register operations");
+                    throw new server_common_node_1.exceptions.InvalidParamError('Committed transaction cannot register operations');
                 }
-                if (typeof idOrRecord === "number" || typeof idOrRecord === "string") {
+                if (typeof idOrRecord === 'number' || typeof idOrRecord === 'string') {
                     recordMap = record;
-                    recordMap["_id"] = idOrRecord;
+                    recordMap._id = idOrRecord;
                 }
                 else {
                     recordMap = idOrRecord;
                 }
                 if (!recordMap) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("record is empty");
+                    throw new server_common_node_1.exceptions.InvalidParamError('record is empty');
                 }
-                let recordID = recordMap['_id'];
+                recordMap = permissionUtils.delUnauthField(recordMap).newRecord;
+                const recordID = recordMap._id;
                 if (!recordID) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("record._id is empty");
+                    throw new server_common_node_1.exceptions.InvalidParamError('record._id is empty');
                 }
                 this.operations.push(new operation_1.UpdateOperation(objectApiName, recordMap));
             },
@@ -79,24 +82,24 @@ class Transaction {
             // 注册删除和注册更新一样，ID 有可能是事务中创建的 Record，也有可能是现存的 Record，因此 ID 的类型是 string | number
             registerDelete: (idOrRecord) => {
                 if (this.isCommit) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("Committed transaction cannot register operations");
+                    throw new server_common_node_1.exceptions.InvalidParamError('Committed transaction cannot register operations');
                 }
                 if (!idOrRecord) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("record is empty");
+                    throw new server_common_node_1.exceptions.InvalidParamError('record is empty');
                 }
                 let recordId = null;
-                if (typeof idOrRecord === "number" || typeof idOrRecord === "string") {
+                if (typeof idOrRecord === 'number' || typeof idOrRecord === 'string') {
                     recordId = idOrRecord;
                 }
                 else {
                     if (server_common_node_1.checkUtils.isObject(idOrRecord)) {
                         if (!idOrRecord._id) {
-                            throw new server_common_node_1.exceptions.InvalidParamError("record._id is empty");
+                            throw new server_common_node_1.exceptions.InvalidParamError('record._id is empty');
                         }
                         recordId = idOrRecord._id;
                     }
                     else {
-                        throw new server_common_node_1.exceptions.InvalidParamError("param type should be number | string | Object. ");
+                        throw new server_common_node_1.exceptions.InvalidParamError('param type should be number | string | Object. ');
                     }
                 }
                 this.operations.push(new operation_1.DeleteOperation(objectApiName, { _id: recordId }));
@@ -104,24 +107,25 @@ class Transaction {
             // 注册批量创建
             registerBatchCreate: (recordMaps) => {
                 if (this.isCommit) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("Committed transaction cannot register operations");
+                    throw new server_common_node_1.exceptions.InvalidParamError('Committed transaction cannot register operations');
                 }
                 if (!recordMaps) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("recordMaps is empty");
+                    throw new server_common_node_1.exceptions.InvalidParamError('recordMaps is empty');
                 }
                 if (!Array.isArray(recordMaps)) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("recordMaps is not Array");
+                    throw new server_common_node_1.exceptions.InvalidParamError('recordMaps is not Array');
                 }
                 if (recordMaps.length < 1) {
                     return [];
                 }
+                recordMaps = permissionUtils.batchDelUnauthField(recordMaps).newRecords;
                 let result = [];
                 let records = [];
                 for (let oldRecord of recordMaps) {
                     let record = { ...oldRecord };
                     let uuid = uuidv4();
                     this.placeholders[uuid] = 0;
-                    record['_id'] = uuid;
+                    record._id = uuid;
                     result.push(uuid);
                     records.push(record);
                 }
@@ -131,29 +135,30 @@ class Transaction {
             },
             registerBatchUpdate: (recordMaps) => {
                 if (this.isCommit) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("Committed transaction cannot register operations");
+                    throw new server_common_node_1.exceptions.InvalidParamError('Committed transaction cannot register operations');
                 }
                 if (!recordMaps) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("recordMaps is empty");
+                    throw new server_common_node_1.exceptions.InvalidParamError('recordMaps is empty');
                 }
                 if (!Array.isArray(recordMaps)) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("recordMaps is not Array");
+                    throw new server_common_node_1.exceptions.InvalidParamError('recordMaps is not Array');
                 }
                 if (recordMaps.length < 1) {
                     return;
                 }
+                recordMaps = permissionUtils.batchDelUnauthField(recordMaps).newRecords;
                 // 判断同字段同值更新标志
                 let isSameValue = true;
                 let ids = [];
                 let flag = recordMaps[0];
                 for (let record of recordMaps) {
                     if (server_common_node_1.checkUtils.isNotObject(record)) {
-                        throw new server_common_node_1.exceptions.InvalidParamError("one record of recordMaps is not object");
+                        throw new server_common_node_1.exceptions.InvalidParamError('one record of recordMaps is not object');
                     }
-                    if (!record["_id"]) {
+                    if (!record._id) {
                         throw new server_common_node_1.exceptions.InvalidParamError(`one record of recordMaps has no _id ${JSON.stringify(record)}`);
                     }
-                    ids.push(record["_id"]);
+                    ids.push(record._id);
                     if (!deepEqualExceptID(flag, record)) {
                         isSameValue = false;
                         break;
@@ -167,7 +172,7 @@ class Transaction {
                 }
                 else {
                     for (const i in ids) {
-                        recordMaps[i]["_id"] = ids[i];
+                        recordMaps[i]._id = ids[i];
                     }
                     this.operations.push(new operation_1.BatchUpdateOperation(objectApiName, recordMaps));
                 }
@@ -175,13 +180,13 @@ class Transaction {
             // 注册批量删除
             registerBatchDelete: (idOrRecords) => {
                 if (this.isCommit) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("Committed transaction cannot register operations");
+                    throw new server_common_node_1.exceptions.InvalidParamError('Committed transaction cannot register operations');
                 }
                 if (!idOrRecords) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("idOrRecords is empty");
+                    throw new server_common_node_1.exceptions.InvalidParamError('idOrRecords is empty');
                 }
                 if (!Array.isArray(idOrRecords)) {
-                    throw new server_common_node_1.exceptions.InvalidParamError("idOrRecords is not Array");
+                    throw new server_common_node_1.exceptions.InvalidParamError('idOrRecords is not Array');
                 }
                 if (idOrRecords.length < 1) {
                     return;
@@ -189,20 +194,20 @@ class Transaction {
                 let ids = [];
                 for (const idOrRecord of idOrRecords) {
                     switch (typeof idOrRecord) {
-                        case "string":
-                        case "number":
+                        case 'string':
+                        case 'number':
                             ids.push(idOrRecord);
                             break;
-                        case "object":
-                            if (!idOrRecord['_id']) {
-                                throw new server_common_node_1.exceptions.InvalidParamError("_id of one record is empty");
+                        case 'object':
+                            if (!idOrRecord._id) {
+                                throw new server_common_node_1.exceptions.InvalidParamError('_id of one record is empty');
                             }
                             else {
-                                ids.push(idOrRecord['_id']);
+                                ids.push(idOrRecord._id);
                             }
                             break;
                         default:
-                            throw new server_common_node_1.exceptions.InvalidParamError("type of one param is not string | number | object");
+                            throw new server_common_node_1.exceptions.InvalidParamError('type of one param is not string | number | object');
                     }
                 }
                 this.operations.push(new operation_1.BatchDeleteOperation(objectApiName, { 'ids': ids }));
@@ -211,7 +216,7 @@ class Transaction {
     }
     async commit() {
         if (this.isCommit) {
-            throw new server_common_node_1.exceptions.InvalidParamError("The transaction cannot be committed repeatedly");
+            throw new server_common_node_1.exceptions.InvalidParamError('The transaction cannot be committed repeatedly');
         }
         this.isCommit = true;
         if (!this.operations || this.operations.length === 0) {
@@ -219,7 +224,7 @@ class Transaction {
         }
         let uuid2recordId = await Request.GetInstance().modifyRecordsWithTransaction(this.placeholders, this.operations, this.authType);
         if (!uuid2recordId) {
-            throw new server_common_node_1.exceptions.InternalError("uuid2recordId is empty");
+            throw new server_common_node_1.exceptions.InternalError('uuid2recordId is empty');
         }
         // 单个注册结果映射
         for (let uuid of Object.keys(this.uuid2result)) {
@@ -228,7 +233,7 @@ class Transaction {
             if (!recordId) {
                 throw new server_common_node_1.exceptions.InternalError(`uuid (${uuid}) is not in uuid2recordId (${JSON.stringify(uuid2recordId)})`);
             }
-            if (typeof (recordId) !== "number") {
+            if (typeof (recordId) !== 'number') {
                 throw new server_common_node_1.exceptions.InternalError(`the type (${typeof (recordId)}) of recordId (${recordId}) must be number`);
             }
             preResult._id = recordId;
@@ -249,7 +254,7 @@ class Transaction {
                 if (!recordId) {
                     throw new server_common_node_1.exceptions.InternalError(`uuid (${this.batchResults[i][j]}) is not in uuid2recordId (${JSON.stringify(uuid2recordId)})`);
                 }
-                if (typeof (recordId) !== "number") {
+                if (typeof (recordId) !== 'number') {
                     throw new server_common_node_1.exceptions.InternalError(`the type (${typeof (recordId)}) of recordId (${recordId}) must be number`);
                 }
                 this.batchResults[i][j] = recordId;
@@ -267,12 +272,12 @@ class Transaction {
 }
 exports.Transaction = Transaction;
 function deepEqualExceptID(left, right) {
-    let leftID = left["_id"], rightID = right["_id"];
-    delete left["_id"];
-    delete right["_id"];
+    const leftID = left._id, rightID = right._id;
+    delete left._id;
+    delete right._id;
     let result = deepEqual(left, right);
-    left["_id"] = leftID;
-    right["_id"] = rightID;
+    left._id = leftID;
+    right._id = rightID;
     return result;
 }
 function deepEqual(left, right) {