@cerbos/orm-prisma 0.1.4 → 1.0.0-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +91 -8
  2. package/lib/cjs/index.d.ts +20 -5
  3. package/lib/cjs/index.js +115 -53
  4. package/lib/index.d.ts +20 -5
  5. package/lib/index.js +112 -51
  6. package/package.json +1 -1
package/README.md CHANGED
@@ -2,7 +2,20 @@
2
2
 
3
3
  An adapater library that takes a [Cerbos](https://cerbos.dev) Query Plan ([PlanResources API](https://docs.cerbos.dev/cerbos/latest/api/index.html#resources-query-plan)) response and converts it into a [Prisma](https://prisma.io) where class object. This is designed to work alongside a project using the [Cerbos Javascript SDK](https://github.com/cerbos/cerbos-sdk-javascript).
4
4
 
5
- The following conditions are supported: `and`, `or`, `eq`, `ne`, `lt`, `gt`, `lte`, `gte` and `in`.
5
+ The following conditions are supported: `and`, `or`, `eq`, `ne`, `lt`, `gt`, `lte`, `gte` and `in`, as well as relational filters `some`, `none`, `is` and `isNot`.
6
+
7
+ Not Supported:
8
+
9
+ - `every`
10
+ - `contains`
11
+ - `search`
12
+ - `mode`
13
+ - `startsWith`
14
+ - `endsWith`
15
+ - Scalar filters
16
+ - Composite type filters
17
+ - Atomic number operations
18
+ - Composite keys
6
19
 
7
20
  ## Requirements
8
21
  - Cerbos > v0.16
@@ -14,13 +27,39 @@ The following conditions are supported: `and`, `or`, `eq`, `ne`, `lt`, `gt`, `lt
14
27
  npm install @cerbos/orm-prisma
15
28
  ```
16
29
 
17
- This package exports a single function:
30
+ This package exports a function:
18
31
 
19
- ```js
20
- queryPlanToPrisma({ queryPlan, fieldNameMapper }): PrismaCondition
32
+ ```ts
33
+ import { queryPlanToPrisma, PlanKind } from "@cerbos/orm-prisma";
34
+
35
+ queryPlanToPrisma({ queryPlan, fieldNameMapper, relationMapper }): {
36
+ kind: PlanKind,
37
+ filters?: any // a filter to pass to the findMany() function of Prisma
38
+ }
21
39
  ```
22
40
 
23
- The function reqiures the full query plan from Cerbos to be passed in an object along with a `fieldNameMapper`.
41
+ where `PlanKind` is:
42
+
43
+ ```ts
44
+ export enum PlanKind {
45
+ /**
46
+ * The specified action is always allowed for the principal on resources matching the input.
47
+ */
48
+ ALWAYS_ALLOWED = "KIND_ALWAYS_ALLOWED",
49
+
50
+ /**
51
+ * The specified action is always denied for the principal on resources matching the input.
52
+ */
53
+ ALWAYS_DENIED = "KIND_ALWAYS_DENIED",
54
+
55
+ /**
56
+ * The specified action is conditionally allowed for the principal on resources matching the input.
57
+ */
58
+ CONDITIONAL = "KIND_CONDITIONAL",
59
+ }
60
+ ```
61
+
62
+ The function reqiures the full query plan from Cerbos to be passed in an object along with a `fieldNameMapper` and option `relationMapper` if the model has relations.
24
63
 
25
64
  A basic implementation can be as simple as:
26
65
 
@@ -28,6 +67,8 @@ A basic implementation can be as simple as:
28
67
  import { GRPC as Cerbos } from "@cerbos/grpc";
29
68
  import { PrismaClient } from "@prisma/client";
30
69
 
70
+ import { queryPlanToPrisma, PlanKind } from "@cerbos/orm-prisma";
71
+
31
72
  const prisma = new PrismaClient();
32
73
  const cerbos = new Cerbos("localhost:3592", { tls: false });
33
74
 
@@ -40,18 +81,30 @@ const queryPlan = await cerbos.planResources({
40
81
  })
41
82
 
42
83
  // Generate the prisma filter from the query plan
43
- const filters = queryPlanToPrisma({
84
+ const result = queryPlanToPrisma({
44
85
  queryPlan,
45
86
  fieldNameMapper: {
46
87
  "request.resource.attr.aFieldName": "prismaModelFieldName"
88
+ },
89
+ relationMapper: {
90
+ "request.resource.attr.aRelatedModel": {
91
+ "relation": "aRelatedModel",
92
+ "field": "id" // the column it is joined on
93
+ }
47
94
  }
48
95
  });
49
96
 
97
+ // The query plan says the user would always be denied
98
+ // return empty or throw an error depending on your app.
99
+ if(result.kind == PlanKind.ALWAYS_DENIED) {
100
+ return console.log([]);
101
+ }
102
+
50
103
  // Pass the filters in as where conditions
51
104
  // If you have prexisting where conditions, you can pass them in an AND clause
52
105
  const result = await prisma.myModel.findMany({
53
106
  where: {
54
- AND: filters
107
+ AND: result.filters
55
108
  },
56
109
  });
57
110
 
@@ -68,7 +121,6 @@ const filters = queryPlanToPrisma({
68
121
  }
69
122
  });
70
123
 
71
-
72
124
  //or
73
125
 
74
126
  const filters = queryPlanToPrisma({
@@ -85,6 +137,37 @@ const filters = queryPlanToPrisma({
85
137
  });
86
138
  ```
87
139
 
140
+
141
+ The `relationMapper` is used to convert references to fields which are joins at the database level
142
+
143
+ ```js
144
+ const filters = queryPlanToPrisma({
145
+ queryPlan,
146
+ fieldNameMapper: {},
147
+ relationMapper: {
148
+ "request.resource.attr.aRelatedModel": {
149
+ "relation": "aRelatedModel",
150
+ "field": "id" // the column it is joined on
151
+ }
152
+ }
153
+ });
154
+
155
+ //or
156
+
157
+ const filters = queryPlanToPrisma({
158
+ queryPlan,
159
+ fieldNameMapper: {},
160
+ relationMapper: (fieldName: string): string => {
161
+ if(fieldName.indexOf("request.resource.") > 0) {
162
+ return {
163
+ "relation": fieldName.replace("request.resource.attr.", ""),
164
+ "field": "id" // the column it is joined on
165
+ }
166
+ }
167
+ }
168
+ });
169
+ ```
170
+
88
171
  ## Full Example
89
172
 
90
173
  A full Prisma application making use of this adapater can be found at [https://github.com/cerbos/express-prisma-cerbos](https://github.com/cerbos/express-prisma-cerbos)
package/lib/cjs/index.d.ts CHANGED
@@ -1,9 +1,24 @@
1
- import { PlanResourcesResponse } from "@cerbos/core";
1
+ import { PlanResourcesResponse, PlanKind as PK } from "@cerbos/core";
2
+ export declare type PlanKind = PK;
3
+ export declare const PlanKind: typeof PK;
4
+ declare type FieldMapper = {
5
+ [key: string]: string;
6
+ } | ((key: string) => string);
7
+ declare type Relation = {
8
+ relation: string;
9
+ field: string;
10
+ };
11
+ declare type RelationMapper = {
12
+ [key: string]: Relation;
13
+ } | ((key: string) => Relation);
2
14
  interface QueryPlanToPrismaArgs {
3
15
  queryPlan: PlanResourcesResponse;
4
- fieldNameMapper: {
5
- [key: string]: string;
6
- } | ((key: string) => string);
16
+ fieldNameMapper: FieldMapper;
17
+ relationMapper?: RelationMapper;
7
18
  }
8
- export default function queryPlanToPrisma({ queryPlan, fieldNameMapper, }: QueryPlanToPrismaArgs): any;
19
+ interface QueryPlanToPrismaResult {
20
+ kind: PlanKind;
21
+ filters?: any;
22
+ }
23
+ export declare function queryPlanToPrisma({ queryPlan, fieldNameMapper, relationMapper }: QueryPlanToPrismaArgs): QueryPlanToPrismaResult;
9
24
  export {};
package/lib/cjs/index.js CHANGED
@@ -1,21 +1,39 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.queryPlanToPrisma = exports.PlanKind = void 0;
3
4
  const core_1 = require("@cerbos/core");
4
- function queryPlanToPrisma({ queryPlan, fieldNameMapper, }) {
5
- if (queryPlan.kind === core_1.PlanKind.ALWAYS_ALLOWED)
6
- return {};
7
- if (queryPlan.kind === core_1.PlanKind.ALWAYS_DENIED)
8
- return { "1": { "equals": 0 } };
9
- return mapOperand(queryPlan.condition, (key) => {
10
- if (typeof fieldNameMapper === "function") {
11
- return fieldNameMapper(key);
12
- }
13
- else {
14
- return (fieldNameMapper[key] = fieldNameMapper[key] || key);
15
- }
16
- }, {});
5
+ exports.PlanKind = core_1.PlanKind;
6
+ function queryPlanToPrisma({ queryPlan, fieldNameMapper, relationMapper = {} }) {
7
+ if (queryPlan.kind === exports.PlanKind.ALWAYS_ALLOWED)
8
+ return {
9
+ kind: exports.PlanKind.ALWAYS_ALLOWED,
10
+ filters: {}
11
+ };
12
+ if (queryPlan.kind === exports.PlanKind.ALWAYS_DENIED)
13
+ return {
14
+ kind: exports.PlanKind.ALWAYS_DENIED
15
+ };
16
+ return {
17
+ kind: exports.PlanKind.CONDITIONAL,
18
+ filters: mapOperand(queryPlan.condition, (key) => {
19
+ if (typeof fieldNameMapper === "function") {
20
+ return fieldNameMapper(key);
21
+ }
22
+ else {
23
+ return (fieldNameMapper[key] = fieldNameMapper[key] || key);
24
+ }
25
+ }, (key) => {
26
+ if (typeof relationMapper === "function") {
27
+ return relationMapper(key);
28
+ }
29
+ else if (relationMapper[key]) {
30
+ return relationMapper[key];
31
+ }
32
+ return null;
33
+ }, {})
34
+ };
17
35
  }
18
- exports.default = queryPlanToPrisma;
36
+ exports.queryPlanToPrisma = queryPlanToPrisma;
19
37
  function isExpression(e) {
20
38
  return e.operator !== undefined;
21
39
  }
@@ -26,56 +44,100 @@ function isVariable(e) {
26
44
  return e.variable !== undefined;
27
45
  }
28
46
  function getOperandName(operands) {
29
- return (operands.find(o => o.hasOwnProperty("name"))).name;
47
+ const op = operands.find(o => o.hasOwnProperty("name"));
48
+ if (!op)
49
+ return;
50
+ return op.name;
30
51
  }
31
52
  function getOperandValue(operands) {
32
- return (operands.find(o => o.hasOwnProperty("value"))).value;
53
+ const op = operands.find(o => o.hasOwnProperty("value"));
54
+ if (!op)
55
+ return;
56
+ return op.value;
33
57
  }
34
- function mapOperand(operand, getFieldName, output = {}) {
58
+ function mapOperand(operand, getFieldName, getRelationName, output = {}) {
35
59
  if (isExpression(operand)) {
36
60
  const { operator, operands } = operand;
37
- switch (operator) {
38
- case "and":
39
- output.AND = operands.map((o) => mapOperand(o, getFieldName, {}));
40
- break;
41
- case "or":
42
- output.OR = operands.map((o) => mapOperand(o, getFieldName, {}));
43
- break;
44
- case "eq":
45
- output[getFieldName(getOperandName(operands))] = {
46
- equals: getOperandValue(operands),
47
- };
48
- break;
49
- case "ne":
50
- output[getFieldName(getOperandName(operands))] = {
51
- not: getOperandValue(operands),
61
+ const opName = getOperandName(operands);
62
+ const opValue = getOperandValue(operands);
63
+ const relation = opName && getRelationName(opName);
64
+ const fieldName = opName && getFieldName(opName);
65
+ if (operator == "and") {
66
+ if (operands.length < 2)
67
+ throw Error("Expected atleast 2 operands");
68
+ output.AND = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}));
69
+ }
70
+ if (operator == "or") {
71
+ if (operands.length < 2)
72
+ throw Error("Expected atleast 2 operands");
73
+ output.OR = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}));
74
+ }
75
+ if (operator == "not") {
76
+ if (operands.length > 1)
77
+ throw Error("Expected only one operand");
78
+ output.NOT = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}))[0];
79
+ }
80
+ if (operator == "eq") {
81
+ if (relation) {
82
+ output[relation.relation] = {
83
+ is: {
84
+ [relation.field]: opValue
85
+ }
52
86
  };
53
- break;
54
- case "lt":
55
- output[getFieldName(getOperandName(operands))] = {
56
- lt: getOperandValue(operands),
87
+ }
88
+ else if (fieldName) {
89
+ output[fieldName] = {
90
+ equals: opValue,
57
91
  };
58
- break;
59
- case "gt":
60
- output[getFieldName(getOperandName(operands))] = {
61
- gt: getOperandValue(operands),
92
+ }
93
+ }
94
+ if (operator == "ne") {
95
+ if (relation) {
96
+ output[relation.relation] = {
97
+ isNot: {
98
+ [relation.field]: opValue
99
+ }
62
100
  };
63
- break;
64
- case "le":
65
- output[getFieldName(getOperandName(operands))] = {
66
- lte: getOperandValue(operands),
101
+ }
102
+ else if (fieldName) {
103
+ output[fieldName] = {
104
+ not: opValue,
67
105
  };
68
- break;
69
- case "ge":
70
- output[getFieldName(getOperandName(operands))] = {
71
- gte: getOperandValue(operands),
106
+ }
107
+ }
108
+ if (operator == "lt" && fieldName) {
109
+ output[fieldName] = {
110
+ lt: opValue,
111
+ };
112
+ }
113
+ if (operator == "gt" && fieldName) {
114
+ output[fieldName] = {
115
+ gt: opValue,
116
+ };
117
+ }
118
+ if (operator == "le" && fieldName) {
119
+ output[fieldName] = {
120
+ lte: opValue,
121
+ };
122
+ }
123
+ if (operator == "ge" && fieldName) {
124
+ output[fieldName] = {
125
+ gte: opValue,
126
+ };
127
+ }
128
+ if (operator == "in") {
129
+ if (relation) {
130
+ output[relation.relation] = {
131
+ some: {
132
+ [relation.field]: opValue
133
+ }
72
134
  };
73
- break;
74
- case "in":
75
- output[getFieldName(getOperandName(operands))] = {
76
- in: getOperandValue(operands),
135
+ }
136
+ else if (fieldName) {
137
+ output[fieldName] = {
138
+ in: opValue,
77
139
  };
78
- break;
140
+ }
79
141
  }
80
142
  }
81
143
  return output;
package/lib/index.d.ts CHANGED
@@ -1,9 +1,24 @@
1
- import { PlanResourcesResponse } from "@cerbos/core";
1
+ import { PlanResourcesResponse, PlanKind as PK } from "@cerbos/core";
2
+ export declare type PlanKind = PK;
3
+ export declare const PlanKind: typeof PK;
4
+ declare type FieldMapper = {
5
+ [key: string]: string;
6
+ } | ((key: string) => string);
7
+ declare type Relation = {
8
+ relation: string;
9
+ field: string;
10
+ };
11
+ declare type RelationMapper = {
12
+ [key: string]: Relation;
13
+ } | ((key: string) => Relation);
2
14
  interface QueryPlanToPrismaArgs {
3
15
  queryPlan: PlanResourcesResponse;
4
- fieldNameMapper: {
5
- [key: string]: string;
6
- } | ((key: string) => string);
16
+ fieldNameMapper: FieldMapper;
17
+ relationMapper?: RelationMapper;
7
18
  }
8
- export default function queryPlanToPrisma({ queryPlan, fieldNameMapper, }: QueryPlanToPrismaArgs): any;
19
+ interface QueryPlanToPrismaResult {
20
+ kind: PlanKind;
21
+ filters?: any;
22
+ }
23
+ export declare function queryPlanToPrisma({ queryPlan, fieldNameMapper, relationMapper }: QueryPlanToPrismaArgs): QueryPlanToPrismaResult;
9
24
  export {};
package/lib/index.js CHANGED
@@ -1,17 +1,34 @@
1
- import { PlanKind } from "@cerbos/core";
2
- export default function queryPlanToPrisma({ queryPlan, fieldNameMapper, }) {
1
+ import { PlanKind as PK } from "@cerbos/core";
2
+ export const PlanKind = PK;
3
+ export function queryPlanToPrisma({ queryPlan, fieldNameMapper, relationMapper = {} }) {
3
4
  if (queryPlan.kind === PlanKind.ALWAYS_ALLOWED)
4
- return {};
5
+ return {
6
+ kind: PlanKind.ALWAYS_ALLOWED,
7
+ filters: {}
8
+ };
5
9
  if (queryPlan.kind === PlanKind.ALWAYS_DENIED)
6
- return { "1": { "equals": 0 } };
7
- return mapOperand(queryPlan.condition, (key) => {
8
- if (typeof fieldNameMapper === "function") {
9
- return fieldNameMapper(key);
10
- }
11
- else {
12
- return (fieldNameMapper[key] = fieldNameMapper[key] || key);
13
- }
14
- }, {});
10
+ return {
11
+ kind: PlanKind.ALWAYS_DENIED
12
+ };
13
+ return {
14
+ kind: PlanKind.CONDITIONAL,
15
+ filters: mapOperand(queryPlan.condition, (key) => {
16
+ if (typeof fieldNameMapper === "function") {
17
+ return fieldNameMapper(key);
18
+ }
19
+ else {
20
+ return (fieldNameMapper[key] = fieldNameMapper[key] || key);
21
+ }
22
+ }, (key) => {
23
+ if (typeof relationMapper === "function") {
24
+ return relationMapper(key);
25
+ }
26
+ else if (relationMapper[key]) {
27
+ return relationMapper[key];
28
+ }
29
+ return null;
30
+ }, {})
31
+ };
15
32
  }
16
33
  function isExpression(e) {
17
34
  return e.operator !== undefined;
@@ -23,56 +40,100 @@ function isVariable(e) {
23
40
  return e.variable !== undefined;
24
41
  }
25
42
  function getOperandName(operands) {
26
- return (operands.find(o => o.hasOwnProperty("name"))).name;
43
+ const op = operands.find(o => o.hasOwnProperty("name"));
44
+ if (!op)
45
+ return;
46
+ return op.name;
27
47
  }
28
48
  function getOperandValue(operands) {
29
- return (operands.find(o => o.hasOwnProperty("value"))).value;
49
+ const op = operands.find(o => o.hasOwnProperty("value"));
50
+ if (!op)
51
+ return;
52
+ return op.value;
30
53
  }
31
- function mapOperand(operand, getFieldName, output = {}) {
54
+ function mapOperand(operand, getFieldName, getRelationName, output = {}) {
32
55
  if (isExpression(operand)) {
33
56
  const { operator, operands } = operand;
34
- switch (operator) {
35
- case "and":
36
- output.AND = operands.map((o) => mapOperand(o, getFieldName, {}));
37
- break;
38
- case "or":
39
- output.OR = operands.map((o) => mapOperand(o, getFieldName, {}));
40
- break;
41
- case "eq":
42
- output[getFieldName(getOperandName(operands))] = {
43
- equals: getOperandValue(operands),
44
- };
45
- break;
46
- case "ne":
47
- output[getFieldName(getOperandName(operands))] = {
48
- not: getOperandValue(operands),
57
+ const opName = getOperandName(operands);
58
+ const opValue = getOperandValue(operands);
59
+ const relation = opName && getRelationName(opName);
60
+ const fieldName = opName && getFieldName(opName);
61
+ if (operator == "and") {
62
+ if (operands.length < 2)
63
+ throw Error("Expected atleast 2 operands");
64
+ output.AND = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}));
65
+ }
66
+ if (operator == "or") {
67
+ if (operands.length < 2)
68
+ throw Error("Expected atleast 2 operands");
69
+ output.OR = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}));
70
+ }
71
+ if (operator == "not") {
72
+ if (operands.length > 1)
73
+ throw Error("Expected only one operand");
74
+ output.NOT = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}))[0];
75
+ }
76
+ if (operator == "eq") {
77
+ if (relation) {
78
+ output[relation.relation] = {
79
+ is: {
80
+ [relation.field]: opValue
81
+ }
49
82
  };
50
- break;
51
- case "lt":
52
- output[getFieldName(getOperandName(operands))] = {
53
- lt: getOperandValue(operands),
83
+ }
84
+ else if (fieldName) {
85
+ output[fieldName] = {
86
+ equals: opValue,
54
87
  };
55
- break;
56
- case "gt":
57
- output[getFieldName(getOperandName(operands))] = {
58
- gt: getOperandValue(operands),
88
+ }
89
+ }
90
+ if (operator == "ne") {
91
+ if (relation) {
92
+ output[relation.relation] = {
93
+ isNot: {
94
+ [relation.field]: opValue
95
+ }
59
96
  };
60
- break;
61
- case "le":
62
- output[getFieldName(getOperandName(operands))] = {
63
- lte: getOperandValue(operands),
97
+ }
98
+ else if (fieldName) {
99
+ output[fieldName] = {
100
+ not: opValue,
64
101
  };
65
- break;
66
- case "ge":
67
- output[getFieldName(getOperandName(operands))] = {
68
- gte: getOperandValue(operands),
102
+ }
103
+ }
104
+ if (operator == "lt" && fieldName) {
105
+ output[fieldName] = {
106
+ lt: opValue,
107
+ };
108
+ }
109
+ if (operator == "gt" && fieldName) {
110
+ output[fieldName] = {
111
+ gt: opValue,
112
+ };
113
+ }
114
+ if (operator == "le" && fieldName) {
115
+ output[fieldName] = {
116
+ lte: opValue,
117
+ };
118
+ }
119
+ if (operator == "ge" && fieldName) {
120
+ output[fieldName] = {
121
+ gte: opValue,
122
+ };
123
+ }
124
+ if (operator == "in") {
125
+ if (relation) {
126
+ output[relation.relation] = {
127
+ some: {
128
+ [relation.field]: opValue
129
+ }
69
130
  };
70
- break;
71
- case "in":
72
- output[getFieldName(getOperandName(operands))] = {
73
- in: getOperandValue(operands),
131
+ }
132
+ else if (fieldName) {
133
+ output[fieldName] = {
134
+ in: opValue,
74
135
  };
75
- break;
136
+ }
76
137
  }
77
138
  }
78
139
  return output;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cerbos/orm-prisma",
3
- "version": "0.1.4",
3
+ "version": "1.0.0-alpha.0",
4
4
  "homepage": "https://cerbos.dev",
5
5
  "description": "",
6
6
  "private": false,