@cerbos/orm-prisma 0.1.4 → 1.0.0

package/README.md

@@ -2,7 +2,20 @@
 
 An adapater library that takes a [Cerbos](https://cerbos.dev) Query Plan ([PlanResources API](https://docs.cerbos.dev/cerbos/latest/api/index.html#resources-query-plan)) response and converts it into a [Prisma](https://prisma.io) where class object. This is designed to work alongside a project using the [Cerbos Javascript SDK](https://github.com/cerbos/cerbos-sdk-javascript).
 
-The following conditions are supported: `and`, `or`, `eq`, `ne`, `lt`, `gt`, `lte`, `gte` and `in`.
+The following conditions are supported: `and`, `or`, `eq`, `ne`, `lt`, `gt`, `lte`, `gte` and `in`, as well as relational filters `some`, `none`, `is` and `isNot`.
+
+Not Supported:
+
+- `every`
+- `contains`
+- `search`
+- `mode`
+- `startsWith`
+- `endsWith`
+- `isSet`
+- Scalar filters
+- Atomic number operations
+- Composite keys
 
 ## Requirements
 - Cerbos > v0.16
@@ -14,13 +27,39 @@ The following conditions are supported: `and`, `or`, `eq`, `ne`, `lt`, `gt`, `lt
 npm install @cerbos/orm-prisma
 ```
 
-This package exports a single function:
+This package exports a function:
 
-```js
-queryPlanToPrisma({ queryPlan, fieldNameMapper }): PrismaCondition
+```ts
+import { queryPlanToPrisma, PlanKind } from "@cerbos/orm-prisma";
+
+queryPlanToPrisma({ queryPlan, fieldNameMapper, relationMapper }): {
+  kind: PlanKind,
+  filters?: any // a filter to pass to the findMany() function of Prisma
+}
 ```
 
-The function reqiures the full query plan from Cerbos to be passed in an object along with a `fieldNameMapper`.
+where `PlanKind` is:
+
+```ts
+export enum PlanKind {
+  /**
+   * The specified action is always allowed for the principal on resources matching the input.
+   */
+  ALWAYS_ALLOWED = "KIND_ALWAYS_ALLOWED",
+
+  /**
+   * The specified action is always denied for the principal on resources matching the input.
+   */
+  ALWAYS_DENIED = "KIND_ALWAYS_DENIED",
+
+  /**
+   * The specified action is conditionally allowed for the principal on resources matching the input.
+   */
+  CONDITIONAL = "KIND_CONDITIONAL",
+}
+```
+
+The function reqiures the full query plan from Cerbos to be passed in an object along with a `fieldNameMapper` and option `relationMapper` if the model has relations.
 
 A basic implementation can be as simple as:
 
@@ -28,6 +67,8 @@ A basic implementation can be as simple as:
 import { GRPC as Cerbos } from "@cerbos/grpc";
 import { PrismaClient } from "@prisma/client";
 
+import { queryPlanToPrisma, PlanKind } from "@cerbos/orm-prisma";
+
 const prisma = new PrismaClient();
 const cerbos = new Cerbos("localhost:3592", { tls: false });
 
@@ -40,18 +81,30 @@ const queryPlan = await cerbos.planResources({
 })
 
 // Generate the prisma filter from the query plan
-const filters = queryPlanToPrisma({
+const result = queryPlanToPrisma({
   queryPlan,
   fieldNameMapper: {
     "request.resource.attr.aFieldName": "prismaModelFieldName"
+  },
+  relationMapper: {
+    "request.resource.attr.aRelatedModel": {
+      "relation": "aRelatedModel",
+      "field": "id" // the column it is joined on
+    }
   }
 });
 
+// The query plan says the user would always be denied
+// return empty or throw an error depending on your app.
+if(result.kind == PlanKind.ALWAYS_DENIED) {
+  return console.log([]);
+}
+
 // Pass the filters in as where conditions
 // If you have prexisting where conditions, you can pass them in an AND clause
 const result = await prisma.myModel.findMany({
   where: {
-    AND: filters
+    AND: result.filters
   },
 });
 
@@ -68,7 +121,6 @@ const filters = queryPlanToPrisma({
   }
 });
 
-
 //or
 
 const filters = queryPlanToPrisma({
@@ -85,6 +137,37 @@ const filters = queryPlanToPrisma({
 });
 ```
 
+
+The `relationMapper` is used to convert references to fields which are joins at the database level
+
+```js
+const filters = queryPlanToPrisma({
+  queryPlan,
+  fieldNameMapper: {},
+  relationMapper: {
+    "request.resource.attr.aRelatedModel": {
+      "relation": "aRelatedModel",
+      "field": "id" // the column it is joined on
+    }
+  }
+});
+
+//or
+
+const filters = queryPlanToPrisma({
+  queryPlan,
+  fieldNameMapper: {},
+  relationMapper: (fieldName: string): string => {
+    if(fieldName.indexOf("request.resource.") > 0) {
+      return {
+        "relation": fieldName.replace("request.resource.attr.", ""),
+        "field": "id" // the column it is joined on
+      }
+    }
+  }
+});
+```
+
 ## Full Example
 
 A full Prisma application making use of this adapater can be found at [https://github.com/cerbos/express-prisma-cerbos](https://github.com/cerbos/express-prisma-cerbos)

package/lib/cjs/index.d.ts

@@ -1,9 +1,24 @@
-import { PlanResourcesResponse } from "@cerbos/core";
+import { PlanResourcesResponse, PlanKind as PK } from "@cerbos/core";
+export declare type PlanKind = PK;
+export declare const PlanKind: typeof PK;
+declare type FieldMapper = {
+    [key: string]: string;
+} | ((key: string) => string);
+declare type Relation = {
+    relation: string;
+    field: string;
+};
+declare type RelationMapper = {
+    [key: string]: Relation;
+} | ((key: string) => Relation);
 interface QueryPlanToPrismaArgs {
     queryPlan: PlanResourcesResponse;
-    fieldNameMapper: {
-        [key: string]: string;
-    } | ((key: string) => string);
+    fieldNameMapper: FieldMapper;
+    relationMapper?: RelationMapper;
 }
-export default function queryPlanToPrisma({ queryPlan, fieldNameMapper, }: QueryPlanToPrismaArgs): any;
+interface QueryPlanToPrismaResult {
+    kind: PlanKind;
+    filters?: any;
+}
+export declare function queryPlanToPrisma({ queryPlan, fieldNameMapper, relationMapper }: QueryPlanToPrismaArgs): QueryPlanToPrismaResult;
 export {};

package/lib/cjs/index.js

@@ -1,21 +1,49 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryPlanToPrisma = exports.PlanKind = void 0;
 const core_1 = require("@cerbos/core");
-function queryPlanToPrisma({ queryPlan, fieldNameMapper, }) {
-    if (queryPlan.kind === core_1.PlanKind.ALWAYS_ALLOWED)
-        return {};
-    if (queryPlan.kind === core_1.PlanKind.ALWAYS_DENIED)
-        return { "1": { "equals": 0 } };
-    return mapOperand(queryPlan.condition, (key) => {
+exports.PlanKind = core_1.PlanKind;
+function queryPlanToPrisma({ queryPlan, fieldNameMapper, relationMapper = {} }) {
+    const toFieldName = (key) => {
         if (typeof fieldNameMapper === "function") {
             return fieldNameMapper(key);
         }
+        else if (fieldNameMapper[key]) {
+            return fieldNameMapper[key];
+        }
         else {
-            return (fieldNameMapper[key] = fieldNameMapper[key] || key);
+            return key;
+        }
+    };
+    const toRelationName = (key) => {
+        if (typeof relationMapper === "function") {
+            return relationMapper(key);
+        }
+        else if (relationMapper[key]) {
+            return relationMapper[key];
         }
-    }, {});
+        return null;
+    };
+    switch (queryPlan.kind) {
+        case exports.PlanKind.ALWAYS_ALLOWED:
+            return {
+                kind: exports.PlanKind.ALWAYS_ALLOWED,
+                filters: {}
+            };
+        case exports.PlanKind.ALWAYS_DENIED:
+            return {
+                kind: exports.PlanKind.ALWAYS_DENIED
+            };
+        case exports.PlanKind.CONDITIONAL:
+            return {
+                kind: exports.PlanKind.CONDITIONAL,
+                filters: mapOperand(queryPlan.condition, toFieldName, toRelationName)
+            };
+        default:
+            throw Error(`Invalid query plan.`);
+    }
 }
-exports.default = queryPlanToPrisma;
+exports.queryPlanToPrisma = queryPlanToPrisma;
 function isExpression(e) {
     return e.operator !== undefined;
 }
@@ -25,58 +53,94 @@ function isValue(e) {
 function isVariable(e) {
     return e.variable !== undefined;
 }
-function getOperandName(operands) {
-    return (operands.find(o => o.hasOwnProperty("name"))).name;
+function getOperandVariable(operands) {
+    const op = operands.find(o => o.hasOwnProperty("name"));
+    if (!op)
+        return;
+    return op.name;
 }
 function getOperandValue(operands) {
-    return (operands.find(o => o.hasOwnProperty("value"))).value;
+    const op = operands.find(o => isValue(o));
+    if (!op)
+        return;
+    return op.value;
 }
-function mapOperand(operand, getFieldName, output = {}) {
-    if (isExpression(operand)) {
-        const { operator, operands } = operand;
-        switch (operator) {
-            case "and":
-                output.AND = operands.map((o) => mapOperand(o, getFieldName, {}));
-                break;
-            case "or":
-                output.OR = operands.map((o) => mapOperand(o, getFieldName, {}));
-                break;
-            case "eq":
-                output[getFieldName(getOperandName(operands))] = {
-                    equals: getOperandValue(operands),
-                };
-                break;
-            case "ne":
-                output[getFieldName(getOperandName(operands))] = {
-                    not: getOperandValue(operands),
-                };
-                break;
-            case "lt":
-                output[getFieldName(getOperandName(operands))] = {
-                    lt: getOperandValue(operands),
-                };
-                break;
-            case "gt":
-                output[getFieldName(getOperandName(operands))] = {
-                    gt: getOperandValue(operands),
-                };
-                break;
-            case "le":
-                output[getFieldName(getOperandName(operands))] = {
-                    lte: getOperandValue(operands),
-                };
-                break;
-            case "ge":
-                output[getFieldName(getOperandName(operands))] = {
-                    gte: getOperandValue(operands),
-                };
-                break;
-            case "in":
-                output[getFieldName(getOperandName(operands))] = {
-                    in: getOperandValue(operands),
-                };
-                break;
-        }
+const OPERATORS = {
+    "eq": {
+        relationalCondition: "is",
+        fieldCondition: "equals"
+    },
+    "ne": {
+        relationalCondition: "isNot",
+        fieldCondition: "not"
+    },
+    "in": {
+        relationalCondition: "some",
+        fieldCondition: "in"
+    },
+    "lt": {
+        fieldCondition: "lt"
+    },
+    "gt": {
+        fieldCondition: "gt"
+    },
+    "le": {
+        fieldCondition: "lte"
+    },
+    "ge": {
+        fieldCondition: "gte"
+    }
+};
+function mapOperand(operand, getFieldName, getRelationName, output = {}) {
+    if (!isExpression(operand))
+        throw Error(`Query plan did not contain an expression for operand ${operand}`);
+    const { operator, operands } = operand;
+    // HANDLE NESTING OPERATIONS: AND/OR/NOT
+    if (operator == "and") {
+        if (operands.length < 2)
+            throw Error("Expected atleast 2 operands");
+        output.AND = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}));
+        return output;
+    }
+    if (operator == "or") {
+        if (operands.length < 2)
+            throw Error("Expected atleast 2 operands");
+        output.OR = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}));
+        return output;
+    }
+    if (operator == "not") {
+        if (operands.length > 1)
+            throw Error("Expected only one operand");
+        output.NOT = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}))[0];
+        return output;
+    }
+    // get the operation parameters
+    const operation = OPERATORS[operator];
+    if (!operation)
+        throw Error(`Unsupported operator ${operator}`);
+    const opVariable = getOperandVariable(operands);
+    if (!opVariable)
+        throw Error(`Unexpected variable ${operands}`);
+    const opValue = getOperandValue(operands);
+    const relation = getRelationName(opVariable);
+    const fieldName = getFieldName(opVariable);
+    // There is a relational mapper for this variable
+    if (relation && operation.relationalCondition) {
+        output[relation.relation] = {
+            [operation.relationalCondition]: {
+                [relation.field]: opValue
+            }
+        };
+        return output;
+    }
+    else if (fieldName && operation.fieldCondition) {
+        // There is a field mapper for this variable
+        output[fieldName] = {
+            [operation.fieldCondition]: opValue,
+        };
+        return output;
+    }
+    else {
+        throw Error("Failed to map");
     }
-    return output;
 }

package/lib/index.d.ts

@@ -1,9 +1,24 @@
-import { PlanResourcesResponse } from "@cerbos/core";
+import { PlanResourcesResponse, PlanKind as PK } from "@cerbos/core";
+export declare type PlanKind = PK;
+export declare const PlanKind: typeof PK;
+declare type FieldMapper = {
+    [key: string]: string;
+} | ((key: string) => string);
+declare type Relation = {
+    relation: string;
+    field: string;
+};
+declare type RelationMapper = {
+    [key: string]: Relation;
+} | ((key: string) => Relation);
 interface QueryPlanToPrismaArgs {
     queryPlan: PlanResourcesResponse;
-    fieldNameMapper: {
-        [key: string]: string;
-    } | ((key: string) => string);
+    fieldNameMapper: FieldMapper;
+    relationMapper?: RelationMapper;
 }
-export default function queryPlanToPrisma({ queryPlan, fieldNameMapper, }: QueryPlanToPrismaArgs): any;
+interface QueryPlanToPrismaResult {
+    kind: PlanKind;
+    filters?: any;
+}
+export declare function queryPlanToPrisma({ queryPlan, fieldNameMapper, relationMapper }: QueryPlanToPrismaArgs): QueryPlanToPrismaResult;
 export {};

package/lib/index.js

@@ -1,17 +1,44 @@
-import { PlanKind } from "@cerbos/core";
-export default function queryPlanToPrisma({ queryPlan, fieldNameMapper, }) {
-    if (queryPlan.kind === PlanKind.ALWAYS_ALLOWED)
-        return {};
-    if (queryPlan.kind === PlanKind.ALWAYS_DENIED)
-        return { "1": { "equals": 0 } };
-    return mapOperand(queryPlan.condition, (key) => {
+import { PlanKind as PK } from "@cerbos/core";
+export const PlanKind = PK;
+export function queryPlanToPrisma({ queryPlan, fieldNameMapper, relationMapper = {} }) {
+    const toFieldName = (key) => {
         if (typeof fieldNameMapper === "function") {
             return fieldNameMapper(key);
         }
+        else if (fieldNameMapper[key]) {
+            return fieldNameMapper[key];
+        }
         else {
-            return (fieldNameMapper[key] = fieldNameMapper[key] || key);
+            return key;
+        }
+    };
+    const toRelationName = (key) => {
+        if (typeof relationMapper === "function") {
+            return relationMapper(key);
+        }
+        else if (relationMapper[key]) {
+            return relationMapper[key];
         }
-    }, {});
+        return null;
+    };
+    switch (queryPlan.kind) {
+        case PlanKind.ALWAYS_ALLOWED:
+            return {
+                kind: PlanKind.ALWAYS_ALLOWED,
+                filters: {}
+            };
+        case PlanKind.ALWAYS_DENIED:
+            return {
+                kind: PlanKind.ALWAYS_DENIED
+            };
+        case PlanKind.CONDITIONAL:
+            return {
+                kind: PlanKind.CONDITIONAL,
+                filters: mapOperand(queryPlan.condition, toFieldName, toRelationName)
+            };
+        default:
+            throw Error(`Invalid query plan.`);
+    }
 }
 function isExpression(e) {
     return e.operator !== undefined;
@@ -22,58 +49,94 @@ function isValue(e) {
 function isVariable(e) {
     return e.variable !== undefined;
 }
-function getOperandName(operands) {
-    return (operands.find(o => o.hasOwnProperty("name"))).name;
+function getOperandVariable(operands) {
+    const op = operands.find(o => o.hasOwnProperty("name"));
+    if (!op)
+        return;
+    return op.name;
 }
 function getOperandValue(operands) {
-    return (operands.find(o => o.hasOwnProperty("value"))).value;
+    const op = operands.find(o => isValue(o));
+    if (!op)
+        return;
+    return op.value;
 }
-function mapOperand(operand, getFieldName, output = {}) {
-    if (isExpression(operand)) {
-        const { operator, operands } = operand;
-        switch (operator) {
-            case "and":
-                output.AND = operands.map((o) => mapOperand(o, getFieldName, {}));
-                break;
-            case "or":
-                output.OR = operands.map((o) => mapOperand(o, getFieldName, {}));
-                break;
-            case "eq":
-                output[getFieldName(getOperandName(operands))] = {
-                    equals: getOperandValue(operands),
-                };
-                break;
-            case "ne":
-                output[getFieldName(getOperandName(operands))] = {
-                    not: getOperandValue(operands),
-                };
-                break;
-            case "lt":
-                output[getFieldName(getOperandName(operands))] = {
-                    lt: getOperandValue(operands),
-                };
-                break;
-            case "gt":
-                output[getFieldName(getOperandName(operands))] = {
-                    gt: getOperandValue(operands),
-                };
-                break;
-            case "le":
-                output[getFieldName(getOperandName(operands))] = {
-                    lte: getOperandValue(operands),
-                };
-                break;
-            case "ge":
-                output[getFieldName(getOperandName(operands))] = {
-                    gte: getOperandValue(operands),
-                };
-                break;
-            case "in":
-                output[getFieldName(getOperandName(operands))] = {
-                    in: getOperandValue(operands),
-                };
-                break;
-        }
+const OPERATORS = {
+    "eq": {
+        relationalCondition: "is",
+        fieldCondition: "equals"
+    },
+    "ne": {
+        relationalCondition: "isNot",
+        fieldCondition: "not"
+    },
+    "in": {
+        relationalCondition: "some",
+        fieldCondition: "in"
+    },
+    "lt": {
+        fieldCondition: "lt"
+    },
+    "gt": {
+        fieldCondition: "gt"
+    },
+    "le": {
+        fieldCondition: "lte"
+    },
+    "ge": {
+        fieldCondition: "gte"
+    }
+};
+function mapOperand(operand, getFieldName, getRelationName, output = {}) {
+    if (!isExpression(operand))
+        throw Error(`Query plan did not contain an expression for operand ${operand}`);
+    const { operator, operands } = operand;
+    // HANDLE NESTING OPERATIONS: AND/OR/NOT
+    if (operator == "and") {
+        if (operands.length < 2)
+            throw Error("Expected atleast 2 operands");
+        output.AND = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}));
+        return output;
+    }
+    if (operator == "or") {
+        if (operands.length < 2)
+            throw Error("Expected atleast 2 operands");
+        output.OR = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}));
+        return output;
+    }
+    if (operator == "not") {
+        if (operands.length > 1)
+            throw Error("Expected only one operand");
+        output.NOT = operands.map((o) => mapOperand(o, getFieldName, getRelationName, {}))[0];
+        return output;
+    }
+    // get the operation parameters
+    const operation = OPERATORS[operator];
+    if (!operation)
+        throw Error(`Unsupported operator ${operator}`);
+    const opVariable = getOperandVariable(operands);
+    if (!opVariable)
+        throw Error(`Unexpected variable ${operands}`);
+    const opValue = getOperandValue(operands);
+    const relation = getRelationName(opVariable);
+    const fieldName = getFieldName(opVariable);
+    // There is a relational mapper for this variable
+    if (relation && operation.relationalCondition) {
+        output[relation.relation] = {
+            [operation.relationalCondition]: {
+                [relation.field]: opValue
+            }
+        };
+        return output;
+    }
+    else if (fieldName && operation.fieldCondition) {
+        // There is a field mapper for this variable
+        output[fieldName] = {
+            [operation.fieldCondition]: opValue,
+        };
+        return output;
+    }
+    else {
+        throw Error("Failed to map");
     }
-    return output;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cerbos/orm-prisma",
-  "version": "0.1.4",
+  "version": "1.0.0",
   "homepage": "https://cerbos.dev",
   "description": "",
   "private": false,