@cloudbase/manager-node 4.11.0-alpha.1 → 4.11.0-alpha.11

package/lib/permission/index.js

@@ -0,0 +1,310 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionService = void 0;
+const utils_1 = require("../utils");
+const PERMISSION_BY_RESOURCE = {
+    function: ['CUSTOM'],
+    storage: ['READONLY', 'PRIVATE', 'ADMINWRITE', 'ADMINONLY', 'CUSTOM'],
+    table: ['READONLY', 'PRIVATE', 'ADMINWRITE', 'ADMINONLY'],
+    collection: ['READONLY', 'PRIVATE', 'ADMINWRITE', 'ADMINONLY', 'CUSTOM']
+};
+class PermissionService {
+    constructor(environment) {
+        this.environment = environment;
+        this.tcbService = new utils_1.CloudService(environment.cloudBaseContext, 'tcb', '2018-06-08');
+    }
+    async modifyResourcePermission(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { resourceType, resource, permission, securityRule } = options;
+        if (!resourceType || !PERMISSION_BY_RESOURCE[resourceType]) {
+            throw new Error('Invalid resourceType');
+        }
+        const isFunctionResourceType = resourceType === 'function';
+        const hasValidResourceValue = typeof resource === 'string' && resource.trim().length > 0;
+        if (!isFunctionResourceType && !hasValidResourceValue) {
+            throw new Error('Invalid resource');
+        }
+        const allowed = PERMISSION_BY_RESOURCE[resourceType];
+        if (!allowed.includes(permission)) {
+            throw new Error(`Permission ${permission} is not allowed for resourceType ${resourceType}`);
+        }
+        if (permission === 'CUSTOM') {
+            if (typeof securityRule !== 'string' || securityRule.trim().length === 0) {
+                throw new Error('securityRule is required when permission is CUSTOM');
+            }
+            // // 校验 JSON 字符串合法性
+            // try {
+            //     JSON.parse(securityRule)
+            // } catch {
+            //     throw new Error('securityRule must be a valid JSON string')
+            // }
+        }
+        const reqData = Object.assign({ EnvId, ResourceType: resourceType, Permission: permission }, (hasValidResourceValue || !isFunctionResourceType ? { Resource: resource } : {}));
+        if (permission === 'CUSTOM') {
+            reqData.SecurityRule = securityRule;
+        }
+        return this.tcbService.request('ModifyResourcePermission', reqData);
+    }
+    async describeResourcePermission(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { resourceType, resources } = options;
+        if (!resourceType || !PERMISSION_BY_RESOURCE[resourceType]) {
+            throw new Error('Invalid resourceType');
+        }
+        if (resources !== undefined) {
+            if (!Array.isArray(resources)) {
+                throw new Error('Invalid resources');
+            }
+            if (resources.length > 100) {
+                throw new Error('resources length must be <= 100');
+            }
+            const invalid = resources.find(item => typeof item !== 'string' || item.trim().length === 0);
+            if (invalid !== undefined) {
+                throw new Error('resources contains invalid item');
+            }
+        }
+        return this.tcbService.request('DescribeResourcePermission', Object.assign({ EnvId, ResourceType: resourceType }, (resources !== undefined ? { Resources: resources } : {})));
+    }
+    async createRole(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { roleName, roleIdentity, description, memberUids, policies } = options;
+        // RoleName 校验：非空，2-32字符，中文/字母/数字/_-:@.，必须以字母或中文开头
+        if (typeof roleName !== 'string' || roleName.trim().length === 0) {
+            throw new Error('roleName is required');
+        }
+        if (roleName.length < 2 || roleName.length > 32) {
+            throw new Error('roleName length must be between 2 and 32');
+        }
+        if (!/^[\u4e00-\u9fa5a-zA-Z]/.test(roleName)) {
+            throw new Error('roleName must start with a letter or Chinese character');
+        }
+        if (!/^[\u4e00-\u9fa5a-zA-Z0-9\-_:@.]+$/.test(roleName)) {
+            throw new Error('roleName can only contain Chinese, letters, digits, and -_:@.');
+        }
+        // RoleIdentity 校验：非空，字母/数字/_-:@.，不能与默认角色标识重复
+        if (typeof roleIdentity !== 'string' || roleIdentity.trim().length === 0) {
+            throw new Error('roleIdentity is required');
+        }
+        if (!/^[a-zA-Z0-9\-_:@.]+$/.test(roleIdentity)) {
+            throw new Error('roleIdentity can only contain letters, digits, and -_:@.');
+        }
+        // Description 校验
+        if (description !== undefined && description.length > 255) {
+            throw new Error('description length must be <= 255');
+        }
+        // MemberUids 校验
+        if (memberUids !== undefined) {
+            if (!Array.isArray(memberUids)) {
+                throw new Error('memberUids must be an array');
+            }
+            if (memberUids.length > 100) {
+                throw new Error('memberUids length must be <= 100');
+            }
+            const invalidUid = memberUids.find(uid => typeof uid !== 'string' || uid.trim().length === 0);
+            if (invalidUid !== undefined) {
+                throw new Error('memberUids contains invalid item');
+            }
+        }
+        // Policies 校验
+        if (policies !== undefined) {
+            if (!Array.isArray(policies)) {
+                throw new Error('policies must be an array');
+            }
+            if (policies.length > 50) {
+                throw new Error('policies length must be <= 50');
+            }
+            const invalidPolicy = policies.find(policy => !policy.ResourceType || !policy.Resource);
+            if (invalidPolicy !== undefined) {
+                throw new Error('each policy must have ResourceType and Resource');
+            }
+        }
+        const reqData = {
+            EnvId,
+            RoleName: roleName,
+            RoleIdentity: roleIdentity
+        };
+        if (description !== undefined) {
+            reqData.Description = description;
+        }
+        if (memberUids !== undefined && memberUids.length > 0) {
+            reqData.MemberUids = memberUids;
+        }
+        if (policies !== undefined && policies.length > 0) {
+            reqData.Policies = policies;
+        }
+        return this.tcbService.request('CreateRole', reqData);
+    }
+    async describeRoleList(options = {}) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { pageNumber, pageSize, roleId, roleIdentity, roleName, loadDetails } = options;
+        // PageNumber 校验：从1开始
+        if (pageNumber !== undefined && (pageNumber < 1 || !Number.isInteger(pageNumber))) {
+            throw new Error('pageNumber must be a positive integer');
+        }
+        // PageSize 校验：默认10，最大100
+        if (pageSize !== undefined && (pageSize < 1 || pageSize > 100 || !Number.isInteger(pageSize))) {
+            throw new Error('pageSize must be an integer between 1 and 100');
+        }
+        // RoleId 校验
+        if (roleId !== undefined && (typeof roleId !== 'string' || roleId.trim().length === 0)) {
+            throw new Error('Invalid roleId');
+        }
+        // RoleIdentity 校验
+        if (roleIdentity !== undefined && (typeof roleIdentity !== 'string' || roleIdentity.trim().length === 0)) {
+            throw new Error('Invalid roleIdentity');
+        }
+        // RoleName 校验
+        if (roleName !== undefined && (typeof roleName !== 'string' || roleName.trim().length === 0)) {
+            throw new Error('Invalid roleName');
+        }
+        const reqData = { EnvId };
+        if (pageNumber !== undefined) {
+            reqData.PageNumber = pageNumber;
+        }
+        if (pageSize !== undefined) {
+            reqData.PageSize = pageSize;
+        }
+        if (roleId !== undefined) {
+            reqData.RoleId = roleId;
+        }
+        if (roleIdentity !== undefined) {
+            reqData.RoleIdentity = roleIdentity;
+        }
+        if (roleName !== undefined) {
+            reqData.RoleName = roleName;
+        }
+        if (loadDetails !== undefined) {
+            reqData.LoadDetails = loadDetails;
+        }
+        return this.tcbService.request('DescribeRoleList', reqData);
+    }
+    async modifyRole(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { roleId, roleName, description, addMemberUids, removeMemberUids, addPolicies, removePolicies } = options;
+        // RoleId 校验：必填
+        if (typeof roleId !== 'string' || roleId.trim().length === 0) {
+            throw new Error('roleId is required');
+        }
+        // RoleName 校验：不传或传空 => 不修改；非空时校验规则
+        if (roleName !== undefined && roleName !== '') {
+            if (roleName.length < 2 || roleName.length > 32) {
+                throw new Error('roleName length must be between 2 and 32');
+            }
+            if (!/^[\u4e00-\u9fa5a-zA-Z]/.test(roleName)) {
+                throw new Error('roleName must start with a letter or Chinese character');
+            }
+            if (!/^[\u4e00-\u9fa5a-zA-Z0-9\-_:@.]+$/.test(roleName)) {
+                throw new Error('roleName can only contain Chinese, letters, digits, and -_:@.');
+            }
+        }
+        // Description 校验
+        if (description !== undefined && description.length > 255) {
+            throw new Error('description length must be <= 255');
+        }
+        // AddMemberUids 校验
+        if (addMemberUids !== undefined) {
+            if (!Array.isArray(addMemberUids)) {
+                throw new Error('addMemberUids must be an array');
+            }
+            const invalidUid = addMemberUids.find(uid => typeof uid !== 'string' || uid.trim().length === 0);
+            if (invalidUid !== undefined) {
+                throw new Error('addMemberUids contains invalid item');
+            }
+        }
+        // RemoveMemberUids 校验
+        if (removeMemberUids !== undefined) {
+            if (!Array.isArray(removeMemberUids)) {
+                throw new Error('removeMemberUids must be an array');
+            }
+            const invalidUid = removeMemberUids.find(uid => typeof uid !== 'string' || uid.trim().length === 0);
+            if (invalidUid !== undefined) {
+                throw new Error('removeMemberUids contains invalid item');
+            }
+        }
+        // AddPolicies 校验
+        if (addPolicies !== undefined) {
+            if (!Array.isArray(addPolicies)) {
+                throw new Error('addPolicies must be an array');
+            }
+            const invalidPolicy = addPolicies.find(policy => !policy.ResourceType || !policy.Resource);
+            if (invalidPolicy !== undefined) {
+                throw new Error('each addPolicy must have ResourceType and Resource');
+            }
+        }
+        // RemovePolicies 校验
+        if (removePolicies !== undefined) {
+            if (!Array.isArray(removePolicies)) {
+                throw new Error('removePolicies must be an array');
+            }
+            const invalidPolicy = removePolicies.find(policy => !policy.ResourceType || !policy.Resource);
+            if (invalidPolicy !== undefined) {
+                throw new Error('each removePolicy must have ResourceType and Resource');
+            }
+        }
+        const reqData = { EnvId, RoleId: roleId };
+        // RoleName：不传或传空 => 不修改（不下发）
+        if (roleName !== undefined && roleName !== '') {
+            reqData.RoleName = roleName;
+        }
+        if (description !== undefined) {
+            reqData.Description = description;
+        }
+        if (addMemberUids !== undefined) {
+            reqData.AddMemberUids = addMemberUids;
+        }
+        if (removeMemberUids !== undefined) {
+            reqData.RemoveMemberUids = removeMemberUids;
+        }
+        if (addPolicies !== undefined) {
+            reqData.AddPolicies = addPolicies;
+        }
+        if (removePolicies !== undefined) {
+            reqData.RemovePolicies = removePolicies;
+        }
+        return this.tcbService.request('ModifyRole', reqData);
+    }
+    async deleteRoles(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { roleIds } = options;
+        // RoleIds 校验：必填数组，最多100个
+        if (!Array.isArray(roleIds) || roleIds.length === 0) {
+            throw new Error('roleIds is required and must be a non-empty array');
+        }
+        if (roleIds.length > 100) {
+            throw new Error('roleIds length must be <= 100');
+        }
+        const invalidId = roleIds.find(id => typeof id !== 'string' || id.trim().length === 0);
+        if (invalidId !== undefined) {
+            throw new Error('roleIds contains invalid item');
+        }
+        return this.tcbService.request('DeleteRoles', {
+            EnvId,
+            RoleIds: roleIds
+        });
+    }
+}
+exports.PermissionService = PermissionService;
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "modifyResourcePermission", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "describeResourcePermission", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "createRole", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "describeRoleList", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "modifyRole", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "deleteRoles", null);

package/lib/permission/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });