@contember/engine-content-api 1.1.0-alpha.3 → 1.1.0-alpha.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-content-api",
-  "version": "1.1.0-alpha.3",
+  "version": "1.1.0-alpha.4",
   "license": "Apache-2.0",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -10,19 +10,19 @@
     "test": "uvu dist/tests/cases/ \\.js$"
   },
   "dependencies": {
-    "@contember/database": "^1.1.0-alpha.3",
-    "@contember/dic": "^1.1.0-alpha.3",
-    "@contember/engine-common": "^1.1.0-alpha.3",
-    "@contember/graphql-utils": "^1.1.0-alpha.3",
-    "@contember/schema": "^1.1.0-alpha.3",
-    "@contember/schema-utils": "^1.1.0-alpha.3",
+    "@contember/database": "^1.1.0-alpha.4",
+    "@contember/dic": "^1.1.0-alpha.4",
+    "@contember/engine-common": "^1.1.0-alpha.4",
+    "@contember/graphql-utils": "^1.1.0-alpha.4",
+    "@contember/schema": "^1.1.0-alpha.4",
+    "@contember/schema-utils": "^1.1.0-alpha.4",
     "@graphql-tools/schema": "^7.1.5",
     "graphql-tag": "^2.12.5"
   },
   "devDependencies": {
-    "@contember/database-tester": "^1.1.0-alpha.3",
-    "@contember/engine-api-tester": "^1.1.0-alpha.3",
-    "@contember/schema-definition": "^1.1.0-alpha.3",
+    "@contember/database-tester": "^1.1.0-alpha.4",
+    "@contember/engine-api-tester": "^1.1.0-alpha.4",
+    "@contember/schema-definition": "^1.1.0-alpha.4",
     "@graphql-codegen/cli": "^1.15.2",
     "@graphql-codegen/typescript": "^1.15.2",
     "@graphql-codegen/typescript-operations": "^1.15.2",

package/src/acl/Authorizator.ts

@@ -23,8 +23,12 @@ export class Authorizator {
 		return Object.values(fieldPermissions).filter(it => !!it).length > 0 ? 'yes' : 'no'
 	}
 
+	getFieldPredicate(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string): Acl.Predicate {
+		return this.permissions[entity]?.operations[operation]?.[field] ?? false
+	}
+
 	getFieldPermissions(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string): AuthorizationResult {
-		const fieldPermissions = this.permissions[entity]?.operations[operation]?.[field]
+		const fieldPermissions = this.getFieldPredicate(operation, entity, field)
 		if (!fieldPermissions) {
 			return 'no'
 		}

package/src/schema/entities/FieldTypeVisitor.ts

@@ -3,6 +3,7 @@ import { Acl, Model } from '@contember/schema'
 import { ColumnTypeResolver } from '../ColumnTypeResolver'
 import { EntityTypeProvider } from '../EntityTypeProvider'
 import { Authorizator } from '../../acl'
+import { ImplementationException } from '../../exception'
 
 export class FieldTypeVisitor implements Model.ColumnVisitor<GraphQLOutputType>, Model.RelationByGenericTypeVisitor<GraphQLOutputType> {
 	constructor(
@@ -14,8 +15,15 @@ export class FieldTypeVisitor implements Model.ColumnVisitor<GraphQLOutputType>,
 
 	public visitColumn(entity: Model.Entity, column: Model.AnyColumn): GraphQLOutputType {
 		const basicType = this.columnTypeResolver.getType(column)
-		const permissions = this.authorizator.getFieldPermissions(Acl.Operation.read, entity.name, column.name)
-		return column.nullable || permissions === 'maybe' ? basicType : new GraphQLNonNull(basicType)
+		const fieldPredicate = this.authorizator.getFieldPredicate(Acl.Operation.read, entity.name, column.name)
+		const idPredicate = this.authorizator.getFieldPredicate(Acl.Operation.read, entity.name, entity.primary)
+		if (!fieldPredicate || !idPredicate) {
+			throw new ImplementationException()
+		}
+		if (!column.nullable && (fieldPredicate === true || fieldPredicate === idPredicate)) {
+			return new GraphQLNonNull(basicType)
+		}
+		return basicType
 	}
 
 	public visitHasMany(entity: Model.Entity, relation: Model.Relation): GraphQLOutputType {

package/tests/cases/integration/graphQlSchema/graphQlSchemaBuilder.test.ts

@@ -112,7 +112,7 @@ graphqlSchemaBuilderTest('restricted access to fields by permissions', async ()
 })
 
 
-graphqlSchemaBuilderTest('conditionally restricted read', async () => {
+graphqlSchemaBuilderTest('conditionally restricted read of some fields', async () => {
 	await testSchema({
 		schema: builder =>
 			builder.entity('Test', e =>
@@ -138,6 +138,33 @@ graphqlSchemaBuilderTest('conditionally restricted read', async () => {
 	})
 })
 
+
+graphqlSchemaBuilderTest('conditionally restricted read of whole row', async () => {
+	await testSchema({
+		schema: builder =>
+			builder.entity('Test', e =>
+				e
+					.column('a', c => c.type(Model.ColumnType.String).notNull()),
+			),
+		permissions: () => ({
+			Test: {
+				predicates: {
+					testPredicate: {
+						a: { eq: 'Foo' },
+					},
+				},
+				operations: {
+					read: {
+						id: 'testPredicate',
+						a: 'testPredicate',
+					},
+				},
+			},
+		}),
+		graphQlSchemaFile: 'schema-acl-predicate2.gql',
+	})
+})
+
 const oneHasManySchema = (builder: SchemaBuilder) =>
 	builder.entity('Root', e =>
 		e

package/tests/cases/integration/graphQlSchema/schema-acl-predicate2.gql

@@ -0,0 +1,110 @@
+type Query {
+  getTest(by: TestUniqueWhere!, filter: TestWhere): Test
+  listTest(filter: TestWhere, orderBy: [TestOrderBy!], offset: Int, limit: Int): [Test!]!
+  paginateTest(filter: TestWhere, orderBy: [TestOrderBy!], skip: Int, first: Int): TestConnection!
+  transaction: QueryTransaction
+  _info: Info
+}
+
+type Test {
+  _meta: TestMeta
+  id: UUID!
+  a: String!
+}
+
+type TestMeta {
+  id: FieldMeta
+  a: FieldMeta
+}
+
+type FieldMeta {
+  readable: Boolean
+  updatable: Boolean
+}
+
+scalar UUID
+
+input TestUniqueWhere {
+  id: UUID
+}
+
+input TestWhere {
+  id: UUIDCondition
+  a: StringCondition
+  and: [TestWhere]
+  or: [TestWhere]
+  not: TestWhere
+}
+
+input UUIDCondition {
+  and: [UUIDCondition!]
+  or: [UUIDCondition!]
+  not: UUIDCondition
+  null: Boolean
+  isNull: Boolean
+  eq: UUID
+  notEq: UUID
+  in: [UUID!]
+  notIn: [UUID!]
+  lt: UUID
+  lte: UUID
+  gt: UUID
+  gte: UUID
+}
+
+input StringCondition {
+  and: [StringCondition!]
+  or: [StringCondition!]
+  not: StringCondition
+  null: Boolean
+  isNull: Boolean
+  eq: String
+  notEq: String
+  in: [String!]
+  notIn: [String!]
+  lt: String
+  lte: String
+  gt: String
+  gte: String
+  contains: String
+  startsWith: String
+  endsWith: String
+  containsCI: String
+  startsWithCI: String
+  endsWithCI: String
+}
+
+input TestOrderBy {
+  _random: Boolean
+  _randomSeeded: Int
+  id: OrderDirection
+  a: OrderDirection
+}
+
+enum OrderDirection {
+  asc
+  desc
+}
+
+type TestConnection {
+  pageInfo: PageInfo!
+  edges: [TestEdge!]!
+}
+
+type PageInfo {
+  totalCount: Int!
+}
+
+type TestEdge {
+  node: Test!
+}
+
+type QueryTransaction {
+  getTest(by: TestUniqueWhere!, filter: TestWhere): Test
+  listTest(filter: TestWhere, orderBy: [TestOrderBy!], offset: Int, limit: Int): [Test!]!
+  paginateTest(filter: TestWhere, orderBy: [TestOrderBy!], skip: Int, first: Int): TestConnection!
+}
+
+type Info {
+  description: String
+}