@contember/engine-content-api 1.3.0-alpha.6 → 1.3.0-alpha.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-content-api",
-  "version": "1.3.0-alpha.6",
+  "version": "1.3.0-alpha.7",
   "license": "Apache-2.0",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -14,21 +14,21 @@
     "test": "vitest --no-threads"
   },
   "dependencies": {
-    "@contember/database": "^1.3.0-alpha.6",
-    "@contember/dic": "^1.3.0-alpha.6",
-    "@contember/logger": "^1.3.0-alpha.6",
-    "@contember/graphql-utils": "^1.3.0-alpha.6",
-    "@contember/schema": "^1.3.0-alpha.6",
-    "@contember/schema-definition": "^1.3.0-alpha.6",
-    "@contember/schema-utils": "^1.3.0-alpha.6",
+    "@contember/database": "^1.3.0-alpha.7",
+    "@contember/dic": "^1.3.0-alpha.7",
+    "@contember/logger": "^1.3.0-alpha.7",
+    "@contember/graphql-utils": "^1.3.0-alpha.7",
+    "@contember/schema": "^1.3.0-alpha.7",
+    "@contember/schema-definition": "^1.3.0-alpha.7",
+    "@contember/schema-utils": "^1.3.0-alpha.7",
     "@graphql-tools/schema": "^8.3.5",
     "fast-deep-equal": "^3.1.3",
     "graphql-tag": "^2.12.5"
   },
   "devDependencies": {
-    "@contember/database-tester": "^1.3.0-alpha.6",
-    "@contember/engine-api-tester": "^1.3.0-alpha.6",
-    "@contember/schema-definition": "^1.3.0-alpha.6",
+    "@contember/database-tester": "^1.3.0-alpha.7",
+    "@contember/engine-api-tester": "^1.3.0-alpha.7",
+    "@contember/schema-definition": "^1.3.0-alpha.7",
     "@graphql-codegen/cli": "^2.6.2",
     "@graphql-codegen/typescript": "^2.5.1",
     "@graphql-codegen/typescript-operations": "^2.4.2",

package/src/acl/PermissionFactory.ts

@@ -1,33 +1,35 @@
-import { Acl, Model, Writable } from '@contember/schema'
+import { Acl, Model, Schema, Writable } from '@contember/schema'
 import { getEntity, PredicateDefinitionProcessor } from '@contember/schema-utils'
 import { mapObject } from '../utils'
 import { prefixVariable } from './VariableUtils'
 
-export class PermissionFactory {
-	constructor(private readonly schema: Model.Schema) {}
+export interface Identity {
+	projectRoles: readonly string[]
+}
 
-	public create(acl: Acl.Schema, roles: readonly string[], prefix?: string): Acl.Permissions {
+export class PermissionFactory {
+	public create(schema: Schema, roles: readonly string[], prefix?: string): Acl.Permissions {
 		let result: Acl.Permissions = {}
 		for (let role of roles) {
-			const roleDefinition = acl.roles[role] || { entities: {} }
-			let rolePermissions: Acl.Permissions = this.prefixPredicatesWithRole(roleDefinition.entities, prefix || role)
+			const roleDefinition = schema.acl.roles[role] || { entities: {} }
+			let rolePermissions: Acl.Permissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role)
 			if (roleDefinition.inherits) {
-				const inheritedPermissions = this.create(acl, roleDefinition.inherits, prefix || role)
+				const inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role)
 				rolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions)
 			}
 			result = this.mergePermissions(result, rolePermissions)
 		}
-		result = this.makePrimaryPredicatesUnionOfAllFields(result)
+		result = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result)
 
 		return result
 	}
 
-	private prefixPredicatesWithRole(permissions: Acl.Permissions, role: string): Acl.Permissions {
+	private prefixPredicatesWithRole(model: Model.Schema, permissions: Acl.Permissions, role: string): Acl.Permissions {
 		return mapObject(permissions, ({ operations, predicates }, entityName) => ({
 			operations,
 			predicates: mapObject(predicates, predicate => {
-				const predicateDefinitionProcessor = new PredicateDefinitionProcessor(this.schema)
-				return predicateDefinitionProcessor.process(getEntity(this.schema, entityName), predicate, {
+				const predicateDefinitionProcessor = new PredicateDefinitionProcessor(model)
+				return predicateDefinitionProcessor.process(getEntity(model, entityName), predicate, {
 					handleColumn: ({ value }) => {
 						if (typeof value === 'string') {
 							return prefixVariable(role, value)
@@ -45,9 +47,9 @@ export class PermissionFactory {
 		}))
 	}
 
-	private makePrimaryPredicatesUnionOfAllFields(permissions: Acl.Permissions): Acl.Permissions {
+	private makePrimaryPredicatesUnionOfAllFields(model: Model.Schema, permissions: Acl.Permissions): Acl.Permissions {
 		return mapObject(permissions, (permission, entityName): Acl.EntityPermissions => {
-			const entity = getEntity(this.schema, entityName)
+			const entity = getEntity(model, entityName)
 			const entityPredicates: Writable<Acl.PredicateMap> = { ...permission.predicates }
 			const entityOperations: Writable<Acl.EntityOperations> = { ...permission.operations }
 

package/src/acl/index.ts

@@ -1,6 +1,5 @@
 export * from './Authorizator'
 export * from './PermissionFactory'
-export * from './PermissionsByIdentityFactory'
 export * from './PredicateFactory'
 export * from './PredicatesInjector'
 export * from './VariableInjector'

package/src/types.ts

@@ -6,5 +6,5 @@ export interface Context {
 	db: Client
 	identityVariables: Acl.VariablesMap
 	executionContainer: ExecutionContainer
-	timer: <T>(event: string, cb?: () => T) => Promise<T>
+	timer: <T>(event: string, cb: () => T) => T
 }

package/src/utils/index.ts

@@ -1,5 +1,4 @@
 export * from './accessor'
-export * from './arrays'
 export * from './assertNever'
 export * from './Interface'
 export * from './isIt'

package/tests/cases/integration/graphQlRequests/query/acl/isNullAcl.test.ts

@@ -0,0 +1,77 @@
+import { AclDefinition as acl, createSchema, SchemaDefinition as def } from '@contember/schema-definition'
+import { test } from 'vitest'
+import { execute } from '../../../../../src/test'
+import { GQL, SQL } from '../../../../../src/tags'
+import { PermissionFactory } from '../../../../../../src'
+import { testUuid } from '@contember/engine-api-tester'
+
+
+namespace RowPredicateSubset {
+	export const ownerRole = acl.createRole('owner')
+	export const personIdVariable = acl.createPredefinedVariable('personId', 'personID', ownerRole)
+
+	@acl.allow(ownerRole, {
+		read: true,
+		when: { resource: acl.canRead('item') },
+	})
+	export class Item {
+		resource = def.oneHasOne(Resource, 'item')
+	}
+
+	@acl.allow(ownerRole, {
+		read: true,
+		when: { owner: acl.canRead('resources') },
+	})
+	export class Resource {
+		item = def.oneHasOneInverse(Item, 'resource')
+		owner = def.manyHasOne(Person, 'resources')
+	}
+
+	@acl.allow(ownerRole, {
+		read: true,
+		when: { personId: personIdVariable },
+	})
+	export class Person {
+		personId = def.uuidColumn().notNull()
+		resources = def.oneHasMany(Resource, 'owner')
+	}
+}
+
+
+test('owner predicate with isNull', async () => {
+	const schema = createSchema(RowPredicateSubset)
+
+	const permissions = new PermissionFactory().create(schema, ['owner'])
+
+	await execute({
+		schema: schema.model,
+		permissions: permissions,
+		variables: {
+			owner__personId: { eq: testUuid(0) },
+		},
+		query: GQL`
+        query {
+          listItem(filter: {resource: {id: {isNull: true}}}) {
+          	id
+          }
+        }`,
+		executes: [
+			{
+				sql: SQL`select "root_"."id" as "root_id"  from "public"."item" as "root_" 
+    left join  "public"."resource" as "root_resource" on  "root_"."resource_id" = "root_resource"."id" 
+    left join  "public"."person" as "root_resource_owner" on  "root_resource"."owner_id" = "root_resource_owner"."id"  
+	where "root_resource"."id" is null and "root_resource_owner"."person_id" = ? and "root_resource_owner"."person_id" = ?`,
+				response: {
+					rows: [],
+				},
+			},
+		],
+		return: {
+			data: {
+				listItem: [],
+			},
+		},
+	})
+})
+
+

package/tests/cases/integration/graphQlRequests/query/acl/rowPredicateSubset.test.ts

@@ -37,7 +37,7 @@ namespace RowPredicateSubset {
 test('row level predicate includes main predicate', async () => {
 	const schema = createSchema(RowPredicateSubset)
 
-	const permissions = new PermissionFactory(schema.model).create(schema.acl, ['reader'])
+	const permissions = new PermissionFactory().create(schema, ['reader'])
 
 	await execute({
 		schema: schema.model,

package/tests/cases/unit/permissionMerger.test.ts

@@ -1,7 +1,8 @@
 import { Acl, Model } from '@contember/schema'
 import { PermissionFactory } from '../../../src/acl'
 import { SchemaBuilder } from '@contember/schema-definition'
-import { describe, it, assert } from 'vitest'
+import { assert, describe, it } from 'vitest'
+import { emptySchema } from '@contember/schema-utils'
 
 interface Test {
 	acl: Acl.Schema
@@ -10,13 +11,17 @@ interface Test {
 }
 
 const execute = (test: Test) => {
-	const schema: Model.Schema = new SchemaBuilder()
+	const model: Model.Schema = new SchemaBuilder()
 		.entity('Entity1', e => e.column('lorem').column('bar'))
 		.entity('Entity2', e => e.oneHasOne('xyz', r => r.target('Entity1')))
 		.buildSchema()
-	const merger = new PermissionFactory(schema)
+	const merger = new PermissionFactory()
 	const initialAcl = JSON.parse(JSON.stringify(test.acl))
-	const result = merger.create(test.acl, test.roles)
+	const result = merger.create({
+		...emptySchema,
+		 model,
+		acl: test.acl,
+	}, test.roles)
 	assert.deepStrictEqual(result, test.result)
 	assert.deepStrictEqual(test.acl, initialAcl)
 }

package/tests/cases/unit/predicatesInjector.test.ts

@@ -160,7 +160,7 @@ namespace DeepFilterModel {
 
 describe('predicates injector elimination', () => {
 	const schema = createSchema(DeepFilterModel)
-	const permissions = new PermissionFactory(schema.model).create(schema.acl, ['reader'])
+	const permissions = new PermissionFactory().create(schema, ['reader'])
 
 	const injector = new PredicatesInjector(
 		schema.model,

package/dist/src/acl/PermissionsByIdentityFactory.d.ts

@@ -1,12 +0,0 @@
-import { Acl, Schema } from '@contember/schema';
-export declare class PermissionsByIdentityFactory {
-    createPermissions(schema: Schema, identity: Identity): PermissionResult;
-}
-export interface Identity {
-    projectRoles: string[];
-}
-export interface PermissionResult {
-    permissions: Acl.Permissions;
-    verifier: (identity: Identity) => boolean;
-}
-//# sourceMappingURL=PermissionsByIdentityFactory.d.ts.map

package/dist/src/acl/PermissionsByIdentityFactory.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PermissionsByIdentityFactory.d.ts","sourceRoot":"","sources":["../../../src/acl/PermissionsByIdentityFactory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE/C,qBAAa,4BAA4B;IACjC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,gBAAgB;CAM9E;AAED,MAAM,WAAW,QAAQ;IACxB,YAAY,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAChC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAA;IAC5B,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAA;CACzC"}

package/dist/src/acl/PermissionsByIdentityFactory.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PermissionsByIdentityFactory = void 0;
-const PermissionFactory_1 = require("./PermissionFactory");
-const utils_1 = require("../utils");
-class PermissionsByIdentityFactory {
-    createPermissions(schema, identity) {
-        return {
-            permissions: new PermissionFactory_1.PermissionFactory(schema.model).create(schema.acl, identity.projectRoles),
-            verifier: otherIdentity => (0, utils_1.arrayEquals)(identity.projectRoles, otherIdentity.projectRoles),
-        };
-    }
-}
-exports.PermissionsByIdentityFactory = PermissionsByIdentityFactory;
-//# sourceMappingURL=PermissionsByIdentityFactory.js.map

package/dist/src/acl/PermissionsByIdentityFactory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PermissionsByIdentityFactory.js","sourceRoot":"","sources":["../../../src/acl/PermissionsByIdentityFactory.ts"],"names":[],"mappings":";;;AAAA,2DAAuD;AACvD,oCAAsC;AAGtC,MAAa,4BAA4B;IACjC,iBAAiB,CAAC,MAAc,EAAE,QAAkB;QAC1D,OAAO;YACN,WAAW,EAAE,IAAI,qCAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC;YAC1F,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC,IAAA,mBAAW,EAAC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,YAAY,CAAC;SACzF,CAAA;IACF,CAAC;CACD;AAPD,oEAOC"}

package/dist/src/utils/arrays.d.ts

@@ -1,3 +0,0 @@
-declare const arrayEquals: (a: unknown[] | null, b: unknown[] | null) => boolean;
-export { arrayEquals };
-//# sourceMappingURL=arrays.d.ts.map

package/dist/src/utils/arrays.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"arrays.d.ts","sourceRoot":"","sources":["../../../src/utils/arrays.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,WAAW,MAAO,OAAO,EAAE,GAAG,IAAI,KAAK,OAAO,EAAE,GAAG,IAAI,KAAG,OAgB/D,CAAA;AAED,OAAO,EAAE,WAAW,EAAE,CAAA"}

package/dist/src/utils/arrays.js

@@ -1,22 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.arrayEquals = void 0;
-const arrayEquals = (a, b) => {
-    if (a === b) {
-        return true;
-    }
-    if (a === null || b === null) {
-        return false;
-    }
-    if (a.length !== b.length) {
-        return false;
-    }
-    for (let i = 0; i < a.length; ++i) {
-        if (a[i] !== b[i]) {
-            return false;
-        }
-    }
-    return true;
-};
-exports.arrayEquals = arrayEquals;
-//# sourceMappingURL=arrays.js.map

package/dist/src/utils/arrays.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"arrays.js","sourceRoot":"","sources":["../../../src/utils/arrays.ts"],"names":[],"mappings":";;;AAAA,MAAM,WAAW,GAAG,CAAC,CAAmB,EAAE,CAAmB,EAAW,EAAE;IACzE,IAAI,CAAC,KAAK,CAAC,EAAE;QACZ,OAAO,IAAI,CAAA;KACX;IACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;QAC7B,OAAO,KAAK,CAAA;KACZ;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE;QAC1B,OAAO,KAAK,CAAA;KACZ;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;QAClC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;YAClB,OAAO,KAAK,CAAA;SACZ;KACD;IACD,OAAO,IAAI,CAAA;AACZ,CAAC,CAAA;AAEQ,kCAAW"}

package/src/acl/PermissionsByIdentityFactory.ts

@@ -1,21 +0,0 @@
-import { PermissionFactory } from './PermissionFactory'
-import { arrayEquals } from '../utils'
-import { Acl, Schema } from '@contember/schema'
-
-export class PermissionsByIdentityFactory {
-	public createPermissions(schema: Schema, identity: Identity): PermissionResult {
-		return {
-			permissions: new PermissionFactory(schema.model).create(schema.acl, identity.projectRoles),
-			verifier: otherIdentity => arrayEquals(identity.projectRoles, otherIdentity.projectRoles),
-		}
-	}
-}
-
-export interface Identity {
-	projectRoles: string[]
-}
-
-export interface PermissionResult {
-	permissions: Acl.Permissions
-	verifier: (identity: Identity) => boolean
-}

package/src/utils/arrays.ts

@@ -1,19 +0,0 @@
-const arrayEquals = (a: unknown[] | null, b: unknown[] | null): boolean => {
-	if (a === b) {
-		return true
-	}
-	if (a === null || b === null) {
-		return false
-	}
-	if (a.length !== b.length) {
-		return false
-	}
-	for (let i = 0; i < a.length; ++i) {
-		if (a[i] !== b[i]) {
-			return false
-		}
-	}
-	return true
-}
-
-export { arrayEquals }