@contember/engine-content-api 2.0.0-beta.2 → 2.0.0-beta.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-content-api",
-  "version": "2.0.0-beta.2",
+  "version": "2.0.0-beta.4",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,18 +26,18 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/database": "2.0.0-beta.2",
-    "@contember/dic": "2.0.0-beta.2",
-    "@contember/graphql-utils": "2.0.0-beta.2",
-    "@contember/logger": "2.0.0-beta.2",
-    "@contember/schema": "2.0.0-beta.2",
-    "@contember/schema-definition": "2.0.0-beta.2",
-    "@contember/schema-utils": "2.0.0-beta.2",
+    "@contember/database": "2.0.0-beta.4",
+    "@contember/dic": "2.0.0-beta.4",
+    "@contember/graphql-utils": "2.0.0-beta.4",
+    "@contember/logger": "2.0.0-beta.4",
+    "@contember/schema": "2.0.0-beta.4",
+    "@contember/schema-definition": "2.0.0-beta.4",
+    "@contember/schema-utils": "2.0.0-beta.4",
     "fast-deep-equal": "^3.1.3"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.0.0-beta.2",
-    "@contember/schema-definition": "2.0.0-beta.2",
+    "@contember/database-tester": "2.0.0-beta.4",
+    "@contember/schema-definition": "2.0.0-beta.4",
     "@types/node": "^20.16.11",
     "graphql": "^16.9.0",
     "pg": "^8.12.0"

package/src/acl/Authorizator.ts

@@ -52,4 +52,8 @@ export class Authorizator {
 	isCustomPrimaryAllowed(entity: string): boolean {
 		return this.permissions?.[entity]?.operations?.customPrimary ?? this.defaultCustomPrimary
 	}
+
+	isRootOperationDisallowed(entity: string, operation: Acl.Operation): boolean {
+		return this.permissions?.[entity]?.operations?.noRoot?.includes(operation) ?? false
+	}
 }

package/src/acl/PermissionFactory.ts

@@ -116,6 +116,7 @@ export class PermissionFactory {
 		if (left.operations.customPrimary || right.operations.customPrimary) {
 			operations.customPrimary = true
 		}
+		const noRoot: `${Acl.Operation}`[] = []
 
 		const operationNames: (keyof Pick<Acl.EntityOperations, 'create' | 'read' | 'update'>)[] = [
 			'create',
@@ -124,8 +125,14 @@ export class PermissionFactory {
 		]
 
 		for (let operation of operationNames) {
-			const leftFieldPermissions: Acl.FieldPermissions = left.operations[operation] || {}
-			const rightFieldPermissions: Acl.FieldPermissions = right.operations[operation] || {}
+			const leftNoRoot = left.operations.noRoot?.includes(operation) || false
+			const rightNoRoot = right.operations.noRoot?.includes(operation) || false
+			if (leftNoRoot && rightNoRoot) {
+				noRoot.push(operation)
+			}
+
+			const leftFieldPermissions: Acl.FieldPermissions = leftNoRoot && !rightNoRoot ? {} : (left.operations[operation] || {})
+			const rightFieldPermissions: Acl.FieldPermissions = rightNoRoot && !leftNoRoot ? {} : (right.operations[operation] || {})
 			const [operationPredicates, fieldPermissions] = this.mergeFieldPermissions(
 				left.predicates,
 				leftFieldPermissions,
@@ -150,6 +157,9 @@ export class PermissionFactory {
 			predicates[predicate] = predicateDefinition
 			operations.delete = predicate
 		}
+		if (noRoot.length > 0) {
+			operations.noRoot = noRoot
+		}
 
 		return {
 			predicates: predicates,

package/src/schema/MutationProvider.ts

@@ -41,6 +41,9 @@ export class MutationProvider {
 	}
 
 	protected getCreateMutation(entity: Model.Entity): FieldConfig<Input.CreateInput> | undefined {
+		if (this.authorizator.isRootOperationDisallowed(entity.name, Acl.Operation.create)) {
+			return undefined
+		}
 		const entityName = entity.name
 		const dataType = this.createEntityInputProvider.getInput(entityName)
 		if (dataType === undefined) {
@@ -66,6 +69,9 @@ export class MutationProvider {
 
 	protected getDeleteMutation(entity: Model.Entity): FieldConfig<Input.DeleteInput> | undefined {
 		const entityName = entity.name
+		if (this.authorizator.isRootOperationDisallowed(entityName, Acl.Operation.delete)) {
+			return undefined
+		}
 		if (entity.view) {
 			return undefined
 		}
@@ -99,6 +105,9 @@ export class MutationProvider {
 	}
 
 	protected getUpdateMutation(entity: Model.Entity): FieldConfig<Input.UpdateInput> | undefined {
+		if (this.authorizator.isRootOperationDisallowed(entity.name, Acl.Operation.update)) {
+			return undefined
+		}
 		const entityName = entity.name
 		const dataType = this.updateEntityInputProvider.getInput(entityName)
 		if (dataType === undefined) {
@@ -133,6 +142,10 @@ export class MutationProvider {
 	}
 
 	private getUpsertMutation(entity: Model.Entity): FieldConfig<Input.UpsertInput> | undefined {
+		if (this.authorizator.isRootOperationDisallowed(entity.name, Acl.Operation.update)
+			|| this.authorizator.isRootOperationDisallowed(entity.name, Acl.Operation.create)) {
+			return undefined
+		}
 		const entityName = entity.name
 		const createInput = this.createEntityInputProvider.getInput(entityName)
 		if (createInput === undefined) {

package/src/schema/QueryProvider.ts

@@ -22,6 +22,9 @@ export class QueryProvider {
 		if (this.authorizator.getEntityPermission(Acl.Operation.read, entity.name) === 'no') {
 			return {}
 		}
+		if (this.authorizator.isRootOperationDisallowed(entity.name, Acl.Operation.read)) {
+			return {}
+		}
 		return {
 			['get' + entity.name]: this.getByUniqueQuery(entity),
 			['list' + entity.name]: this.getListQuery(entity),

package/tests/cases/integration/graphQlSchema/graphQlSchemaBuilder.test.ts

@@ -6,9 +6,11 @@ import {
 	AllowAllPermissionFactory,
 	SchemaBuilder,
 	SchemaDefinition,
+	c,
+	createSchema,
 	SchemaDefinition as def,
 } from '@contember/schema-definition'
-import { Authorizator, GraphQlSchemaBuilderFactory } from '../../../../src'
+import { Authorizator, GraphQlSchemaBuilderFactory, PermissionFactory } from '../../../../src'
 import * as model from './model'
 import { expect, describe, it } from 'bun:test'
 import { dirname } from 'node:path'
@@ -387,6 +389,20 @@ describe('GraphQL schema builder', () => {
 			graphQlSchemaFile: 'schema-view-entity.gql',
 		})
 	})
+
+	it.only('no root ops', async () => {
+		const schema = createSchema(NoRootOperation)
+		console.log(schema.acl.roles.editor.entities.Image)
+
+		await testSchema({
+			schema: () => schema.model,
+			permissions: () => {
+				const factory = new PermissionFactory()
+				return factory.create(schema, ['editor'])
+			},
+			graphQlSchemaFile: 'schema-no-root-ops.gql',
+		})
+	})
 })
 
 namespace ViewEntity {
@@ -395,3 +411,29 @@ namespace ViewEntity {
 		name = def.stringColumn()
 	}
 }
+
+namespace NoRootOperation {
+	export const editorRole = c.createRole('editor')
+
+	@c.Allow(editorRole, {
+		read: true,
+		create: true,
+		delete: true,
+		update: true,
+	})
+	export class Article {
+		title = c.stringColumn()
+		coverImage = c.oneHasOne(Image)
+	}
+
+	@c.Allow(editorRole, {
+		through: true,
+		read: true,
+		create: true,
+		delete: true,
+		update: true,
+	})
+	export class Image {
+		url = c.stringColumn()
+	}
+}

package/tests/cases/integration/graphQlSchema/schema-no-root-ops.gql

@@ -0,0 +1,308 @@
+type Query {
+  getArticle(by: ArticleUniqueWhere!, filter: ArticleWhere): Article
+  listArticle(filter: ArticleWhere, orderBy: [ArticleOrderBy!], offset: Int, limit: Int): [Article!]!
+  paginateArticle(filter: ArticleWhere, orderBy: [ArticleOrderBy!], skip: Int, first: Int): ArticleConnection!
+  validateCreateArticle(data: ArticleCreateInput!): _ValidationResult!
+  validateUpdateArticle(by: ArticleUniqueWhere!, data: ArticleUpdateInput!): _ValidationResult!
+  validateCreateImage(data: ImageCreateInput!): _ValidationResult!
+  validateUpdateImage(by: ImageUniqueWhere!, data: ImageUpdateInput!): _ValidationResult!
+  transaction: QueryTransaction
+  _info: Info
+}
+
+type Article {
+  _meta: ArticleMeta
+  id: UUID!
+  title: String
+  coverImage(filter: ImageWhere): Image
+}
+
+type ArticleMeta {
+  id: FieldMeta
+  title: FieldMeta
+  coverImage: FieldMeta
+}
+
+type FieldMeta {
+  readable: Boolean
+  updatable: Boolean
+}
+
+scalar UUID
+
+type Image {
+  _meta: ImageMeta
+  id: UUID!
+  url: String
+}
+
+type ImageMeta {
+  id: FieldMeta
+  url: FieldMeta
+}
+
+input ImageWhere {
+  id: UUIDCondition
+  url: StringCondition
+  and: [ImageWhere]
+  or: [ImageWhere]
+  not: ImageWhere
+}
+
+input UUIDCondition {
+  and: [UUIDCondition!]
+  or: [UUIDCondition!]
+  not: UUIDCondition
+  null: Boolean
+  isNull: Boolean
+  eq: UUID
+  notEq: UUID
+  in: [UUID!]
+  notIn: [UUID!]
+  lt: UUID
+  lte: UUID
+  gt: UUID
+  gte: UUID
+}
+
+input StringCondition {
+  and: [StringCondition!]
+  or: [StringCondition!]
+  not: StringCondition
+  null: Boolean
+  isNull: Boolean
+  eq: String
+  notEq: String
+  in: [String!]
+  notIn: [String!]
+  lt: String
+  lte: String
+  gt: String
+  gte: String
+  contains: String
+  startsWith: String
+  endsWith: String
+  containsCI: String
+  startsWithCI: String
+  endsWithCI: String
+}
+
+input ArticleUniqueWhere {
+  id: UUID
+  coverImage: ImageUniqueWhere
+}
+
+input ImageUniqueWhere {
+  id: UUID
+}
+
+input ArticleWhere {
+  id: UUIDCondition
+  title: StringCondition
+  coverImage: ImageWhere
+  and: [ArticleWhere]
+  or: [ArticleWhere]
+  not: ArticleWhere
+}
+
+input ArticleOrderBy {
+  _random: Boolean
+  _randomSeeded: Int
+  id: OrderDirection
+  title: OrderDirection
+  coverImage: ImageOrderBy
+}
+
+enum OrderDirection {
+  asc
+  desc
+  ascNullsFirst
+  descNullsLast
+}
+
+input ImageOrderBy {
+  _random: Boolean
+  _randomSeeded: Int
+  id: OrderDirection
+  url: OrderDirection
+}
+
+type ArticleConnection {
+  pageInfo: PageInfo!
+  edges: [ArticleEdge!]!
+}
+
+type PageInfo {
+  totalCount: Int!
+}
+
+type ArticleEdge {
+  node: Article!
+}
+
+type _ValidationResult {
+  valid: Boolean!
+  errors: [_ValidationError!]!
+}
+
+type _ValidationError {
+  path: [_PathFragment!]!
+  message: _ValidationMessage!
+}
+
+union _PathFragment = _FieldPathFragment | _IndexPathFragment
+
+type _FieldPathFragment {
+  field: String!
+}
+
+type _IndexPathFragment {
+  index: Int!
+  alias: String
+}
+
+type _ValidationMessage {
+  text: String!
+}
+
+input ArticleCreateInput {
+  title: String
+  coverImage: ArticleCreateCoverImageEntityRelationInput
+  _dummy_field_: Boolean
+}
+
+input ArticleCreateCoverImageEntityRelationInput {
+  connect: ImageUniqueWhere
+  create: ImageCreateInput
+  connectOrCreate: ArticleConnectOrCreateCoverImageRelationInput
+}
+
+input ImageCreateInput {
+  url: String
+  _dummy_field_: Boolean
+}
+
+input ArticleConnectOrCreateCoverImageRelationInput {
+  connect: ImageUniqueWhere!
+  create: ImageCreateInput!
+}
+
+input ArticleUpdateInput {
+  title: String
+  coverImage: ArticleUpdateCoverImageEntityRelationInput
+  _dummy_field_: Boolean
+}
+
+input ArticleUpdateCoverImageEntityRelationInput {
+  connect: ImageUniqueWhere
+  create: ImageCreateInput
+  connectOrCreate: ArticleConnectOrCreateCoverImageRelationInput
+  update: ImageUpdateInput
+  upsert: ArticleUpsertCoverImageRelationInput
+  disconnect: Boolean
+  delete: Boolean
+}
+
+input ImageUpdateInput {
+  url: String
+  _dummy_field_: Boolean
+}
+
+input ArticleUpsertCoverImageRelationInput {
+  update: ImageUpdateInput!
+  create: ImageCreateInput!
+}
+
+type QueryTransaction {
+  getArticle(by: ArticleUniqueWhere!, filter: ArticleWhere): Article
+  listArticle(filter: ArticleWhere, orderBy: [ArticleOrderBy!], offset: Int, limit: Int): [Article!]!
+  paginateArticle(filter: ArticleWhere, orderBy: [ArticleOrderBy!], skip: Int, first: Int): ArticleConnection!
+  validateCreateArticle(data: ArticleCreateInput!): _ValidationResult!
+  validateUpdateArticle(by: ArticleUniqueWhere!, data: ArticleUpdateInput!): _ValidationResult!
+  validateCreateImage(data: ImageCreateInput!): _ValidationResult!
+  validateUpdateImage(by: ImageUniqueWhere!, data: ImageUpdateInput!): _ValidationResult!
+}
+
+type Info {
+  description: String
+}
+
+type Mutation {
+  createArticle(data: ArticleCreateInput!): ArticleCreateResult!
+  deleteArticle(by: ArticleUniqueWhere!, filter: ArticleWhere): ArticleDeleteResult!
+  updateArticle(by: ArticleUniqueWhere!, filter: ArticleWhere, data: ArticleUpdateInput!): ArticleUpdateResult!
+  upsertArticle(by: ArticleUniqueWhere!, filter: ArticleWhere, update: ArticleUpdateInput!, create: ArticleCreateInput!): ArticleUpsertResult!
+  transaction(options: MutationTransactionOptions): MutationTransaction!
+  query: Query!
+}
+
+type ArticleCreateResult implements MutationResult {
+  ok: Boolean!
+  errorMessage: String
+  errors: [_MutationError!]!
+  node: Article
+  validation: _ValidationResult!
+}
+
+interface MutationResult {
+  ok: Boolean!
+  errorMessage: String
+  errors: [_MutationError!]!
+}
+
+type _MutationError {
+  path: [_PathFragment!]! @deprecated(reason: "Use `paths`.")
+  paths: [[_PathFragment!]!]!
+  type: _MutationErrorType!
+  message: String
+}
+
+enum _MutationErrorType {
+  NotNullConstraintViolation
+  UniqueConstraintViolation
+  ForeignKeyConstraintViolation
+  NotFoundOrDenied
+  NonUniqueWhereInput
+  InvalidDataInput
+  SqlError
+}
+
+type ArticleDeleteResult implements MutationResult {
+  ok: Boolean!
+  errorMessage: String
+  errors: [_MutationError!]!
+  node: Article
+}
+
+type ArticleUpdateResult implements MutationResult {
+  ok: Boolean!
+  errorMessage: String
+  errors: [_MutationError!]!
+  node: Article
+  validation: _ValidationResult!
+}
+
+type ArticleUpsertResult implements MutationResult {
+  ok: Boolean!
+  errorMessage: String
+  errors: [_MutationError!]!
+  node: Article
+  validation: _ValidationResult!
+}
+
+type MutationTransaction {
+  ok: Boolean!
+  errorMessage: String
+  errors: [_MutationError!]!
+  validation: _ValidationResult!
+  createArticle(data: ArticleCreateInput!): ArticleCreateResult!
+  deleteArticle(by: ArticleUniqueWhere!, filter: ArticleWhere): ArticleDeleteResult!
+  updateArticle(by: ArticleUniqueWhere!, filter: ArticleWhere, data: ArticleUpdateInput!): ArticleUpdateResult!
+  upsertArticle(by: ArticleUniqueWhere!, filter: ArticleWhere, update: ArticleUpdateInput!, create: ArticleCreateInput!): ArticleUpsertResult!
+  query: Query
+}
+
+input MutationTransactionOptions {
+  deferForeignKeyConstraints: Boolean
+  deferUniqueConstraints: Boolean
+}

package/tests/cases/unit/permissionMerger.test.ts

@@ -550,4 +550,124 @@ describe('Permission merger', () => {
 	})
 
 
+
+	it('prefer permissions with root allowed', () => {
+		execute({
+			acl: {
+				roles: {
+					role1: {
+						variables: {},
+						entities: {
+							Entity2: {
+								predicates: {
+									foo: { xyz: { lorem: { eq: 'foo' } } },
+								},
+								operations: {
+									read: {
+										title: 'foo',
+									},
+									noRoot: ['read'],
+								},
+							},
+						},
+					},
+					role2: {
+						variables: {},
+						entities: {
+							Entity2: {
+								predicates: {
+									foo: { xyz: { lorem: { eq: 'bar' } } },
+								},
+								operations: {
+									read: {
+										title: 'foo',
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			roles: ['role1', 'role2'],
+			result: {
+				Entity2: {
+					operations: {
+						read: {
+							title: 'foo_',
+							id: 'foo_',
+						},
+					},
+					predicates: {
+						foo_: {
+							xyz: {
+								lorem: { eq: 'bar' },
+							},
+						},
+					},
+				},
+			},
+		})
+	})
+
+
+	it('merge permissions with no root', () => {
+		execute({
+			acl: {
+				roles: {
+					role1: {
+						variables: {},
+						entities: {
+							Entity2: {
+								predicates: {
+									foo: { xyz: { lorem: { eq: 'foo' } } },
+								},
+								operations: {
+									read: {
+										title: 'foo',
+									},
+									noRoot: ['read'],
+								},
+							},
+						},
+					},
+					role2: {
+						variables: {},
+						entities: {
+							Entity2: {
+								predicates: {
+									foo: { xyz: { lorem: { eq: 'bar' } } },
+								},
+								operations: {
+									read: {
+										title: 'foo',
+									},
+									noRoot: ['read'],
+								},
+							},
+						},
+					},
+				},
+			},
+			roles: ['role1', 'role2'],
+			result: {
+				Entity2: {
+					operations: {
+						noRoot: ['read'],
+						read: {
+							title: '__merge__foo__foo',
+							id: '__merge__foo__foo',
+						},
+					},
+					predicates: {
+						__merge__foo__foo: {
+							or: [
+								{ xyz: { lorem: { eq: 'foo' } } },
+								{ xyz: { lorem: { eq: 'bar' } } },
+							],
+						},
+					},
+				},
+			},
+		})
+	})
 })