@contember/schema-definition 1.1.0-alpha.6 → 1.1.0-beta.0

package/src/acl/definition/internal/AclFactory.ts

@@ -0,0 +1,130 @@
+import { Acl, Model, Writable } from '@contember/schema'
+import { getEntity } from '@contember/schema-utils'
+
+import { EntityPredicatesResolver } from './EntityPredicateResolver'
+import { AllowDefinition } from '../permissions'
+import {
+	allowCustomPrimaryAllRolesStore,
+	allowCustomPrimaryStore,
+	allowDefinitionsStore,
+	EntityPermissionsDefinition,
+} from './stores'
+import { Role } from '../roles'
+import { EntityVariableDefinition, VariableDefinition } from '../variables'
+import { filterEntityDefinition } from '../../../utils'
+
+export class AclFactory {
+	constructor(
+		private model: Model.Schema,
+	) {
+	}
+
+	public create(
+		exportedDefinitions: Record<string, any>,
+	): Acl.Schema {
+		const entityLikeDefinition = filterEntityDefinition(exportedDefinitions)
+		const roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)
+		const variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof EntityVariableDefinition)
+
+		const groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)
+
+		return {
+			roles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {
+				const rolePermissions = groupedPermissions.get(role)
+				return [
+					role.name,
+					{
+						stages: role.options.stages ?? '*',
+						entities: this.createPermissions(rolePermissions),
+						variables: this.createVariables(role, variables),
+					},
+				]
+			})),
+		}
+	}
+
+	private createPermissions(rolePermissions: PermissionsByEntity | undefined): Acl.Permissions {
+		if (!rolePermissions) {
+			return {}
+		}
+		return Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {
+			const entity = getEntity(this.model, entityName)
+
+			const predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)
+
+			const entityOperations: Writable<Acl.EntityOperations> = {}
+			for (const op of ['create', 'update', 'read'] as const) {
+				const fieldPermissions: Writable<Acl.FieldPermissions> = {}
+				for (const field of Object.keys(entity.fields)) {
+					if (field === entity.primary) {
+						continue
+					}
+					const predicate = predicatesResolver.createFieldPredicate(op, field)
+					if (predicate !== undefined) {
+						fieldPermissions[field] = predicate
+					}
+				}
+				if (Object.keys(fieldPermissions).length > 0) {
+					entityOperations[op] = fieldPermissions
+				}
+			}
+			const delPredicate = predicatesResolver.createFieldPredicate('delete', '')
+			if (delPredicate !== undefined) {
+				entityOperations.delete = delPredicate
+			}
+			if (rolePermissions.get(entityName)?.allowCustomPrimary) {
+				entityOperations.customPrimary = true
+			}
+			return [entityName, {
+				predicates: predicatesResolver.getUsedPredicates(),
+				operations: entityOperations,
+			}]
+		}))
+	}
+
+	private createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {
+		const roleVariables = variables.filter(it => it.roles.includes(role))
+		return Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {
+			switch (variable.type) {
+				case 'entity':
+					return [variable.name, { type: Acl.VariableType.entity, entityName: variable.entityName }]
+			}
+		}))
+	}
+
+	private static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {
+		const groupedPermissions: PermissionsByRoleAndEntity = new Map()
+		for (const [name, entity] of entityLikeDefinition) {
+			const initEntityPermissions = (role: Role): EntityPermissions => {
+				const rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()
+				groupedPermissions.set(role, rolePermissions)
+				const entityPermissions = rolePermissions.get(name) ?? {
+					allowCustomPrimary: false,
+					definitions: [],
+				}
+				rolePermissions.set(name, entityPermissions)
+				return entityPermissions
+			}
+			const metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)
+			for (const { role, ...definition } of metadata) {
+				if (!roles.includes(role)) {
+					throw `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`
+				}
+				const entityPermissions = initEntityPermissions(role)
+				entityPermissions.definitions.push(definition)
+			}
+
+			const rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)
+			for (const role of rolesWithCustomPrimary) {
+				initEntityPermissions(role).allowCustomPrimary = true
+			}
+		}
+
+		return groupedPermissions
+	}
+}
+
+
+export type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }
+export type PermissionsByEntity = Map<string, EntityPermissions>
+export type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>

package/src/acl/definition/internal/EntityPredicateResolver.ts

@@ -0,0 +1,149 @@
+import { isDeepStrictEqual } from 'util'
+
+import { Acl, Input, Model, Writable } from '@contember/schema'
+import { PredicateDefinitionProcessor } from '@contember/schema-utils'
+
+import { PermissionsByEntity } from './AclFactory'
+import { createPredicateName } from './createPredicateName'
+import { AllowDefinition, PredicateExtra, WhenDefinition } from '../permissions'
+import { PredicateEvaluationReference } from '../references'
+import { EntityVariableDefinition } from '../variables'
+
+export class EntityPredicatesResolver {
+	private usedPredicates: string[] = []
+
+	private constructor(
+		private aclDefinitions: AllowDefinition<any>[],
+		private predicates: Writable<Acl.PredicateMap>,
+		private predicateNamesMap: Map<WhenDefinition, string>,
+		private generatedNames: Set<string>,
+	) {
+	}
+
+	public static create(
+		rolePermissions: PermissionsByEntity,
+		model: Model.Schema,
+		entity: Model.Entity,
+	): EntityPredicatesResolver {
+		const predicates: Writable<Acl.PredicateMap> = {}
+		const predicateNamesMap = new Map<WhenDefinition, string>()
+		const aclDefinitions = rolePermissions.get(entity.name)?.definitions ?? []
+		const generatedNames = new Set<string>()
+		const definedNames = new Set<string>(aclDefinitions.map(it => it.name).filter((it): it is string => it !== undefined))
+		for (const permission of aclDefinitions) {
+			if (!permission.when) {
+				continue
+			}
+			const resolvedPredicate = EntityPredicatesResolver.resolvePredicate(model, entity, permission.when, rolePermissions)
+			let predicateName = permission.name ?? createPredicateName(resolvedPredicate)
+			while (predicateName in predicates || definedNames.has(predicateName)) {
+				predicateName += '_'
+			}
+			if (!permission.name) {
+				generatedNames.add(predicateName)
+			}
+			predicates[predicateName] = resolvedPredicate
+			predicateNamesMap.set(permission.when, predicateName)
+		}
+		return new EntityPredicatesResolver(aclDefinitions, predicates, predicateNamesMap, generatedNames)
+	}
+
+	createFieldPredicate(op: 'create' | 'update' | 'read' | 'delete', field: string): true | undefined | string {
+		const fieldWhens = EntityPredicatesResolver.getMatchingWhens(this.aclDefinitions, op, field)
+		if (fieldWhens.length === 0) {
+			return undefined
+		}
+		if (fieldWhens.includes(true)) {
+			return true
+		}
+		const predicateNames = (fieldWhens as WhenDefinition[]).map(it => {
+			const name = this.predicateNamesMap.get(it)
+			if (!name) throw new Error('implementation error')
+			return name
+		})
+		if (predicateNames.length === 1) {
+			this.usedPredicates.push(predicateNames[0])
+			return predicateNames[0]
+		}
+
+
+		const predicate = { or: predicateNames.map(it => this.predicates[it]) }
+		const predicateName = predicateNames.every(it => this.generatedNames.has(it)) ? createPredicateName(predicate) : predicateNames.join('_or_')
+		if (!(predicateName in this.predicates)) {
+			this.predicates[predicateName] = predicate
+		} else if (!isDeepStrictEqual(predicate, this.predicates[predicateName])) {
+			throw new Error('Duplicate predicate')
+		}
+		this.usedPredicates.push(predicateName)
+		return predicateName
+	}
+
+	getUsedPredicates(): Acl.PredicateMap {
+		return Object.fromEntries(Object.entries(this.predicates).filter(([name]) => this.usedPredicates.includes(name)))
+	}
+
+
+	private static resolvePredicate(
+		model: Model.Schema,
+		entity: Model.Entity,
+		when: WhenDefinition,
+		rolePermissionsByEntity: PermissionsByEntity,
+	): Acl.PredicateDefinition {
+		const processor = new PredicateDefinitionProcessor(model)
+		return processor.process<Acl.PredicateReference | Input.Condition, PredicateExtra>(entity, when, {
+			handleColumn(ctx) {
+				if (ctx.value instanceof EntityVariableDefinition) {
+					return ctx.value.name
+				}
+				if (ctx.value instanceof PredicateEvaluationReference) {
+					throw `Predicate references are allowed only on relations. \nYou cannot use "can${upperCaseFirst(ctx.value.operation)}(${ctx.value.field ? JSON.stringify(ctx.value.field) : ''})" on a column "${ctx.column.name}" of entity "${ctx.entity.name}".`
+				}
+				return ctx.value
+			},
+			handleRelation(ctx) {
+				if (ctx.value instanceof EntityVariableDefinition) {
+					return { [ctx.targetEntity.primary]: ctx.value.name }
+				}
+				if (ctx.value instanceof PredicateEvaluationReference) {
+					const targetPermissions = rolePermissionsByEntity.get(ctx.targetEntity.name)
+					if (!targetPermissions) {
+						return { [ctx.targetEntity.primary]: { never: true } }
+					}
+					const ref = ctx.value
+					const whens = EntityPredicatesResolver.getMatchingWhens(targetPermissions.definitions, ref.operation, ref.field ?? '')
+					if (whens.length === 0) {
+						return { [ctx.targetEntity.primary]: { never: true } }
+					}
+					if (whens.includes(true)) {
+						return { [ctx.targetEntity.primary]: { always: true } }
+					}
+					const predicates = (whens as WhenDefinition[]).map(it =>
+						EntityPredicatesResolver.resolvePredicate(model, ctx.targetEntity, it, rolePermissionsByEntity),
+					)
+					if (predicates.length > 1) {
+						return { or: predicates }
+					}
+					return predicates[0]
+				}
+				return ctx.value
+			},
+		})
+	}
+
+	private static getMatchingWhens(permissions: AllowDefinition<any>[], operation: 'delete' | 'read' | 'update' | 'create', field: string) {
+		return permissions
+			.filter(it => {
+				if (operation === 'delete') {
+					return !!it.delete
+				}
+				const op = it[operation]
+				if (!op) {
+					return false
+				}
+				return op === true || op.includes(field)
+			})
+			.map(it => it.when ?? true)
+	}
+}
+
+const upperCaseFirst = (string: string) => `${string.charAt(0).toUpperCase()}${string.substring(1)}`

package/src/acl/definition/internal/MetadataStore.ts

@@ -0,0 +1,23 @@
+import 'reflect-metadata'
+
+export interface MetadataStore<V> {
+	get(target: Object): V
+	update(target: Object, generator: (current: V) => V): void
+}
+
+export const createMetadataStore = <V>(initialValue: V): MetadataStore<V> => {
+	const key = Symbol()
+	const get = (target: Object): V => {
+		return Reflect.hasMetadata(key, target)
+			? Reflect.getMetadata(key, target)
+			: initialValue
+	}
+	return {
+		get,
+		update: (target, generator) => {
+			const current = get(target)
+			const newMetadata = generator(current)
+			Reflect.defineMetadata(key, newMetadata, target)
+		},
+	}
+}

package/src/acl/definition/internal/createPredicateName.ts

@@ -0,0 +1,6 @@
+import { WhenDefinition } from '../permissions'
+
+export const createPredicateName = (when: WhenDefinition) => {
+	const json = JSON.stringify(when)
+	return json.replace(/[^A-Za-z0-9]+/g, '_').slice(0, 30).replace(/^_|_$/g, '')
+}

package/src/acl/definition/internal/stores.ts

@@ -0,0 +1,13 @@
+import { createMetadataStore } from './MetadataStore'
+import { Role } from '../roles'
+import { AllowDefinition } from '../permissions'
+
+export const allowCustomPrimaryStore = createMetadataStore<Role[]>([])
+export const allowCustomPrimaryAllRolesStore = createMetadataStore<boolean>(false)
+
+export type EntityPermissionsDefinition =
+	& AllowDefinition<any>
+	& {
+		role: Role<string>
+	}
+export const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])

package/src/acl/definition/permissions.ts

@@ -0,0 +1,29 @@
+import { Acl } from '@contember/schema'
+import { Role } from './roles'
+import { VariableDefinition } from './variables'
+import { PredicateEvaluationReference } from './references'
+import { allowDefinitionsStore } from './internal/stores'
+import { DecoratorFunction, EntityConstructor } from '../../model/definition/types'
+
+export type PredicateExtra = PredicateEvaluationReference | VariableDefinition
+export type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>
+
+export interface AllowDefinition<E> {
+	when?: WhenDefinition
+	name?: string
+	create?: true | (keyof E)[]
+	update?: true | (keyof E)[]
+	read?: true | (keyof E)[]
+	delete?: true
+}
+
+export const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E>): DecoratorFunction<E> => {
+	return (entity: EntityConstructor<E>) => {
+		(Array.isArray(role) ? role : [role]).forEach(role => {
+			allowDefinitionsStore.update(entity, val => [...val, { ...args, role }])
+		})
+	}
+}
+
+
+

package/src/acl/definition/references.ts

@@ -0,0 +1,21 @@
+export class PredicateEvaluationReference {
+	constructor(
+		public readonly operation: 'update' | 'delete' | 'create' | 'read',
+		public readonly field?: string,
+	) {
+	}
+}
+
+export const canUpdate = (field: string) => {
+	return new PredicateEvaluationReference('update', field)
+}
+
+export const canRead = (field: string) => {
+	return new PredicateEvaluationReference('read', field)
+}
+export const canCreate = (field: string) => {
+	return new PredicateEvaluationReference('create', field)
+}
+export const canDelete = () => {
+	return new PredicateEvaluationReference('delete')
+}

package/src/acl/definition/roles.ts

@@ -0,0 +1,19 @@
+import { Acl } from '@contember/schema'
+
+export interface RoleOptions {
+	stages?: Acl.StagesDefinition
+	tenant?: Acl.TenantPermissions
+	system?: Acl.SystemPermissions
+}
+
+export class Role<Name extends string = string> {
+	public constructor(
+		public readonly name: Name,
+		public readonly options: RoleOptions,
+	) {
+	}
+}
+
+export const createRole = <Name extends string>(name: Name, options: RoleOptions = {}): Role<Name> => {
+	return new Role(name, options)
+}

package/src/acl/definition/variables.ts

@@ -0,0 +1,27 @@
+import { Role } from './roles'
+
+export class EntityVariableDefinition<Name extends string, Roles extends Role<string>> {
+	public readonly type = 'entity' as const
+
+	constructor(
+		public readonly name: Name,
+		public readonly entityName: string,
+		public readonly roles: Roles[],
+	) {
+	}
+}
+
+export type VariableDefinition =
+	| EntityVariableDefinition<string, Role<string>>
+
+export const createEntityVariable = <R extends Role<string>, Name extends string>(
+	name: Name,
+	entityName: string,
+	roles: R | R[],
+): EntityVariableDefinition<Name, R> => {
+	return new EntityVariableDefinition(
+		name,
+		entityName,
+		Array.isArray(roles) ? roles : [roles],
+	)
+}

package/src/createSchema.ts

@@ -0,0 +1,12 @@
+import { SchemaDefinition } from './model'
+import * as InputValidation from './validation'
+import * as AclDefinition from './acl/definition'
+import { Schema } from '@contember/schema'
+
+export const createSchema = (definitions: Record<string, any>, modifyCallback?: (schema: Schema) => Schema): Schema => {
+	const model = SchemaDefinition.createModel(definitions)
+	const validation = InputValidation.parseDefinition(definitions)
+	const acl = AclDefinition.createAcl(definitions, model)
+	const schema = { model, validation, acl }
+	return modifyCallback ? modifyCallback(schema) : schema
+}

package/src/index.ts

@@ -1,6 +1,6 @@
-import { AllowAllPermissionFactory } from '@contember/schema-utils'
+export { AllowAllPermissionFactory } from '@contember/schema-utils'
+export { PermissionsBuilder } from './acl/builder/PermissionsBuilder'
+export * as InputValidation from './validation'
+export * as AclDefinition from './acl/definition'
+export * from './createSchema'
 export * from './model'
-import PermissionsBuilder from './acl/PermissionsBuilder'
-import * as InputValidation from './validation'
-
-export { AllowAllPermissionFactory, PermissionsBuilder, InputValidation }

package/src/model/definition/index.ts

@@ -5,6 +5,7 @@ import { SchemaBuilder } from './internal'
 import { DefaultNamingConventions } from './NamingConventions'
 import 'reflect-metadata'
 import { FieldDefinition } from './fieldDefinitions'
+import { isEntityConstructor } from '../../utils'
 
 export * from './fieldDefinitions'
 export * from './EventLogDefinition'
@@ -18,7 +19,7 @@ export abstract class Entity {
 }
 
 export type ModelDefinition<M> = {
-	[K in keyof M]: EnumDefinition | EntityConstructor
+	[K in keyof M]: unknown
 }
 
 export function createModel<M extends ModelDefinition<M>>(definitions: M): Model.Schema {
@@ -26,8 +27,8 @@ export function createModel<M extends ModelDefinition<M>>(definitions: M): Model
 	for (const [name, definition] of Object.entries(definitions)) {
 		if (definition instanceof EnumDefinition) {
 			schemaBuilder.addEnum(name, definition)
-		} else {
-			schemaBuilder.addEntity(name, definition as any)
+		} else if (isEntityConstructor(definition)) {
+			schemaBuilder.addEntity(name, definition)
 		}
 	}
 	const schema = schemaBuilder.createSchema()

package/src/utils/filterEntityDefinition.ts

@@ -0,0 +1,8 @@
+import { EntityConstructor } from '../model/definition/types'
+
+export const filterEntityDefinition = (definitions: Record<string, unknown>): [string, EntityConstructor][] => Object.entries(definitions)
+	.filter((it): it is [string, EntityConstructor] => isEntityConstructor(it[1]))
+
+export const isEntityConstructor = (it: unknown): it is EntityConstructor => {
+	return typeof it === 'function' && 'constructor' in it && 'prototype' in it
+}

package/src/utils/index.ts

@@ -1,2 +1,3 @@
 export * from './assertNever'
+export * from './filterEntityDefinition'
 export * from './tuple'

package/src/validation/index.ts

@@ -2,6 +2,7 @@ import { tuple } from '../utils'
 import { SchemaDefinition } from '../model'
 import 'reflect-metadata'
 import { Validation } from '@contember/schema'
+import { filterEntityDefinition } from '../utils'
 
 type MessageOrString = Validation.Message | string
 
@@ -196,10 +197,9 @@ export const combine =
 			decorators.forEach(it => it(target, propertyKey))
 
 export function parseDefinition(
-	definitions: Record<string, SchemaDefinition.EnumDefinition | { new (): any }>,
+	definitions: Record<string, any>,
 ): Validation.Schema {
-	return Object.entries(definitions)
-		.filter((it): it is [string, { new (): any }] => !(it[1] instanceof SchemaDefinition.EnumDefinition))
+	return filterEntityDefinition(definitions)
 		.map(([name, definition]) => {
 			const target = definition.prototype
 			const defInstance = new definition()

package/tests/tsconfig.json

@@ -0,0 +1,13 @@
+{
+	"extends": "../tsconfig.settings.json",
+	"compilerOptions": {
+		"outDir": "../dist/tests",
+		"esModuleInterop": true,
+		"experimentalDecorators": true
+	},
+	"references": [
+		{
+			"path": "../src"
+		}
+	]
+}