@contember/schema-definition 2.0.0-beta.3 → 2.0.0-beta.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/schema-definition",
-  "version": "2.0.0-beta.3",
+  "version": "2.0.0-beta.4",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -23,8 +23,8 @@
     }
   },
   "dependencies": {
-    "@contember/schema": "2.0.0-beta.3",
-    "@contember/schema-utils": "2.0.0-beta.3",
+    "@contember/schema": "2.0.0-beta.4",
+    "@contember/schema-utils": "2.0.0-beta.4",
     "reflect-metadata": "^0.2.2",
     "fast-deep-equal": "^3.1.3"
   },

package/src/acl/builder/PermissionOverrider.ts

@@ -33,6 +33,12 @@ export default class PermissionOverrider {
 					: {
 						customPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary,
 					  }),
+				...(original.operations.noRoot || overrides.operations.noRoot ? {
+					noRoot: [
+						...(original.operations.noRoot || []),
+						...(overrides.operations.noRoot || []),
+					],
+				} : {}),
 			},
 		}
 	}

package/src/acl/definition/internal/AclFactory.ts

@@ -53,7 +53,12 @@ export class AclFactory {
 
 			const predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)
 
-			const entityOperations: Writable<Acl.EntityOperations> = {}
+			const entityOperations: Writable<Acl.EntityOperations> = {
+			}
+			const noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entityName))
+			if (noRootOptions?.length) {
+				entityOperations.noRoot = noRootOptions
+			}
 			for (const op of ['create', 'update', 'read'] as const) {
 				const fieldPermissions: Writable<Acl.FieldPermissions> = {}
 				for (const field of Object.keys(entity.fields)) {
@@ -76,10 +81,34 @@ export class AclFactory {
 			return [entityName, {
 				predicates: predicatesResolver.getUsedPredicates(),
 				operations: entityOperations,
+
 			}]
 		}))
 	}
 
+
+	getNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {
+		const allowedRoot = new Set<Acl.Operation>()
+		const disallowedRoot = new Set<Acl.Operation>()
+		for (const def of permissions?.definitions ?? []) {
+			const noRoot = def.through === true
+			for (const op of ['create', 'read', 'update', 'delete'] as const) {
+				if (def[op]) {
+					const currentSet = noRoot ? disallowedRoot : allowedRoot
+					currentSet.add(op as Acl.Operation)
+
+					const otherSet = noRoot ? allowedRoot : disallowedRoot
+
+					if (otherSet.has(op as Acl.Operation)) {
+						throw new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)
+					}
+				}
+			}
+
+		}
+		return [...disallowedRoot.values()]
+	}
+
 	private createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {
 		const roleVariables = variables.filter(it => it.roles.includes(role))
 		return Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {

package/src/acl/definition/permissions.ts

@@ -10,6 +10,7 @@ export type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>
 
 export interface AllowDefinition<E> {
 	when?: WhenDefinition
+	through?: true
 	name?: string
 	create?: true | ('id' | keyof E)[]
 	update?: true | ('id' | keyof E)[]

package/tests/cases/unit/readAclDefinitions.test.ts

@@ -566,3 +566,79 @@ test('explicit ID predicate', () => {
 		'predicates': {},
 	})
 })
+
+namespace NoRoot {
+	export const publicRole = c.createRole('public')
+
+	@c.Allow(publicRole, {
+		read: ['id'],
+	})
+	@c.Allow(publicRole, {
+		when: { foo: { eq: 2 } },
+		through: true,
+		update: ['id'],
+	})
+	@c.Allow(publicRole, {
+		when: { foo: { eq: 1 } },
+		through: true,
+		update: ['id'],
+	})
+	export class Book {
+		title = c.stringColumn()
+		foo = c.intColumn()
+	}
+}
+
+test('no root - valid', () => {
+	const schema = createSchema(NoRoot)
+	expect(schema.acl.roles.public.entities.Book).toStrictEqual({
+		operations: {
+			noRoot: [Acl.Operation.update],
+			read: {
+				id: true,
+			},
+			update: {
+				id: 'or_foo_eq_1_foo_eq_2',
+			},
+		},
+		predicates: {
+			or_foo_eq_1_foo_eq_2: {
+				or: [
+					{
+						foo: {
+							eq: 1,
+						},
+					},
+					{
+						foo: {
+							eq: 2,
+						},
+					},
+				],
+			},
+		},
+	})
+})
+
+
+namespace NoRootInvalid {
+	export const publicRole = c.createRole('public')
+
+	@c.Allow(publicRole, {
+		when: { foo: { eq: 2 } },
+		through: true,
+		update: ['id'],
+	})
+	@c.Allow(publicRole, {
+		when: { foo: { eq: 1 } },
+		update: ['id'],
+	})
+	export class Book {
+		title = c.stringColumn()
+		foo = c.intColumn()
+	}
+}
+
+test('no root - invalid combo', () => {
+	expect(() => createSchema(NoRootInvalid)).toThrow('Operation update cannot be both allowed and disallowed on root on entity Book')
+})