@contember/schema-definition 2.1.0-alpha.25 → 2.1.0-alpha.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/schema-definition",
-  "version": "2.1.0-alpha.25",
+  "version": "2.1.0-alpha.26",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -23,8 +23,8 @@
     }
   },
   "dependencies": {
-    "@contember/schema": "2.1.0-alpha.25",
-    "@contember/schema-utils": "2.1.0-alpha.25",
+    "@contember/schema": "2.1.0-alpha.26",
+    "@contember/schema-utils": "2.1.0-alpha.26",
     "reflect-metadata": "^0.2.2",
     "fast-deep-equal": "^3.1.3"
   },

package/src/acl/definition/internal/AclFactory.ts

@@ -25,7 +25,7 @@ export class AclFactory {
 		const roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)
 		const variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)
 
-		const groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)
+		const groupedPermissions = this.groupPermissions(entityLikeDefinition, roles)
 
 		return {
 			roles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {
@@ -118,7 +118,7 @@ export class AclFactory {
 		}))
 	}
 
-	private static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {
+	private groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {
 		const groupedPermissions: PermissionsByRoleAndEntity = new Map()
 		for (const [name, entity] of entityLikeDefinition) {
 			const initEntityPermissions = (role: Role): EntityPermissions => {
@@ -131,12 +131,17 @@ export class AclFactory {
 				return entityPermissions
 			}
 			const metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)
-			for (const { role, ...definition } of metadata) {
+			for (const { role, factory } of metadata) {
 				if (!roles.includes(role)) {
 					throw `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`
 				}
 				const entityPermissions = initEntityPermissions(role)
-				entityPermissions.definitions.push(definition)
+				const entity = getEntity(this.model, name)
+				entityPermissions.definitions.push(factory({
+					model: this.model,
+					entity: getEntity(this.model, name),
+					except: (...fields) => (Object.keys(entity.fields)).filter(it => !fields.includes(it)),
+				}))
 			}
 		}
 

package/src/acl/definition/internal/stores.ts

@@ -1,10 +1,10 @@
 import { createMetadataStore } from '../../../utils/MetadataStore'
+import { AllowDefinitionFactory } from '../permissions'
 import { Role } from '../roles'
-import { AllowDefinition } from '../permissions'
 
 export type EntityPermissionsDefinition =
-	& AllowDefinition<any>
 	& {
+		factory: AllowDefinitionFactory<any>
 		role: Role<string>
 	}
 export const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])

package/src/acl/definition/permissions.ts

@@ -1,4 +1,4 @@
-import { Acl } from '@contember/schema'
+import { Acl, Model } from '@contember/schema'
 import { Role } from './roles'
 import { VariableDefinition } from './variables'
 import { PredicateEvaluationReference } from './references'
@@ -18,10 +18,19 @@ export interface AllowDefinition<E> {
 	delete?: true
 }
 
-export const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E>): DecoratorFunction<E> => {
+export type AllowDefinitionFactory<E> = (args: {
+	model: Model.Schema
+	entity: Model.Entity<(keyof E) & string>
+	except: (...fields: (keyof E)[]) => (keyof E)[]
+}) => AllowDefinition<E>
+
+export const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E> | AllowDefinitionFactory<E>): DecoratorFunction<E> => {
 	return (entity: EntityConstructor<E>) => {
 		(Array.isArray(role) ? role : [role]).forEach(role => {
-			allowDefinitionsStore.update(entity, val => [...val, { ...args, role }])
+			allowDefinitionsStore.update(entity, val => [...val, {
+				factory: typeof args === 'function' ? args : () => args,
+				role,
+			}])
 		})
 	}
 }

package/tests/cases/unit/readAclDefinitions.test.ts

@@ -1,6 +1,6 @@
 import { expect, test } from 'bun:test'
 import { c, createSchema } from '../../../src'
-import { Acl } from '@contember/schema'
+import { Acl, Model } from '@contember/schema'
 
 namespace SimpleModel {
 	export const publicRole = c.createRole('public')
@@ -130,24 +130,24 @@ test('definition with update, create, delete predicates', () => {
 	const schema = createSchema(ModelWithModificationAcl)
 	expect(schema.acl.roles.public.entities.Book).toStrictEqual(
 		{
-		  'operations': {
-		    'create': {
-		      'isPublished': 'isPublished_eq_true',
-		      'title': 'isPublished_eq_true',
-		    },
-		    'delete': 'isPublished_eq_true',
-		    'update': {
-		      'isPublished': 'isPublished_eq_true',
-		      'title': 'isPublished_eq_true',
-		    },
-		  },
-		  'predicates': {
-		    'isPublished_eq_true': {
-		      'isPublished': {
-		        'eq': true,
-		      },
-		    },
-		  },
+			'operations': {
+				'create': {
+					'isPublished': 'isPublished_eq_true',
+					'title': 'isPublished_eq_true',
+				},
+				'delete': 'isPublished_eq_true',
+				'update': {
+					'isPublished': 'isPublished_eq_true',
+					'title': 'isPublished_eq_true',
+				},
+			},
+			'predicates': {
+				'isPublished_eq_true': {
+					'isPublished': {
+						'eq': true,
+					},
+				},
+			},
 		},
 	)
 })
@@ -174,27 +174,27 @@ test('definition with multiple predicates on a single field', () => {
 	const schema = createSchema(ModelWithMultiplePredicates)
 	expect(schema.acl.roles.public.entities.Book).toStrictEqual(
 		{
-		  'operations': {
-		    'read': {
-		      'title': 'or_isPublished_eq_false_isPub',
-		    },
-		  },
-		  'predicates': {
-		    'or_isPublished_eq_false_isPub': {
-		      'or': [
-		        {
-		          'isPublished': {
-		            'eq': false,
-		          },
-		        },
-		        {
-		          'isPublished': {
-		            'eq': true,
-		          },
-		        },
-		      ],
-		    },
-		  },
+			'operations': {
+				'read': {
+					'title': 'or_isPublished_eq_false_isPub',
+				},
+			},
+			'predicates': {
+				'or_isPublished_eq_false_isPub': {
+					'or': [
+						{
+							'isPublished': {
+								'eq': false,
+							},
+						},
+						{
+							'isPublished': {
+								'eq': true,
+							},
+						},
+					],
+				},
+			},
 		},
 	)
 })
@@ -225,42 +225,42 @@ test('definition with collision', () => {
 	const schema = createSchema(ModelWithJoinedPredicateCollision)
 	expect(schema.acl.roles.public.entities.Book).toStrictEqual(
 		{
-		  'operations': {
-		    'read': {
-		      'isPublishedLoremIpsumDolorSitAmet': 'or_isPublishedLoremIpsumDolor_1',
-		      'title': 'or_isPublishedLoremIpsumDolor',
-		    },
-		  },
-		  'predicates': {
-		    'or_isPublishedLoremIpsumDolor': {
-		      'or': [
-		        {
-		          'isPublishedLoremIpsumDolorSitAmet': {
-		            'eq': false,
-		          },
-		        },
-		        {
-		          'isPublishedLoremIpsumDolorSitAmet': {
-		            'eq': true,
-		          },
-		        },
-		      ],
-		    },
-		    'or_isPublishedLoremIpsumDolor_1': {
-		      'or': [
-		        {
-		          'isPublishedLoremIpsumDolorSitAmet': {
-		            'eq': false,
-		          },
-		        },
-		        {
-		          'isPublishedLoremIpsumDolorSitAmet': {
-		            'eq': false,
-		          },
-		        },
-		      ],
-		    },
-		  },
+			'operations': {
+				'read': {
+					'isPublishedLoremIpsumDolorSitAmet': 'or_isPublishedLoremIpsumDolor_1',
+					'title': 'or_isPublishedLoremIpsumDolor',
+				},
+			},
+			'predicates': {
+				'or_isPublishedLoremIpsumDolor': {
+					'or': [
+						{
+							'isPublishedLoremIpsumDolorSitAmet': {
+								'eq': false,
+							},
+						},
+						{
+							'isPublishedLoremIpsumDolorSitAmet': {
+								'eq': true,
+							},
+						},
+					],
+				},
+				'or_isPublishedLoremIpsumDolor_1': {
+					'or': [
+						{
+							'isPublishedLoremIpsumDolorSitAmet': {
+								'eq': false,
+							},
+						},
+						{
+							'isPublishedLoremIpsumDolorSitAmet': {
+								'eq': false,
+							},
+						},
+					],
+				},
+			},
 		},
 	)
 })
@@ -283,34 +283,34 @@ test('definition with multiple roles in single predicate', () => {
 	const schema = createSchema(ModelWithMultipleRolesForSinglePredicate)
 	expect(schema.acl.roles).toStrictEqual(
 		{
-		  'admin': {
-		    'entities': {
-		      'Book': {
-		        'operations': {
-		          'read': {
-		            'title': true,
-		          },
-		        },
-		        'predicates': {},
-		      },
-		    },
-		    'stages': '*',
-		    'variables': {},
-		  },
-		  'public': {
-		    'entities': {
-		      'Book': {
-		        'operations': {
-		          'read': {
-		            'title': true,
-		          },
-		        },
-		        'predicates': {},
-		      },
-		    },
-		    'stages': '*',
-		    'variables': {},
-		  },
+			'admin': {
+				'entities': {
+					'Book': {
+						'operations': {
+							'read': {
+								'title': true,
+							},
+						},
+						'predicates': {},
+					},
+				},
+				'stages': '*',
+				'variables': {},
+			},
+			'public': {
+				'entities': {
+					'Book': {
+						'operations': {
+							'read': {
+								'title': true,
+							},
+						},
+						'predicates': {},
+					},
+				},
+				'stages': '*',
+				'variables': {},
+			},
 		},
 	)
 })
@@ -340,36 +340,36 @@ test('definition with predicate references', () => {
 	const schema = createSchema(ModelWithAclPredicateReferences)
 	expect(schema.acl.roles.public.entities).toStrictEqual(
 		{
-		  'Book': {
-		    'operations': {
-		      'read': {
-		        'title': 'isPublished_eq_true',
-		      },
-		    },
-		    'predicates': {
-		      'isPublished_eq_true': {
-		        'isPublished': {
-		          'eq': true,
-		        },
-		      },
-		    },
-		  },
-		  'BookReview': {
-		    'operations': {
-		      'read': {
-		        'content': 'book_isPublished_eq_true',
-		      },
-		    },
-		    'predicates': {
-		      'book_isPublished_eq_true': {
-		        'book': {
-		          'isPublished': {
-		            'eq': true,
-		          },
-		        },
-		      },
-		    },
-		  },
+			'Book': {
+				'operations': {
+					'read': {
+						'title': 'isPublished_eq_true',
+					},
+				},
+				'predicates': {
+					'isPublished_eq_true': {
+						'isPublished': {
+							'eq': true,
+						},
+					},
+				},
+			},
+			'BookReview': {
+				'operations': {
+					'read': {
+						'content': 'book_isPublished_eq_true',
+					},
+				},
+				'predicates': {
+					'book_isPublished_eq_true': {
+						'book': {
+							'isPublished': {
+								'eq': true,
+							},
+						},
+					},
+				},
+			},
 		},
 	)
 })
@@ -392,27 +392,27 @@ test('definition with variables', () => {
 	const schema = createSchema(ModelWithVariables)
 	expect(schema.acl.roles.manager).toStrictEqual(
 		{
-		  'entities': {
-		    'Book': {
-		      'operations': {
-		        'read': {
-		          'title': 'id_bookId',
-		        },
-		      },
-		      'predicates': {
-		        'id_bookId': {
-		          'id': 'bookId',
-		        },
-		      },
-		    },
-		  },
-		  'stages': '*',
-		  'variables': {
-		    'bookId': {
-		      'entityName': 'Book',
-		      'type': Acl.VariableType.entity,
-		    },
-		  },
+			'entities': {
+				'Book': {
+					'operations': {
+						'read': {
+							'title': 'id_bookId',
+						},
+					},
+					'predicates': {
+						'id_bookId': {
+							'id': 'bookId',
+						},
+					},
+				},
+			},
+			'stages': '*',
+			'variables': {
+				'bookId': {
+					'entityName': 'Book',
+					'type': Acl.VariableType.entity,
+				},
+			},
 		},
 	)
 })
@@ -430,10 +430,10 @@ test('allow custom primary', () => {
 	const schema = createSchema(ModelWithAllowCustomPrimary)
 	expect(schema.acl.roles.public.entities.Book).toStrictEqual(
 		{
-		  'operations': {
-		    'customPrimary': true,
-		  },
-		  'predicates': {},
+			'operations': {
+				'customPrimary': true,
+			},
+			'predicates': {},
 		},
 	)
 })
@@ -451,10 +451,10 @@ test('allow custom primary', () => {
 	const schema = createSchema(ModelWithAllowCustomPrimaryAllRoles)
 	expect(schema.acl.roles.public.entities.Book).toStrictEqual(
 		{
-		  'operations': {
-		    'customPrimary': true,
-		  },
-		  'predicates': {},
+			'operations': {
+				'customPrimary': true,
+			},
+			'predicates': {},
 		},
 	)
 })
@@ -642,3 +642,29 @@ namespace NoRootInvalid {
 test('no root - invalid combo', () => {
 	expect(() => createSchema(NoRootInvalid)).toThrow('Operation update cannot be both allowed and disallowed on root on entity Book')
 })
+
+
+namespace AllowFactoryModel {
+	export const publicRole = c.createRole('public')
+
+	@c.Allow(publicRole, ({ except }) => ({
+		read: except('confidential'),
+	}))
+	export class Book {
+		title = c.stringColumn()
+		confidential = c.stringColumn()
+	}
+}
+
+test('allow with factory', () => {
+	const schema = createSchema(AllowFactoryModel)
+	expect(schema.acl.roles.public.entities.Book).toStrictEqual({
+		'operations': {
+			'read': {
+				'id': true,
+				'title': true,
+			},
+		},
+		'predicates': {},
+	})
+})