@contember/schema-utils 1.1.0-alpha.4 → 1.1.0-alpha.7

package/src/type-schema/model.ts

@@ -0,0 +1,173 @@
+import * as Typesafe from '@contember/typesafe'
+import { Model } from '@contember/schema'
+
+const orderBySchema = Typesafe.array(Typesafe.object({
+	path: Typesafe.array(Typesafe.string),
+	direction: Typesafe.enumeration<Model.OrderDirection>(Model.OrderDirection.asc, Model.OrderDirection.desc),
+}))
+const joiningColumnSchema = Typesafe.object({
+	columnName: Typesafe.string,
+	onDelete: Typesafe.enumeration<Model.OnDelete>(Model.OnDelete.cascade, Model.OnDelete.restrict, Model.OnDelete.setNull),
+})
+const oneHasManyRelationSchema = Typesafe.intersection(
+	Typesafe.object({
+		type: Typesafe.literal(Model.RelationType.OneHasMany),
+		name: Typesafe.string,
+		target: Typesafe.string,
+		ownedBy: Typesafe.string,
+	}),
+	Typesafe.partial({
+		orderBy: orderBySchema,
+	}),
+)
+const oneHasManyRelationSchemaCheck: Typesafe.Equals<Model.OneHasManyRelation, ReturnType<typeof oneHasManyRelationSchema>> = true
+
+const manyHasOneRelationSchema = Typesafe.intersection(
+	Typesafe.object({
+		type: Typesafe.literal(Model.RelationType.ManyHasOne),
+		name: Typesafe.string,
+		target: Typesafe.string,
+		joiningColumn: joiningColumnSchema,
+		nullable: Typesafe.boolean,
+	}),
+	Typesafe.partial({
+		inversedBy: Typesafe.string,
+	}),
+)
+
+const manyHasOneRelationSchemaCheck: Typesafe.Equals<Model.ManyHasOneRelation, ReturnType<typeof manyHasOneRelationSchema>> = true
+
+const oneHasOneInverseRelationSchema = Typesafe.object({
+	type: Typesafe.literal(Model.RelationType.OneHasOne),
+	name: Typesafe.string,
+	target: Typesafe.string,
+	ownedBy: Typesafe.string,
+	nullable: Typesafe.boolean,
+})
+const oneHasOneInverseRelationSchemaCheck: Typesafe.Equals<Model.OneHasOneInverseRelation, ReturnType<typeof oneHasOneInverseRelationSchema>> = true
+
+
+const oneHasOneOwningRelationSchema = Typesafe.intersection(
+	Typesafe.object({
+		type: Typesafe.literal(Model.RelationType.OneHasOne),
+		name: Typesafe.string,
+		target: Typesafe.string,
+		joiningColumn: joiningColumnSchema,
+		nullable: Typesafe.boolean,
+	}),
+	Typesafe.partial({
+		inversedBy: Typesafe.string,
+		orphanRemoval: Typesafe.literal(true),
+	}),
+)
+
+const oneHasOneOwningRelationSchemaCheck: Typesafe.Equals<Model.OneHasOneOwningRelation, ReturnType<typeof oneHasOneOwningRelationSchema>> = true
+
+const manyHasManyOwningRelationSchema = Typesafe.intersection(
+	Typesafe.object({
+		type: Typesafe.literal(Model.RelationType.ManyHasMany),
+		name: Typesafe.string,
+		target: Typesafe.string,
+		joiningTable: Typesafe.object({
+			tableName: Typesafe.string,
+			joiningColumn: joiningColumnSchema,
+			inverseJoiningColumn: joiningColumnSchema,
+			eventLog: Typesafe.object({
+				enabled: Typesafe.boolean,
+			}),
+		}),
+	}),
+	Typesafe.partial({
+		inversedBy: Typesafe.string,
+		orderBy: orderBySchema,
+	}),
+)
+const manyHasManyOwningRelationSchemaCheck: Typesafe.Equals<Model.ManyHasManyOwningRelation, ReturnType<typeof manyHasManyOwningRelationSchema>> = true
+
+const manyHasManyInverseRelationSchema = Typesafe.intersection(
+	Typesafe.object({
+		type: Typesafe.literal(Model.RelationType.ManyHasMany),
+		name: Typesafe.string,
+		target: Typesafe.string,
+		ownedBy: Typesafe.string,
+	}),
+	Typesafe.partial({
+		orderBy: orderBySchema,
+	}),
+)
+const manyHasManyInverseRelationSchemaCheck: Typesafe.Equals<Model.ManyHasManyInverseRelation, ReturnType<typeof manyHasManyInverseRelationSchema>> = true
+
+const intersectionSchema = Typesafe.intersection(
+	Typesafe.object({
+		precedence: Typesafe.enumeration('ALWAYS', 'BY DEFAULT'),
+	}),
+	Typesafe.partial({
+		start: Typesafe.number,
+	}),
+)
+const intersectionSchemaCheck: Typesafe.Equals<Model.AnyColumn['sequence'], ReturnType<typeof intersectionSchema>> = true
+
+const columnSchema = Typesafe.intersection(
+	Typesafe.object({
+		name: Typesafe.string,
+		columnName: Typesafe.string,
+		columnType: Typesafe.string,
+		nullable: Typesafe.boolean,
+		type: Typesafe.enumeration<Model.ColumnType>(...Object.values(Model.ColumnType)),
+	}),
+	Typesafe.partial({
+		typeAlias: Typesafe.string,
+		default: Typesafe.union(Typesafe.string, Typesafe.number, Typesafe.boolean, Typesafe.null_),
+		sequence: intersectionSchema as Typesafe.Type<Model.AnyColumn['sequence']>,
+	}),
+)
+const columnSchemaCheck: Typesafe.Equals<Model.AnyColumn, ReturnType<typeof columnSchema>> = true
+
+const fieldSchema: Typesafe.Type<Model.AnyField> = Typesafe.union(
+	oneHasOneInverseRelationSchema,
+	oneHasOneOwningRelationSchema,
+	oneHasManyRelationSchema,
+	manyHasOneRelationSchema,
+	manyHasManyInverseRelationSchema,
+	manyHasManyOwningRelationSchema,
+	columnSchema,
+)
+
+const viewSchemaInner = Typesafe.intersection(
+	Typesafe.object({
+		sql: Typesafe.string,
+	}),
+	Typesafe.partial({
+		dependencies: Typesafe.array(Typesafe.string),
+	}),
+)
+const viewSchemaCheck: Typesafe.Equals<Model.View, ReturnType<typeof viewSchemaInner>> = true
+const viewSchema: Typesafe.Type<Model.View> = viewSchemaInner
+
+const entitySchema = Typesafe.intersection(
+	Typesafe.object({
+		name: Typesafe.string,
+		primary: Typesafe.string,
+		primaryColumn: Typesafe.string,
+		tableName: Typesafe.string,
+		fields: Typesafe.record(Typesafe.string, fieldSchema),
+		unique: Typesafe.record(Typesafe.string, Typesafe.object({
+			fields: Typesafe.array(Typesafe.string),
+			name: Typesafe.string,
+		})),
+		eventLog: Typesafe.object({
+			enabled: Typesafe.boolean,
+		}),
+	}),
+	Typesafe.partial({
+		view: viewSchema,
+	}),
+)
+
+const entitySchemaCheck: Typesafe.Equals<Model.Entity, ReturnType<typeof entitySchema>> = true
+
+export const modelSchema = Typesafe.object({
+	entities: Typesafe.record(Typesafe.string, entitySchema),
+	enums: Typesafe.record(Typesafe.string, Typesafe.array(Typesafe.string)),
+})
+

package/src/type-schema/validation.ts

@@ -0,0 +1,100 @@
+import * as Typesafe from '@contember/typesafe'
+import { Validation } from '@contember/schema'
+
+const messageSchema = Typesafe.intersection(
+	Typesafe.object({
+		text: Typesafe.string,
+	}),
+	Typesafe.partial({
+		parameters: Typesafe.array(Typesafe.union(Typesafe.string, Typesafe.number)),
+	}),
+)
+const literalArgumentFactory = <T extends Typesafe.Json>(inner: Typesafe.Type<T>) => Typesafe.object({
+	type: Typesafe.literal(Validation.ArgumentType.literal),
+	value: inner,
+})
+
+const validatorArgumentSchema = Typesafe.object({
+	type: Typesafe.literal(Validation.ArgumentType.validator),
+	validator: (v, p): Validation.Validator => validatorSchema(v, p),
+})
+const pathArgumentSchema = Typesafe.object({
+	type: Typesafe.literal(Validation.ArgumentType.path),
+	path: Typesafe.array(Typesafe.string),
+})
+
+const validatorSchema = Typesafe.union(
+	Typesafe.object({
+		operation: Typesafe.literal('and'),
+		args: Typesafe.array(validatorArgumentSchema),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('or'),
+		args: Typesafe.array(validatorArgumentSchema),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('conditional'),
+		args: Typesafe.tuple(validatorArgumentSchema, validatorArgumentSchema),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('pattern'),
+		args: Typesafe.tuple(literalArgumentFactory(Typesafe.tuple(Typesafe.string, Typesafe.string))),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('lengthRange'),
+		args: Typesafe.tuple(
+			literalArgumentFactory(Typesafe.union(Typesafe.null_, Typesafe.number)),
+			literalArgumentFactory(Typesafe.union(Typesafe.null_, Typesafe.number)),
+		),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('range'),
+		args: Typesafe.tuple(
+			literalArgumentFactory(Typesafe.union(Typesafe.null_, Typesafe.number)),
+			literalArgumentFactory(Typesafe.union(Typesafe.null_, Typesafe.number)),
+		),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('equals'),
+		args: Typesafe.tuple(literalArgumentFactory(Typesafe.anyJson)),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('not'),
+		args: Typesafe.tuple(validatorArgumentSchema),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('empty'),
+		args: Typesafe.tuple(),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('defined'),
+		args: Typesafe.tuple(),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('inContext'),
+		args: Typesafe.tuple(pathArgumentSchema, validatorArgumentSchema),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('every'),
+		args: Typesafe.tuple(validatorArgumentSchema),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('any'),
+		args: Typesafe.tuple(validatorArgumentSchema),
+	}),
+	Typesafe.object({
+		operation: Typesafe.literal('filter'),
+		args: Typesafe.tuple(validatorArgumentSchema, validatorArgumentSchema),
+	}),
+)
+const validatorSchemaCheck: Typesafe.Equals<Validation.Validator, ReturnType<typeof validatorSchema>> = true
+
+const validationRuleSchema = Typesafe.object({
+	validator: validatorSchema as Typesafe.Type<Validation.Validator>,
+	message: messageSchema,
+})
+
+export const validationSchema = Typesafe.record(
+	Typesafe.string,
+	Typesafe.record(Typesafe.string, Typesafe.array(validationRuleSchema)),
+)

package/src/validation/AclValidator.ts

@@ -1,199 +1,71 @@
 import { Acl, Model } from '@contember/schema'
-import { checkExtraProperties, everyIs, hasStringProperty, isObject } from './utils'
 import { PredicateDefinitionProcessor } from '../acl'
 import { getEntity } from '../model'
 import { ErrorBuilder, ValidationError } from './errors'
 
+
 export class AclValidator {
 	constructor(private readonly model: Model.Schema) {}
 
-	public validate(schema: unknown): [Acl.Schema, ValidationError[]] {
+	public validate(schema: Acl.Schema): ValidationError[] {
 		const errorBuilder = new ErrorBuilder([], ['acl'])
-		let validSchema: Acl.Schema
-		if (!isObject(schema)) {
-			errorBuilder.add('Must be an object')
-			validSchema = { roles: {} }
-		} else if (!schema.roles) {
-			errorBuilder.for('roles').add('Property is missing')
-			validSchema = { roles: {} }
-		} else {
-			validSchema = { roles: this.validateRoles(schema.roles, errorBuilder) }
-		}
-		return [validSchema, errorBuilder.errors]
+		this.validateRoles(schema.roles, errorBuilder)
+		return errorBuilder.errors
 	}
 
-	private validateRoles(roles: unknown, errorBuilder: ErrorBuilder): Acl.Schema['roles'] {
-		if (!isObject(roles)) {
-			errorBuilder.add('Must be an object')
-			return {}
-		}
-		const validRoles: Acl.Schema['roles'] = {}
+	private validateRoles(roles: Acl.Roles, errorBuilder: ErrorBuilder): void {
 		for (const role in roles) {
 			if (!roles.hasOwnProperty(role)) {
 				continue
 			}
-			// if (role === 'admin') {
-			// 	errorBuilder.add('Role "admin" is reserved.')
-			// 	continue
-			// }
-			const rolePermissions = this.validateRolePermissions(roles[role], Object.keys(roles), errorBuilder.for(role))
-			if (rolePermissions !== undefined) {
-				validRoles[role] = rolePermissions
-			}
+			this.validateRolePermissions(roles[role], Object.keys(roles), errorBuilder.for(role))
 		}
-		return validRoles
 	}
 
 	private validateRolePermissions(
-		permissions: unknown,
+		permissions: Acl.RolePermissions,
 		roles: string[],
 		errorBuilder: ErrorBuilder,
-	): Acl.RolePermissions | undefined {
-		if (!isObject(permissions)) {
-			errorBuilder.add('Must be an object')
-			return
-		}
+	): void {
 
-		const {
-			inherits: inheritsIn,
-			variables: variablesIn,
-			stages: stagesIn,
-			entities: entitiesIn,
-			implicit: implicitIn,
-			...plugins
-		} = permissions
-
-		const inherits = this.validateInherits(inheritsIn, roles, errorBuilder.for('inherits'))
-		const variables = this.validateVariables(variablesIn, errorBuilder.for('variables'))
-		const stages = this.validateStagesDefinition(stagesIn, errorBuilder.for('stages'))
-		const entities = this.validatePermissions(
-			entitiesIn,
-			(permissions.variables as Acl.Variables) || {},
-			errorBuilder.for('entities'),
-		)
+		this.validateInherits(permissions.inherits, roles, errorBuilder.for('inherits'))
+		this.validateVariables(permissions.variables, errorBuilder.for('variables'))
+		this.validatePermissions(permissions.entities, (permissions.variables as Acl.Variables) || {}, errorBuilder.for('entities'))
 		// todo: plugins validation
-
-		const result: Acl.RolePermissions = { variables, stages, entities }
-		if (inherits !== undefined) {
-			result.inherits = inherits
-		}
-		if (implicitIn !== undefined) {
-			if (typeof implicitIn !== 'boolean') {
-				errorBuilder.for('implicit').add('Must be boolean')
-				return
-			}
-			result.implicit = implicitIn
-		}
-
-		return { ...plugins, ...result }
 	}
 
-	private validateInherits(inherits: unknown, roles: string[], errorBuilder: ErrorBuilder): string[] | undefined {
+	private validateInherits(inherits: Acl.RolePermissions['inherits'], roles: string[], errorBuilder: ErrorBuilder): void {
 		if (inherits === undefined) {
 			return undefined
 		}
-		if (!Array.isArray(inherits) || !everyIs(inherits, (it): it is string => typeof it === 'string')) {
-			errorBuilder.add('Must be an array of strings')
-			return []
-		} else {
-			const validRoles: string[] = []
-			for (const inheritsFrom of inherits) {
-				if (!roles.includes(inheritsFrom)) {
-					// todo: check recursion
-					errorBuilder.for(inheritsFrom).add('Referenced role not exists.')
-				} else {
-					validRoles.push(inheritsFrom)
-				}
+		for (const inheritsFrom of inherits) {
+			if (!roles.includes(inheritsFrom)) {
+				errorBuilder.for(inheritsFrom).add('Referenced role not exists.')
 			}
-			return validRoles
 		}
 	}
 
-	private validateVariables(variables: unknown, errorBuilder: ErrorBuilder): Acl.Variables {
-		let validVariables: Acl.Variables = {}
-		if (!isObject(variables)) {
-			errorBuilder.add('Must be an object')
-			return {}
-		}
+	private validateVariables(variables: Acl.Variables, errorBuilder: ErrorBuilder): void {
 		for (const varName in variables) {
 			if (!variables.hasOwnProperty(varName)) {
 				continue
 			}
-			const validVariable = this.validateVariable(variables[varName], errorBuilder.for(varName))
-			if (validVariable) {
-				validVariables[varName] = validVariable
-			}
+			this.validateVariable(variables[varName], errorBuilder.for(varName))
 		}
-		return validVariables
 	}
 
-	private validateVariable(variable: unknown, errorBuilder: ErrorBuilder): Acl.Variable | undefined {
-		if (!isObject(variable)) {
-			errorBuilder.add('Must be an object')
-			return
-		}
-		if (!hasStringProperty(variable, 'type')) {
-			errorBuilder.add('Variable type is not defined')
-			return
-		}
+	private validateVariable(variable: Acl.Variable, errorBuilder: ErrorBuilder): void {
 		switch (variable.type) {
-			case Acl.VariableType.entity:
-				if (!hasStringProperty(variable, 'entityName')) {
-					errorBuilder.add('Entity name must be specified for this type of variable')
-					return
-				}
+			case 'entity':
 				if (!this.model.entities[variable.entityName]) {
 					errorBuilder.add(`Entity "${variable.entityName}" not found`)
 					return
 				}
-				const extra = checkExtraProperties(variable, ['entityName', 'type'])
-				if (extra.length) {
-					errorBuilder.add('Unsupported properties found: ' + extra.join(', '))
-				}
-				return { type: Acl.VariableType.entity, entityName: variable.entityName }
-
-			case Acl.VariableType.predefined:
-				if (!hasStringProperty(variable, 'value')) {
-					errorBuilder.add('Variable value type must be specified for this type of variable')
-					return
-				}
-				if (variable.value !== 'identityID' && variable.value !== 'personID') {
-					errorBuilder.add('Unknown predefined variable')
-					return
-				}
-				const extra2 = checkExtraProperties(variable, ['type', 'value'])
-				if (extra2.length) {
-					errorBuilder.add('Unsupported properties found: ' + extra2.join(', '))
-				}
-				return { type: variable.type, value: variable.value }
-			default:
-				errorBuilder.add(`Variable type "${variable.type}" is not supported.`)
 		}
 		return
 	}
 
-	private validateStagesDefinition(stages: unknown, errorBuilder: ErrorBuilder): Acl.StagesDefinition {
-		if (stages === '*') {
-			return '*'
-		}
-		if (!Array.isArray(stages) || !everyIs(stages, (it): it is string => typeof it === 'string')) {
-			errorBuilder.add('Stages must be either "*" or array of stage names')
-			return []
-		}
-		// todo validate stages ??
-		return stages
-	}
-
-	private validatePermissions(
-		permissions: unknown,
-		variables: Acl.Variables,
-		errorBuilder: ErrorBuilder,
-	): Acl.Permissions {
-		if (!isObject(permissions)) {
-			errorBuilder.add('Must be an object')
-			return {}
-		}
-		const validPermissions: Acl.Permissions = {}
+	private validatePermissions(permissions: Acl.Permissions, variables: Acl.Variables, errorBuilder: ErrorBuilder): void {
 		for (const entityName in permissions) {
 			if (!permissions.hasOwnProperty(entityName)) {
 				continue
@@ -204,161 +76,99 @@ export class AclValidator {
 			}
 			const entity = getEntity(this.model, entityName)
 
-			const entityPermissions = this.validateEntityPermissions(
+			this.validateEntityPermissions(
 				permissions[entityName],
 				entity,
 				variables,
 				errorBuilder.for(entityName),
 			)
-			if (entityPermissions) {
-				validPermissions[entityName] = entityPermissions
-			}
 		}
-		return validPermissions
 	}
 
 	private validateEntityPermissions(
-		entityPermissions: unknown,
+		entityPermissions: Acl.EntityPermissions,
 		entity: Model.Entity,
 		variables: Acl.Variables,
 		errorBuilder: ErrorBuilder,
-	): Acl.EntityPermissions | undefined {
-		if (!isObject(entityPermissions)) {
-			errorBuilder.add('Must be an object')
-			return
-		}
-		const extra = checkExtraProperties(entityPermissions, ['predicates', 'operations'])
-		if (extra.length) {
-			errorBuilder.add('Unsupported properties found: ' + extra.join(', '))
-		}
-		const predicates = this.validatePredicates(
+	): void {
+		this.validatePredicates(
 			entityPermissions.predicates,
 			entity,
 			variables,
 			errorBuilder.for('predicates'),
 		)
-		const operations = this.validateOperations(
+		this.validateOperations(
 			entityPermissions.operations,
 			entity,
 			entityPermissions.predicates as Acl.PredicateMap,
 			errorBuilder.for('operations'),
 		)
-
-		return { operations, predicates }
 	}
 
-	private validatePredicates(
-		predicates: unknown,
-		entity: Model.Entity,
-		variables: Acl.Variables,
-		errorBuilder: ErrorBuilder,
-	): Acl.PredicateMap {
-		if (!isObject(predicates)) {
-			errorBuilder.add('Must be an object')
-			return {}
-		}
-		const validPredicates: Acl.PredicateMap = {}
+	private validatePredicates(predicates: Acl.PredicateMap, entity: Model.Entity, variables: Acl.Variables, errorBuilder: ErrorBuilder): void {
 		for (const predicateName in predicates) {
 			if (!predicates.hasOwnProperty(predicateName)) {
 				continue
 			}
-			const predicate = this.validatePredicateDefinition(
+			this.validatePredicateDefinition(
 				predicates[predicateName],
 				entity,
 				variables,
 				errorBuilder.for(predicateName),
 			)
-			if (predicate) {
-				validPredicates[predicateName] = predicate
-			}
 		}
-		return validPredicates
 	}
 
 	private validatePredicateDefinition(
-		predicate: unknown,
+		predicate: Acl.PredicateDefinition,
 		entity: Model.Entity,
 		variables: Acl.Variables,
 		errorBuilder: ErrorBuilder,
-	): Acl.PredicateDefinition | undefined {
-		if (!isObject(predicate)) {
-			errorBuilder.add('Must be an object')
-			return
-		}
+	): void {
 		const processor = new PredicateDefinitionProcessor(this.model)
-		let valid = true
-		const result = processor.process(entity, predicate, {
+		processor.process(entity, predicate, {
 			handleColumn: ctx => {
 				if (typeof ctx.value === 'string' && !variables[ctx.value]) {
-					valid = false
 					errorBuilder.for(...ctx.path).add(`Undefined variable ${ctx.value}`)
 				}
 				return ctx.value
 			},
 			handleRelation: ctx => {
 				if (typeof ctx.value === 'string' && !variables[ctx.value]) {
-					valid = false
 					errorBuilder.for(...ctx.path).add(`Undefined variable ${ctx.value}`)
 				}
 				return ctx.value
 			},
 			handleUndefinedField: ctx => {
 				errorBuilder.for(...ctx.path).add(`Undefined field ${ctx.name} on entity ${ctx.entity.name}`)
-				valid = false
 				return ctx.value
 			},
 		})
-		if (!valid) {
-			return
-		}
-
-		return result
 	}
 
 	private validateOperations(
-		operations: unknown,
+		operations: Acl.EntityOperations,
 		entity: Model.Entity,
 		predicates: Acl.PredicateDefinition,
 		errorBuilder: ErrorBuilder,
-	): Acl.EntityOperations {
-		if (!isObject(operations)) {
-			errorBuilder.add('Must be an object')
-			return {}
-		}
-		const extra = checkExtraProperties(operations, ['read', 'create', 'update', 'delete', 'customPrimary'])
-		if (extra.length) {
-			errorBuilder.add('Unsupported properties found: ' + extra.join(', '))
-		}
-		const validOperations: Acl.EntityOperations = {}
+	): void {
 		if (operations.delete !== undefined) {
-			validOperations.delete = this.validatePredicate(operations.delete, predicates, errorBuilder.for('delete'))
+			this.validatePredicate(operations.delete, predicates, errorBuilder.for('delete'))
 		}
 		for (const op of ['read', 'create', 'update'] as const) {
-			if (operations[op]) {
-				validOperations[op] = this.validateFieldPermissions(operations[op], entity, predicates, errorBuilder.for(op))
-			}
-		}
-		if (operations.customPrimary !== undefined) {
-			if (typeof operations.customPrimary !== 'boolean') {
-				errorBuilder.for('customPrimary').add('Must be boolean')
+			const operation = operations[op]
+			if (operation !== undefined) {
+				this.validateFieldPermissions(operation, entity, predicates, errorBuilder.for(op))
 			}
-			validOperations.customPrimary = operations.customPrimary as boolean
 		}
-
-		return validOperations
 	}
 
 	private validateFieldPermissions(
-		permissions: unknown,
+		permissions: Acl.FieldPermissions,
 		entity: Model.Entity,
 		predicates: Acl.PredicateDefinition,
 		errorBuilder: ErrorBuilder,
-	): Acl.FieldPermissions {
-		if (!isObject(permissions)) {
-			errorBuilder.add('Must be an object')
-			return {}
-		}
-		const valid: Acl.FieldPermissions = {}
+	): void {
 		for (const field in permissions) {
 			if (!permissions.hasOwnProperty(field)) {
 				continue
@@ -366,27 +176,20 @@ export class AclValidator {
 			if (!entity.fields[field]) {
 				errorBuilder.add(`Field ${field} not found on entity ${entity.name}`)
 			}
-			valid[field] = this.validatePredicate(permissions[field], predicates, errorBuilder.for(field))
+			this.validatePredicate(permissions[field], predicates, errorBuilder.for(field))
 		}
-		return valid
 	}
 
 	private validatePredicate(
-		predicate: unknown,
+		predicate: Acl.Predicate,
 		predicates: Acl.PredicateDefinition,
 		errorBuilder: ErrorBuilder,
-	): Acl.Predicate {
+	): void {
 		if (predicate === false || predicate === true) {
-			return predicate
-		}
-		if (typeof predicate !== 'string') {
-			errorBuilder.add('Predicate must be either boolean or predicate reference')
-			return false
+			return
 		}
 		if (!predicates[predicate]) {
 			errorBuilder.add(`Predicate ${predicate} not found`)
-			return false
 		}
-		return predicate
 	}
 }