npm - @contember/schema-utils - Versions diffs - 2.2.0-alpha.3 → 2.2.0-alpha.5 - Mend

@contember/schema-utils 2.2.0-alpha.3 → 2.2.0-alpha.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (67) hide show

package/dist/development/src/acl/schemaUtils.cjs CHANGED Viewed

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const getRoleVariables = (roleName, schema) => {
-  const role = schema.roles[roleName];
+  const role = Object.prototype.hasOwnProperty.call(schema.roles, roleName) ? schema.roles[roleName] : void 0;
+  if (!role) {
+    return {};
+  }
   return (role.inherits || []).reduce(
     (acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),
     role.variables

package/dist/development/src/acl/schemaUtils.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schemaUtils.cjs","sources":["../../../../../packages/schema-utils/src/acl/schemaUtils.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport const getRoleVariables = (roleName: string, schema: Acl.Schema): Acl.Variables => {\n\tconst role = schema.roles[roleName]\n\treturn (role.inherits \|\| []).reduce<Acl.Variables>(\n\t\t(acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),\n\t\trole.variables,\n\t)\n}\n"],"names":[],"mappings":";;AAEO,MAAM,mBAAmB,CAAC,UAAkB,WAAsC;~~AACxF~~,QAAM,OAAO,OAAO,MAAM,QAAQ;~~AAClC~~,UAAQ,KAAK,YAAY,CAAA,GAAI;AAAA,IAC5B,CAAC,KAAK,kBAAkB,EAAE,GAAG,iBAAiB,cAAc,MAAM,GAAG,GAAG;IACxE,KAAK;AAAA,EAAA;AAEP;;"}
1	+ {"version":3,"file":"schemaUtils.cjs","sources":["../../../../../packages/schema-utils/src/acl/schemaUtils.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport const getRoleVariables = (roleName: string, schema: Acl.Schema): Acl.Variables => {\n\t// Own-property lookup: a role name like `__proto__` / `constructor`, or an `inherits` entry pointing\n\t// at a role absent from the schema, must resolve to \"no such role\" (→ no variables) instead of an\n\t// inherited Object.prototype member — otherwise `role.inherits` / `role.variables` below throw on a\n\t// non-role value (e.g. a sign-in granting such a role would roll back the whole transaction).\n\tconst role = Object.prototype.hasOwnProperty.call(schema.roles, roleName) ? schema.roles[roleName] : undefined\n\tif (!role) {\n\t\treturn {}\n\t}\n\treturn (role.inherits \|\| []).reduce<Acl.Variables>(\n\t\t(acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),\n\t\trole.variables,\n\t)\n}\n"],"names":[],"mappings":";;AAEO,MAAM,mBAAmB,CAAC,UAAkB,WAAsC;AAKxF,QAAM,OAAO,OAAO,UAAU,eAAe,KAAK,OAAO,OAAO,QAAQ,IAAI,OAAO,MAAM,QAAQ,IAAI;AACrG,MAAI,CAAC,MAAM;AACV,WAAO,CAAA;AAAA,EACR;AACA,UAAQ,KAAK,YAAY,CAAA,GAAI;AAAA,IAC5B,CAAC,KAAK,kBAAkB,EAAE,GAAG,iBAAiB,cAAc,MAAM,GAAG,GAAG;IACxE,KAAK;AAAA,EAAA;AAEP;;"}

package/dist/development/src/acl/schemaUtils.js CHANGED Viewed

@@ -1,5 +1,8 @@
 const getRoleVariables = (roleName, schema) => {
-  const role = schema.roles[roleName];
+  const role = Object.prototype.hasOwnProperty.call(schema.roles, roleName) ? schema.roles[roleName] : void 0;
+  if (!role) {
+    return {};
+  }
   return (role.inherits || []).reduce(
     (acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),
     role.variables

package/dist/development/src/acl/schemaUtils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schemaUtils.js","sources":["../../../../../packages/schema-utils/src/acl/schemaUtils.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport const getRoleVariables = (roleName: string, schema: Acl.Schema): Acl.Variables => {\n\tconst role = schema.roles[roleName]\n\treturn (role.inherits \|\| []).reduce<Acl.Variables>(\n\t\t(acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),\n\t\trole.variables,\n\t)\n}\n"],"names":[],"mappings":"AAEO,MAAM,mBAAmB,CAAC,UAAkB,WAAsC;~~AACxF~~,QAAM,OAAO,OAAO,MAAM,QAAQ;~~AAClC~~,UAAQ,KAAK,YAAY,CAAA,GAAI;AAAA,IAC5B,CAAC,KAAK,kBAAkB,EAAE,GAAG,iBAAiB,cAAc,MAAM,GAAG,GAAG;IACxE,KAAK;AAAA,EAAA;AAEP;"}
1	+ {"version":3,"file":"schemaUtils.js","sources":["../../../../../packages/schema-utils/src/acl/schemaUtils.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport const getRoleVariables = (roleName: string, schema: Acl.Schema): Acl.Variables => {\n\t// Own-property lookup: a role name like `__proto__` / `constructor`, or an `inherits` entry pointing\n\t// at a role absent from the schema, must resolve to \"no such role\" (→ no variables) instead of an\n\t// inherited Object.prototype member — otherwise `role.inherits` / `role.variables` below throw on a\n\t// non-role value (e.g. a sign-in granting such a role would roll back the whole transaction).\n\tconst role = Object.prototype.hasOwnProperty.call(schema.roles, roleName) ? schema.roles[roleName] : undefined\n\tif (!role) {\n\t\treturn {}\n\t}\n\treturn (role.inherits \|\| []).reduce<Acl.Variables>(\n\t\t(acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),\n\t\trole.variables,\n\t)\n}\n"],"names":[],"mappings":"AAEO,MAAM,mBAAmB,CAAC,UAAkB,WAAsC;AAKxF,QAAM,OAAO,OAAO,UAAU,eAAe,KAAK,OAAO,OAAO,QAAQ,IAAI,OAAO,MAAM,QAAQ,IAAI;AACrG,MAAI,CAAC,MAAM;AACV,WAAO,CAAA;AAAA,EACR;AACA,UAAQ,KAAK,YAAY,CAAA,GAAI;AAAA,IAC5B,CAAC,KAAK,kBAAkB,EAAE,GAAG,iBAAiB,cAAc,MAAM,GAAG,GAAG;IACxE,KAAK;AAAA,EAAA;AAEP;"}

package/dist/development/src/definition-generator/AclDefinitionCodeGenerator.cjs CHANGED Viewed

@@ -50,7 +50,7 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
   }
   generateEntityAcl({ entity, schema: schema2 }) {
     const aclOutput = [];
-    const numberOfEntityFieldsWithoutId = Object.keys(entity.fields).length - 1;
+    const nonPrimaryFields = Object.keys(entity.fields).filter((it) => it !== entity.primary);
     for (const [roleName, roleDefinition] of Object.entries(schema2.acl.roles)) {
       const entityPermission = roleDefinition.entities[entity.name];
       if (!entityPermission) {
@@ -61,7 +61,8 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
         const operations = this.getMatchingOperations({
           predicate: predicateName,
           operations: entityPermission.operations,
-          numberOfEntityFieldsWithoutId
+          entity,
+          nonPrimaryFields
         });
         if (Object.keys(operations).length > 0) {
           const processor = new PredicateDefinitionProcessor.PredicateDefinitionProcessor(schema2.model);
@@ -84,7 +85,8 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
       const trueOperations = this.getMatchingOperations({
         predicate: true,
         operations: entityPermission.operations,
-        numberOfEntityFieldsWithoutId
+        entity,
+        nonPrimaryFields
       });
       if (Object.keys(trueOperations).length > 0) {
         const aclDefinition = printJsValue.printJsValue({ ...trueOperations }, indentFirstLevel);
@@ -97,12 +99,12 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
     }
     return `${aclOutput.join("")}`;
   }
-  getMatchingOperations({ operations, predicate, numberOfEntityFieldsWithoutId }) {
+  getMatchingOperations({ operations, predicate, entity, nonPrimaryFields }) {
     const result = {};
     for (const op of ["read", "create", "update"]) {
       const fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it);
       if (fields.length === 0) ;
-      else if (fields.length === numberOfEntityFieldsWithoutId) {
+      else if (this.coversEveryNonPrimaryField(fields, entity, nonPrimaryFields)) {
         result[op] = true;
       } else {
         result[op] = fields;
@@ -113,6 +115,18 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
     }
     return result;
   }
+  /**
+   * `read: true` re-parses as every field except the primary, so it may only stand in for a grant that
+   * covers exactly that set. Comparing counts instead treated a grant naming the primary plus all but
+   * one field as complete, and regenerating it silently granted the missing field.
+   */
+  coversEveryNonPrimaryField(fields, entity, nonPrimaryFields) {
+    if (fields.includes(entity.primary)) {
+      return false;
+    }
+    const granted = new Set(fields);
+    return nonPrimaryFields.every((it) => granted.has(it));
+  }
 }
 exports.AclDefinitionCodeGenerator = AclDefinitionCodeGenerator;
 //# sourceMappingURL=AclDefinitionCodeGenerator.cjs.map

package/dist/development/src/definition-generator/AclDefinitionCodeGenerator.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AclDefinitionCodeGenerator.cjs","sources":["../../../../../packages/schema-utils/src/definition-generator/AclDefinitionCodeGenerator.ts"],"sourcesContent":["import { PredicateDefinitionProcessor } from '../acl/index.js'\nimport { IndentDecider, Literal, printJsValue } from '../utils/printJsValue.js'\nimport { Acl, Model, Schema } from '@contember/schema'\nimport { DefinitionNamingConventions } from './DefinitionNamingConventions.js'\n\nconst indentFirstLevel: IndentDecider = (val, path) => path.length === 0\n\nexport class AclDefinitionCodeGenerator {\n\tconstructor(\n\t\tprivate readonly definitionNamingConventions = new DefinitionNamingConventions(),\n\t) {\n\t}\n\n\tpublic generateRoles({ acl }: { acl: Acl.Schema }): string {\n\t\treturn Object.entries(acl.roles).map(([name, values]) =>\n\t\t\tthis.generateRole({\n\t\t\t\tname,\n\t\t\t\tvalues,\n\t\t\t})\n\t\t).join('')\n\t}\n\n\tprivate generateRole({ name, values }: { name: string; values: Acl.RolePermissions }): string {\n\t\tconst { variables, entities, inherits, ...other } = values\n\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(name)\n\t\treturn `\\nexport const ${roleVarName} = c.createRole(${printJsValue(name)}, ${printJsValue(other)})\\n`\n\t}\n\n\tpublic generateAclVariables({ acl }: { acl: Acl.Schema }): string {\n\t\tconst variablesOutput: string[] = []\n\n\t\tObject.entries(acl.roles).map(([roleName, roleValues]) => {\n\t\t\tObject.entries(roleValues.variables).map(([variableName, variableValues]) => {\n\t\t\t\tlet variableDefinition = `\\nexport const ${this.definitionNamingConventions.variableVarName(roleName, variableName)} = c.`\n\t\t\t\tconst varFormatted = printJsValue(variableName)\n\t\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\n\t\t\t\tif (variableValues.type === Acl.VariableType.predefined) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.value)\n\t\t\t\t\tvariableDefinition += `createPredefinedVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else if (variableValues.type === Acl.VariableType.entity) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.entityName)\n\t\t\t\t\tvariableDefinition += `createEntityVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else {\n\t\t\t\t\tthrow new Error(`Variable type ${variableValues.type} not yet supported`)\n\t\t\t\t}\n\n\t\t\t\tvariablesOutput.push(variableDefinition)\n\t\t\t})\n\t\t})\n\n\t\treturn variablesOutput.join('')\n\t}\n\n\tpublic generateEntityAcl({ entity, schema }: { entity: Model.Entity; schema: Schema }): string {\n\t\tconst aclOutput: string[] = []\n\t\tconst ~~numberOfEntityFieldsWithoutId~~ = Object.keys(entity.fields).~~length~~ - 1\n\t\tfor (const [roleName, roleDefinition] of Object.entries(schema.acl.roles)) {\n\t\t\tconst entityPermission = roleDefinition.entities[entity.name]\n\t\t\tif (!entityPermission) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\t\t\tfor (const [predicateName, predicateDefinition] of Object.entries(entityPermission.predicates)) {\n\t\t\t\tconst operations = this.getMatchingOperations({\n\t\t\t\t\tpredicate: predicateName,\n\t\t\t\t\toperations: entityPermission.operations,\n\t\t\t\t\~~tnumberOfEntityFieldsWithoutId~~,\n\t\t\t\t})\n\t\t\t\tif (Object.keys(operations).length > 0) {\n\t\t\t\t\tconst processor = new PredicateDefinitionProcessor(schema.model)\n\t\t\t\t\tconst when = processor.process(entity, predicateDefinition, {\n\t\t\t\t\t\thandleColumn: ctx => {\n\t\t\t\t\t\t\tif (typeof ctx.value === 'string' && ctx.value in roleDefinition.variables) {\n\t\t\t\t\t\t\t\treturn new Literal(this.definitionNamingConventions.variableVarName(roleName, ctx.value))\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t\thandleRelation: ctx => {\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t})\n\t\t\t\t\tconst aclDefinition = printJsValue({ when, ...operations }, indentFirstLevel)\n\t\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst trueOperations = this.getMatchingOperations({\n\t\t\t\tpredicate: true,\n\t\t\t\toperations: entityPermission.operations,\n\t\t\t\~~tnumberOfEntityFieldsWithoutId~~,\n\t\t\t})\n\t\t\tif (Object.keys(trueOperations).length > 0) {\n\t\t\t\tconst aclDefinition = printJsValue({ ...trueOperations }, indentFirstLevel)\n\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t}\n\t\t}\n\n\t\tif (!aclOutput.length) {\n\t\t\treturn ''\n\t\t}\n\t\treturn `${aclOutput.join('')}`\n\t}\n\n\tprivate getMatchingOperations({ operations, predicate, ~~numberOfEntityFieldsWithoutId~~ }: {\n\t\toperations: Acl.EntityOperations\n\t\tpredicate: Acl.Predicate\n\t\~~tnumberOfEntityFieldsWithoutId~~: ~~number~~\n\t}): { read?: string[] \| true; create?: string[] \| boolean; update?: string[] \| boolean; delete?: true } {\n\t\tconst result: ReturnType<AclDefinitionCodeGenerator['getMatchingOperations']> = {}\n\t\tfor (const op of ['read', 'create', 'update'] as const) {\n\t\t\tconst fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it)\n\t\t\tif (fields.length === 0) {\n\t\t\t} else if (fields~~.length~~ ~~===~~ ~~numberOfEntityFieldsWithoutId~~) {\n\t\t\t\tresult[op] = true\n\t\t\t} else {\n\t\t\t\tresult[op] = fields\n\t\t\t}\n\t\t}\n\t\tif (operations.delete === predicate) {\n\t\t\tresult.delete = true\n\t\t}\n\n\t\treturn result\n\t}\n}\n"],"names":["DefinitionNamingConventions","printJsValue","Acl","schema","PredicateDefinitionProcessor","Literal"],"mappings":";;;;;;AAKA,MAAM,mBAAkC,CAAC,KAAK,SAAS,KAAK,WAAW;AAEhE,MAAM,2BAA2B;AAAA,EACvC,YACkB,8BAA8B,IAAIA,4BAAAA,+BAClD;AADgB,SAAA,8BAAA;AAAA,EAElB;AAAA,EAEO,cAAc,EAAE,OAAoC;AAC1D,WAAO,OAAO,QAAQ,IAAI,KAAK,EAAE;AAAA,MAAI,CAAC,CAAC,MAAM,MAAM,MAClD,KAAK,aAAa;AAAA,QACjB;AAAA,QACA;AAAA,MAAA,CACA;AAAA,IAAA,EACA,KAAK,EAAE;AAAA,EACV;AAAA,EAEQ,aAAa,EAAE,MAAM,UAAiE;AAC7F,UAAM,EAAE,WAAW,UAAU,UAAU,GAAG,UAAU;AACpD,UAAM,cAAc,KAAK,4BAA4B,YAAY,IAAI;AACrE,WAAO;AAAA,eAAkB,WAAW,mBAAmBC,0BAAa,IAAI,CAAC,KAAKA,aAAAA,aAAa,KAAK,CAAC;AAAA;AAAA,EAClG;AAAA,EAEO,qBAAqB,EAAE,OAAoC;AACjE,UAAM,kBAA4B,CAAA;AAElC,WAAO,QAAQ,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,UAAU,MAAM;AACzD,aAAO,QAAQ,WAAW,SAAS,EAAE,IAAI,CAAC,CAAC,cAAc,cAAc,MAAM;AAC5E,YAAI,qBAAqB;AAAA,eAAkB,KAAK,4BAA4B,gBAAgB,UAAU,YAAY,CAAC;AACnH,cAAM,eAAeA,aAAAA,aAAa,YAAY;AAC9C,cAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AAEzE,YAAI,eAAe,SAASC,WAAI,aAAa,YAAY;AACxD,gBAAM,gBAAgBD,aAAAA,aAAa,eAAe,KAAK;AACvD,gCAAsB,4BAA4B,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QACjG,WAAW,eAAe,SAASC,OAAAA,IAAI,aAAa,QAAQ;AAC3D,gBAAM,gBAAgBD,aAAAA,aAAa,eAAe,UAAU;AAC5D,gCAAsB,wBAAwB,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QAC7F,OAAO;AACN,gBAAM,IAAI,MAAM,iBAAiB,eAAe,IAAI,oBAAoB;AAAA,QACzE;AAEA,wBAAgB,KAAK,kBAAkB;AAAA,MACxC,CAAC;AAAA,IACF,CAAC;AAED,WAAO,gBAAgB,KAAK,EAAE;AAAA,EAC/B;AAAA,EAEO,kBAAkB,EAAE,QAAQ,QAAAE,WAA4D;AAC9F,UAAM,YAAsB,CAAA;AAC5B,UAAM,~~gCAAgC~~,OAAO,KAAK,OAAO,MAAM,EAAE,~~SAAS~~;~~AAC1E~~,eAAW,CAAC,UAAU,cAAc,KAAK,OAAO,QAAQA,QAAO,IAAI,KAAK,GAAG;AAC1E,YAAM,mBAAmB,eAAe,SAAS,OAAO,IAAI;AAC5D,UAAI,CAAC,kBAAkB;AACtB;AAAA,MACD;AACA,YAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AACzE,iBAAW,CAAC,eAAe,mBAAmB,KAAK,OAAO,QAAQ,iBAAiB,UAAU,GAAG;AAC/F,cAAM,aAAa,KAAK,sBAAsB;AAAA,UAC7C,WAAW;AAAA,UACX,YAAY,iBAAiB;AAAA,UAC7B;AAAA,QAAA,CACA;AACD,YAAI,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG;AACvC,gBAAM,YAAY,IAAIC,0DAA6BD,QAAO,KAAK;AAC/D,gBAAM,OAAO,UAAU,QAAQ,QAAQ,qBAAqB;AAAA,YAC3D,cAAc,CAAA,QAAO;AACpB,kBAAI,OAAO,IAAI,UAAU,YAAY,IAAI,SAAS,eAAe,WAAW;AAC3E,uBAAO,IAAIE,aAAAA,QAAQ,KAAK,4BAA4B,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAAA,cACzF;AACA,qBAAO,IAAI;AAAA,YACZ;AAAA,YACA,gBAAgB,CAAA,QAAO;AACtB,qBAAO,IAAI;AAAA,YACZ;AAAA,UAAA,CACA;AACD,gBAAM,gBAAgBJ,aAAAA,aAAa,EAAE,MAAM,GAAG,WAAA,GAAc,gBAAgB;AAC5E,oBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,QAC9D;AAAA,MACD;AACA,YAAM,iBAAiB,KAAK,sBAAsB;AAAA,QACjD,WAAW;AAAA,QACX,YAAY,iBAAiB;AAAA,QAC7B;AAAA,MAAA,CACA;AACD,UAAI,OAAO,KAAK,cAAc,EAAE,SAAS,GAAG;AAC3C,cAAM,gBAAgBA,aAAAA,aAAa,EAAE,GAAG,eAAA,GAAkB,gBAAgB;AAC1E,kBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,MAC9D;AAAA,IACD;AAEA,QAAI,CAAC,UAAU,QAAQ;AACtB,aAAO;AAAA,IACR;AACA,WAAO,GAAG,UAAU,KAAK,EAAE,CAAC;AAAA,EAC7B;AAAA,EAEQ,sBAAsB,EAAE,YAAY,WAAW,~~iCAIiD~~;AACvG,UAAM,SAA0E,CAAA;AAChF,eAAW,MAAM,CAAC,QAAQ,UAAU,QAAQ,GAAY;AACvD,YAAM,SAAS,OAAO,QAAQ,WAAW,EAAE,KAAK,CAAA,CAAE,EAAE,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,OAAO,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE;AACzG,UAAI,OAAO,WAAW,EAAG;AAAA,eACd,~~OAAO~~,~~WAAW,+BAA+B~~;~~AAC3D~~,eAAO,EAAE,IAAI;AAAA,MACd,OAAO;AACN,eAAO,EAAE,IAAI;AAAA,MACd;AAAA,IACD;AACA,QAAI,WAAW,WAAW,WAAW;AACpC,aAAO,SAAS;AAAA,IACjB;AAEA,WAAO;AAAA,EACR;AACD;;"}
1	+ {"version":3,"file":"AclDefinitionCodeGenerator.cjs","sources":["../../../../../packages/schema-utils/src/definition-generator/AclDefinitionCodeGenerator.ts"],"sourcesContent":["import { PredicateDefinitionProcessor } from '../acl/index.js'\nimport { IndentDecider, Literal, printJsValue } from '../utils/printJsValue.js'\nimport { Acl, Model, Schema } from '@contember/schema'\nimport { DefinitionNamingConventions } from './DefinitionNamingConventions.js'\n\nconst indentFirstLevel: IndentDecider = (val, path) => path.length === 0\n\nexport class AclDefinitionCodeGenerator {\n\tconstructor(\n\t\tprivate readonly definitionNamingConventions = new DefinitionNamingConventions(),\n\t) {\n\t}\n\n\tpublic generateRoles({ acl }: { acl: Acl.Schema }): string {\n\t\treturn Object.entries(acl.roles).map(([name, values]) =>\n\t\t\tthis.generateRole({\n\t\t\t\tname,\n\t\t\t\tvalues,\n\t\t\t})\n\t\t).join('')\n\t}\n\n\tprivate generateRole({ name, values }: { name: string; values: Acl.RolePermissions }): string {\n\t\tconst { variables, entities, inherits, ...other } = values\n\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(name)\n\t\treturn `\\nexport const ${roleVarName} = c.createRole(${printJsValue(name)}, ${printJsValue(other)})\\n`\n\t}\n\n\tpublic generateAclVariables({ acl }: { acl: Acl.Schema }): string {\n\t\tconst variablesOutput: string[] = []\n\n\t\tObject.entries(acl.roles).map(([roleName, roleValues]) => {\n\t\t\tObject.entries(roleValues.variables).map(([variableName, variableValues]) => {\n\t\t\t\tlet variableDefinition = `\\nexport const ${this.definitionNamingConventions.variableVarName(roleName, variableName)} = c.`\n\t\t\t\tconst varFormatted = printJsValue(variableName)\n\t\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\n\t\t\t\tif (variableValues.type === Acl.VariableType.predefined) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.value)\n\t\t\t\t\tvariableDefinition += `createPredefinedVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else if (variableValues.type === Acl.VariableType.entity) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.entityName)\n\t\t\t\t\tvariableDefinition += `createEntityVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else {\n\t\t\t\t\tthrow new Error(`Variable type ${variableValues.type} not yet supported`)\n\t\t\t\t}\n\n\t\t\t\tvariablesOutput.push(variableDefinition)\n\t\t\t})\n\t\t})\n\n\t\treturn variablesOutput.join('')\n\t}\n\n\tpublic generateEntityAcl({ entity, schema }: { entity: Model.Entity; schema: Schema }): string {\n\t\tconst aclOutput: string[] = []\n\t\tconst nonPrimaryFields = Object.keys(entity.fields).filter(it => it !== entity.primary)\n\t\tfor (const [roleName, roleDefinition] of Object.entries(schema.acl.roles)) {\n\t\t\tconst entityPermission = roleDefinition.entities[entity.name]\n\t\t\tif (!entityPermission) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\t\t\tfor (const [predicateName, predicateDefinition] of Object.entries(entityPermission.predicates)) {\n\t\t\t\tconst operations = this.getMatchingOperations({\n\t\t\t\t\tpredicate: predicateName,\n\t\t\t\t\toperations: entityPermission.operations,\n\t\t\t\t\tentity,\n\t\t\t\t\tnonPrimaryFields,\n\t\t\t\t})\n\t\t\t\tif (Object.keys(operations).length > 0) {\n\t\t\t\t\tconst processor = new PredicateDefinitionProcessor(schema.model)\n\t\t\t\t\tconst when = processor.process(entity, predicateDefinition, {\n\t\t\t\t\t\thandleColumn: ctx => {\n\t\t\t\t\t\t\tif (typeof ctx.value === 'string' && ctx.value in roleDefinition.variables) {\n\t\t\t\t\t\t\t\treturn new Literal(this.definitionNamingConventions.variableVarName(roleName, ctx.value))\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t\thandleRelation: ctx => {\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t})\n\t\t\t\t\tconst aclDefinition = printJsValue({ when, ...operations }, indentFirstLevel)\n\t\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst trueOperations = this.getMatchingOperations({\n\t\t\t\tpredicate: true,\n\t\t\t\toperations: entityPermission.operations,\n\t\t\t\tentity,\n\t\t\t\tnonPrimaryFields,\n\t\t\t})\n\t\t\tif (Object.keys(trueOperations).length > 0) {\n\t\t\t\tconst aclDefinition = printJsValue({ ...trueOperations }, indentFirstLevel)\n\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t}\n\t\t}\n\n\t\tif (!aclOutput.length) {\n\t\t\treturn ''\n\t\t}\n\t\treturn `${aclOutput.join('')}`\n\t}\n\n\tprivate getMatchingOperations({ operations, predicate, entity, nonPrimaryFields }: {\n\t\toperations: Acl.EntityOperations\n\t\tpredicate: Acl.Predicate\n\t\tentity: Model.Entity\n\t\tnonPrimaryFields: string[]\n\t}): { read?: string[] \| true; create?: string[] \| boolean; update?: string[] \| boolean; delete?: true } {\n\t\tconst result: ReturnType<AclDefinitionCodeGenerator['getMatchingOperations']> = {}\n\t\tfor (const op of ['read', 'create', 'update'] as const) {\n\t\t\tconst fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it)\n\t\t\tif (fields.length === 0) {\n\t\t\t} else if (this.coversEveryNonPrimaryField(fields, entity, nonPrimaryFields)) {\n\t\t\t\tresult[op] = true\n\t\t\t} else {\n\t\t\t\tresult[op] = fields\n\t\t\t}\n\t\t}\n\t\tif (operations.delete === predicate) {\n\t\t\tresult.delete = true\n\t\t}\n\n\t\treturn result\n\t}\n\n\t/*\n\t `read: true` re-parses as every field except the primary, so it may only stand in for a grant that\n\t * covers exactly that set. Comparing counts instead treated a grant naming the primary plus all but\n\t * one field as complete, and regenerating it silently granted the missing field.\n\t */\n\tprivate coversEveryNonPrimaryField(fields: string[], entity: Model.Entity, nonPrimaryFields: string[]): boolean {\n\t\tif (fields.includes(entity.primary)) {\n\t\t\treturn false\n\t\t}\n\t\tconst granted = new Set(fields)\n\t\treturn nonPrimaryFields.every(it => granted.has(it))\n\t}\n}\n"],"names":["DefinitionNamingConventions","printJsValue","Acl","schema","PredicateDefinitionProcessor","Literal"],"mappings":";;;;;;AAKA,MAAM,mBAAkC,CAAC,KAAK,SAAS,KAAK,WAAW;AAEhE,MAAM,2BAA2B;AAAA,EACvC,YACkB,8BAA8B,IAAIA,4BAAAA,+BAClD;AADgB,SAAA,8BAAA;AAAA,EAElB;AAAA,EAEO,cAAc,EAAE,OAAoC;AAC1D,WAAO,OAAO,QAAQ,IAAI,KAAK,EAAE;AAAA,MAAI,CAAC,CAAC,MAAM,MAAM,MAClD,KAAK,aAAa;AAAA,QACjB;AAAA,QACA;AAAA,MAAA,CACA;AAAA,IAAA,EACA,KAAK,EAAE;AAAA,EACV;AAAA,EAEQ,aAAa,EAAE,MAAM,UAAiE;AAC7F,UAAM,EAAE,WAAW,UAAU,UAAU,GAAG,UAAU;AACpD,UAAM,cAAc,KAAK,4BAA4B,YAAY,IAAI;AACrE,WAAO;AAAA,eAAkB,WAAW,mBAAmBC,0BAAa,IAAI,CAAC,KAAKA,aAAAA,aAAa,KAAK,CAAC;AAAA;AAAA,EAClG;AAAA,EAEO,qBAAqB,EAAE,OAAoC;AACjE,UAAM,kBAA4B,CAAA;AAElC,WAAO,QAAQ,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,UAAU,MAAM;AACzD,aAAO,QAAQ,WAAW,SAAS,EAAE,IAAI,CAAC,CAAC,cAAc,cAAc,MAAM;AAC5E,YAAI,qBAAqB;AAAA,eAAkB,KAAK,4BAA4B,gBAAgB,UAAU,YAAY,CAAC;AACnH,cAAM,eAAeA,aAAAA,aAAa,YAAY;AAC9C,cAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AAEzE,YAAI,eAAe,SAASC,WAAI,aAAa,YAAY;AACxD,gBAAM,gBAAgBD,aAAAA,aAAa,eAAe,KAAK;AACvD,gCAAsB,4BAA4B,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QACjG,WAAW,eAAe,SAASC,OAAAA,IAAI,aAAa,QAAQ;AAC3D,gBAAM,gBAAgBD,aAAAA,aAAa,eAAe,UAAU;AAC5D,gCAAsB,wBAAwB,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QAC7F,OAAO;AACN,gBAAM,IAAI,MAAM,iBAAiB,eAAe,IAAI,oBAAoB;AAAA,QACzE;AAEA,wBAAgB,KAAK,kBAAkB;AAAA,MACxC,CAAC;AAAA,IACF,CAAC;AAED,WAAO,gBAAgB,KAAK,EAAE;AAAA,EAC/B;AAAA,EAEO,kBAAkB,EAAE,QAAQ,QAAAE,WAA4D;AAC9F,UAAM,YAAsB,CAAA;AAC5B,UAAM,mBAAmB,OAAO,KAAK,OAAO,MAAM,EAAE,OAAO,CAAA,OAAM,OAAO,OAAO,OAAO;AACtF,eAAW,CAAC,UAAU,cAAc,KAAK,OAAO,QAAQA,QAAO,IAAI,KAAK,GAAG;AAC1E,YAAM,mBAAmB,eAAe,SAAS,OAAO,IAAI;AAC5D,UAAI,CAAC,kBAAkB;AACtB;AAAA,MACD;AACA,YAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AACzE,iBAAW,CAAC,eAAe,mBAAmB,KAAK,OAAO,QAAQ,iBAAiB,UAAU,GAAG;AAC/F,cAAM,aAAa,KAAK,sBAAsB;AAAA,UAC7C,WAAW;AAAA,UACX,YAAY,iBAAiB;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA,CACA;AACD,YAAI,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG;AACvC,gBAAM,YAAY,IAAIC,0DAA6BD,QAAO,KAAK;AAC/D,gBAAM,OAAO,UAAU,QAAQ,QAAQ,qBAAqB;AAAA,YAC3D,cAAc,CAAA,QAAO;AACpB,kBAAI,OAAO,IAAI,UAAU,YAAY,IAAI,SAAS,eAAe,WAAW;AAC3E,uBAAO,IAAIE,aAAAA,QAAQ,KAAK,4BAA4B,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAAA,cACzF;AACA,qBAAO,IAAI;AAAA,YACZ;AAAA,YACA,gBAAgB,CAAA,QAAO;AACtB,qBAAO,IAAI;AAAA,YACZ;AAAA,UAAA,CACA;AACD,gBAAM,gBAAgBJ,aAAAA,aAAa,EAAE,MAAM,GAAG,WAAA,GAAc,gBAAgB;AAC5E,oBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,QAC9D;AAAA,MACD;AACA,YAAM,iBAAiB,KAAK,sBAAsB;AAAA,QACjD,WAAW;AAAA,QACX,YAAY,iBAAiB;AAAA,QAC7B;AAAA,QACA;AAAA,MAAA,CACA;AACD,UAAI,OAAO,KAAK,cAAc,EAAE,SAAS,GAAG;AAC3C,cAAM,gBAAgBA,aAAAA,aAAa,EAAE,GAAG,eAAA,GAAkB,gBAAgB;AAC1E,kBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,MAC9D;AAAA,IACD;AAEA,QAAI,CAAC,UAAU,QAAQ;AACtB,aAAO;AAAA,IACR;AACA,WAAO,GAAG,UAAU,KAAK,EAAE,CAAC;AAAA,EAC7B;AAAA,EAEQ,sBAAsB,EAAE,YAAY,WAAW,QAAQ,oBAKyC;AACvG,UAAM,SAA0E,CAAA;AAChF,eAAW,MAAM,CAAC,QAAQ,UAAU,QAAQ,GAAY;AACvD,YAAM,SAAS,OAAO,QAAQ,WAAW,EAAE,KAAK,CAAA,CAAE,EAAE,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,OAAO,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE;AACzG,UAAI,OAAO,WAAW,EAAG;AAAA,eACd,KAAK,2BAA2B,QAAQ,QAAQ,gBAAgB,GAAG;AAC7E,eAAO,EAAE,IAAI;AAAA,MACd,OAAO;AACN,eAAO,EAAE,IAAI;AAAA,MACd;AAAA,IACD;AACA,QAAI,WAAW,WAAW,WAAW;AACpC,aAAO,SAAS;AAAA,IACjB;AAEA,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,2BAA2B,QAAkB,QAAsB,kBAAqC;AAC/G,QAAI,OAAO,SAAS,OAAO,OAAO,GAAG;AACpC,aAAO;AAAA,IACR;AACA,UAAM,UAAU,IAAI,IAAI,MAAM;AAC9B,WAAO,iBAAiB,MAAM,CAAA,OAAM,QAAQ,IAAI,EAAE,CAAC;AAAA,EACpD;AACD;;"}

package/dist/development/src/definition-generator/AclDefinitionCodeGenerator.js CHANGED Viewed

@@ -48,7 +48,7 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
   }
   generateEntityAcl({ entity, schema }) {
     const aclOutput = [];
-    const numberOfEntityFieldsWithoutId = Object.keys(entity.fields).length - 1;
+    const nonPrimaryFields = Object.keys(entity.fields).filter((it) => it !== entity.primary);
     for (const [roleName, roleDefinition] of Object.entries(schema.acl.roles)) {
       const entityPermission = roleDefinition.entities[entity.name];
       if (!entityPermission) {
@@ -59,7 +59,8 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
         const operations = this.getMatchingOperations({
           predicate: predicateName,
           operations: entityPermission.operations,
-          numberOfEntityFieldsWithoutId
+          entity,
+          nonPrimaryFields
         });
         if (Object.keys(operations).length > 0) {
           const processor = new PredicateDefinitionProcessor(schema.model);
@@ -82,7 +83,8 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
       const trueOperations = this.getMatchingOperations({
         predicate: true,
         operations: entityPermission.operations,
-        numberOfEntityFieldsWithoutId
+        entity,
+        nonPrimaryFields
       });
       if (Object.keys(trueOperations).length > 0) {
         const aclDefinition = printJsValue({ ...trueOperations }, indentFirstLevel);
@@ -95,12 +97,12 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
     }
     return `${aclOutput.join("")}`;
   }
-  getMatchingOperations({ operations, predicate, numberOfEntityFieldsWithoutId }) {
+  getMatchingOperations({ operations, predicate, entity, nonPrimaryFields }) {
     const result = {};
     for (const op of ["read", "create", "update"]) {
       const fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it);
       if (fields.length === 0) ;
-      else if (fields.length === numberOfEntityFieldsWithoutId) {
+      else if (this.coversEveryNonPrimaryField(fields, entity, nonPrimaryFields)) {
         result[op] = true;
       } else {
         result[op] = fields;
@@ -111,6 +113,18 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
     }
     return result;
   }
+  /**
+   * `read: true` re-parses as every field except the primary, so it may only stand in for a grant that
+   * covers exactly that set. Comparing counts instead treated a grant naming the primary plus all but
+   * one field as complete, and regenerating it silently granted the missing field.
+   */
+  coversEveryNonPrimaryField(fields, entity, nonPrimaryFields) {
+    if (fields.includes(entity.primary)) {
+      return false;
+    }
+    const granted = new Set(fields);
+    return nonPrimaryFields.every((it) => granted.has(it));
+  }
 }
 export {
   AclDefinitionCodeGenerator

package/dist/development/src/definition-generator/AclDefinitionCodeGenerator.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AclDefinitionCodeGenerator.js","sources":["../../../../../packages/schema-utils/src/definition-generator/AclDefinitionCodeGenerator.ts"],"sourcesContent":["import { PredicateDefinitionProcessor } from '../acl/index.js'\nimport { IndentDecider, Literal, printJsValue } from '../utils/printJsValue.js'\nimport { Acl, Model, Schema } from '@contember/schema'\nimport { DefinitionNamingConventions } from './DefinitionNamingConventions.js'\n\nconst indentFirstLevel: IndentDecider = (val, path) => path.length === 0\n\nexport class AclDefinitionCodeGenerator {\n\tconstructor(\n\t\tprivate readonly definitionNamingConventions = new DefinitionNamingConventions(),\n\t) {\n\t}\n\n\tpublic generateRoles({ acl }: { acl: Acl.Schema }): string {\n\t\treturn Object.entries(acl.roles).map(([name, values]) =>\n\t\t\tthis.generateRole({\n\t\t\t\tname,\n\t\t\t\tvalues,\n\t\t\t})\n\t\t).join('')\n\t}\n\n\tprivate generateRole({ name, values }: { name: string; values: Acl.RolePermissions }): string {\n\t\tconst { variables, entities, inherits, ...other } = values\n\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(name)\n\t\treturn `\\nexport const ${roleVarName} = c.createRole(${printJsValue(name)}, ${printJsValue(other)})\\n`\n\t}\n\n\tpublic generateAclVariables({ acl }: { acl: Acl.Schema }): string {\n\t\tconst variablesOutput: string[] = []\n\n\t\tObject.entries(acl.roles).map(([roleName, roleValues]) => {\n\t\t\tObject.entries(roleValues.variables).map(([variableName, variableValues]) => {\n\t\t\t\tlet variableDefinition = `\\nexport const ${this.definitionNamingConventions.variableVarName(roleName, variableName)} = c.`\n\t\t\t\tconst varFormatted = printJsValue(variableName)\n\t\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\n\t\t\t\tif (variableValues.type === Acl.VariableType.predefined) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.value)\n\t\t\t\t\tvariableDefinition += `createPredefinedVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else if (variableValues.type === Acl.VariableType.entity) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.entityName)\n\t\t\t\t\tvariableDefinition += `createEntityVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else {\n\t\t\t\t\tthrow new Error(`Variable type ${variableValues.type} not yet supported`)\n\t\t\t\t}\n\n\t\t\t\tvariablesOutput.push(variableDefinition)\n\t\t\t})\n\t\t})\n\n\t\treturn variablesOutput.join('')\n\t}\n\n\tpublic generateEntityAcl({ entity, schema }: { entity: Model.Entity; schema: Schema }): string {\n\t\tconst aclOutput: string[] = []\n\t\tconst ~~numberOfEntityFieldsWithoutId~~ = Object.keys(entity.fields).~~length~~ - 1\n\t\tfor (const [roleName, roleDefinition] of Object.entries(schema.acl.roles)) {\n\t\t\tconst entityPermission = roleDefinition.entities[entity.name]\n\t\t\tif (!entityPermission) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\t\t\tfor (const [predicateName, predicateDefinition] of Object.entries(entityPermission.predicates)) {\n\t\t\t\tconst operations = this.getMatchingOperations({\n\t\t\t\t\tpredicate: predicateName,\n\t\t\t\t\toperations: entityPermission.operations,\n\t\t\t\t\~~tnumberOfEntityFieldsWithoutId~~,\n\t\t\t\t})\n\t\t\t\tif (Object.keys(operations).length > 0) {\n\t\t\t\t\tconst processor = new PredicateDefinitionProcessor(schema.model)\n\t\t\t\t\tconst when = processor.process(entity, predicateDefinition, {\n\t\t\t\t\t\thandleColumn: ctx => {\n\t\t\t\t\t\t\tif (typeof ctx.value === 'string' && ctx.value in roleDefinition.variables) {\n\t\t\t\t\t\t\t\treturn new Literal(this.definitionNamingConventions.variableVarName(roleName, ctx.value))\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t\thandleRelation: ctx => {\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t})\n\t\t\t\t\tconst aclDefinition = printJsValue({ when, ...operations }, indentFirstLevel)\n\t\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst trueOperations = this.getMatchingOperations({\n\t\t\t\tpredicate: true,\n\t\t\t\toperations: entityPermission.operations,\n\t\t\t\~~tnumberOfEntityFieldsWithoutId~~,\n\t\t\t})\n\t\t\tif (Object.keys(trueOperations).length > 0) {\n\t\t\t\tconst aclDefinition = printJsValue({ ...trueOperations }, indentFirstLevel)\n\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t}\n\t\t}\n\n\t\tif (!aclOutput.length) {\n\t\t\treturn ''\n\t\t}\n\t\treturn `${aclOutput.join('')}`\n\t}\n\n\tprivate getMatchingOperations({ operations, predicate, ~~numberOfEntityFieldsWithoutId~~ }: {\n\t\toperations: Acl.EntityOperations\n\t\tpredicate: Acl.Predicate\n\t\~~tnumberOfEntityFieldsWithoutId~~: ~~number~~\n\t}): { read?: string[] \| true; create?: string[] \| boolean; update?: string[] \| boolean; delete?: true } {\n\t\tconst result: ReturnType<AclDefinitionCodeGenerator['getMatchingOperations']> = {}\n\t\tfor (const op of ['read', 'create', 'update'] as const) {\n\t\t\tconst fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it)\n\t\t\tif (fields.length === 0) {\n\t\t\t} else if (fields~~.length~~ ~~===~~ ~~numberOfEntityFieldsWithoutId~~) {\n\t\t\t\tresult[op] = true\n\t\t\t} else {\n\t\t\t\tresult[op] = fields\n\t\t\t}\n\t\t}\n\t\tif (operations.delete === predicate) {\n\t\t\tresult.delete = true\n\t\t}\n\n\t\treturn result\n\t}\n}\n"],"names":[],"mappings":";;;;AAKA,MAAM,mBAAkC,CAAC,KAAK,SAAS,KAAK,WAAW;AAEhE,MAAM,2BAA2B;AAAA,EACvC,YACkB,8BAA8B,IAAI,+BAClD;AADgB,SAAA,8BAAA;AAAA,EAElB;AAAA,EAEO,cAAc,EAAE,OAAoC;AAC1D,WAAO,OAAO,QAAQ,IAAI,KAAK,EAAE;AAAA,MAAI,CAAC,CAAC,MAAM,MAAM,MAClD,KAAK,aAAa;AAAA,QACjB;AAAA,QACA;AAAA,MAAA,CACA;AAAA,IAAA,EACA,KAAK,EAAE;AAAA,EACV;AAAA,EAEQ,aAAa,EAAE,MAAM,UAAiE;AAC7F,UAAM,EAAE,WAAW,UAAU,UAAU,GAAG,UAAU;AACpD,UAAM,cAAc,KAAK,4BAA4B,YAAY,IAAI;AACrE,WAAO;AAAA,eAAkB,WAAW,mBAAmB,aAAa,IAAI,CAAC,KAAK,aAAa,KAAK,CAAC;AAAA;AAAA,EAClG;AAAA,EAEO,qBAAqB,EAAE,OAAoC;AACjE,UAAM,kBAA4B,CAAA;AAElC,WAAO,QAAQ,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,UAAU,MAAM;AACzD,aAAO,QAAQ,WAAW,SAAS,EAAE,IAAI,CAAC,CAAC,cAAc,cAAc,MAAM;AAC5E,YAAI,qBAAqB;AAAA,eAAkB,KAAK,4BAA4B,gBAAgB,UAAU,YAAY,CAAC;AACnH,cAAM,eAAe,aAAa,YAAY;AAC9C,cAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AAEzE,YAAI,eAAe,SAAS,IAAI,aAAa,YAAY;AACxD,gBAAM,gBAAgB,aAAa,eAAe,KAAK;AACvD,gCAAsB,4BAA4B,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QACjG,WAAW,eAAe,SAAS,IAAI,aAAa,QAAQ;AAC3D,gBAAM,gBAAgB,aAAa,eAAe,UAAU;AAC5D,gCAAsB,wBAAwB,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QAC7F,OAAO;AACN,gBAAM,IAAI,MAAM,iBAAiB,eAAe,IAAI,oBAAoB;AAAA,QACzE;AAEA,wBAAgB,KAAK,kBAAkB;AAAA,MACxC,CAAC;AAAA,IACF,CAAC;AAED,WAAO,gBAAgB,KAAK,EAAE;AAAA,EAC/B;AAAA,EAEO,kBAAkB,EAAE,QAAQ,UAA4D;AAC9F,UAAM,YAAsB,CAAA;AAC5B,UAAM,~~gCAAgC~~,OAAO,KAAK,OAAO,MAAM,EAAE,~~SAAS~~;~~AAC1E~~,eAAW,CAAC,UAAU,cAAc,KAAK,OAAO,QAAQ,OAAO,IAAI,KAAK,GAAG;AAC1E,YAAM,mBAAmB,eAAe,SAAS,OAAO,IAAI;AAC5D,UAAI,CAAC,kBAAkB;AACtB;AAAA,MACD;AACA,YAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AACzE,iBAAW,CAAC,eAAe,mBAAmB,KAAK,OAAO,QAAQ,iBAAiB,UAAU,GAAG;AAC/F,cAAM,aAAa,KAAK,sBAAsB;AAAA,UAC7C,WAAW;AAAA,UACX,YAAY,iBAAiB;AAAA,UAC7B;AAAA,QAAA,CACA;AACD,YAAI,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG;AACvC,gBAAM,YAAY,IAAI,6BAA6B,OAAO,KAAK;AAC/D,gBAAM,OAAO,UAAU,QAAQ,QAAQ,qBAAqB;AAAA,YAC3D,cAAc,CAAA,QAAO;AACpB,kBAAI,OAAO,IAAI,UAAU,YAAY,IAAI,SAAS,eAAe,WAAW;AAC3E,uBAAO,IAAI,QAAQ,KAAK,4BAA4B,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAAA,cACzF;AACA,qBAAO,IAAI;AAAA,YACZ;AAAA,YACA,gBAAgB,CAAA,QAAO;AACtB,qBAAO,IAAI;AAAA,YACZ;AAAA,UAAA,CACA;AACD,gBAAM,gBAAgB,aAAa,EAAE,MAAM,GAAG,WAAA,GAAc,gBAAgB;AAC5E,oBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,QAC9D;AAAA,MACD;AACA,YAAM,iBAAiB,KAAK,sBAAsB;AAAA,QACjD,WAAW;AAAA,QACX,YAAY,iBAAiB;AAAA,QAC7B;AAAA,MAAA,CACA;AACD,UAAI,OAAO,KAAK,cAAc,EAAE,SAAS,GAAG;AAC3C,cAAM,gBAAgB,aAAa,EAAE,GAAG,eAAA,GAAkB,gBAAgB;AAC1E,kBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,MAC9D;AAAA,IACD;AAEA,QAAI,CAAC,UAAU,QAAQ;AACtB,aAAO;AAAA,IACR;AACA,WAAO,GAAG,UAAU,KAAK,EAAE,CAAC;AAAA,EAC7B;AAAA,EAEQ,sBAAsB,EAAE,YAAY,WAAW,~~iCAIiD~~;AACvG,UAAM,SAA0E,CAAA;AAChF,eAAW,MAAM,CAAC,QAAQ,UAAU,QAAQ,GAAY;AACvD,YAAM,SAAS,OAAO,QAAQ,WAAW,EAAE,KAAK,CAAA,CAAE,EAAE,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,OAAO,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE;AACzG,UAAI,OAAO,WAAW,EAAG;AAAA,eACd,~~OAAO~~,~~WAAW,+BAA+B~~;~~AAC3D~~,eAAO,EAAE,IAAI;AAAA,MACd,OAAO;AACN,eAAO,EAAE,IAAI;AAAA,MACd;AAAA,IACD;AACA,QAAI,WAAW,WAAW,WAAW;AACpC,aAAO,SAAS;AAAA,IACjB;AAEA,WAAO;AAAA,EACR;AACD;"}
1	+ {"version":3,"file":"AclDefinitionCodeGenerator.js","sources":["../../../../../packages/schema-utils/src/definition-generator/AclDefinitionCodeGenerator.ts"],"sourcesContent":["import { PredicateDefinitionProcessor } from '../acl/index.js'\nimport { IndentDecider, Literal, printJsValue } from '../utils/printJsValue.js'\nimport { Acl, Model, Schema } from '@contember/schema'\nimport { DefinitionNamingConventions } from './DefinitionNamingConventions.js'\n\nconst indentFirstLevel: IndentDecider = (val, path) => path.length === 0\n\nexport class AclDefinitionCodeGenerator {\n\tconstructor(\n\t\tprivate readonly definitionNamingConventions = new DefinitionNamingConventions(),\n\t) {\n\t}\n\n\tpublic generateRoles({ acl }: { acl: Acl.Schema }): string {\n\t\treturn Object.entries(acl.roles).map(([name, values]) =>\n\t\t\tthis.generateRole({\n\t\t\t\tname,\n\t\t\t\tvalues,\n\t\t\t})\n\t\t).join('')\n\t}\n\n\tprivate generateRole({ name, values }: { name: string; values: Acl.RolePermissions }): string {\n\t\tconst { variables, entities, inherits, ...other } = values\n\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(name)\n\t\treturn `\\nexport const ${roleVarName} = c.createRole(${printJsValue(name)}, ${printJsValue(other)})\\n`\n\t}\n\n\tpublic generateAclVariables({ acl }: { acl: Acl.Schema }): string {\n\t\tconst variablesOutput: string[] = []\n\n\t\tObject.entries(acl.roles).map(([roleName, roleValues]) => {\n\t\t\tObject.entries(roleValues.variables).map(([variableName, variableValues]) => {\n\t\t\t\tlet variableDefinition = `\\nexport const ${this.definitionNamingConventions.variableVarName(roleName, variableName)} = c.`\n\t\t\t\tconst varFormatted = printJsValue(variableName)\n\t\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\n\t\t\t\tif (variableValues.type === Acl.VariableType.predefined) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.value)\n\t\t\t\t\tvariableDefinition += `createPredefinedVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else if (variableValues.type === Acl.VariableType.entity) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.entityName)\n\t\t\t\t\tvariableDefinition += `createEntityVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else {\n\t\t\t\t\tthrow new Error(`Variable type ${variableValues.type} not yet supported`)\n\t\t\t\t}\n\n\t\t\t\tvariablesOutput.push(variableDefinition)\n\t\t\t})\n\t\t})\n\n\t\treturn variablesOutput.join('')\n\t}\n\n\tpublic generateEntityAcl({ entity, schema }: { entity: Model.Entity; schema: Schema }): string {\n\t\tconst aclOutput: string[] = []\n\t\tconst nonPrimaryFields = Object.keys(entity.fields).filter(it => it !== entity.primary)\n\t\tfor (const [roleName, roleDefinition] of Object.entries(schema.acl.roles)) {\n\t\t\tconst entityPermission = roleDefinition.entities[entity.name]\n\t\t\tif (!entityPermission) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\t\t\tfor (const [predicateName, predicateDefinition] of Object.entries(entityPermission.predicates)) {\n\t\t\t\tconst operations = this.getMatchingOperations({\n\t\t\t\t\tpredicate: predicateName,\n\t\t\t\t\toperations: entityPermission.operations,\n\t\t\t\t\tentity,\n\t\t\t\t\tnonPrimaryFields,\n\t\t\t\t})\n\t\t\t\tif (Object.keys(operations).length > 0) {\n\t\t\t\t\tconst processor = new PredicateDefinitionProcessor(schema.model)\n\t\t\t\t\tconst when = processor.process(entity, predicateDefinition, {\n\t\t\t\t\t\thandleColumn: ctx => {\n\t\t\t\t\t\t\tif (typeof ctx.value === 'string' && ctx.value in roleDefinition.variables) {\n\t\t\t\t\t\t\t\treturn new Literal(this.definitionNamingConventions.variableVarName(roleName, ctx.value))\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t\thandleRelation: ctx => {\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t})\n\t\t\t\t\tconst aclDefinition = printJsValue({ when, ...operations }, indentFirstLevel)\n\t\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst trueOperations = this.getMatchingOperations({\n\t\t\t\tpredicate: true,\n\t\t\t\toperations: entityPermission.operations,\n\t\t\t\tentity,\n\t\t\t\tnonPrimaryFields,\n\t\t\t})\n\t\t\tif (Object.keys(trueOperations).length > 0) {\n\t\t\t\tconst aclDefinition = printJsValue({ ...trueOperations }, indentFirstLevel)\n\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t}\n\t\t}\n\n\t\tif (!aclOutput.length) {\n\t\t\treturn ''\n\t\t}\n\t\treturn `${aclOutput.join('')}`\n\t}\n\n\tprivate getMatchingOperations({ operations, predicate, entity, nonPrimaryFields }: {\n\t\toperations: Acl.EntityOperations\n\t\tpredicate: Acl.Predicate\n\t\tentity: Model.Entity\n\t\tnonPrimaryFields: string[]\n\t}): { read?: string[] \| true; create?: string[] \| boolean; update?: string[] \| boolean; delete?: true } {\n\t\tconst result: ReturnType<AclDefinitionCodeGenerator['getMatchingOperations']> = {}\n\t\tfor (const op of ['read', 'create', 'update'] as const) {\n\t\t\tconst fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it)\n\t\t\tif (fields.length === 0) {\n\t\t\t} else if (this.coversEveryNonPrimaryField(fields, entity, nonPrimaryFields)) {\n\t\t\t\tresult[op] = true\n\t\t\t} else {\n\t\t\t\tresult[op] = fields\n\t\t\t}\n\t\t}\n\t\tif (operations.delete === predicate) {\n\t\t\tresult.delete = true\n\t\t}\n\n\t\treturn result\n\t}\n\n\t/*\n\t `read: true` re-parses as every field except the primary, so it may only stand in for a grant that\n\t * covers exactly that set. Comparing counts instead treated a grant naming the primary plus all but\n\t * one field as complete, and regenerating it silently granted the missing field.\n\t */\n\tprivate coversEveryNonPrimaryField(fields: string[], entity: Model.Entity, nonPrimaryFields: string[]): boolean {\n\t\tif (fields.includes(entity.primary)) {\n\t\t\treturn false\n\t\t}\n\t\tconst granted = new Set(fields)\n\t\treturn nonPrimaryFields.every(it => granted.has(it))\n\t}\n}\n"],"names":[],"mappings":";;;;AAKA,MAAM,mBAAkC,CAAC,KAAK,SAAS,KAAK,WAAW;AAEhE,MAAM,2BAA2B;AAAA,EACvC,YACkB,8BAA8B,IAAI,+BAClD;AADgB,SAAA,8BAAA;AAAA,EAElB;AAAA,EAEO,cAAc,EAAE,OAAoC;AAC1D,WAAO,OAAO,QAAQ,IAAI,KAAK,EAAE;AAAA,MAAI,CAAC,CAAC,MAAM,MAAM,MAClD,KAAK,aAAa;AAAA,QACjB;AAAA,QACA;AAAA,MAAA,CACA;AAAA,IAAA,EACA,KAAK,EAAE;AAAA,EACV;AAAA,EAEQ,aAAa,EAAE,MAAM,UAAiE;AAC7F,UAAM,EAAE,WAAW,UAAU,UAAU,GAAG,UAAU;AACpD,UAAM,cAAc,KAAK,4BAA4B,YAAY,IAAI;AACrE,WAAO;AAAA,eAAkB,WAAW,mBAAmB,aAAa,IAAI,CAAC,KAAK,aAAa,KAAK,CAAC;AAAA;AAAA,EAClG;AAAA,EAEO,qBAAqB,EAAE,OAAoC;AACjE,UAAM,kBAA4B,CAAA;AAElC,WAAO,QAAQ,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,UAAU,MAAM;AACzD,aAAO,QAAQ,WAAW,SAAS,EAAE,IAAI,CAAC,CAAC,cAAc,cAAc,MAAM;AAC5E,YAAI,qBAAqB;AAAA,eAAkB,KAAK,4BAA4B,gBAAgB,UAAU,YAAY,CAAC;AACnH,cAAM,eAAe,aAAa,YAAY;AAC9C,cAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AAEzE,YAAI,eAAe,SAAS,IAAI,aAAa,YAAY;AACxD,gBAAM,gBAAgB,aAAa,eAAe,KAAK;AACvD,gCAAsB,4BAA4B,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QACjG,WAAW,eAAe,SAAS,IAAI,aAAa,QAAQ;AAC3D,gBAAM,gBAAgB,aAAa,eAAe,UAAU;AAC5D,gCAAsB,wBAAwB,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QAC7F,OAAO;AACN,gBAAM,IAAI,MAAM,iBAAiB,eAAe,IAAI,oBAAoB;AAAA,QACzE;AAEA,wBAAgB,KAAK,kBAAkB;AAAA,MACxC,CAAC;AAAA,IACF,CAAC;AAED,WAAO,gBAAgB,KAAK,EAAE;AAAA,EAC/B;AAAA,EAEO,kBAAkB,EAAE,QAAQ,UAA4D;AAC9F,UAAM,YAAsB,CAAA;AAC5B,UAAM,mBAAmB,OAAO,KAAK,OAAO,MAAM,EAAE,OAAO,CAAA,OAAM,OAAO,OAAO,OAAO;AACtF,eAAW,CAAC,UAAU,cAAc,KAAK,OAAO,QAAQ,OAAO,IAAI,KAAK,GAAG;AAC1E,YAAM,mBAAmB,eAAe,SAAS,OAAO,IAAI;AAC5D,UAAI,CAAC,kBAAkB;AACtB;AAAA,MACD;AACA,YAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AACzE,iBAAW,CAAC,eAAe,mBAAmB,KAAK,OAAO,QAAQ,iBAAiB,UAAU,GAAG;AAC/F,cAAM,aAAa,KAAK,sBAAsB;AAAA,UAC7C,WAAW;AAAA,UACX,YAAY,iBAAiB;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA,CACA;AACD,YAAI,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG;AACvC,gBAAM,YAAY,IAAI,6BAA6B,OAAO,KAAK;AAC/D,gBAAM,OAAO,UAAU,QAAQ,QAAQ,qBAAqB;AAAA,YAC3D,cAAc,CAAA,QAAO;AACpB,kBAAI,OAAO,IAAI,UAAU,YAAY,IAAI,SAAS,eAAe,WAAW;AAC3E,uBAAO,IAAI,QAAQ,KAAK,4BAA4B,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAAA,cACzF;AACA,qBAAO,IAAI;AAAA,YACZ;AAAA,YACA,gBAAgB,CAAA,QAAO;AACtB,qBAAO,IAAI;AAAA,YACZ;AAAA,UAAA,CACA;AACD,gBAAM,gBAAgB,aAAa,EAAE,MAAM,GAAG,WAAA,GAAc,gBAAgB;AAC5E,oBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,QAC9D;AAAA,MACD;AACA,YAAM,iBAAiB,KAAK,sBAAsB;AAAA,QACjD,WAAW;AAAA,QACX,YAAY,iBAAiB;AAAA,QAC7B;AAAA,QACA;AAAA,MAAA,CACA;AACD,UAAI,OAAO,KAAK,cAAc,EAAE,SAAS,GAAG;AAC3C,cAAM,gBAAgB,aAAa,EAAE,GAAG,eAAA,GAAkB,gBAAgB;AAC1E,kBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,MAC9D;AAAA,IACD;AAEA,QAAI,CAAC,UAAU,QAAQ;AACtB,aAAO;AAAA,IACR;AACA,WAAO,GAAG,UAAU,KAAK,EAAE,CAAC;AAAA,EAC7B;AAAA,EAEQ,sBAAsB,EAAE,YAAY,WAAW,QAAQ,oBAKyC;AACvG,UAAM,SAA0E,CAAA;AAChF,eAAW,MAAM,CAAC,QAAQ,UAAU,QAAQ,GAAY;AACvD,YAAM,SAAS,OAAO,QAAQ,WAAW,EAAE,KAAK,CAAA,CAAE,EAAE,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,OAAO,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE;AACzG,UAAI,OAAO,WAAW,EAAG;AAAA,eACd,KAAK,2BAA2B,QAAQ,QAAQ,gBAAgB,GAAG;AAC7E,eAAO,EAAE,IAAI;AAAA,MACd,OAAO;AACN,eAAO,EAAE,IAAI;AAAA,MACd;AAAA,IACD;AACA,QAAI,WAAW,WAAW,WAAW;AACpC,aAAO,SAAS;AAAA,IACjB;AAEA,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,2BAA2B,QAAkB,QAAsB,kBAAqC;AAC/G,QAAI,OAAO,SAAS,OAAO,OAAO,GAAG;AACpC,aAAO;AAAA,IACR;AACA,UAAM,UAAU,IAAI,IAAI,MAAM;AAC9B,WAAO,iBAAiB,MAAM,CAAA,OAAM,QAAQ,IAAI,EAAE,CAAC;AAAA,EACpD;AACD;"}

package/dist/development/src/validation/MembershipResolver.cjs CHANGED Viewed

@@ -17,7 +17,7 @@ class MembershipResolver {
     const parsed = [];
     const roles = acl.roles;
     for (const membership of memberships) {
-      if (!roles[membership.role]) {
+      if (!Object.prototype.hasOwnProperty.call(roles, membership.role)) {
         errors.push(new MembershipValidationError(
           membership.role,
           "roleNotFound"
@@ -27,7 +27,8 @@ class MembershipResolver {
       }
       const roleVariables = schemaUtils.getRoleVariables(membership.role, acl);
       for (const variable of membership.variables) {
-        if (!roleVariables[variable.name] || !isAssumed && roleVariables[variable.name].type === schema.Acl.VariableType.predefined) {
+        const roleVariable = Object.prototype.hasOwnProperty.call(roleVariables, variable.name) ? roleVariables[variable.name] : void 0;
+        if (!roleVariable || !isAssumed && roleVariable.type === schema.Acl.VariableType.predefined) {
           errors.push(
             new MembershipValidationError(
               membership.role,

package/dist/development/src/validation/MembershipResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"MembershipResolver.cjs","sources":["../../../../../packages/schema-utils/src/validation/MembershipResolver.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables } from '../acl/index.js'\nimport { conditionSchema } from '../type-schema/index.js'\nimport { assertNever } from '../utils/index.js'\n\nexport class MembershipResolver {\n\tpublic static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }\n\n\tresolve(\n\t\tacl: Acl.Schema,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tidentity: {\n\t\t\tidentityId: string\n\t\t\tpersonId?: string\n\t\t},\n\t\tisAssumed: boolean,\n\t): MembershipReadResult {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsed: ParsedMembership[] = []\n\t\tconst roles = acl.roles\n\t\tfor (const membership of memberships) {\n\t\t\tif (!roles[membership.role]) {\n\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVariables = getRoleVariables(membership.role, acl)\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\~~tif~~ (!roleVariables[variable.name] \|\| (!isAssumed && ~~roleVariables[variable~~.~~name].~~type === Acl.VariableType.predefined)) {\n\t\t\t\t\terrors.push(\n\t\t\t\t\t\tnew MembershipValidationError(\n\t\t\t\t\t\t\tmembership.role,\n\t\t\t\t\t\t\tMembershipValidationErrorType.VARIABLE_NOT_FOUND,\n\t\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed)\n\t\t\terrors.push(...membershipErrors)\n\t\t\tparsed.push({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: parsedVariables,\n\t\t\t})\n\t\t}\n\t\treturn new MembershipReadResult(errors, parsed)\n\t}\n\n\tprivate readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {\n\t\tidentityId: string\n\t\tpersonId?: string\n\t}, isAssumed: boolean): [MembershipValidationError[], ParsedMembershipVariable[]] {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsedVariables: ParsedMembershipVariable[] = []\n\t\tfor (const [name, variable] of Object.entries(roleVariables)) {\n\t\t\tconst inputVariable = membership.variables.find(it => it.name === name)\n\t\t\tif (variable.type === Acl.VariableType.predefined) {\n\t\t\t\tswitch (variable.value) {\n\t\t\t\t\tcase 'identityID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'personID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (!inputVariable) {\n\t\t\t\tif (variable.fallback) {\n\t\t\t\t\tparsedVariables.push({ name, condition: variable.fallback })\n\t\t\t\t} else {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (variable.type === Acl.VariableType.entity) {\n\t\t\t\tparsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int\n\t\t\t} else if (variable.type === Acl.VariableType.condition) {\n\t\t\t\ttry {\n\t\t\t\t\tconst conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))\n\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tcondition: conditions.length === 1 ? conditions[0] : { or: conditions },\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tassertNever(variable)\n\t\t\t}\n\t\t}\n\t\treturn [errors, parsedVariables]\n\t}\n}\n\nexport class MembershipReadResult {\n\tconstructor(\n\t\tpublic readonly errors: MembershipValidationError[],\n\t\tpublic readonly memberships: ParsedMembership[],\n\t) {\n\t}\n}\n\nexport class MembershipValidationError {\n\tconstructor(\n\t\tpublic readonly role: string,\n\t\tpublic readonly error: MembershipValidationErrorType,\n\t\tpublic readonly variable?: string,\n\t) {\n\t}\n}\n\nexport enum MembershipValidationErrorType {\n\tROLE_NOT_FOUND = 'roleNotFound',\n\tVARIABLE_NOT_FOUND = 'variableNotFound',\n\tVARIABLE_EMPTY = 'variableEmpty',\n\tVARIABLE_INVALID = 'variableInvalid',\n}\n\nexport interface ParsedMembershipVariable {\n\treadonly name: string\n\treadonly condition: Input.Condition\n}\n\nexport interface ParsedMembership {\n\treadonly role: string\n\treadonly variables: readonly ParsedMembershipVariable[]\n}\n"],"names":["getRoleVariables","Acl","conditionSchema","assertNever","MembershipValidationErrorType"],"mappings":";;;;;;;;;;;;;AAKO,MAAM,mBAAmB;AAAA,EAG/B,QACC,KACA,aACA,UAIA,WACuB;AACvB,UAAM,SAAsC,CAAA;AAC5C,UAAM,SAA6B,CAAA;AACnC,UAAM,QAAQ,IAAI;AAClB,eAAW,cAAc,aAAa;~~AACrC~~,UAAI,CAAC,~~MAAM~~,WAAW,IAAI,GAAG;~~AAC5B~~,eAAO,KAAK,IAAI;AAAA,UAA0B,WAAW;AAAA,UAAM;AAAA;AAAA,SAA6C;AACxG;AAAA,MACD;AACA,YAAM,gBAAgBA,YAAAA,iBAAiB,WAAW,MAAM,GAAG;AAC3D,iBAAW,YAAY,WAAW,WAAW;AAC5C,~~YAAI~~,~~CAAC~~,cAAc,SAAS,IAAI,~~KAAM~~,CAAC,~~aAAa~~,~~cAAc~~,~~SAAS~~,~~IAAI~~,~~EAAE,~~SAASC,OAAAA,IAAI,aAAa,YAAa;~~AACvH~~,iBAAO;AAAA,YACN,IAAI;AAAA,cACH,WAAW;AAAA,cACX;AAAA,cACA,SAAS;AAAA,YAAA;AAAA,UACV;AAAA,QAEF;AAAA,MACD;AACA,YAAM,CAAC,kBAAkB,eAAe,IAAI,KAAK,wBAAwB,eAAe,YAAY,UAAU,SAAS;AACvH,aAAO,KAAK,GAAG,gBAAgB;AAC/B,aAAO,KAAK;AAAA,QACX,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,MAAA,CACX;AAAA,IACF;AACA,WAAO,IAAI,qBAAqB,QAAQ,MAAM;AAAA,EAC/C;AAAA,EAEQ,wBAAwB,eAA8B,YAA4B,UAGvF,WAA+E;AACjF,UAAM,SAAsC,CAAA;AAC5C,UAAM,kBAA8C,CAAA;AACpD,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC7D,YAAM,gBAAgB,WAAW,UAAU,KAAK,CAAA,OAAM,GAAG,SAAS,IAAI;AACtE,UAAI,SAAS,SAASA,WAAI,aAAa,YAAY;AAClD,gBAAQ,SAAS,OAAA;AAAA,UAChB,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,CAAC,SAAS,UAAU,EAAA;AAAA,YAAE,CAC3F;AACD;AAAA,UACD,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,SAAS,WAAW,CAAC,SAAS,QAAQ,IAAI,CAAA,EAAC;AAAA,YAAE,CAClH;AACD;AAAA,UACD;AACC,4BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AACzD,mBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH;AAAA,QAAA;AAEF;AAAA,MACD;AAEA,UAAI,CAAC,eAAe;AACnB,YAAI,SAAS,UAAU;AACtB,0BAAgB,KAAK,EAAE,MAAM,WAAW,SAAS,UAAU;AAAA,QAC5D,OAAO;AACN,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,iBAA8C,IAAI,CAAC;AAC9G,0BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAC1D;AACA;AAAA,MACD;AAEA,UAAI,SAAS,SAASA,WAAI,aAAa,QAAQ;AAC9C,wBAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,cAAc,OAAA,GAAU;AAAA,MACvE,WAAW,SAAS,SAASA,OAAAA,IAAI,aAAa,WAAW;AACxD,YAAI;AACH,gBAAM,aAAa,cAAc,OAAO,IAAI,CAAA,OAAMC,UAAAA,gBAAA,EAAkB,KAAK,MAAM,EAAE,CAAC,CAAC;AACnF,0BAAgB,KAAK;AAAA,YACpB;AAAA,YACA,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,WAAA;AAAA,UAAW,CACtE;AAAA,QACF,QAAQ;AACP,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH,0BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAC1D;AAAA,MACD,OAAO;AACNC,oBAAAA,YAAoB;AAAA,MACrB;AAAA,IACD;AACA,WAAO,CAAC,QAAQ,eAAe;AAAA,EAChC;AACD;~~AApGC~~,cADY,oBACE,mBAAkB,EAAE,YAAY,uCAAA,CAAuC;~~AAsG~~/E,MAAM,qBAAqB;AAAA,EACjC,YACiB,QACA,aACf;AAFe,SAAA,SAAA;AACA,SAAA,cAAA;AAAA,EAEjB;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YACiB,MACA,OACA,UACf;AAHe,SAAA,OAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AAAA,EAEjB;AACD;AAEO,IAAK,kDAAAC,mCAAL;AACNA,iCAAA,gBAAA,IAAiB;AACjBA,iCAAA,oBAAA,IAAqB;AACrBA,iCAAA,gBAAA,IAAiB;AACjBA,iCAAA,kBAAA,IAAmB;AAJR,SAAAA;AAAA,GAAA,iCAAA,CAAA,CAAA;;;;;"}
1	+ {"version":3,"file":"MembershipResolver.cjs","sources":["../../../../../packages/schema-utils/src/validation/MembershipResolver.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables } from '../acl/index.js'\nimport { conditionSchema } from '../type-schema/index.js'\nimport { assertNever } from '../utils/index.js'\n\nexport class MembershipResolver {\n\tpublic static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }\n\n\tresolve(\n\t\tacl: Acl.Schema,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tidentity: {\n\t\t\tidentityId: string\n\t\t\tpersonId?: string\n\t\t},\n\t\tisAssumed: boolean,\n\t): MembershipReadResult {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsed: ParsedMembership[] = []\n\t\tconst roles = acl.roles\n\t\tfor (const membership of memberships) {\n\t\t\t// own-property lookup so a role named `__proto__` / `constructor` resolves to \"not found\"\n\t\t\t// rather than an inherited Object.prototype member\n\t\t\tif (!Object.prototype.hasOwnProperty.call(roles, membership.role)) {\n\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVariables = getRoleVariables(membership.role, acl)\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst roleVariable = Object.prototype.hasOwnProperty.call(roleVariables, variable.name) ? roleVariables[variable.name] : undefined\n\t\t\t\tif (!roleVariable \|\| (!isAssumed && roleVariable.type === Acl.VariableType.predefined)) {\n\t\t\t\t\terrors.push(\n\t\t\t\t\t\tnew MembershipValidationError(\n\t\t\t\t\t\t\tmembership.role,\n\t\t\t\t\t\t\tMembershipValidationErrorType.VARIABLE_NOT_FOUND,\n\t\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed)\n\t\t\terrors.push(...membershipErrors)\n\t\t\tparsed.push({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: parsedVariables,\n\t\t\t})\n\t\t}\n\t\treturn new MembershipReadResult(errors, parsed)\n\t}\n\n\tprivate readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {\n\t\tidentityId: string\n\t\tpersonId?: string\n\t}, isAssumed: boolean): [MembershipValidationError[], ParsedMembershipVariable[]] {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsedVariables: ParsedMembershipVariable[] = []\n\t\tfor (const [name, variable] of Object.entries(roleVariables)) {\n\t\t\tconst inputVariable = membership.variables.find(it => it.name === name)\n\t\t\tif (variable.type === Acl.VariableType.predefined) {\n\t\t\t\tswitch (variable.value) {\n\t\t\t\t\tcase 'identityID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'personID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (!inputVariable) {\n\t\t\t\tif (variable.fallback) {\n\t\t\t\t\tparsedVariables.push({ name, condition: variable.fallback })\n\t\t\t\t} else {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (variable.type === Acl.VariableType.entity) {\n\t\t\t\tparsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int\n\t\t\t} else if (variable.type === Acl.VariableType.condition) {\n\t\t\t\ttry {\n\t\t\t\t\tconst conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))\n\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tcondition: conditions.length === 1 ? conditions[0] : { or: conditions },\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tassertNever(variable)\n\t\t\t}\n\t\t}\n\t\treturn [errors, parsedVariables]\n\t}\n}\n\nexport class MembershipReadResult {\n\tconstructor(\n\t\tpublic readonly errors: MembershipValidationError[],\n\t\tpublic readonly memberships: ParsedMembership[],\n\t) {\n\t}\n}\n\nexport class MembershipValidationError {\n\tconstructor(\n\t\tpublic readonly role: string,\n\t\tpublic readonly error: MembershipValidationErrorType,\n\t\tpublic readonly variable?: string,\n\t) {\n\t}\n}\n\nexport enum MembershipValidationErrorType {\n\tROLE_NOT_FOUND = 'roleNotFound',\n\tVARIABLE_NOT_FOUND = 'variableNotFound',\n\tVARIABLE_EMPTY = 'variableEmpty',\n\tVARIABLE_INVALID = 'variableInvalid',\n}\n\nexport interface ParsedMembershipVariable {\n\treadonly name: string\n\treadonly condition: Input.Condition\n}\n\nexport interface ParsedMembership {\n\treadonly role: string\n\treadonly variables: readonly ParsedMembershipVariable[]\n}\n"],"names":["getRoleVariables","Acl","conditionSchema","assertNever","MembershipValidationErrorType"],"mappings":";;;;;;;;;;;;;AAKO,MAAM,mBAAmB;AAAA,EAG/B,QACC,KACA,aACA,UAIA,WACuB;AACvB,UAAM,SAAsC,CAAA;AAC5C,UAAM,SAA6B,CAAA;AACnC,UAAM,QAAQ,IAAI;AAClB,eAAW,cAAc,aAAa;AAGrC,UAAI,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,WAAW,IAAI,GAAG;AAClE,eAAO,KAAK,IAAI;AAAA,UAA0B,WAAW;AAAA,UAAM;AAAA;AAAA,SAA6C;AACxG;AAAA,MACD;AACA,YAAM,gBAAgBA,YAAAA,iBAAiB,WAAW,MAAM,GAAG;AAC3D,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,eAAe,OAAO,UAAU,eAAe,KAAK,eAAe,SAAS,IAAI,IAAI,cAAc,SAAS,IAAI,IAAI;AACzH,YAAI,CAAC,gBAAiB,CAAC,aAAa,aAAa,SAASC,OAAAA,IAAI,aAAa,YAAa;AACvF,iBAAO;AAAA,YACN,IAAI;AAAA,cACH,WAAW;AAAA,cACX;AAAA,cACA,SAAS;AAAA,YAAA;AAAA,UACV;AAAA,QAEF;AAAA,MACD;AACA,YAAM,CAAC,kBAAkB,eAAe,IAAI,KAAK,wBAAwB,eAAe,YAAY,UAAU,SAAS;AACvH,aAAO,KAAK,GAAG,gBAAgB;AAC/B,aAAO,KAAK;AAAA,QACX,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,MAAA,CACX;AAAA,IACF;AACA,WAAO,IAAI,qBAAqB,QAAQ,MAAM;AAAA,EAC/C;AAAA,EAEQ,wBAAwB,eAA8B,YAA4B,UAGvF,WAA+E;AACjF,UAAM,SAAsC,CAAA;AAC5C,UAAM,kBAA8C,CAAA;AACpD,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC7D,YAAM,gBAAgB,WAAW,UAAU,KAAK,CAAA,OAAM,GAAG,SAAS,IAAI;AACtE,UAAI,SAAS,SAASA,WAAI,aAAa,YAAY;AAClD,gBAAQ,SAAS,OAAA;AAAA,UAChB,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,CAAC,SAAS,UAAU,EAAA;AAAA,YAAE,CAC3F;AACD;AAAA,UACD,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,SAAS,WAAW,CAAC,SAAS,QAAQ,IAAI,CAAA,EAAC;AAAA,YAAE,CAClH;AACD;AAAA,UACD;AACC,4BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AACzD,mBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH;AAAA,QAAA;AAEF;AAAA,MACD;AAEA,UAAI,CAAC,eAAe;AACnB,YAAI,SAAS,UAAU;AACtB,0BAAgB,KAAK,EAAE,MAAM,WAAW,SAAS,UAAU;AAAA,QAC5D,OAAO;AACN,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,iBAA8C,IAAI,CAAC;AAC9G,0BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAC1D;AACA;AAAA,MACD;AAEA,UAAI,SAAS,SAASA,WAAI,aAAa,QAAQ;AAC9C,wBAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,cAAc,OAAA,GAAU;AAAA,MACvE,WAAW,SAAS,SAASA,OAAAA,IAAI,aAAa,WAAW;AACxD,YAAI;AACH,gBAAM,aAAa,cAAc,OAAO,IAAI,CAAA,OAAMC,UAAAA,gBAAA,EAAkB,KAAK,MAAM,EAAE,CAAC,CAAC;AACnF,0BAAgB,KAAK;AAAA,YACpB;AAAA,YACA,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,WAAA;AAAA,UAAW,CACtE;AAAA,QACF,QAAQ;AACP,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH,0BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAC1D;AAAA,MACD,OAAO;AACNC,oBAAAA,YAAoB;AAAA,MACrB;AAAA,IACD;AACA,WAAO,CAAC,QAAQ,eAAe;AAAA,EAChC;AACD;AAvGC,cADY,oBACE,mBAAkB,EAAE,YAAY,uCAAA,CAAuC;AAyG/E,MAAM,qBAAqB;AAAA,EACjC,YACiB,QACA,aACf;AAFe,SAAA,SAAA;AACA,SAAA,cAAA;AAAA,EAEjB;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YACiB,MACA,OACA,UACf;AAHe,SAAA,OAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AAAA,EAEjB;AACD;AAEO,IAAK,kDAAAC,mCAAL;AACNA,iCAAA,gBAAA,IAAiB;AACjBA,iCAAA,oBAAA,IAAqB;AACrBA,iCAAA,gBAAA,IAAiB;AACjBA,iCAAA,kBAAA,IAAmB;AAJR,SAAAA;AAAA,GAAA,iCAAA,CAAA,CAAA;;;;;"}

package/dist/development/src/validation/MembershipResolver.js CHANGED Viewed

@@ -15,7 +15,7 @@ class MembershipResolver {
     const parsed = [];
     const roles = acl.roles;
     for (const membership of memberships) {
-      if (!roles[membership.role]) {
+      if (!Object.prototype.hasOwnProperty.call(roles, membership.role)) {
         errors.push(new MembershipValidationError(
           membership.role,
           "roleNotFound"
@@ -25,7 +25,8 @@ class MembershipResolver {
       }
       const roleVariables = getRoleVariables(membership.role, acl);
       for (const variable of membership.variables) {
-        if (!roleVariables[variable.name] || !isAssumed && roleVariables[variable.name].type === Acl.VariableType.predefined) {
+        const roleVariable = Object.prototype.hasOwnProperty.call(roleVariables, variable.name) ? roleVariables[variable.name] : void 0;
+        if (!roleVariable || !isAssumed && roleVariable.type === Acl.VariableType.predefined) {
           errors.push(
             new MembershipValidationError(
               membership.role,

package/dist/development/src/validation/MembershipResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"MembershipResolver.js","sources":["../../../../../packages/schema-utils/src/validation/MembershipResolver.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables } from '../acl/index.js'\nimport { conditionSchema } from '../type-schema/index.js'\nimport { assertNever } from '../utils/index.js'\n\nexport class MembershipResolver {\n\tpublic static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }\n\n\tresolve(\n\t\tacl: Acl.Schema,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tidentity: {\n\t\t\tidentityId: string\n\t\t\tpersonId?: string\n\t\t},\n\t\tisAssumed: boolean,\n\t): MembershipReadResult {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsed: ParsedMembership[] = []\n\t\tconst roles = acl.roles\n\t\tfor (const membership of memberships) {\n\t\t\tif (!roles[membership.role]) {\n\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVariables = getRoleVariables(membership.role, acl)\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\~~tif~~ (!roleVariables[variable.name] \|\| (!isAssumed && ~~roleVariables[variable~~.~~name].~~type === Acl.VariableType.predefined)) {\n\t\t\t\t\terrors.push(\n\t\t\t\t\t\tnew MembershipValidationError(\n\t\t\t\t\t\t\tmembership.role,\n\t\t\t\t\t\t\tMembershipValidationErrorType.VARIABLE_NOT_FOUND,\n\t\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed)\n\t\t\terrors.push(...membershipErrors)\n\t\t\tparsed.push({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: parsedVariables,\n\t\t\t})\n\t\t}\n\t\treturn new MembershipReadResult(errors, parsed)\n\t}\n\n\tprivate readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {\n\t\tidentityId: string\n\t\tpersonId?: string\n\t}, isAssumed: boolean): [MembershipValidationError[], ParsedMembershipVariable[]] {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsedVariables: ParsedMembershipVariable[] = []\n\t\tfor (const [name, variable] of Object.entries(roleVariables)) {\n\t\t\tconst inputVariable = membership.variables.find(it => it.name === name)\n\t\t\tif (variable.type === Acl.VariableType.predefined) {\n\t\t\t\tswitch (variable.value) {\n\t\t\t\t\tcase 'identityID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'personID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (!inputVariable) {\n\t\t\t\tif (variable.fallback) {\n\t\t\t\t\tparsedVariables.push({ name, condition: variable.fallback })\n\t\t\t\t} else {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (variable.type === Acl.VariableType.entity) {\n\t\t\t\tparsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int\n\t\t\t} else if (variable.type === Acl.VariableType.condition) {\n\t\t\t\ttry {\n\t\t\t\t\tconst conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))\n\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tcondition: conditions.length === 1 ? conditions[0] : { or: conditions },\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tassertNever(variable)\n\t\t\t}\n\t\t}\n\t\treturn [errors, parsedVariables]\n\t}\n}\n\nexport class MembershipReadResult {\n\tconstructor(\n\t\tpublic readonly errors: MembershipValidationError[],\n\t\tpublic readonly memberships: ParsedMembership[],\n\t) {\n\t}\n}\n\nexport class MembershipValidationError {\n\tconstructor(\n\t\tpublic readonly role: string,\n\t\tpublic readonly error: MembershipValidationErrorType,\n\t\tpublic readonly variable?: string,\n\t) {\n\t}\n}\n\nexport enum MembershipValidationErrorType {\n\tROLE_NOT_FOUND = 'roleNotFound',\n\tVARIABLE_NOT_FOUND = 'variableNotFound',\n\tVARIABLE_EMPTY = 'variableEmpty',\n\tVARIABLE_INVALID = 'variableInvalid',\n}\n\nexport interface ParsedMembershipVariable {\n\treadonly name: string\n\treadonly condition: Input.Condition\n}\n\nexport interface ParsedMembership {\n\treadonly role: string\n\treadonly variables: readonly ParsedMembershipVariable[]\n}\n"],"names":["MembershipValidationErrorType"],"mappings":";;;;;;;;;;;AAKO,MAAM,mBAAmB;AAAA,EAG/B,QACC,KACA,aACA,UAIA,WACuB;AACvB,UAAM,SAAsC,CAAA;AAC5C,UAAM,SAA6B,CAAA;AACnC,UAAM,QAAQ,IAAI;AAClB,eAAW,cAAc,aAAa;~~AACrC~~,UAAI,CAAC,~~MAAM~~,WAAW,IAAI,GAAG;~~AAC5B~~,eAAO,KAAK,IAAI;AAAA,UAA0B,WAAW;AAAA,UAAM;AAAA;AAAA,SAA6C;AACxG;AAAA,MACD;AACA,YAAM,gBAAgB,iBAAiB,WAAW,MAAM,GAAG;AAC3D,iBAAW,YAAY,WAAW,WAAW;AAC5C,~~YAAI~~,~~CAAC~~,cAAc,SAAS,IAAI,~~KAAM~~,CAAC,~~aAAa~~,~~cAAc~~,~~SAAS~~,~~IAAI~~,~~EAAE,~~SAAS,IAAI,aAAa,YAAa;~~AACvH~~,iBAAO;AAAA,YACN,IAAI;AAAA,cACH,WAAW;AAAA,cACX;AAAA,cACA,SAAS;AAAA,YAAA;AAAA,UACV;AAAA,QAEF;AAAA,MACD;AACA,YAAM,CAAC,kBAAkB,eAAe,IAAI,KAAK,wBAAwB,eAAe,YAAY,UAAU,SAAS;AACvH,aAAO,KAAK,GAAG,gBAAgB;AAC/B,aAAO,KAAK;AAAA,QACX,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,MAAA,CACX;AAAA,IACF;AACA,WAAO,IAAI,qBAAqB,QAAQ,MAAM;AAAA,EAC/C;AAAA,EAEQ,wBAAwB,eAA8B,YAA4B,UAGvF,WAA+E;AACjF,UAAM,SAAsC,CAAA;AAC5C,UAAM,kBAA8C,CAAA;AACpD,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC7D,YAAM,gBAAgB,WAAW,UAAU,KAAK,CAAA,OAAM,GAAG,SAAS,IAAI;AACtE,UAAI,SAAS,SAAS,IAAI,aAAa,YAAY;AAClD,gBAAQ,SAAS,OAAA;AAAA,UAChB,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,CAAC,SAAS,UAAU,EAAA;AAAA,YAAE,CAC3F;AACD;AAAA,UACD,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,SAAS,WAAW,CAAC,SAAS,QAAQ,IAAI,CAAA,EAAC;AAAA,YAAE,CAClH;AACD;AAAA,UACD;AACC,4BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AACzD,mBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH;AAAA,QAAA;AAEF;AAAA,MACD;AAEA,UAAI,CAAC,eAAe;AACnB,YAAI,SAAS,UAAU;AACtB,0BAAgB,KAAK,EAAE,MAAM,WAAW,SAAS,UAAU;AAAA,QAC5D,OAAO;AACN,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,iBAA8C,IAAI,CAAC;AAC9G,0BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAC1D;AACA;AAAA,MACD;AAEA,UAAI,SAAS,SAAS,IAAI,aAAa,QAAQ;AAC9C,wBAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,cAAc,OAAA,GAAU;AAAA,MACvE,WAAW,SAAS,SAAS,IAAI,aAAa,WAAW;AACxD,YAAI;AACH,gBAAM,aAAa,cAAc,OAAO,IAAI,CAAA,OAAM,gBAAA,EAAkB,KAAK,MAAM,EAAE,CAAC,CAAC;AACnF,0BAAgB,KAAK;AAAA,YACpB;AAAA,YACA,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,WAAA;AAAA,UAAW,CACtE;AAAA,QACF,QAAQ;AACP,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH,0BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAC1D;AAAA,MACD,OAAO;AACN,oBAAoB;AAAA,MACrB;AAAA,IACD;AACA,WAAO,CAAC,QAAQ,eAAe;AAAA,EAChC;AACD;~~AApGC~~,cADY,oBACE,mBAAkB,EAAE,YAAY,uCAAA,CAAuC;~~AAsG~~/E,MAAM,qBAAqB;AAAA,EACjC,YACiB,QACA,aACf;AAFe,SAAA,SAAA;AACA,SAAA,cAAA;AAAA,EAEjB;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YACiB,MACA,OACA,UACf;AAHe,SAAA,OAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AAAA,EAEjB;AACD;AAEO,IAAK,kDAAAA,mCAAL;AACNA,iCAAA,gBAAA,IAAiB;AACjBA,iCAAA,oBAAA,IAAqB;AACrBA,iCAAA,gBAAA,IAAiB;AACjBA,iCAAA,kBAAA,IAAmB;AAJR,SAAAA;AAAA,GAAA,iCAAA,CAAA,CAAA;"}
1	+ {"version":3,"file":"MembershipResolver.js","sources":["../../../../../packages/schema-utils/src/validation/MembershipResolver.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables } from '../acl/index.js'\nimport { conditionSchema } from '../type-schema/index.js'\nimport { assertNever } from '../utils/index.js'\n\nexport class MembershipResolver {\n\tpublic static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }\n\n\tresolve(\n\t\tacl: Acl.Schema,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tidentity: {\n\t\t\tidentityId: string\n\t\t\tpersonId?: string\n\t\t},\n\t\tisAssumed: boolean,\n\t): MembershipReadResult {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsed: ParsedMembership[] = []\n\t\tconst roles = acl.roles\n\t\tfor (const membership of memberships) {\n\t\t\t// own-property lookup so a role named `__proto__` / `constructor` resolves to \"not found\"\n\t\t\t// rather than an inherited Object.prototype member\n\t\t\tif (!Object.prototype.hasOwnProperty.call(roles, membership.role)) {\n\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVariables = getRoleVariables(membership.role, acl)\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst roleVariable = Object.prototype.hasOwnProperty.call(roleVariables, variable.name) ? roleVariables[variable.name] : undefined\n\t\t\t\tif (!roleVariable \|\| (!isAssumed && roleVariable.type === Acl.VariableType.predefined)) {\n\t\t\t\t\terrors.push(\n\t\t\t\t\t\tnew MembershipValidationError(\n\t\t\t\t\t\t\tmembership.role,\n\t\t\t\t\t\t\tMembershipValidationErrorType.VARIABLE_NOT_FOUND,\n\t\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed)\n\t\t\terrors.push(...membershipErrors)\n\t\t\tparsed.push({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: parsedVariables,\n\t\t\t})\n\t\t}\n\t\treturn new MembershipReadResult(errors, parsed)\n\t}\n\n\tprivate readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {\n\t\tidentityId: string\n\t\tpersonId?: string\n\t}, isAssumed: boolean): [MembershipValidationError[], ParsedMembershipVariable[]] {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsedVariables: ParsedMembershipVariable[] = []\n\t\tfor (const [name, variable] of Object.entries(roleVariables)) {\n\t\t\tconst inputVariable = membership.variables.find(it => it.name === name)\n\t\t\tif (variable.type === Acl.VariableType.predefined) {\n\t\t\t\tswitch (variable.value) {\n\t\t\t\t\tcase 'identityID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'personID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (!inputVariable) {\n\t\t\t\tif (variable.fallback) {\n\t\t\t\t\tparsedVariables.push({ name, condition: variable.fallback })\n\t\t\t\t} else {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (variable.type === Acl.VariableType.entity) {\n\t\t\t\tparsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int\n\t\t\t} else if (variable.type === Acl.VariableType.condition) {\n\t\t\t\ttry {\n\t\t\t\t\tconst conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))\n\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tcondition: conditions.length === 1 ? conditions[0] : { or: conditions },\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tassertNever(variable)\n\t\t\t}\n\t\t}\n\t\treturn [errors, parsedVariables]\n\t}\n}\n\nexport class MembershipReadResult {\n\tconstructor(\n\t\tpublic readonly errors: MembershipValidationError[],\n\t\tpublic readonly memberships: ParsedMembership[],\n\t) {\n\t}\n}\n\nexport class MembershipValidationError {\n\tconstructor(\n\t\tpublic readonly role: string,\n\t\tpublic readonly error: MembershipValidationErrorType,\n\t\tpublic readonly variable?: string,\n\t) {\n\t}\n}\n\nexport enum MembershipValidationErrorType {\n\tROLE_NOT_FOUND = 'roleNotFound',\n\tVARIABLE_NOT_FOUND = 'variableNotFound',\n\tVARIABLE_EMPTY = 'variableEmpty',\n\tVARIABLE_INVALID = 'variableInvalid',\n}\n\nexport interface ParsedMembershipVariable {\n\treadonly name: string\n\treadonly condition: Input.Condition\n}\n\nexport interface ParsedMembership {\n\treadonly role: string\n\treadonly variables: readonly ParsedMembershipVariable[]\n}\n"],"names":["MembershipValidationErrorType"],"mappings":";;;;;;;;;;;AAKO,MAAM,mBAAmB;AAAA,EAG/B,QACC,KACA,aACA,UAIA,WACuB;AACvB,UAAM,SAAsC,CAAA;AAC5C,UAAM,SAA6B,CAAA;AACnC,UAAM,QAAQ,IAAI;AAClB,eAAW,cAAc,aAAa;AAGrC,UAAI,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,WAAW,IAAI,GAAG;AAClE,eAAO,KAAK,IAAI;AAAA,UAA0B,WAAW;AAAA,UAAM;AAAA;AAAA,SAA6C;AACxG;AAAA,MACD;AACA,YAAM,gBAAgB,iBAAiB,WAAW,MAAM,GAAG;AAC3D,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,eAAe,OAAO,UAAU,eAAe,KAAK,eAAe,SAAS,IAAI,IAAI,cAAc,SAAS,IAAI,IAAI;AACzH,YAAI,CAAC,gBAAiB,CAAC,aAAa,aAAa,SAAS,IAAI,aAAa,YAAa;AACvF,iBAAO;AAAA,YACN,IAAI;AAAA,cACH,WAAW;AAAA,cACX;AAAA,cACA,SAAS;AAAA,YAAA;AAAA,UACV;AAAA,QAEF;AAAA,MACD;AACA,YAAM,CAAC,kBAAkB,eAAe,IAAI,KAAK,wBAAwB,eAAe,YAAY,UAAU,SAAS;AACvH,aAAO,KAAK,GAAG,gBAAgB;AAC/B,aAAO,KAAK;AAAA,QACX,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,MAAA,CACX;AAAA,IACF;AACA,WAAO,IAAI,qBAAqB,QAAQ,MAAM;AAAA,EAC/C;AAAA,EAEQ,wBAAwB,eAA8B,YAA4B,UAGvF,WAA+E;AACjF,UAAM,SAAsC,CAAA;AAC5C,UAAM,kBAA8C,CAAA;AACpD,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC7D,YAAM,gBAAgB,WAAW,UAAU,KAAK,CAAA,OAAM,GAAG,SAAS,IAAI;AACtE,UAAI,SAAS,SAAS,IAAI,aAAa,YAAY;AAClD,gBAAQ,SAAS,OAAA;AAAA,UAChB,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,CAAC,SAAS,UAAU,EAAA;AAAA,YAAE,CAC3F;AACD;AAAA,UACD,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,SAAS,WAAW,CAAC,SAAS,QAAQ,IAAI,CAAA,EAAC;AAAA,YAAE,CAClH;AACD;AAAA,UACD;AACC,4BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AACzD,mBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH;AAAA,QAAA;AAEF;AAAA,MACD;AAEA,UAAI,CAAC,eAAe;AACnB,YAAI,SAAS,UAAU;AACtB,0BAAgB,KAAK,EAAE,MAAM,WAAW,SAAS,UAAU;AAAA,QAC5D,OAAO;AACN,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,iBAA8C,IAAI,CAAC;AAC9G,0BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAC1D;AACA;AAAA,MACD;AAEA,UAAI,SAAS,SAAS,IAAI,aAAa,QAAQ;AAC9C,wBAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,cAAc,OAAA,GAAU;AAAA,MACvE,WAAW,SAAS,SAAS,IAAI,aAAa,WAAW;AACxD,YAAI;AACH,gBAAM,aAAa,cAAc,OAAO,IAAI,CAAA,OAAM,gBAAA,EAAkB,KAAK,MAAM,EAAE,CAAC,CAAC;AACnF,0BAAgB,KAAK;AAAA,YACpB;AAAA,YACA,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,WAAA;AAAA,UAAW,CACtE;AAAA,QACF,QAAQ;AACP,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH,0BAAgB,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAC1D;AAAA,MACD,OAAO;AACN,oBAAoB;AAAA,MACrB;AAAA,IACD;AACA,WAAO,CAAC,QAAQ,eAAe;AAAA,EAChC;AACD;AAvGC,cADY,oBACE,mBAAkB,EAAE,YAAY,uCAAA,CAAuC;AAyG/E,MAAM,qBAAqB;AAAA,EACjC,YACiB,QACA,aACf;AAFe,SAAA,SAAA;AACA,SAAA,cAAA;AAAA,EAEjB;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YACiB,MACA,OACA,UACf;AAHe,SAAA,OAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AAAA,EAEjB;AACD;AAEO,IAAK,kDAAAA,mCAAL;AACNA,iCAAA,gBAAA,IAAiB;AACjBA,iCAAA,oBAAA,IAAqB;AACrBA,iCAAA,gBAAA,IAAiB;AACjBA,iCAAA,kBAAA,IAAmB;AAJR,SAAAA;AAAA,GAAA,iCAAA,CAAA,CAAA;"}

package/dist/production/src/acl/schemaUtils.cjs CHANGED Viewed

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const getRoleVariables = (roleName, schema) => {
-  const role = schema.roles[roleName];
+  const role = Object.prototype.hasOwnProperty.call(schema.roles, roleName) ? schema.roles[roleName] : void 0;
+  if (!role) {
+    return {};
+  }
   return (role.inherits || []).reduce(
     (acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),
     role.variables

package/dist/production/src/acl/schemaUtils.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schemaUtils.cjs","sources":["../../../../../packages/schema-utils/src/acl/schemaUtils.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport const getRoleVariables = (roleName: string, schema: Acl.Schema): Acl.Variables => {\n\tconst role = schema.roles[roleName]\n\treturn (role.inherits \|\| []).reduce<Acl.Variables>(\n\t\t(acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),\n\t\trole.variables,\n\t)\n}\n"],"names":[],"mappings":";;AAEO,MAAM,mBAAmB,CAAC,UAAkB,WAAsC;~~AACxF~~,QAAM,OAAO,OAAO,MAAM,QAAQ;~~AAClC~~,UAAQ,KAAK,YAAY,CAAA,GAAI;AAAA,IAC5B,CAAC,KAAK,kBAAkB,EAAE,GAAG,iBAAiB,cAAc,MAAM,GAAG,GAAG;IACxE,KAAK;AAAA,EAAA;AAEP;;"}
1	+ {"version":3,"file":"schemaUtils.cjs","sources":["../../../../../packages/schema-utils/src/acl/schemaUtils.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport const getRoleVariables = (roleName: string, schema: Acl.Schema): Acl.Variables => {\n\t// Own-property lookup: a role name like `__proto__` / `constructor`, or an `inherits` entry pointing\n\t// at a role absent from the schema, must resolve to \"no such role\" (→ no variables) instead of an\n\t// inherited Object.prototype member — otherwise `role.inherits` / `role.variables` below throw on a\n\t// non-role value (e.g. a sign-in granting such a role would roll back the whole transaction).\n\tconst role = Object.prototype.hasOwnProperty.call(schema.roles, roleName) ? schema.roles[roleName] : undefined\n\tif (!role) {\n\t\treturn {}\n\t}\n\treturn (role.inherits \|\| []).reduce<Acl.Variables>(\n\t\t(acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),\n\t\trole.variables,\n\t)\n}\n"],"names":[],"mappings":";;AAEO,MAAM,mBAAmB,CAAC,UAAkB,WAAsC;AAKxF,QAAM,OAAO,OAAO,UAAU,eAAe,KAAK,OAAO,OAAO,QAAQ,IAAI,OAAO,MAAM,QAAQ,IAAI;AACrG,MAAI,CAAC,MAAM;AACV,WAAO,CAAA;AAAA,EACR;AACA,UAAQ,KAAK,YAAY,CAAA,GAAI;AAAA,IAC5B,CAAC,KAAK,kBAAkB,EAAE,GAAG,iBAAiB,cAAc,MAAM,GAAG,GAAG;IACxE,KAAK;AAAA,EAAA;AAEP;;"}

package/dist/production/src/acl/schemaUtils.js CHANGED Viewed

@@ -1,5 +1,8 @@
 const getRoleVariables = (roleName, schema) => {
-  const role = schema.roles[roleName];
+  const role = Object.prototype.hasOwnProperty.call(schema.roles, roleName) ? schema.roles[roleName] : void 0;
+  if (!role) {
+    return {};
+  }
   return (role.inherits || []).reduce(
     (acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),
     role.variables

package/dist/production/src/acl/schemaUtils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schemaUtils.js","sources":["../../../../../packages/schema-utils/src/acl/schemaUtils.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport const getRoleVariables = (roleName: string, schema: Acl.Schema): Acl.Variables => {\n\tconst role = schema.roles[roleName]\n\treturn (role.inherits \|\| []).reduce<Acl.Variables>(\n\t\t(acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),\n\t\trole.variables,\n\t)\n}\n"],"names":[],"mappings":"AAEO,MAAM,mBAAmB,CAAC,UAAkB,WAAsC;~~AACxF~~,QAAM,OAAO,OAAO,MAAM,QAAQ;~~AAClC~~,UAAQ,KAAK,YAAY,CAAA,GAAI;AAAA,IAC5B,CAAC,KAAK,kBAAkB,EAAE,GAAG,iBAAiB,cAAc,MAAM,GAAG,GAAG;IACxE,KAAK;AAAA,EAAA;AAEP;"}
1	+ {"version":3,"file":"schemaUtils.js","sources":["../../../../../packages/schema-utils/src/acl/schemaUtils.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport const getRoleVariables = (roleName: string, schema: Acl.Schema): Acl.Variables => {\n\t// Own-property lookup: a role name like `__proto__` / `constructor`, or an `inherits` entry pointing\n\t// at a role absent from the schema, must resolve to \"no such role\" (→ no variables) instead of an\n\t// inherited Object.prototype member — otherwise `role.inherits` / `role.variables` below throw on a\n\t// non-role value (e.g. a sign-in granting such a role would roll back the whole transaction).\n\tconst role = Object.prototype.hasOwnProperty.call(schema.roles, roleName) ? schema.roles[roleName] : undefined\n\tif (!role) {\n\t\treturn {}\n\t}\n\treturn (role.inherits \|\| []).reduce<Acl.Variables>(\n\t\t(acc, inheritsFrom) => ({ ...getRoleVariables(inheritsFrom, schema), ...acc }),\n\t\trole.variables,\n\t)\n}\n"],"names":[],"mappings":"AAEO,MAAM,mBAAmB,CAAC,UAAkB,WAAsC;AAKxF,QAAM,OAAO,OAAO,UAAU,eAAe,KAAK,OAAO,OAAO,QAAQ,IAAI,OAAO,MAAM,QAAQ,IAAI;AACrG,MAAI,CAAC,MAAM;AACV,WAAO,CAAA;AAAA,EACR;AACA,UAAQ,KAAK,YAAY,CAAA,GAAI;AAAA,IAC5B,CAAC,KAAK,kBAAkB,EAAE,GAAG,iBAAiB,cAAc,MAAM,GAAG,GAAG;IACxE,KAAK;AAAA,EAAA;AAEP;"}

package/dist/production/src/definition-generator/AclDefinitionCodeGenerator.cjs CHANGED Viewed

@@ -50,7 +50,7 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
   }
   generateEntityAcl({ entity, schema: schema2 }) {
     const aclOutput = [];
-    const numberOfEntityFieldsWithoutId = Object.keys(entity.fields).length - 1;
+    const nonPrimaryFields = Object.keys(entity.fields).filter((it) => it !== entity.primary);
     for (const [roleName, roleDefinition] of Object.entries(schema2.acl.roles)) {
       const entityPermission = roleDefinition.entities[entity.name];
       if (!entityPermission) {
@@ -61,7 +61,8 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
         const operations = this.getMatchingOperations({
           predicate: predicateName,
           operations: entityPermission.operations,
-          numberOfEntityFieldsWithoutId
+          entity,
+          nonPrimaryFields
         });
         if (Object.keys(operations).length > 0) {
           const processor = new PredicateDefinitionProcessor.PredicateDefinitionProcessor(schema2.model);
@@ -84,7 +85,8 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
       const trueOperations = this.getMatchingOperations({
         predicate: true,
         operations: entityPermission.operations,
-        numberOfEntityFieldsWithoutId
+        entity,
+        nonPrimaryFields
       });
       if (Object.keys(trueOperations).length > 0) {
         const aclDefinition = printJsValue.printJsValue({ ...trueOperations }, indentFirstLevel);
@@ -97,12 +99,12 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
     }
     return `${aclOutput.join("")}`;
   }
-  getMatchingOperations({ operations, predicate, numberOfEntityFieldsWithoutId }) {
+  getMatchingOperations({ operations, predicate, entity, nonPrimaryFields }) {
     const result = {};
     for (const op of ["read", "create", "update"]) {
       const fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it);
       if (fields.length === 0) ;
-      else if (fields.length === numberOfEntityFieldsWithoutId) {
+      else if (this.coversEveryNonPrimaryField(fields, entity, nonPrimaryFields)) {
         result[op] = true;
       } else {
         result[op] = fields;
@@ -113,6 +115,18 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
     }
     return result;
   }
+  /**
+   * `read: true` re-parses as every field except the primary, so it may only stand in for a grant that
+   * covers exactly that set. Comparing counts instead treated a grant naming the primary plus all but
+   * one field as complete, and regenerating it silently granted the missing field.
+   */
+  coversEveryNonPrimaryField(fields, entity, nonPrimaryFields) {
+    if (fields.includes(entity.primary)) {
+      return false;
+    }
+    const granted = new Set(fields);
+    return nonPrimaryFields.every((it) => granted.has(it));
+  }
 }
 exports.AclDefinitionCodeGenerator = AclDefinitionCodeGenerator;
 //# sourceMappingURL=AclDefinitionCodeGenerator.cjs.map

package/dist/production/src/definition-generator/AclDefinitionCodeGenerator.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AclDefinitionCodeGenerator.cjs","sources":["../../../../../packages/schema-utils/src/definition-generator/AclDefinitionCodeGenerator.ts"],"sourcesContent":["import { PredicateDefinitionProcessor } from '../acl/index.js'\nimport { IndentDecider, Literal, printJsValue } from '../utils/printJsValue.js'\nimport { Acl, Model, Schema } from '@contember/schema'\nimport { DefinitionNamingConventions } from './DefinitionNamingConventions.js'\n\nconst indentFirstLevel: IndentDecider = (val, path) => path.length === 0\n\nexport class AclDefinitionCodeGenerator {\n\tconstructor(\n\t\tprivate readonly definitionNamingConventions = new DefinitionNamingConventions(),\n\t) {\n\t}\n\n\tpublic generateRoles({ acl }: { acl: Acl.Schema }): string {\n\t\treturn Object.entries(acl.roles).map(([name, values]) =>\n\t\t\tthis.generateRole({\n\t\t\t\tname,\n\t\t\t\tvalues,\n\t\t\t})\n\t\t).join('')\n\t}\n\n\tprivate generateRole({ name, values }: { name: string; values: Acl.RolePermissions }): string {\n\t\tconst { variables, entities, inherits, ...other } = values\n\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(name)\n\t\treturn `\\nexport const ${roleVarName} = c.createRole(${printJsValue(name)}, ${printJsValue(other)})\\n`\n\t}\n\n\tpublic generateAclVariables({ acl }: { acl: Acl.Schema }): string {\n\t\tconst variablesOutput: string[] = []\n\n\t\tObject.entries(acl.roles).map(([roleName, roleValues]) => {\n\t\t\tObject.entries(roleValues.variables).map(([variableName, variableValues]) => {\n\t\t\t\tlet variableDefinition = `\\nexport const ${this.definitionNamingConventions.variableVarName(roleName, variableName)} = c.`\n\t\t\t\tconst varFormatted = printJsValue(variableName)\n\t\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\n\t\t\t\tif (variableValues.type === Acl.VariableType.predefined) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.value)\n\t\t\t\t\tvariableDefinition += `createPredefinedVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else if (variableValues.type === Acl.VariableType.entity) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.entityName)\n\t\t\t\t\tvariableDefinition += `createEntityVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else {\n\t\t\t\t\tthrow new Error(`Variable type ${variableValues.type} not yet supported`)\n\t\t\t\t}\n\n\t\t\t\tvariablesOutput.push(variableDefinition)\n\t\t\t})\n\t\t})\n\n\t\treturn variablesOutput.join('')\n\t}\n\n\tpublic generateEntityAcl({ entity, schema }: { entity: Model.Entity; schema: Schema }): string {\n\t\tconst aclOutput: string[] = []\n\t\tconst ~~numberOfEntityFieldsWithoutId~~ = Object.keys(entity.fields).~~length~~ - 1\n\t\tfor (const [roleName, roleDefinition] of Object.entries(schema.acl.roles)) {\n\t\t\tconst entityPermission = roleDefinition.entities[entity.name]\n\t\t\tif (!entityPermission) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\t\t\tfor (const [predicateName, predicateDefinition] of Object.entries(entityPermission.predicates)) {\n\t\t\t\tconst operations = this.getMatchingOperations({\n\t\t\t\t\tpredicate: predicateName,\n\t\t\t\t\toperations: entityPermission.operations,\n\t\t\t\t\~~tnumberOfEntityFieldsWithoutId~~,\n\t\t\t\t})\n\t\t\t\tif (Object.keys(operations).length > 0) {\n\t\t\t\t\tconst processor = new PredicateDefinitionProcessor(schema.model)\n\t\t\t\t\tconst when = processor.process(entity, predicateDefinition, {\n\t\t\t\t\t\thandleColumn: ctx => {\n\t\t\t\t\t\t\tif (typeof ctx.value === 'string' && ctx.value in roleDefinition.variables) {\n\t\t\t\t\t\t\t\treturn new Literal(this.definitionNamingConventions.variableVarName(roleName, ctx.value))\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t\thandleRelation: ctx => {\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t})\n\t\t\t\t\tconst aclDefinition = printJsValue({ when, ...operations }, indentFirstLevel)\n\t\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst trueOperations = this.getMatchingOperations({\n\t\t\t\tpredicate: true,\n\t\t\t\toperations: entityPermission.operations,\n\t\t\t\~~tnumberOfEntityFieldsWithoutId~~,\n\t\t\t})\n\t\t\tif (Object.keys(trueOperations).length > 0) {\n\t\t\t\tconst aclDefinition = printJsValue({ ...trueOperations }, indentFirstLevel)\n\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t}\n\t\t}\n\n\t\tif (!aclOutput.length) {\n\t\t\treturn ''\n\t\t}\n\t\treturn `${aclOutput.join('')}`\n\t}\n\n\tprivate getMatchingOperations({ operations, predicate, ~~numberOfEntityFieldsWithoutId~~ }: {\n\t\toperations: Acl.EntityOperations\n\t\tpredicate: Acl.Predicate\n\t\~~tnumberOfEntityFieldsWithoutId~~: ~~number~~\n\t}): { read?: string[] \| true; create?: string[] \| boolean; update?: string[] \| boolean; delete?: true } {\n\t\tconst result: ReturnType<AclDefinitionCodeGenerator['getMatchingOperations']> = {}\n\t\tfor (const op of ['read', 'create', 'update'] as const) {\n\t\t\tconst fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it)\n\t\t\tif (fields.length === 0) {\n\t\t\t} else if (fields~~.length~~ ~~===~~ ~~numberOfEntityFieldsWithoutId~~) {\n\t\t\t\tresult[op] = true\n\t\t\t} else {\n\t\t\t\tresult[op] = fields\n\t\t\t}\n\t\t}\n\t\tif (operations.delete === predicate) {\n\t\t\tresult.delete = true\n\t\t}\n\n\t\treturn result\n\t}\n}\n"],"names":["DefinitionNamingConventions","printJsValue","Acl","schema","PredicateDefinitionProcessor","Literal"],"mappings":";;;;;;AAKA,MAAM,mBAAkC,CAAC,KAAK,SAAS,KAAK,WAAW;AAEhE,MAAM,2BAA2B;AAAA,EACvC,YACkB,8BAA8B,IAAIA,4BAAAA,+BAClD;AADgB,SAAA,8BAAA;AAAA,EAElB;AAAA,EAEO,cAAc,EAAE,OAAoC;AAC1D,WAAO,OAAO,QAAQ,IAAI,KAAK,EAAE;AAAA,MAAI,CAAC,CAAC,MAAM,MAAM,MAClD,KAAK,aAAa;AAAA,QACjB;AAAA,QACA;AAAA,MAAA,CACA;AAAA,IAAA,EACA,KAAK,EAAE;AAAA,EACV;AAAA,EAEQ,aAAa,EAAE,MAAM,UAAiE;AAC7F,UAAM,EAAE,WAAW,UAAU,UAAU,GAAG,UAAU;AACpD,UAAM,cAAc,KAAK,4BAA4B,YAAY,IAAI;AACrE,WAAO;AAAA,eAAkB,WAAW,mBAAmBC,0BAAa,IAAI,CAAC,KAAKA,aAAAA,aAAa,KAAK,CAAC;AAAA;AAAA,EAClG;AAAA,EAEO,qBAAqB,EAAE,OAAoC;AACjE,UAAM,kBAA4B,CAAA;AAElC,WAAO,QAAQ,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,UAAU,MAAM;AACzD,aAAO,QAAQ,WAAW,SAAS,EAAE,IAAI,CAAC,CAAC,cAAc,cAAc,MAAM;AAC5E,YAAI,qBAAqB;AAAA,eAAkB,KAAK,4BAA4B,gBAAgB,UAAU,YAAY,CAAC;AACnH,cAAM,eAAeA,aAAAA,aAAa,YAAY;AAC9C,cAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AAEzE,YAAI,eAAe,SAASC,WAAI,aAAa,YAAY;AACxD,gBAAM,gBAAgBD,aAAAA,aAAa,eAAe,KAAK;AACvD,gCAAsB,4BAA4B,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QACjG,WAAW,eAAe,SAASC,OAAAA,IAAI,aAAa,QAAQ;AAC3D,gBAAM,gBAAgBD,aAAAA,aAAa,eAAe,UAAU;AAC5D,gCAAsB,wBAAwB,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QAC7F,OAAO;AACN,gBAAM,IAAI,MAAM,iBAAiB,eAAe,IAAI,oBAAoB;AAAA,QACzE;AAEA,wBAAgB,KAAK,kBAAkB;AAAA,MACxC,CAAC;AAAA,IACF,CAAC;AAED,WAAO,gBAAgB,KAAK,EAAE;AAAA,EAC/B;AAAA,EAEO,kBAAkB,EAAE,QAAQ,QAAAE,WAA4D;AAC9F,UAAM,YAAsB,CAAA;AAC5B,UAAM,~~gCAAgC~~,OAAO,KAAK,OAAO,MAAM,EAAE,~~SAAS~~;~~AAC1E~~,eAAW,CAAC,UAAU,cAAc,KAAK,OAAO,QAAQA,QAAO,IAAI,KAAK,GAAG;AAC1E,YAAM,mBAAmB,eAAe,SAAS,OAAO,IAAI;AAC5D,UAAI,CAAC,kBAAkB;AACtB;AAAA,MACD;AACA,YAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AACzE,iBAAW,CAAC,eAAe,mBAAmB,KAAK,OAAO,QAAQ,iBAAiB,UAAU,GAAG;AAC/F,cAAM,aAAa,KAAK,sBAAsB;AAAA,UAC7C,WAAW;AAAA,UACX,YAAY,iBAAiB;AAAA,UAC7B;AAAA,QAAA,CACA;AACD,YAAI,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG;AACvC,gBAAM,YAAY,IAAIC,0DAA6BD,QAAO,KAAK;AAC/D,gBAAM,OAAO,UAAU,QAAQ,QAAQ,qBAAqB;AAAA,YAC3D,cAAc,CAAA,QAAO;AACpB,kBAAI,OAAO,IAAI,UAAU,YAAY,IAAI,SAAS,eAAe,WAAW;AAC3E,uBAAO,IAAIE,aAAAA,QAAQ,KAAK,4BAA4B,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAAA,cACzF;AACA,qBAAO,IAAI;AAAA,YACZ;AAAA,YACA,gBAAgB,CAAA,QAAO;AACtB,qBAAO,IAAI;AAAA,YACZ;AAAA,UAAA,CACA;AACD,gBAAM,gBAAgBJ,aAAAA,aAAa,EAAE,MAAM,GAAG,WAAA,GAAc,gBAAgB;AAC5E,oBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,QAC9D;AAAA,MACD;AACA,YAAM,iBAAiB,KAAK,sBAAsB;AAAA,QACjD,WAAW;AAAA,QACX,YAAY,iBAAiB;AAAA,QAC7B;AAAA,MAAA,CACA;AACD,UAAI,OAAO,KAAK,cAAc,EAAE,SAAS,GAAG;AAC3C,cAAM,gBAAgBA,aAAAA,aAAa,EAAE,GAAG,eAAA,GAAkB,gBAAgB;AAC1E,kBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,MAC9D;AAAA,IACD;AAEA,QAAI,CAAC,UAAU,QAAQ;AACtB,aAAO;AAAA,IACR;AACA,WAAO,GAAG,UAAU,KAAK,EAAE,CAAC;AAAA,EAC7B;AAAA,EAEQ,sBAAsB,EAAE,YAAY,WAAW,~~iCAIiD~~;AACvG,UAAM,SAA0E,CAAA;AAChF,eAAW,MAAM,CAAC,QAAQ,UAAU,QAAQ,GAAY;AACvD,YAAM,SAAS,OAAO,QAAQ,WAAW,EAAE,KAAK,CAAA,CAAE,EAAE,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,OAAO,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE;AACzG,UAAI,OAAO,WAAW,EAAG;AAAA,eACd,~~OAAO~~,~~WAAW,+BAA+B~~;~~AAC3D~~,eAAO,EAAE,IAAI;AAAA,MACd,OAAO;AACN,eAAO,EAAE,IAAI;AAAA,MACd;AAAA,IACD;AACA,QAAI,WAAW,WAAW,WAAW;AACpC,aAAO,SAAS;AAAA,IACjB;AAEA,WAAO;AAAA,EACR;AACD;;"}
1	+ {"version":3,"file":"AclDefinitionCodeGenerator.cjs","sources":["../../../../../packages/schema-utils/src/definition-generator/AclDefinitionCodeGenerator.ts"],"sourcesContent":["import { PredicateDefinitionProcessor } from '../acl/index.js'\nimport { IndentDecider, Literal, printJsValue } from '../utils/printJsValue.js'\nimport { Acl, Model, Schema } from '@contember/schema'\nimport { DefinitionNamingConventions } from './DefinitionNamingConventions.js'\n\nconst indentFirstLevel: IndentDecider = (val, path) => path.length === 0\n\nexport class AclDefinitionCodeGenerator {\n\tconstructor(\n\t\tprivate readonly definitionNamingConventions = new DefinitionNamingConventions(),\n\t) {\n\t}\n\n\tpublic generateRoles({ acl }: { acl: Acl.Schema }): string {\n\t\treturn Object.entries(acl.roles).map(([name, values]) =>\n\t\t\tthis.generateRole({\n\t\t\t\tname,\n\t\t\t\tvalues,\n\t\t\t})\n\t\t).join('')\n\t}\n\n\tprivate generateRole({ name, values }: { name: string; values: Acl.RolePermissions }): string {\n\t\tconst { variables, entities, inherits, ...other } = values\n\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(name)\n\t\treturn `\\nexport const ${roleVarName} = c.createRole(${printJsValue(name)}, ${printJsValue(other)})\\n`\n\t}\n\n\tpublic generateAclVariables({ acl }: { acl: Acl.Schema }): string {\n\t\tconst variablesOutput: string[] = []\n\n\t\tObject.entries(acl.roles).map(([roleName, roleValues]) => {\n\t\t\tObject.entries(roleValues.variables).map(([variableName, variableValues]) => {\n\t\t\t\tlet variableDefinition = `\\nexport const ${this.definitionNamingConventions.variableVarName(roleName, variableName)} = c.`\n\t\t\t\tconst varFormatted = printJsValue(variableName)\n\t\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\n\t\t\t\tif (variableValues.type === Acl.VariableType.predefined) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.value)\n\t\t\t\t\tvariableDefinition += `createPredefinedVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else if (variableValues.type === Acl.VariableType.entity) {\n\t\t\t\t\tconst varDefinition = printJsValue(variableValues.entityName)\n\t\t\t\t\tvariableDefinition += `createEntityVariable(${varFormatted}, ${varDefinition}, ${roleVarName})\\n`\n\t\t\t\t} else {\n\t\t\t\t\tthrow new Error(`Variable type ${variableValues.type} not yet supported`)\n\t\t\t\t}\n\n\t\t\t\tvariablesOutput.push(variableDefinition)\n\t\t\t})\n\t\t})\n\n\t\treturn variablesOutput.join('')\n\t}\n\n\tpublic generateEntityAcl({ entity, schema }: { entity: Model.Entity; schema: Schema }): string {\n\t\tconst aclOutput: string[] = []\n\t\tconst nonPrimaryFields = Object.keys(entity.fields).filter(it => it !== entity.primary)\n\t\tfor (const [roleName, roleDefinition] of Object.entries(schema.acl.roles)) {\n\t\t\tconst entityPermission = roleDefinition.entities[entity.name]\n\t\t\tif (!entityPermission) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVarName = this.definitionNamingConventions.roleVarName(roleName)\n\t\t\tfor (const [predicateName, predicateDefinition] of Object.entries(entityPermission.predicates)) {\n\t\t\t\tconst operations = this.getMatchingOperations({\n\t\t\t\t\tpredicate: predicateName,\n\t\t\t\t\toperations: entityPermission.operations,\n\t\t\t\t\tentity,\n\t\t\t\t\tnonPrimaryFields,\n\t\t\t\t})\n\t\t\t\tif (Object.keys(operations).length > 0) {\n\t\t\t\t\tconst processor = new PredicateDefinitionProcessor(schema.model)\n\t\t\t\t\tconst when = processor.process(entity, predicateDefinition, {\n\t\t\t\t\t\thandleColumn: ctx => {\n\t\t\t\t\t\t\tif (typeof ctx.value === 'string' && ctx.value in roleDefinition.variables) {\n\t\t\t\t\t\t\t\treturn new Literal(this.definitionNamingConventions.variableVarName(roleName, ctx.value))\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t\thandleRelation: ctx => {\n\t\t\t\t\t\t\treturn ctx.value\n\t\t\t\t\t\t},\n\t\t\t\t\t})\n\t\t\t\t\tconst aclDefinition = printJsValue({ when, ...operations }, indentFirstLevel)\n\t\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst trueOperations = this.getMatchingOperations({\n\t\t\t\tpredicate: true,\n\t\t\t\toperations: entityPermission.operations,\n\t\t\t\tentity,\n\t\t\t\tnonPrimaryFields,\n\t\t\t})\n\t\t\tif (Object.keys(trueOperations).length > 0) {\n\t\t\t\tconst aclDefinition = printJsValue({ ...trueOperations }, indentFirstLevel)\n\t\t\t\taclOutput.push(`@c.Allow(${roleVarName}, ${aclDefinition})\\n`)\n\t\t\t}\n\t\t}\n\n\t\tif (!aclOutput.length) {\n\t\t\treturn ''\n\t\t}\n\t\treturn `${aclOutput.join('')}`\n\t}\n\n\tprivate getMatchingOperations({ operations, predicate, entity, nonPrimaryFields }: {\n\t\toperations: Acl.EntityOperations\n\t\tpredicate: Acl.Predicate\n\t\tentity: Model.Entity\n\t\tnonPrimaryFields: string[]\n\t}): { read?: string[] \| true; create?: string[] \| boolean; update?: string[] \| boolean; delete?: true } {\n\t\tconst result: ReturnType<AclDefinitionCodeGenerator['getMatchingOperations']> = {}\n\t\tfor (const op of ['read', 'create', 'update'] as const) {\n\t\t\tconst fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it)\n\t\t\tif (fields.length === 0) {\n\t\t\t} else if (this.coversEveryNonPrimaryField(fields, entity, nonPrimaryFields)) {\n\t\t\t\tresult[op] = true\n\t\t\t} else {\n\t\t\t\tresult[op] = fields\n\t\t\t}\n\t\t}\n\t\tif (operations.delete === predicate) {\n\t\t\tresult.delete = true\n\t\t}\n\n\t\treturn result\n\t}\n\n\t/*\n\t `read: true` re-parses as every field except the primary, so it may only stand in for a grant that\n\t * covers exactly that set. Comparing counts instead treated a grant naming the primary plus all but\n\t * one field as complete, and regenerating it silently granted the missing field.\n\t */\n\tprivate coversEveryNonPrimaryField(fields: string[], entity: Model.Entity, nonPrimaryFields: string[]): boolean {\n\t\tif (fields.includes(entity.primary)) {\n\t\t\treturn false\n\t\t}\n\t\tconst granted = new Set(fields)\n\t\treturn nonPrimaryFields.every(it => granted.has(it))\n\t}\n}\n"],"names":["DefinitionNamingConventions","printJsValue","Acl","schema","PredicateDefinitionProcessor","Literal"],"mappings":";;;;;;AAKA,MAAM,mBAAkC,CAAC,KAAK,SAAS,KAAK,WAAW;AAEhE,MAAM,2BAA2B;AAAA,EACvC,YACkB,8BAA8B,IAAIA,4BAAAA,+BAClD;AADgB,SAAA,8BAAA;AAAA,EAElB;AAAA,EAEO,cAAc,EAAE,OAAoC;AAC1D,WAAO,OAAO,QAAQ,IAAI,KAAK,EAAE;AAAA,MAAI,CAAC,CAAC,MAAM,MAAM,MAClD,KAAK,aAAa;AAAA,QACjB;AAAA,QACA;AAAA,MAAA,CACA;AAAA,IAAA,EACA,KAAK,EAAE;AAAA,EACV;AAAA,EAEQ,aAAa,EAAE,MAAM,UAAiE;AAC7F,UAAM,EAAE,WAAW,UAAU,UAAU,GAAG,UAAU;AACpD,UAAM,cAAc,KAAK,4BAA4B,YAAY,IAAI;AACrE,WAAO;AAAA,eAAkB,WAAW,mBAAmBC,0BAAa,IAAI,CAAC,KAAKA,aAAAA,aAAa,KAAK,CAAC;AAAA;AAAA,EAClG;AAAA,EAEO,qBAAqB,EAAE,OAAoC;AACjE,UAAM,kBAA4B,CAAA;AAElC,WAAO,QAAQ,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,UAAU,MAAM;AACzD,aAAO,QAAQ,WAAW,SAAS,EAAE,IAAI,CAAC,CAAC,cAAc,cAAc,MAAM;AAC5E,YAAI,qBAAqB;AAAA,eAAkB,KAAK,4BAA4B,gBAAgB,UAAU,YAAY,CAAC;AACnH,cAAM,eAAeA,aAAAA,aAAa,YAAY;AAC9C,cAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AAEzE,YAAI,eAAe,SAASC,WAAI,aAAa,YAAY;AACxD,gBAAM,gBAAgBD,aAAAA,aAAa,eAAe,KAAK;AACvD,gCAAsB,4BAA4B,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QACjG,WAAW,eAAe,SAASC,OAAAA,IAAI,aAAa,QAAQ;AAC3D,gBAAM,gBAAgBD,aAAAA,aAAa,eAAe,UAAU;AAC5D,gCAAsB,wBAAwB,YAAY,KAAK,aAAa,KAAK,WAAW;AAAA;AAAA,QAC7F,OAAO;AACN,gBAAM,IAAI,MAAM,iBAAiB,eAAe,IAAI,oBAAoB;AAAA,QACzE;AAEA,wBAAgB,KAAK,kBAAkB;AAAA,MACxC,CAAC;AAAA,IACF,CAAC;AAED,WAAO,gBAAgB,KAAK,EAAE;AAAA,EAC/B;AAAA,EAEO,kBAAkB,EAAE,QAAQ,QAAAE,WAA4D;AAC9F,UAAM,YAAsB,CAAA;AAC5B,UAAM,mBAAmB,OAAO,KAAK,OAAO,MAAM,EAAE,OAAO,CAAA,OAAM,OAAO,OAAO,OAAO;AACtF,eAAW,CAAC,UAAU,cAAc,KAAK,OAAO,QAAQA,QAAO,IAAI,KAAK,GAAG;AAC1E,YAAM,mBAAmB,eAAe,SAAS,OAAO,IAAI;AAC5D,UAAI,CAAC,kBAAkB;AACtB;AAAA,MACD;AACA,YAAM,cAAc,KAAK,4BAA4B,YAAY,QAAQ;AACzE,iBAAW,CAAC,eAAe,mBAAmB,KAAK,OAAO,QAAQ,iBAAiB,UAAU,GAAG;AAC/F,cAAM,aAAa,KAAK,sBAAsB;AAAA,UAC7C,WAAW;AAAA,UACX,YAAY,iBAAiB;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA,CACA;AACD,YAAI,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG;AACvC,gBAAM,YAAY,IAAIC,0DAA6BD,QAAO,KAAK;AAC/D,gBAAM,OAAO,UAAU,QAAQ,QAAQ,qBAAqB;AAAA,YAC3D,cAAc,CAAA,QAAO;AACpB,kBAAI,OAAO,IAAI,UAAU,YAAY,IAAI,SAAS,eAAe,WAAW;AAC3E,uBAAO,IAAIE,aAAAA,QAAQ,KAAK,4BAA4B,gBAAgB,UAAU,IAAI,KAAK,CAAC;AAAA,cACzF;AACA,qBAAO,IAAI;AAAA,YACZ;AAAA,YACA,gBAAgB,CAAA,QAAO;AACtB,qBAAO,IAAI;AAAA,YACZ;AAAA,UAAA,CACA;AACD,gBAAM,gBAAgBJ,aAAAA,aAAa,EAAE,MAAM,GAAG,WAAA,GAAc,gBAAgB;AAC5E,oBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,QAC9D;AAAA,MACD;AACA,YAAM,iBAAiB,KAAK,sBAAsB;AAAA,QACjD,WAAW;AAAA,QACX,YAAY,iBAAiB;AAAA,QAC7B;AAAA,QACA;AAAA,MAAA,CACA;AACD,UAAI,OAAO,KAAK,cAAc,EAAE,SAAS,GAAG;AAC3C,cAAM,gBAAgBA,aAAAA,aAAa,EAAE,GAAG,eAAA,GAAkB,gBAAgB;AAC1E,kBAAU,KAAK,YAAY,WAAW,KAAK,aAAa;AAAA,CAAK;AAAA,MAC9D;AAAA,IACD;AAEA,QAAI,CAAC,UAAU,QAAQ;AACtB,aAAO;AAAA,IACR;AACA,WAAO,GAAG,UAAU,KAAK,EAAE,CAAC;AAAA,EAC7B;AAAA,EAEQ,sBAAsB,EAAE,YAAY,WAAW,QAAQ,oBAKyC;AACvG,UAAM,SAA0E,CAAA;AAChF,eAAW,MAAM,CAAC,QAAQ,UAAU,QAAQ,GAAY;AACvD,YAAM,SAAS,OAAO,QAAQ,WAAW,EAAE,KAAK,CAAA,CAAE,EAAE,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,OAAO,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE;AACzG,UAAI,OAAO,WAAW,EAAG;AAAA,eACd,KAAK,2BAA2B,QAAQ,QAAQ,gBAAgB,GAAG;AAC7E,eAAO,EAAE,IAAI;AAAA,MACd,OAAO;AACN,eAAO,EAAE,IAAI;AAAA,MACd;AAAA,IACD;AACA,QAAI,WAAW,WAAW,WAAW;AACpC,aAAO,SAAS;AAAA,IACjB;AAEA,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,2BAA2B,QAAkB,QAAsB,kBAAqC;AAC/G,QAAI,OAAO,SAAS,OAAO,OAAO,GAAG;AACpC,aAAO;AAAA,IACR;AACA,UAAM,UAAU,IAAI,IAAI,MAAM;AAC9B,WAAO,iBAAiB,MAAM,CAAA,OAAM,QAAQ,IAAI,EAAE,CAAC;AAAA,EACpD;AACD;;"}

package/dist/production/src/definition-generator/AclDefinitionCodeGenerator.js CHANGED Viewed

@@ -48,7 +48,7 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
   }
   generateEntityAcl({ entity, schema }) {
     const aclOutput = [];
-    const numberOfEntityFieldsWithoutId = Object.keys(entity.fields).length - 1;
+    const nonPrimaryFields = Object.keys(entity.fields).filter((it) => it !== entity.primary);
     for (const [roleName, roleDefinition] of Object.entries(schema.acl.roles)) {
       const entityPermission = roleDefinition.entities[entity.name];
       if (!entityPermission) {
@@ -59,7 +59,8 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
         const operations = this.getMatchingOperations({
           predicate: predicateName,
           operations: entityPermission.operations,
-          numberOfEntityFieldsWithoutId
+          entity,
+          nonPrimaryFields
         });
         if (Object.keys(operations).length > 0) {
           const processor = new PredicateDefinitionProcessor(schema.model);
@@ -82,7 +83,8 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
       const trueOperations = this.getMatchingOperations({
         predicate: true,
         operations: entityPermission.operations,
-        numberOfEntityFieldsWithoutId
+        entity,
+        nonPrimaryFields
       });
       if (Object.keys(trueOperations).length > 0) {
         const aclDefinition = printJsValue({ ...trueOperations }, indentFirstLevel);
@@ -95,12 +97,12 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
     }
     return `${aclOutput.join("")}`;
   }
-  getMatchingOperations({ operations, predicate, numberOfEntityFieldsWithoutId }) {
+  getMatchingOperations({ operations, predicate, entity, nonPrimaryFields }) {
     const result = {};
     for (const op of ["read", "create", "update"]) {
       const fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it);
       if (fields.length === 0) ;
-      else if (fields.length === numberOfEntityFieldsWithoutId) {
+      else if (this.coversEveryNonPrimaryField(fields, entity, nonPrimaryFields)) {
         result[op] = true;
       } else {
         result[op] = fields;
@@ -111,6 +113,18 @@ export const ${this.definitionNamingConventions.variableVarName(roleName, variab
     }
     return result;
   }
+  /**
+   * `read: true` re-parses as every field except the primary, so it may only stand in for a grant that
+   * covers exactly that set. Comparing counts instead treated a grant naming the primary plus all but
+   * one field as complete, and regenerating it silently granted the missing field.
+   */
+  coversEveryNonPrimaryField(fields, entity, nonPrimaryFields) {
+    if (fields.includes(entity.primary)) {
+      return false;
+    }
+    const granted = new Set(fields);
+    return nonPrimaryFields.every((it) => granted.has(it));
+  }
 }
 export {
   AclDefinitionCodeGenerator