@contember/schema-utils 2.2.0-alpha.3 → 2.2.0-alpha.6

package/src/definition-generator/AclDefinitionCodeGenerator.ts

@@ -54,7 +54,7 @@ export class AclDefinitionCodeGenerator {
 
 	public generateEntityAcl({ entity, schema }: { entity: Model.Entity; schema: Schema }): string {
 		const aclOutput: string[] = []
-		const numberOfEntityFieldsWithoutId = Object.keys(entity.fields).length - 1
+		const nonPrimaryFields = Object.keys(entity.fields).filter(it => it !== entity.primary)
 		for (const [roleName, roleDefinition] of Object.entries(schema.acl.roles)) {
 			const entityPermission = roleDefinition.entities[entity.name]
 			if (!entityPermission) {
@@ -65,7 +65,8 @@ export class AclDefinitionCodeGenerator {
 				const operations = this.getMatchingOperations({
 					predicate: predicateName,
 					operations: entityPermission.operations,
-					numberOfEntityFieldsWithoutId,
+					entity,
+					nonPrimaryFields,
 				})
 				if (Object.keys(operations).length > 0) {
 					const processor = new PredicateDefinitionProcessor(schema.model)
@@ -87,7 +88,8 @@ export class AclDefinitionCodeGenerator {
 			const trueOperations = this.getMatchingOperations({
 				predicate: true,
 				operations: entityPermission.operations,
-				numberOfEntityFieldsWithoutId,
+				entity,
+				nonPrimaryFields,
 			})
 			if (Object.keys(trueOperations).length > 0) {
 				const aclDefinition = printJsValue({ ...trueOperations }, indentFirstLevel)
@@ -101,16 +103,17 @@ export class AclDefinitionCodeGenerator {
 		return `${aclOutput.join('')}`
 	}
 
-	private getMatchingOperations({ operations, predicate, numberOfEntityFieldsWithoutId }: {
+	private getMatchingOperations({ operations, predicate, entity, nonPrimaryFields }: {
 		operations: Acl.EntityOperations
 		predicate: Acl.Predicate
-		numberOfEntityFieldsWithoutId: number
+		entity: Model.Entity
+		nonPrimaryFields: string[]
 	}): { read?: string[] | true; create?: string[] | boolean; update?: string[] | boolean; delete?: true } {
 		const result: ReturnType<AclDefinitionCodeGenerator['getMatchingOperations']> = {}
 		for (const op of ['read', 'create', 'update'] as const) {
 			const fields = Object.entries(operations[op] ?? {}).filter(([, it]) => it === predicate).map(([it]) => it)
 			if (fields.length === 0) {
-			} else if (fields.length === numberOfEntityFieldsWithoutId) {
+			} else if (this.coversEveryNonPrimaryField(fields, entity, nonPrimaryFields)) {
 				result[op] = true
 			} else {
 				result[op] = fields
@@ -122,4 +125,17 @@ export class AclDefinitionCodeGenerator {
 
 		return result
 	}
+
+	/**
+	 * `read: true` re-parses as every field except the primary, so it may only stand in for a grant that
+	 * covers exactly that set. Comparing counts instead treated a grant naming the primary plus all but
+	 * one field as complete, and regenerating it silently granted the missing field.
+	 */
+	private coversEveryNonPrimaryField(fields: string[], entity: Model.Entity, nonPrimaryFields: string[]): boolean {
+		if (fields.includes(entity.primary)) {
+			return false
+		}
+		const granted = new Set(fields)
+		return nonPrimaryFields.every(it => granted.has(it))
+	}
 }

package/src/validation/MembershipResolver.ts

@@ -19,13 +19,16 @@ export class MembershipResolver {
 		const parsed: ParsedMembership[] = []
 		const roles = acl.roles
 		for (const membership of memberships) {
-			if (!roles[membership.role]) {
+			// own-property lookup so a role named `__proto__` / `constructor` resolves to "not found"
+			// rather than an inherited Object.prototype member
+			if (!Object.prototype.hasOwnProperty.call(roles, membership.role)) {
 				errors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))
 				continue
 			}
 			const roleVariables = getRoleVariables(membership.role, acl)
 			for (const variable of membership.variables) {
-				if (!roleVariables[variable.name] || (!isAssumed && roleVariables[variable.name].type === Acl.VariableType.predefined)) {
+				const roleVariable = Object.prototype.hasOwnProperty.call(roleVariables, variable.name) ? roleVariables[variable.name] : undefined
+				if (!roleVariable || (!isAssumed && roleVariable.type === Acl.VariableType.predefined)) {
 					errors.push(
 						new MembershipValidationError(
 							membership.role,

package/tests/cases/unit/membershipResolver.test.ts

@@ -1,5 +1,5 @@
 import { expect, test } from 'bun:test'
-import { MembershipResolver, MembershipValidationErrorType } from '../../../src/index.js'
+import { getRoleVariables, MembershipResolver, MembershipValidationErrorType } from '../../../src/index.js'
 import { Acl } from '@contember/schema'
 
 const id1 = 'bff057b3-11f7-4bc7-abe3-1f2ef266824d'
@@ -268,3 +268,38 @@ test('use fallback value', () => {
 		{ role: 'editor', variables: [{ name: 'localeID', condition: { always: true } }] },
 	])
 })
+
+// Own-property hardening: a role / variable named after an inherited Object.prototype member must resolve
+// to "not found" rather than the inherited member (which would otherwise throw on `role.inherits` /
+// `role.variables`, or pass as a defined variable). Exercised here in schema-utils itself because these
+// helpers are shared cross-package (the direct add-member path and the A09 IdP claim mapping both use them).
+test('a role named after a prototype member resolves to ROLE_NOT_FOUND (own-property, no throw)', () => {
+	const reader = new MembershipResolver()
+	for (const role of ['__proto__', 'constructor', 'toString', 'hasOwnProperty']) {
+		const result = reader.resolve({ roles: {} }, [{ role, variables: [] }], MembershipResolver.UnknownIdentity, false)
+		expect(result.errors).toEqual([{ error: MembershipValidationErrorType.ROLE_NOT_FOUND, role, variable: undefined }])
+		expect(result.memberships).toStrictEqual([])
+	}
+})
+
+test('a variable named after a prototype member resolves to VARIABLE_NOT_FOUND (own-property)', () => {
+	const reader = new MembershipResolver()
+	const acl: Acl.Schema = { roles: { editor: { variables: {}, entities: {} } } }
+	for (const name of ['__proto__', 'constructor', 'toString', 'hasOwnProperty']) {
+		const result = reader.resolve(acl, [{ role: 'editor', variables: [{ name, values: ['x'] }] }], MembershipResolver.UnknownIdentity, false)
+		expect(result.errors).toEqual([{ error: MembershipValidationErrorType.VARIABLE_NOT_FOUND, role: 'editor', variable: name }])
+	}
+})
+
+test('getRoleVariables: a prototype-named role, and an `inherits` pointing at a missing role, resolve to {} (own-property, no throw)', () => {
+	for (const role of ['__proto__', 'constructor', 'toString', 'hasOwnProperty']) {
+		expect(getRoleVariables(role, { roles: {} })).toEqual({})
+	}
+	// an `inherits` entry naming a role absent from the schema must resolve to no variables, not throw
+	const acl: Acl.Schema = {
+		roles: {
+			editor: { variables: { a: { type: Acl.VariableType.entity, entityName: 'A' } }, entities: {}, inherits: ['ghost'] },
+		},
+	}
+	expect(getRoleVariables('editor', acl)).toEqual({ a: { type: Acl.VariableType.entity, entityName: 'A' } })
+})

package/tests/cases/unit/tsDefinitionGenerator.test.ts

@@ -73,3 +73,39 @@ test('definition generator round-trips per-column index options', () => {
 	expect(generated).toContain(`@c.Index({ fields: ['title', { field: 'rank', order: 'desc', nulls: 'last' }] })`)
 	expect(generated).toContain(`@c.Index({ fields: [{ field: 'title', opClass: 'text_pattern_ops' }] })`)
 })
+
+namespace ExplicitPrimaryReadModel {
+	export const editorRole = c.createRole('editor')
+
+	@c.Allow(editorRole, { read: ['id', 'a'] })
+	export class Article {
+		a = c.stringColumn()
+		b = c.stringColumn()
+	}
+}
+
+test('definition generator does not widen a grant that names the primary key', () => {
+	const generator = new DefinitionCodeGenerator()
+	const generated = generator.generate(createSchema(ExplicitPrimaryReadModel))
+	// regression: the `read: true` collapse compared counts, and `fields` includes the primary while
+	// `numberOfEntityFieldsWithoutId` excludes it - so `{id, a}` on a two-column entity collapsed to
+	// `read: true`, which re-parses as `{a, b}` and grants `b`.
+	expect(generated).toContain(`@c.Allow(editorRole, {\n\tread: ['id', 'a'],\n})`)
+	expect(generated).not.toContain(`@c.Allow(editorRole, {\n\tread: true,\n})`)
+})
+
+namespace FullReadModel {
+	export const editorRole = c.createRole('editor')
+
+	@c.Allow(editorRole, { read: true })
+	export class Article {
+		a = c.stringColumn()
+		b = c.stringColumn()
+	}
+}
+
+test('definition generator still collapses a grant covering every non-primary field', () => {
+	const generator = new DefinitionCodeGenerator()
+	const generated = generator.generate(createSchema(FullReadModel))
+	expect(generated).toContain(`@c.Allow(editorRole, {\n\tread: true,\n})`)
+})