@drax/crud-back 0.25.0 → 0.27.0

package/dist/controllers/AbstractFastifyController.js

@@ -1,18 +1,27 @@
 import { CommonConfig, DraxConfig, LimitError, NotFoundError, BadRequestError, CommonController } from "@drax/common-back";
 import { join } from "path";
 import QueryFilterRegex from "../regexs/QueryFilterRegex.js";
-const BASE_FILE_DIR = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
-const BASE_URL = DraxConfig.getOrLoad(CommonConfig.BaseUrl) ? DraxConfig.get(CommonConfig.BaseUrl).replace(/\/$/, '') : '';
 class AbstractFastifyController extends CommonController {
     constructor(service, permission) {
         super();
+        this.baseFileDir = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
+        this.baseURL = DraxConfig.getOrLoad(CommonConfig.BaseUrl) ? DraxConfig.get(CommonConfig.BaseUrl).replace(/\/$/, '') : '';
         this.tenantField = 'tenant';
         this.userField = 'user';
         this.tenantFilter = false;
-        this.userFilter = false;
         this.tenantSetter = false;
-        this.userSetter = false;
         this.tenantAssert = false;
+        /**
+         * userFilter is used to filter items by user field like createdBy with auth user. Used by find, search, paginate
+         */
+        this.userFilter = false;
+        /**
+         * userSetter is used to set user like createdBy with auth user. Used by create
+         */
+        this.userSetter = false;
+        /**
+         * userSetter is used to verify item user like createdBy with auth user. Used by update, delete, findById
+         */
         this.userAssert = false;
         this.defaultLimit = 1000;
         this.maximumLimit = 10000;
@@ -42,13 +51,22 @@ class AbstractFastifyController extends CommonController {
         }
     }
     applyUserAndTenantFilters(filters, rbac) {
-        if (this.tenantFilter && rbac.tenantId) {
-            filters.push({ field: this.tenantField, operator: 'eq', value: rbac.tenantId });
+        this.applyTenantFilter(filters, rbac);
+        this.applyUserFilter(filters, rbac);
+    }
+    applyUserFilter(filters, rbac) {
+        if (rbac.hasSomePermission([this.permission.All, this.permission.ViewAll])) {
+            return;
         }
         if (this.userFilter && rbac.userId) {
             filters.push({ field: this.userField, operator: 'eq', value: rbac.userId });
         }
     }
+    applyTenantFilter(filters, rbac) {
+        if (this.tenantFilter && rbac.tenantId) {
+            filters.push({ field: this.tenantField, operator: 'eq', value: rbac.tenantId });
+        }
+    }
     assertTenant(item, rbac) {
         if (this.tenantAssert) {
             const itemTenantId = item[this.tenantField]?._id ? item[this.tenantField]._id.toString() : null;
@@ -94,10 +112,17 @@ class AbstractFastifyController extends CommonController {
             }
             const id = request.params.id;
             const payload = request.body;
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.UpdateAll])) {
+                let preItem = await this.service.findById(id);
+                if (!preItem) {
+                    reply.statusCode = 404;
+                    reply.send({ error: 'NOT_FOUND' });
+                }
+                this.assertUser(preItem, request.rbac);
+            }
+            //Definido el tenant/user en el create no debe modificarse en un update
             delete payload[this.tenantField];
             delete payload[this.userField];
-            //Una vez que un registro se crea con un tenant, no deberia actualizarse nunca mas
-            //this.applyUserAndTenantSetters(payload, request.rbac)
             let item = await this.service.update(id, payload);
             if (!item) {
                 throw new NotFoundError();
@@ -117,10 +142,17 @@ class AbstractFastifyController extends CommonController {
             }
             const id = request.params.id;
             const payload = request.body;
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.UpdateAll])) {
+                let preItem = await this.service.findById(id);
+                if (!preItem) {
+                    reply.statusCode = 404;
+                    reply.send({ error: 'NOT_FOUND' });
+                }
+                this.assertUser(preItem, request.rbac);
+            }
+            //Definido el tenant/user en el create no debe modificarse en un update
             delete payload[this.tenantField];
             delete payload[this.userField];
-            //Una vez que un registro se crea con un tenant, no deberia actualizarse nunca mas
-            //this.applyUserAndTenantSetters(payload, request.rbac)
             let item = await this.service.updatePartial(id, payload);
             if (!item) {
                 throw new NotFoundError();
@@ -144,7 +176,10 @@ class AbstractFastifyController extends CommonController {
                 reply.statusCode = 404;
                 reply.send({ error: 'NOT_FOUND' });
             }
-            this.assertUserAndTenant(item, request.rbac);
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.DeleteAll])) {
+                this.assertUser(item, request.rbac);
+            }
+            this.assertTenant(item, request.rbac);
             await this.service.delete(id);
             reply.send({
                 id: id,
@@ -169,7 +204,10 @@ class AbstractFastifyController extends CommonController {
             if (!item) {
                 throw new NotFoundError();
             }
-            this.assertUserAndTenant(item, request.rbac);
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.ViewAll])) {
+                this.assertUser(item, request.rbac);
+            }
+            this.assertTenant(item, request.rbac);
             return item;
         }
         catch (e) {
@@ -315,7 +353,7 @@ class AbstractFastifyController extends CommonController {
             const year = (new Date().getFullYear()).toString();
             const month = (new Date().getMonth() + 1).toString().padStart(2, '0');
             const exportPath = 'exports';
-            const destinationPath = join(BASE_FILE_DIR, 'exports', year, month);
+            const destinationPath = join(this.baseFileDir, 'exports', year, month);
             let result = await this.service.export({
                 separator,
                 format,
@@ -326,7 +364,7 @@ class AbstractFastifyController extends CommonController {
                 search,
                 filters,
             }, destinationPath);
-            const url = `${BASE_URL}/api/file/${exportPath}/${year}/${month}/${result.fileName}`;
+            const url = `${this.baseURL}/api/file/${exportPath}/${year}/${month}/${result.fileName}`;
             return {
                 url: url,
                 rowCount: result.rowCount,

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Crud utils across modules",
   "main": "dist/index.js",
   "types": "types/index.d.ts",
@@ -22,10 +22,10 @@
   "author": "Cristian Incarnato & Drax Team",
   "license": "ISC",
   "dependencies": {
-    "@drax/common-back": "^0.25.0",
-    "@drax/common-share": "^0.25.0",
-    "@drax/identity-share": "^0.25.0",
-    "@drax/media-back": "^0.25.0",
+    "@drax/common-back": "^0.27.0",
+    "@drax/common-share": "^0.27.0",
+    "@drax/identity-share": "^0.27.0",
+    "@drax/media-back": "^0.27.0",
     "@graphql-tools/load-files": "^7.0.0",
     "@graphql-tools/merge": "^9.0.4",
     "mongoose": "^8.6.3",
@@ -45,5 +45,5 @@
     "tsc-alias": "^1.8.10",
     "typescript": "^5.6.2"
   },
-  "gitHead": "5238915c16f72cba683c64c42cb6764ad146ec53"
+  "gitHead": "b8c4047451d7bcae320e5b9e50b8e60fb69229a8"
 }

package/src/controllers/AbstractFastifyController.ts

@@ -40,25 +40,35 @@ type CustomRequest = FastifyRequest<{
     }
 }>
 
-const BASE_FILE_DIR = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
-const BASE_URL = DraxConfig.getOrLoad(CommonConfig.BaseUrl) ? DraxConfig.get(CommonConfig.BaseUrl).replace(/\/$/, '') : ''
-
 
 class AbstractFastifyController<T, C, U> extends CommonController {
 
     protected service: AbstractService<T, C, U>
     protected permission: IDraxPermission
 
+    protected baseFileDir = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
+    protected baseURL = DraxConfig.getOrLoad(CommonConfig.BaseUrl) ? DraxConfig.get(CommonConfig.BaseUrl).replace(/\/$/, '') : ''
+
     protected tenantField: string = 'tenant'
     protected userField: string = 'user'
 
     protected tenantFilter: boolean = false
+    protected tenantSetter: boolean = false
+    protected tenantAssert: boolean = false
+
+    /**
+     * userFilter is used to filter items by user field like createdBy with auth user. Used by find, search, paginate
+     */
     protected userFilter: boolean = false
 
-    protected tenantSetter: boolean = false
+    /**
+     * userSetter is used to set user like createdBy with auth user. Used by create
+     */
     protected userSetter: boolean = false
 
-    protected tenantAssert: boolean = false
+    /**
+     * userSetter is used to verify item user like createdBy with auth user. Used by update, delete, findById
+     */
     protected userAssert: boolean = false
 
     protected defaultLimit: number = 1000
@@ -89,41 +99,55 @@ class AbstractFastifyController<T, C, U> extends CommonController {
             })
             return filters
         } catch (e) {
-            console.error("parseFilters error",e)
+            console.error("parseFilters error", e)
             throw e
         }
     }
 
-    private applyUserAndTenantFilters(filters: IDraxFieldFilter[], rbac: IRbac) {
-        if (this.tenantFilter && rbac.tenantId) {
-            filters.push({field: this.tenantField, operator: 'eq', value: rbac.tenantId})
+    protected applyUserAndTenantFilters(filters: IDraxFieldFilter[], rbac: IRbac) {
+        this.applyTenantFilter(filters, rbac)
+        this.applyUserFilter(filters, rbac)
+    }
+
+    protected applyUserFilter(filters: IDraxFieldFilter[], rbac: IRbac) {
+
+        if(rbac.hasSomePermission([this.permission.All, this.permission.ViewAll])) {
+            return
         }
 
-        if (this.userFilter && rbac.userId) {
+        if(this.userFilter && rbac.userId) {
             filters.push({field: this.userField, operator: 'eq', value: rbac.userId})
         }
+
+    }
+
+    protected applyTenantFilter(filters: IDraxFieldFilter[], rbac: IRbac) {
+        if (this.tenantFilter && rbac.tenantId) {
+            filters.push({field: this.tenantField, operator: 'eq', value: rbac.tenantId})
+        }
     }
 
-    private assertTenant(item: T, rbac: IRbac) {
+    protected assertTenant(item: T, rbac: IRbac) {
         if (this.tenantAssert) {
             const itemTenantId = item[this.tenantField]?._id ? item[this.tenantField]._id.toString() : null
             rbac.assertTenantId(itemTenantId)
         }
     }
 
-    private assertUser(item: T, rbac: IRbac) {
+    protected assertUser(item: T, rbac: IRbac) {
+
         if (this.userAssert) {
             const itemUserId = item[this.userField]?._id ? item[this.userField]._id.toString() : null
             rbac.assertUserId(itemUserId)
         }
     }
 
-    private assertUserAndTenant(item: T, rbac: IRbac) {
+    protected assertUserAndTenant(item: T, rbac: IRbac) {
         this.assertTenant(item, rbac)
         this.assertUser(item, rbac)
     }
 
-    private applyUserAndTenantSetters(payload: any, rbac: any) {
+    protected applyUserAndTenantSetters(payload: any, rbac: any) {
         if (this.tenantSetter && rbac.tenantId) {
             payload[this.tenantField] = rbac.tenantId
         }
@@ -155,10 +179,23 @@ class AbstractFastifyController<T, C, U> extends CommonController {
             }
             const id = request.params.id
             const payload = request.body
+
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.UpdateAll])) {
+
+                let preItem = await this.service.findById(id)
+
+                if (!preItem) {
+                    reply.statusCode = 404
+                    reply.send({error: 'NOT_FOUND'})
+                }
+
+                this.assertUser(preItem, request.rbac)
+            }
+
+            //Definido el tenant/user en el create no debe modificarse en un update
             delete payload[this.tenantField]
             delete payload[this.userField]
-            //Una vez que un registro se crea con un tenant, no deberia actualizarse nunca mas
-            //this.applyUserAndTenantSetters(payload, request.rbac)
+
             let item = await this.service.update(id, payload as U)
 
             if (!item) {
@@ -180,10 +217,23 @@ class AbstractFastifyController<T, C, U> extends CommonController {
             }
             const id = request.params.id
             const payload = request.body
+
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.UpdateAll])) {
+
+                let preItem = await this.service.findById(id)
+
+                if (!preItem) {
+                    reply.statusCode = 404
+                    reply.send({error: 'NOT_FOUND'})
+                }
+
+                this.assertUser(preItem, request.rbac)
+            }
+
+            //Definido el tenant/user en el create no debe modificarse en un update
             delete payload[this.tenantField]
             delete payload[this.userField]
-            //Una vez que un registro se crea con un tenant, no deberia actualizarse nunca mas
-            //this.applyUserAndTenantSetters(payload, request.rbac)
+
             let item = await this.service.updatePartial(id, payload as U)
             if (!item) {
                 throw new NotFoundError()
@@ -201,6 +251,7 @@ class AbstractFastifyController<T, C, U> extends CommonController {
                 reply.statusCode = 400
                 reply.send({error: 'BAD REQUEST'})
             }
+
             const id = request.params.id
 
             let item = await this.service.findById(id)
@@ -210,7 +261,12 @@ class AbstractFastifyController<T, C, U> extends CommonController {
                 reply.send({error: 'NOT_FOUND'})
             }
 
-            this.assertUserAndTenant(item, request.rbac)
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.DeleteAll])) {
+                this.assertUser(item, request.rbac)
+            }
+
+            this.assertTenant(item, request.rbac)
+
 
             await this.service.delete(id)
             reply.send({
@@ -240,7 +296,11 @@ class AbstractFastifyController<T, C, U> extends CommonController {
                 throw new NotFoundError()
             }
 
-            this.assertUserAndTenant(item, request.rbac)
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.ViewAll])) {
+                this.assertUser(item, request.rbac)
+            }
+
+            this.assertTenant(item, request.rbac)
 
             return item
         } catch (e) {
@@ -281,6 +341,7 @@ class AbstractFastifyController<T, C, U> extends CommonController {
             const search = request.query.search ??= undefined
             const filters = this.parseFilters(request.query.filters)
 
+
             this.applyUserAndTenantFilters(filters, request.rbac);
 
             let items = await this.service.find({search, filters, order, orderBy, limit})
@@ -353,7 +414,6 @@ class AbstractFastifyController<T, C, U> extends CommonController {
     }
 
 
-
     async search(request: CustomRequest, reply: FastifyReply) {
         try {
             request.rbac.assertPermission(this.permission.View)
@@ -416,7 +476,7 @@ class AbstractFastifyController<T, C, U> extends CommonController {
             const month = (new Date().getMonth() + 1).toString().padStart(2, '0')
             const exportPath = 'exports'
 
-            const destinationPath = join(BASE_FILE_DIR, 'exports', year, month)
+            const destinationPath = join(this.baseFileDir, 'exports', year, month)
 
             let result: IDraxExportResult = await this.service.export({
                 separator,
@@ -429,7 +489,7 @@ class AbstractFastifyController<T, C, U> extends CommonController {
                 filters,
             }, destinationPath)
 
-            const url = `${BASE_URL}/api/file/${exportPath}/${year}/${month}/${result.fileName}`
+            const url = `${this.baseURL}/api/file/${exportPath}/${year}/${month}/${result.fileName}`
 
 
             return {
@@ -447,3 +507,5 @@ class AbstractFastifyController<T, C, U> extends CommonController {
 
 export default AbstractFastifyController;
 export {AbstractFastifyController}
+
+export type {CustomRequest}

package/src/index.ts

@@ -3,6 +3,7 @@ import AbstractMongoRepository from "./repository/AbstractMongoRepository.js";
 import AbstractSqliteRepository from "./repository/AbstractSqliteRepository.js";
 import AbstractService from "./services/AbstractService.js";
 import AbstractFastifyController from "./controllers/AbstractFastifyController.js";
+import type {CustomRequest} from "./controllers/AbstractFastifyController.js";
 
 //schemas
 import {IdParamSchema} from "./schemas/IdParamSchema.js"
@@ -15,6 +16,9 @@ import {ExportBodyResponseSchema} from "./schemas/ExportBodyResponseSchema.js"
 import {ErrorBodyResponseSchema, ValidationErrorBodyResponseSchema} from "./schemas/ErrorBodyResponseSchema.js"
 import {CrudSchemaBuilder} from "./builders/CrudSchemaBuilder.js";
 
+export type {
+    CustomRequest
+}
 
 export {