@drax/crud-back 0.26.0 → 0.28.0

package/dist/controllers/AbstractFastifyController.js

@@ -9,10 +9,19 @@ class AbstractFastifyController extends CommonController {
         this.tenantField = 'tenant';
         this.userField = 'user';
         this.tenantFilter = false;
-        this.userFilter = false;
         this.tenantSetter = false;
-        this.userSetter = false;
         this.tenantAssert = false;
+        /**
+         * userFilter is used to filter items by user field like createdBy with auth user. Used by find, search, paginate
+         */
+        this.userFilter = false;
+        /**
+         * userSetter is used to set user like createdBy with auth user. Used by create
+         */
+        this.userSetter = false;
+        /**
+         * userSetter is used to verify item user like createdBy with auth user. Used by update, delete, findById
+         */
         this.userAssert = false;
         this.defaultLimit = 1000;
         this.maximumLimit = 10000;
@@ -42,13 +51,22 @@ class AbstractFastifyController extends CommonController {
         }
     }
     applyUserAndTenantFilters(filters, rbac) {
-        if (this.tenantFilter && rbac.tenantId) {
-            filters.push({ field: this.tenantField, operator: 'eq', value: rbac.tenantId });
+        this.applyTenantFilter(filters, rbac);
+        this.applyUserFilter(filters, rbac);
+    }
+    applyUserFilter(filters, rbac) {
+        if (rbac.hasSomePermission([this.permission.All, this.permission.ViewAll])) {
+            return;
         }
         if (this.userFilter && rbac.userId) {
             filters.push({ field: this.userField, operator: 'eq', value: rbac.userId });
         }
     }
+    applyTenantFilter(filters, rbac) {
+        if (this.tenantFilter && rbac.tenantId) {
+            filters.push({ field: this.tenantField, operator: 'eq', value: rbac.tenantId });
+        }
+    }
     assertTenant(item, rbac) {
         if (this.tenantAssert) {
             const itemTenantId = item[this.tenantField]?._id ? item[this.tenantField]._id.toString() : null;
@@ -94,10 +112,17 @@ class AbstractFastifyController extends CommonController {
             }
             const id = request.params.id;
             const payload = request.body;
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.UpdateAll])) {
+                let preItem = await this.service.findById(id);
+                if (!preItem) {
+                    reply.statusCode = 404;
+                    reply.send({ error: 'NOT_FOUND' });
+                }
+                this.assertUser(preItem, request.rbac);
+            }
+            //Definido el tenant/user en el create no debe modificarse en un update
             delete payload[this.tenantField];
             delete payload[this.userField];
-            //Una vez que un registro se crea con un tenant, no deberia actualizarse nunca mas
-            //this.applyUserAndTenantSetters(payload, request.rbac)
             let item = await this.service.update(id, payload);
             if (!item) {
                 throw new NotFoundError();
@@ -117,10 +142,17 @@ class AbstractFastifyController extends CommonController {
             }
             const id = request.params.id;
             const payload = request.body;
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.UpdateAll])) {
+                let preItem = await this.service.findById(id);
+                if (!preItem) {
+                    reply.statusCode = 404;
+                    reply.send({ error: 'NOT_FOUND' });
+                }
+                this.assertUser(preItem, request.rbac);
+            }
+            //Definido el tenant/user en el create no debe modificarse en un update
             delete payload[this.tenantField];
             delete payload[this.userField];
-            //Una vez que un registro se crea con un tenant, no deberia actualizarse nunca mas
-            //this.applyUserAndTenantSetters(payload, request.rbac)
             let item = await this.service.updatePartial(id, payload);
             if (!item) {
                 throw new NotFoundError();
@@ -144,7 +176,10 @@ class AbstractFastifyController extends CommonController {
                 reply.statusCode = 404;
                 reply.send({ error: 'NOT_FOUND' });
             }
-            this.assertUserAndTenant(item, request.rbac);
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.DeleteAll])) {
+                this.assertUser(item, request.rbac);
+            }
+            this.assertTenant(item, request.rbac);
             await this.service.delete(id);
             reply.send({
                 id: id,
@@ -169,7 +204,10 @@ class AbstractFastifyController extends CommonController {
             if (!item) {
                 throw new NotFoundError();
             }
-            this.assertUserAndTenant(item, request.rbac);
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.ViewAll])) {
+                this.assertUser(item, request.rbac);
+            }
+            this.assertTenant(item, request.rbac);
             return item;
         }
         catch (e) {

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Crud utils across modules",
   "main": "dist/index.js",
   "types": "types/index.d.ts",
@@ -22,10 +22,10 @@
   "author": "Cristian Incarnato & Drax Team",
   "license": "ISC",
   "dependencies": {
-    "@drax/common-back": "^0.26.0",
-    "@drax/common-share": "^0.26.0",
-    "@drax/identity-share": "^0.26.0",
-    "@drax/media-back": "^0.26.0",
+    "@drax/common-back": "^0.28.0",
+    "@drax/common-share": "^0.28.0",
+    "@drax/identity-share": "^0.28.0",
+    "@drax/media-back": "^0.28.0",
     "@graphql-tools/load-files": "^7.0.0",
     "@graphql-tools/merge": "^9.0.4",
     "mongoose": "^8.6.3",
@@ -45,5 +45,5 @@
     "tsc-alias": "^1.8.10",
     "typescript": "^5.6.2"
   },
-  "gitHead": "e4b5e941f7d847b340cd290d650100caf1bebf0b"
+  "gitHead": "062c6d15dbbf8b6e337869549ab0bdbc27200a9e"
 }

package/src/controllers/AbstractFastifyController.ts

@@ -53,12 +53,22 @@ class AbstractFastifyController<T, C, U> extends CommonController {
     protected userField: string = 'user'
 
     protected tenantFilter: boolean = false
+    protected tenantSetter: boolean = false
+    protected tenantAssert: boolean = false
+
+    /**
+     * userFilter is used to filter items by user field like createdBy with auth user. Used by find, search, paginate
+     */
     protected userFilter: boolean = false
 
-    protected tenantSetter: boolean = false
+    /**
+     * userSetter is used to set user like createdBy with auth user. Used by create
+     */
     protected userSetter: boolean = false
 
-    protected tenantAssert: boolean = false
+    /**
+     * userSetter is used to verify item user like createdBy with auth user. Used by update, delete, findById
+     */
     protected userAssert: boolean = false
 
     protected defaultLimit: number = 1000
@@ -89,19 +99,32 @@ class AbstractFastifyController<T, C, U> extends CommonController {
             })
             return filters
         } catch (e) {
-            console.error("parseFilters error",e)
+            console.error("parseFilters error", e)
             throw e
         }
     }
 
     protected applyUserAndTenantFilters(filters: IDraxFieldFilter[], rbac: IRbac) {
-        if (this.tenantFilter && rbac.tenantId) {
-            filters.push({field: this.tenantField, operator: 'eq', value: rbac.tenantId})
+        this.applyTenantFilter(filters, rbac)
+        this.applyUserFilter(filters, rbac)
+    }
+
+    protected applyUserFilter(filters: IDraxFieldFilter[], rbac: IRbac) {
+
+        if(rbac.hasSomePermission([this.permission.All, this.permission.ViewAll])) {
+            return
         }
 
-        if (this.userFilter && rbac.userId) {
+        if(this.userFilter && rbac.userId) {
             filters.push({field: this.userField, operator: 'eq', value: rbac.userId})
         }
+
+    }
+
+    protected applyTenantFilter(filters: IDraxFieldFilter[], rbac: IRbac) {
+        if (this.tenantFilter && rbac.tenantId) {
+            filters.push({field: this.tenantField, operator: 'eq', value: rbac.tenantId})
+        }
     }
 
     protected assertTenant(item: T, rbac: IRbac) {
@@ -112,6 +135,7 @@ class AbstractFastifyController<T, C, U> extends CommonController {
     }
 
     protected assertUser(item: T, rbac: IRbac) {
+
         if (this.userAssert) {
             const itemUserId = item[this.userField]?._id ? item[this.userField]._id.toString() : null
             rbac.assertUserId(itemUserId)
@@ -155,10 +179,23 @@ class AbstractFastifyController<T, C, U> extends CommonController {
             }
             const id = request.params.id
             const payload = request.body
+
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.UpdateAll])) {
+
+                let preItem = await this.service.findById(id)
+
+                if (!preItem) {
+                    reply.statusCode = 404
+                    reply.send({error: 'NOT_FOUND'})
+                }
+
+                this.assertUser(preItem, request.rbac)
+            }
+
+            //Definido el tenant/user en el create no debe modificarse en un update
             delete payload[this.tenantField]
             delete payload[this.userField]
-            //Una vez que un registro se crea con un tenant, no deberia actualizarse nunca mas
-            //this.applyUserAndTenantSetters(payload, request.rbac)
+
             let item = await this.service.update(id, payload as U)
 
             if (!item) {
@@ -180,10 +217,23 @@ class AbstractFastifyController<T, C, U> extends CommonController {
             }
             const id = request.params.id
             const payload = request.body
+
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.UpdateAll])) {
+
+                let preItem = await this.service.findById(id)
+
+                if (!preItem) {
+                    reply.statusCode = 404
+                    reply.send({error: 'NOT_FOUND'})
+                }
+
+                this.assertUser(preItem, request.rbac)
+            }
+
+            //Definido el tenant/user en el create no debe modificarse en un update
             delete payload[this.tenantField]
             delete payload[this.userField]
-            //Una vez que un registro se crea con un tenant, no deberia actualizarse nunca mas
-            //this.applyUserAndTenantSetters(payload, request.rbac)
+
             let item = await this.service.updatePartial(id, payload as U)
             if (!item) {
                 throw new NotFoundError()
@@ -201,6 +251,7 @@ class AbstractFastifyController<T, C, U> extends CommonController {
                 reply.statusCode = 400
                 reply.send({error: 'BAD REQUEST'})
             }
+
             const id = request.params.id
 
             let item = await this.service.findById(id)
@@ -210,7 +261,12 @@ class AbstractFastifyController<T, C, U> extends CommonController {
                 reply.send({error: 'NOT_FOUND'})
             }
 
-            this.assertUserAndTenant(item, request.rbac)
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.DeleteAll])) {
+                this.assertUser(item, request.rbac)
+            }
+
+            this.assertTenant(item, request.rbac)
+
 
             await this.service.delete(id)
             reply.send({
@@ -240,7 +296,11 @@ class AbstractFastifyController<T, C, U> extends CommonController {
                 throw new NotFoundError()
             }
 
-            this.assertUserAndTenant(item, request.rbac)
+            if (!request.rbac.hasSomePermission([this.permission.All, this.permission.ViewAll])) {
+                this.assertUser(item, request.rbac)
+            }
+
+            this.assertTenant(item, request.rbac)
 
             return item
         } catch (e) {
@@ -281,6 +341,7 @@ class AbstractFastifyController<T, C, U> extends CommonController {
             const search = request.query.search ??= undefined
             const filters = this.parseFilters(request.query.filters)
 
+
             this.applyUserAndTenantFilters(filters, request.rbac);
 
             let items = await this.service.find({search, filters, order, orderBy, limit})
@@ -353,7 +414,6 @@ class AbstractFastifyController<T, C, U> extends CommonController {
     }
 
 
-
     async search(request: CustomRequest, reply: FastifyReply) {
         try {
             request.rbac.assertPermission(this.permission.View)