@eleven-am/golem-core 0.1.0

package/dist/readtree.js

@@ -0,0 +1,206 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.constraintFieldNames = constraintFieldNames;
+exports.prepareReadTree = prepareReadTree;
+exports.applyToOneChecks = applyToOneChecks;
+exports.applyFieldMasks = applyFieldMasks;
+exports.stripInjectedFields = stripInjectedFields;
+const authorization_1 = require("./authorization");
+const errors_1 = require("./errors");
+function constraintFieldNames(constraint, into = new Set()) {
+    if (!constraint || typeof constraint !== 'object') {
+        return into;
+    }
+    for (const [key, value] of Object.entries(constraint)) {
+        if (key === 'AND' || key === 'OR' || key === 'NOT') {
+            const branches = Array.isArray(value) ? value : [value];
+            for (const branch of branches) {
+                constraintFieldNames(branch, into);
+            }
+        }
+        else {
+            into.add(key);
+        }
+    }
+    return into;
+}
+async function prepareReadTree(options) {
+    const checks = [];
+    const maskChecks = [];
+    const injected = [];
+    const classifying = options.readFieldChecks === true &&
+        options.provider?.classifyFields !== undefined &&
+        options.provider?.checkField !== undefined;
+    async function classifyModelFields(model, tree, path) {
+        if (!classifying) {
+            return;
+        }
+        const scalarNames = options.metadata?.get(model.name)?.scalarFields.map((f) => f.name) ??
+            model.fields.filter((f) => f.kind !== 'object').map((f) => f.name);
+        const requested = tree
+            ? scalarNames.filter((name) => tree[name] === true)
+            : scalarNames;
+        if (requested.length === 0) {
+            return;
+        }
+        const classification = await options.provider.classifyFields('read', model.name, requested, options.context);
+        for (const field of requested) {
+            const entry = classification[field];
+            if (!entry || entry.access === 'always') {
+                continue;
+            }
+            if (entry.access === 'never') {
+                throw new errors_1.GolemForbiddenError(`Cannot read field "${field}" on ${model.name}`);
+            }
+            maskChecks.push({ path, model: model.name, field });
+            if (tree) {
+                for (const required of entry.requires ?? []) {
+                    if (tree[required] === undefined && scalarNames.includes(required)) {
+                        tree[required] = true;
+                        injected.push({ path, field: required });
+                    }
+                }
+            }
+        }
+    }
+    async function walkTree(model, tree, depth, path) {
+        if (!tree) {
+            return tree;
+        }
+        const rewritten = {};
+        for (const [key, entry] of Object.entries(tree)) {
+            const field = options.metadata?.get(model.name)?.fieldsByName.get(key) ??
+                model.fields.find((f) => f.name === key);
+            if (!field || field.kind !== 'object' || entry === false || entry === undefined) {
+                rewritten[key] = entry;
+                continue;
+            }
+            const target = options.modelsByName.get(field.type);
+            if (!target) {
+                rewritten[key] = entry;
+                continue;
+            }
+            if (depth + 1 > options.maxDepth) {
+                throw new errors_1.GolemValidationError(`Query depth ${depth + 1} exceeds the maximum of ${options.maxDepth}`);
+            }
+            let constraint;
+            if (options.provider) {
+                constraint = await options.provider.constrain('read', target.name, options.context);
+            }
+            const conditional = (0, authorization_1.isConditionalConstraint)(constraint);
+            const relationPath = [...path, key];
+            const entryObject = entry === true && classifying
+                ? {
+                    select: Object.fromEntries((options.metadata?.get(target.name)?.scalarFields ??
+                        target.fields.filter((candidate) => candidate.kind !== 'object'))
+                        .map((candidate) => [candidate.name, true])),
+                }
+                : entry === true ? {} : { ...entry };
+            if (entryObject.select !== undefined) {
+                entryObject.select = await walkTree(target, entryObject.select, depth + 1, relationPath);
+            }
+            if (entryObject.include !== undefined) {
+                entryObject.include = await walkTree(target, entryObject.include, depth + 1, relationPath);
+            }
+            if (conditional) {
+                if (field.isList) {
+                    entryObject.where = (0, authorization_1.mergeConstraint)(entryObject.where, constraint);
+                }
+                else if (options.provider?.check) {
+                    if (entryObject.select) {
+                        for (const name of constraintFieldNames(constraint)) {
+                            const constraintField = options.metadata?.get(target.name)?.fieldsByName.get(name) ??
+                                target.fields.find((f) => f.name === name);
+                            if (constraintField && constraintField.kind !== 'object') {
+                                entryObject.select[name] ??= true;
+                            }
+                        }
+                    }
+                    checks.push({ path: relationPath, model: target.name });
+                }
+                else {
+                    throw new errors_1.GolemForbiddenError(`Cannot traverse relation ${model.name}.${key}: row-level constraints apply and the authorization provider does not support instance checks`);
+                }
+            }
+            rewritten[key] = Object.keys(entryObject).length === 0 ? true : entryObject;
+        }
+        await classifyModelFields(model, rewritten, path);
+        return rewritten;
+    }
+    const select = await walkTree(options.model, options.select, 1, []);
+    const include = await walkTree(options.model, options.include, 1, []);
+    if (!options.select && !options.include) {
+        await classifyModelFields(options.model, undefined, []);
+    }
+    return { select, include, toOneChecks: checks, maskChecks, injected };
+}
+async function applyToOneChecks(data, checks, provider, context) {
+    for (const check of checks) {
+        await applyCheck(data, check.path, check.model, provider, context);
+    }
+}
+async function applyFieldMasks(data, checks, provider, context) {
+    for (const check of checks) {
+        await walkAndTransform(data, check.path, async (row) => {
+            if (row[check.field] === undefined || row[check.field] === null) {
+                return;
+            }
+            const allowed = await provider.checkField('read', check.model, row, check.field, context);
+            if (!allowed) {
+                row[check.field] = null;
+            }
+        });
+    }
+}
+async function stripInjectedFields(data, injected) {
+    for (const entry of injected) {
+        await walkAndTransform(data, entry.path, async (row) => {
+            delete row[entry.field];
+        });
+    }
+}
+async function walkAndTransform(node, path, transform) {
+    if (!node || typeof node !== 'object') {
+        return;
+    }
+    if (Array.isArray(node)) {
+        for (const item of node) {
+            await walkAndTransform(item, path, transform);
+        }
+        return;
+    }
+    if (path.length === 0) {
+        await transform(node);
+        return;
+    }
+    const [segment, ...rest] = path;
+    await walkAndTransform(node[segment], rest, transform);
+}
+async function applyCheck(node, path, model, provider, context) {
+    if (!node || typeof node !== 'object') {
+        return;
+    }
+    if (Array.isArray(node)) {
+        for (const item of node) {
+            await applyCheck(item, path, model, provider, context);
+        }
+        return;
+    }
+    const container = node;
+    const [segment, ...rest] = path;
+    const value = container[segment];
+    if (value === undefined || value === null) {
+        return;
+    }
+    if (rest.length > 0) {
+        await applyCheck(value, rest, model, provider, context);
+        return;
+    }
+    if (Array.isArray(value)) {
+        return;
+    }
+    const allowed = await provider.check('read', model, value, context);
+    if (!allowed) {
+        container[segment] = null;
+    }
+}

package/dist/schema.d.ts

@@ -0,0 +1,23 @@
+import { GraphQLScalarType, GraphQLSchema } from 'graphql';
+import { AuthorizationProvider } from './authorization';
+import { GolemDefaults, DatamodelDocument, ModelsConfig } from './datamodel';
+import { GolemEventBus } from './events';
+import { ComputedFieldSpec, CustomOperationSpec } from './extensions';
+import { HookRegistry } from './hooks';
+import { GolemEngine } from './operations';
+export declare const DateTimeScalar: GraphQLScalarType<Date | null, unknown>;
+export interface BuildGolemSchemaOptions<TModels = Record<string, string>> {
+    datamodel: DatamodelDocument<TModels>;
+    client: Record<string, any>;
+    models?: ModelsConfig<TModels>;
+    defaults?: GolemDefaults;
+    eventBus?: GolemEventBus;
+    hooks?: HookRegistry;
+    engine?: GolemEngine;
+    computedFields?: readonly ComputedFieldSpec[];
+    customOperations?: readonly CustomOperationSpec[];
+    authorization?: AuthorizationProvider;
+}
+export declare function createGolemEngine<TModels>(options: BuildGolemSchemaOptions<TModels>): GolemEngine;
+export declare function subscribableModels<TModels>(options: Pick<BuildGolemSchemaOptions<TModels>, 'datamodel' | 'models' | 'defaults'>): Set<string>;
+export declare function buildGolemSchema<TModels>(options: BuildGolemSchemaOptions<TModels>): GraphQLSchema;