@entity-access/entity-access 1.0.2 → 1.0.5

package/src/tests/security/events/ProductEvents.ts

@@ -0,0 +1,92 @@
+import EntityAccessError from "../../../common/EntityAccessError.js";
+import Inject from "../../../di/di.js";
+import { IEntityQuery } from "../../../model/IFilterWithParameter.js";
+import EntityEvents from "../../../model/events/EntityEvents.js";
+import { Product, ProductCategory, ProductPrice } from "../../model/ShoppingContext.js";
+import { UserInfo } from "./UserInfo.js";
+const statusPublished = "published";
+
+export class ProductEvents extends EntityEvents<Product> {
+
+    @Inject
+    user: UserInfo;
+
+    filter(query: IEntityQuery<Product>): IEntityQuery<Product> {
+        const { userID } = this.user;
+
+        // admin can access everything so return null
+        if (this.user.admin) {
+            return null;
+        }
+        // everyone can read published or own products
+        return query.where({ userID, statusPublished }, (p) => (x) => x.ownerID === p.userID || x.status === p.statusPublished);
+    }
+
+    modify(query: IEntityQuery<Product>): IEntityQuery<Product> {
+        const { userID } = this.user;
+
+        // admin can access everything so return null
+        if (this.user.admin) {
+            return null;
+        }
+
+        // customer can modify its own products
+        return query.where({ userID }, (p) => (x) => x.ownerID === p.userID);
+    }
+
+}
+
+export class ProductCategoryEvents extends EntityEvents<ProductCategory> {
+
+    @Inject
+    user: UserInfo;
+
+    filter(query: IEntityQuery<ProductCategory>): IEntityQuery<ProductCategory> {
+        return null;
+    }
+
+    modify(query: IEntityQuery<ProductCategory>): IEntityQuery<ProductCategory> {
+        const { userID } = this.user;
+
+        // admin can access everything so return null
+        if (this.user.admin) {
+            return null;
+        }
+
+        EntityAccessError.throw("Access denied");
+    }
+
+}
+
+
+export class ProductPriceEvents extends EntityEvents<ProductPrice> {
+
+    @Inject
+    user: UserInfo;
+
+    filter(query: IEntityQuery<ProductPrice>): IEntityQuery<ProductPrice> {
+
+        const { userID } = this.user;
+
+        // admin can access everything so return null
+        if (this.user.admin) {
+            return null;
+        }
+
+        // user can view prices of only published or own products
+        return query.where({ userID, statusPublished } , (p) => (x) => x.product.status === p.statusPublished || x.product.ownerID === p.userID);
+    }
+
+    modify(query: IEntityQuery<ProductPrice>): IEntityQuery<ProductPrice> {
+        const { userID } = this.user;
+
+        // admin can access everything so return null
+        if (this.user.admin) {
+            return null;
+        }
+
+        // user can only edit its own prices
+        return query.where({ userID }, (p) => (x) => x.product.ownerID === p.userID);
+    }
+
+}

package/src/tests/security/events/UserEvents.ts

@@ -0,0 +1,18 @@
+import Inject from "../../../di/di.js";
+import { IEntityQuery } from "../../../model/IFilterWithParameter.js";
+import EntityEvents from "../../../model/events/EntityEvents.js";
+import { User } from "../../model/ShoppingContext.js";
+import { UserInfo } from "./UserInfo.js";
+export class UserEvents extends EntityEvents<User> {
+
+    @Inject
+    user: UserInfo;
+
+    filter(query: IEntityQuery<User>): IEntityQuery<User> {
+        if (this.user.admin) {
+            return null;
+        }
+        const { userID } = this.user;
+        return query.where({ userID }, (p) => (x) => x.userID === p.userID);
+    }
+}

package/src/tests/security/events/UserInfo.ts

@@ -0,0 +1,7 @@
+import { RegisterScoped } from "../../../di/di.js";
+
+@RegisterScoped
+export class UserInfo {
+    public userID: number;
+    public admin: boolean;
+}

package/src/tests/security/tests/place-order.ts

@@ -0,0 +1,71 @@
+import assert from "assert";
+import Logger from "../../../common/Logger.js";
+import { ServiceProvider } from "../../../di/di.js";
+import { BaseDriver } from "../../../drivers/base/BaseDriver.js";
+import ContextEvents from "../../../model/events/ContextEvents.js";
+import { TestConfig } from "../../TestConfig.js";
+import { ShoppingContext, User } from "../../model/ShoppingContext.js";
+import { createContext } from "../../model/createContext.js";
+import { ShoppingContextEvents } from "../ShoppingContextEvents.js";
+import { UserInfo } from "../events/UserInfo.js";
+
+export default async function(this: TestConfig) {
+
+    const customer = await createUser(this);
+
+    await addNewOrder.call(this, customer);
+
+    try {
+        await addNewOrder.call(this, customer, 1);
+        assert.fail("No error thrown");
+    } catch(error) {
+
+    }
+}
+
+
+async function addNewOrder(this: TestConfig, customer: User, userID?) {
+    const scope = ServiceProvider.global.createScope();
+    try {
+        const user = new UserInfo();
+        user.userID = userID ?? customer.userID;
+        scope.add(Logger, Logger.instance);
+        scope.add(BaseDriver, this.driver);
+        scope.add(UserInfo, user);
+        scope.add(ContextEvents, new ShoppingContextEvents());
+        const context = scope.create(ShoppingContext);
+        context.verifyFilters = true;
+
+        // get first headphone...
+        const headPhone = await context.products.all().firstOrFail();
+        const headPhonePrice = await context.productPrices.where({ id: headPhone.productID }, (p) => (x) => x.productID === p.id).firstOrFail();
+
+        context.orders.add({
+            customer,
+            orderDate: new Date(),
+            orderItems: [
+                context.orderItems.add({
+                    product: headPhone,
+                    productPrice: headPhonePrice,
+                    amount: headPhonePrice.amount,
+                })
+            ]
+        });
+
+        await context.saveChanges();
+
+    } finally {
+        scope.dispose();
+    }
+}
+
+async function createUser(config: TestConfig) {
+    const context = await createContext(config.driver);
+    config.driver.connectionString.database = context.driver.connectionString.database;
+    const user = context.users.add({
+        dateCreated: new Date()
+    });
+    await context.saveChanges();
+    return user;
+}
+

package/test.js

@@ -40,10 +40,8 @@ export default class TestRunner {
                 options: {
                     encrypt: true, // for azure
                     trustServerCertificate: true // change to true for local dev / self-signed certs
-                },
-                debug: true
+                }
             })
-
         ];
     }
 
@@ -89,14 +87,17 @@ export default class TestRunner {
 
 }
 
+const testDb = !process.argv.includes("no-db");
 
-await TestRunner.runAll("./dist/tests", true);
+await TestRunner.runAll("./dist/tests", testDb);
 
 let exitCode = 0;
+let failed = 0;
 
 for (const { error, name } of results) {
     if (error) {
         exitCode = 1;
+        failed++;
         console.error(`${name} failed`);
         console.error(error?.stack ?? error);
         continue;
@@ -104,4 +105,10 @@ for (const { error, name } of results) {
     console.log(`${name} executed.`);
 }
 
+if (exitCode === 0) {
+    console.log(`${results.length} tests ran successfully.`);
+} else {
+    console.log(`${failed} Tests out of ${results.length} failed.`);
+}
+
 process.exit(exitCode);

package/tsconfig.json

@@ -2,10 +2,12 @@
     "compilerOptions": {
         "target": "ESNext",
         "module":"NodeNext",
+        "incremental": true,
         "sourceMap": true,
         "declaration": true,
         "declarationMap": true,
         "outDir": "dist",
+        "skipDefaultLibCheck": true,
         "experimentalDecorators": true,
         "emitDecoratorMetadata": true,
         "lib": [

package/src/decorators/parser/MemberParser.ts

@@ -1,8 +0,0 @@
-export default class NameParser {
-    public static parseMember(text: ((a: any) => any)) {
-        const t: string = text.toString();
-
-        const index = t.lastIndexOf(".");
-        return t.substring(index + 1);
-    }
-}

package/src/model/EntitySchema.ts

@@ -1,21 +0,0 @@
-export class EntityColumn {
-    constructor(
-        public readonly name: string,
-        public readonly columnName: string,
-        public readonly storageType: string
-    ) {
-
-    }
-}
-
-export default class EntitySchema {
-
-    constructor(
-        public readonly name: string,
-        public readonly table: string,
-        public readonly columns: EntityColumn[],
-        public readonly schema?: string,
-    ) {
-    }
-
-}