@erxes/api-shared 0.0.0-stage → 3.2.19-2

package/src/core-modules/permissions/user-actions-map.ts

@@ -0,0 +1,170 @@
+import {
+  IBranchDocument,
+  IDepartmentDocument,
+} from '../../core-types/modules/structure/structure';
+import { IUserDocument } from '../../core-types';
+import { redis, sendTRPCMessage } from '../../utils';
+
+export const userActionsMap = async (
+  userPermissions: any[],
+  groupPermissions: any[],
+  user: any,
+): Promise<any> => {
+  const totalPermissions: any[] = [
+    ...userPermissions,
+    ...groupPermissions,
+    ...(user.customPermissions || []),
+  ];
+  const allowedActions: any = {};
+
+  const check = (name: string, allowed: boolean) => {
+    if (typeof allowedActions[name] === 'undefined') {
+      allowedActions[name] = allowed;
+    }
+
+    // if a specific permission is denied elsewhere, follow that rule
+    if (allowedActions[name] && !allowed) {
+      allowedActions[name] = false;
+    }
+  };
+
+  for (const { requiredActions, allowed, action } of totalPermissions) {
+    if (requiredActions.length > 0) {
+      for (const actionName of requiredActions) {
+        check(actionName, allowed);
+      }
+    } else {
+      check(action, allowed);
+    }
+  }
+
+  return allowedActions;
+};
+
+export const getUserActionsMap = async (
+  subdomain: string,
+  user: IUserDocument,
+  permissionsFind?: (query: any) => any,
+): Promise<any> => {
+  const key = `user_permissions_${user._id}`;
+  const permissionCache = await redis.get(key);
+
+  let actionMap: any;
+
+  if (permissionCache && permissionCache !== '{}') {
+    actionMap = JSON.parse(permissionCache);
+  } else {
+    const userPermissionQuery = {
+      userId: user._id,
+    };
+
+    const userPermissions = await (permissionsFind
+      ? permissionsFind(userPermissionQuery)
+      : sendTRPCMessage({
+          subdomain,
+
+          pluginName: 'core',
+          method: 'query',
+          module: 'permissions',
+          action: 'find',
+          input: {
+            query: userPermissionQuery,
+          },
+          defaultValue: [],
+        }));
+
+    const groupQuery = { $or: [] as any[] };
+
+    if (user?.branchIds?.length) {
+      const branches: IBranchDocument[] = await sendTRPCMessage({
+        subdomain,
+
+        pluginName: 'core',
+        method: 'query',
+        module: 'branches',
+        action: 'findWithChild',
+        input: {
+          query: {
+            _id: { $in: user.branchIds },
+          },
+          fields: {
+            _id: 1,
+          },
+        },
+        defaultValue: [],
+      });
+
+      groupQuery.$or.push({
+        branchIds: { $in: branches.map((branch) => branch._id) },
+      });
+    }
+
+    if (user?.departmentIds?.length) {
+      const departments: IDepartmentDocument[] = await sendTRPCMessage({
+        subdomain,
+
+        pluginName: 'core',
+        method: 'query',
+        module: 'departments',
+        action: 'findWithChild',
+        input: {
+          query: {
+            _id: { $in: user.departmentIds },
+          },
+          fields: {
+            _id: 1,
+          },
+        },
+        defaultValue: [],
+      });
+
+      groupQuery.$or.push({
+        departmentIds: {
+          $in: departments.map((department) => department._id),
+        },
+      });
+    }
+
+    let groupIds: string[] = [];
+
+    if (groupQuery?.$or?.length > 0) {
+      groupIds = await sendTRPCMessage({
+        subdomain,
+
+        pluginName: 'core',
+        method: 'query',
+        module: 'userGroups',
+        action: 'getIds',
+        input: {
+          query: groupQuery,
+        },
+        defaultValue: [],
+      });
+    }
+
+    const groupPermissionQuery = {
+      groupId: { $in: [...(user?.groupIds || []), ...groupIds] },
+    };
+
+    const groupPermissions = await (permissionsFind
+      ? permissionsFind(groupPermissionQuery)
+      : sendTRPCMessage({
+          subdomain,
+
+          pluginName: 'core',
+          method: 'query',
+          module: 'permissions',
+          action: 'find',
+          input: {
+            query: groupPermissionQuery,
+          },
+          defaultValue: [],
+        }));
+
+    actionMap = await userActionsMap(userPermissions, groupPermissions, user);
+
+    redis.set(key, JSON.stringify(actionMap));
+  }
+
+  return actionMap;
+};

package/src/core-modules/permissions/utils.ts

@@ -0,0 +1,317 @@
+import {
+  IPermissionAction,
+  IPermissionModule,
+  IUserDocument,
+  Resolver,
+} from '../../core-types';
+import {
+  getPlugin,
+  sendTRPCMessage,
+  redis,
+  getActivePlugins,
+  ExpectedError,
+} from '../../utils';
+
+export const checkLogin = (user?: IUserDocument) => {
+  if (!user?._id) {
+    throw new ExpectedError('Login required', 'UNAUTHORIZED');
+  }
+};
+
+export const wrapPermission = (resolver: Resolver, resolverKey: string) => {
+  return async (parent: any, args: any, context: any, info: any) => {
+    const { user } = context;
+
+    checkLogin(user);
+
+    return resolver(parent, args, context, info);
+  };
+};
+
+type GrantedPermission = {
+  plugin?: string;
+  module?: string;
+  actions?: string[];
+};
+
+const resolveActionNames = async (
+  permission: GrantedPermission,
+): Promise<string[]> => {
+  const actions = permission.actions || [];
+
+  if (!actions.includes('*')) return actions;
+
+  if (!permission.plugin || !permission.module) return [];
+
+  const plugin = await getPlugin(permission.plugin);
+  
+  const modules: IPermissionModule[] = plugin?.config?.meta?.permissions?.modules || [];
+  
+  const permissionModule = modules.find((m) => m.name === permission.module);
+
+  return (permissionModule?.actions || []).map((action) => action.name);
+};
+
+const applyPermissions = async (
+  actionsMap: Record<string, boolean>,
+  permissions: GrantedPermission[],
+) => {
+  for (const permission of permissions) {
+    for (const act of await resolveActionNames(permission)) {
+      actionsMap[act] = true;
+    }
+  }
+};
+
+const applyDefaultGroupActions = async (
+  actionsMap: Record<string, boolean>,
+  defaultGroupIds: string[],
+) => {
+  const plugins = await getActivePlugins();
+
+  for (const pluginName of plugins) {
+    const plugin = await getPlugin(pluginName);
+    const defaultGroups = plugin?.config?.meta?.permissions?.defaultGroups;
+
+    if (!defaultGroups) continue;
+
+    for (const group of defaultGroups) {
+      if (defaultGroupIds.includes(group.id)) {
+        await applyPermissions(actionsMap, group.permissions);
+      }
+    }
+  }
+};
+
+const applyCustomGroupActions = async (
+  actionsMap: Record<string, boolean>,
+  subdomain: string,
+  customGroupIds: string[],
+) => {
+  const groups = await sendTRPCMessage({
+    subdomain,
+    pluginName: 'core',
+    method: 'query',
+    module: 'permissionGroups',
+    action: 'find',
+    input: {
+      query: { _id: { $in: customGroupIds } },
+    },
+    defaultValue: [],
+  });
+
+  for (const group of groups) {
+    await applyPermissions(actionsMap, group.permissions || []);
+  }
+};
+
+export const getGroupActionsMap = async (
+  subdomain: string,
+  user: IUserDocument,
+): Promise<Record<string, boolean>> => {
+  const cacheKey = `user_actions_${user._id}`;
+
+  const cached = await redis.get(cacheKey);
+
+  if (cached) {
+    try {
+      const cachedActions: unknown = JSON.parse(cached);
+
+      if (
+        cachedActions &&
+        typeof cachedActions === 'object' &&
+        !Array.isArray(cachedActions) &&
+        Object.values(cachedActions).every(
+          (isAllowed) => typeof isAllowed === 'boolean',
+        )
+      ) {
+        return cachedActions as Record<string, boolean>;
+      }
+    } catch {
+      // Rebuild malformed permission cache entries below.
+    }
+
+    await redis.del(cacheKey);
+  }
+
+  const actionsMap: Record<string, boolean> = {};
+  const groupIds = user.permissionGroupIds || [];
+
+  const defaultGroupIds = groupIds.filter((id) => id.includes(':'));
+  const customGroupIds = groupIds.filter((id) => !id.includes(':'));
+
+  if (defaultGroupIds.length) {
+    await applyDefaultGroupActions(actionsMap, defaultGroupIds);
+  }
+
+  if (customGroupIds.length) {
+    await applyCustomGroupActions(actionsMap, subdomain, customGroupIds);
+  }
+
+  await applyPermissions(actionsMap, user.customPermissions || []);
+
+  await redis.set(cacheKey, JSON.stringify(actionsMap));
+
+  return actionsMap;
+};
+
+export const clearGroupActionsCache = async ({
+  subdomain,
+  userId,
+  groupId,
+}: {
+  subdomain?: string;
+  userId?: string;
+  groupId?: string;
+}) => {
+  if (userId) {
+    await redis.del(`user_actions_${userId}`);
+  }
+
+  if (groupId && subdomain) {
+    const users = await sendTRPCMessage({
+      subdomain,
+      pluginName: 'core',
+      method: 'query',
+      module: 'users',
+      action: 'find',
+      input: {
+        query: { permissionGroupIds: groupId },
+        fields: { _id: 1 },
+      },
+      defaultValue: [],
+    });
+
+    for (const u of users) {
+      await redis.del(`user_actions_${u._id}`);
+    }
+  }
+};
+
+export const canGroup = async (
+  subdomain: string,
+  action: string,
+  user?: IUserDocument,
+): Promise<boolean> => {
+  if (!user || !user._id) return false;
+
+  if (user.isOwner) return true;
+
+  const actionsMap = await getGroupActionsMap(subdomain, user);
+
+  return actionsMap[action] === true;
+};
+
+/** Whether a plugin action names its own OAuth scopes in its permission config. */
+export const hasDeclaredOAuthScopes = (
+  action: Pick<IPermissionAction, 'oauthScope' | 'oauthScopes'>,
+): boolean => Boolean(action.oauthScopes?.length || action.oauthScope);
+
+/**
+ * OAuth scopes that grant an action. Declared scopes win; an action without
+ * any (every non-core plugin today) maps to one scope for its whole module,
+ * `<plugin>-<module>:manage`, so OAuth clients can be granted it on the
+ * approval page and enforcement has something to compare against.
+ */
+export const resolveActionOAuthScopes = (
+  pluginName: string,
+  module: Pick<IPermissionModule, 'name'>,
+  action: Pick<IPermissionAction, 'oauthScope' | 'oauthScopes'>,
+): string[] => {
+  if (action.oauthScopes?.length) {
+    return action.oauthScopes;
+  }
+
+  if (action.oauthScope) {
+    return [action.oauthScope];
+  }
+
+  return [`${pluginName}-${module.name}:manage`];
+};
+
+const getOAuthActionScopeMap = async () => {
+  const activePlugins = await getActivePlugins();
+  const scopeMap: Record<string, string[]> = {};
+
+  for (const pluginName of activePlugins) {
+    const plugin = await getPlugin(pluginName);
+    const modules = plugin?.config?.meta?.permissions?.modules || [];
+
+    for (const module of modules) {
+      for (const action of module.actions || []) {
+        scopeMap[action.name] = resolveActionOAuthScopes(
+          pluginName,
+          module,
+          action,
+        );
+      }
+    }
+  }
+
+  return scopeMap;
+};
+
+const checkOAuthScope = async (action: string, user?: IUserDocument) => {
+  const oauthScopes = (
+    (user || {}) as IUserDocument & {
+      oauthScopes?: string[];
+    }
+  ).oauthScopes;
+
+  // Only OAuth-token sessions carry `oauthScopes` (the gateway sets it from
+  // the token's scope claim); a normal login has none and is not scope-checked.
+  if (oauthScopes === undefined) {
+    return;
+  }
+
+  // An OAuth token that was granted no scopes must not fall through to the
+  // user's full permissions.
+  if (oauthScopes.length === 0) {
+    throw new ExpectedError('OAuth scope required', 'FORBIDDEN');
+  }
+
+  const scopeMap = await getOAuthActionScopeMap();
+  const actionScopes = scopeMap[action] || [];
+
+  if (
+    actionScopes.length === 0 ||
+    !actionScopes.some((scope) => oauthScopes.includes(scope))
+  ) {
+    throw new ExpectedError('OAuth scope required', 'FORBIDDEN');
+  }
+};
+
+export const checkPermissionGroup = (
+  subdomain: string,
+  user?: IUserDocument,
+) => {
+  return async (action: string) => {
+    checkLogin(user);
+
+    const allowed = await canGroup(subdomain, action, user);
+
+    if (!allowed) {
+      throw new ExpectedError('Permission required', 'FORBIDDEN');
+    }
+
+    await checkOAuthScope(action, user);
+  };
+};
+
+export const wrapPublicResolver = (resolver: Resolver, wrapperConfig: any) => {
+  return async (parent: any, args: any, context: any, info: any) => {
+    const { cpUserRequired, forClientPortal } = wrapperConfig || {};
+
+    if (forClientPortal) {
+      if (!context.clientPortal) {
+        throw new ExpectedError('Client portal required', 'UNAUTHORIZED');
+      }
+
+      if (cpUserRequired && !context.cpUser) {
+        throw new ExpectedError('Client portal user required', 'UNAUTHORIZED');
+      }
+    }
+
+    return resolver(parent, args, context, info);
+  };
+};

package/src/core-modules/properties/README.md

@@ -0,0 +1,161 @@
+# Filtering by `propertiesData`
+
+Custom properties are stored in a single `propertiesData` bag on the record.
+This module owns the one filter format every query uses, so a query only has to
+accept a string and hand it to `buildPropertyFilter`.
+
+## What the data looks like
+
+```js
+propertiesData: {
+  // a plain field: key is the field _id, value is whatever that type stores
+  'r3i7wgefyiavf': 'MUIS',
+  'kEpqOxKa8gRLW': ['mn', 'en'],
+
+  // a repeating group: key is the group _id behind `g:`, value is a row array
+  'g:7TEEie5SOcmJWlsFMf68C': [
+    { _id: '8qA2BosS7qquYlQ073X1r', ACMWGZ65G_ipgH: '10', buBHlIEfOv4W: '21312412' },
+    { _id: 'kobCVPjoZjaQYG9cekTHg', ACMWGZ65G_ipgH: '5',  buBHlIEfOv4W: '1' },
+  ],
+}
+```
+
+Rows carry their own `_id` so they can be reordered and addressed. The schema is
+`Schema.Types.Mixed` — nothing is coerced, values are stored exactly as the form
+sent them.
+
+## The filter string
+
+One condition per entry, entries joined by `;`:
+
+```
+<fieldKey>:<operator>[:<value>]
+```
+
+- Every segment is percent-encoded, so a value may contain `:` `;` `,` `/` `~`.
+- No-value operators (`isSet`, `isTrue`, …) omit the value segment.
+- Multi-value operators (`in`, `notIn`, `fileType`) take a comma-separated list.
+
+```
+plan:eq:pro;kEpqOxKa8gRLW:in:mn,en;note:contains:a%3Ab
+```
+
+## Field keys
+
+| Key                     | Meaning                               |
+| ----------------------- | ------------------------------------- |
+| `<fieldId>`             | a plain property                      |
+| `g:<groupId>/<fieldId>` | a repeating-group field, **same row** |
+| `g:<groupId>~<fieldId>` | a repeating-group field, **any row**  |
+
+`:` `/` `~` never occur in a nanoid, so no split can cut an id in half. Build
+keys with `toPropertyRowKey(groupId, fieldId, anyRow)` rather than by hand.
+
+### same row vs any row
+
+Only matters when one group carries two or more conditions.
+
+**Same row** folds them into a single `$elemMatch` — one row has to satisfy all
+of them:
+
+```js
+{ 'propertiesData.g:edu': { $elemMatch: { school: {...}, year: {...} } } }
+```
+
+**Any row** keeps them apart — each condition may be satisfied by a different
+row:
+
+```js
+$and: [
+  { 'propertiesData.g:edu': { $elemMatch: { school: {...} } } },
+  { 'propertiesData.g:edu': { $elemMatch: { year: {...} } } },
+]
+```
+
+Use same row when the conditions describe one entry ("graduated MUIS in 2020").
+Use any row when the group is just a list ("speaks English" and "has a licence",
+which need not be the same line). The filter UI defaults to any row and lets the
+user flip a group; segments always compile to same row.
+
+Conditions of _different_ groups are always independent.
+
+## Operators
+
+| Operator              | Value | Mongo                                                  |
+| --------------------- | ----- | ------------------------------------------------------ |
+| `eq`                  | one   | `$in: [value]` (numeric strings also match the number) |
+| `ne`                  | one   | `$nin: [value]`                                        |
+| `gt` `gte` `lt` `lte` | one   | `$gt` … (numeric strings become numbers)               |
+| `contains`            | one   | `$regex`, case-insensitive, escaped                    |
+| `doesNotContain`      | one   | `$not: $regex`                                         |
+| `in`                  | many  | `$in: [...]`                                           |
+| `notIn`               | many  | `$nin: [...]`                                          |
+| `isTrue`              | —     | `$in: [true, 'true', 'Yes', 'yes']`                    |
+| `isFalse`             | —     | `$in: [false, 'false', 'No', 'no', null]`              |
+| `isSet`               | —     | `$exists: true, $nin: [null, '', []]`                  |
+| `isNotSet`            | —     | missing, `null` or `''`                                |
+| `fileType`            | many  | `$regex` on `<path>.type`                              |
+
+When a condition carries a `type` but no operator, the default comes from
+`PROPERTY_FILTER_OPERATOR_BY_TYPE`: `boolean → isTrue`, `number → eq`,
+`date → eq`, `multiSelect`/`check` → `in`, everything else `contains`.
+
+## Applying it in a query
+
+```ts
+import { buildPropertyFilter } from 'erxes-api-shared/core-modules';
+
+if (propertiesData) {
+  const propertyConditions = buildPropertyFilter(propertiesData);
+
+  if (propertyConditions.length) {
+    filter.$and = [...(filter.$and || []), ...propertyConditions];
+  }
+}
+```
+
+`buildPropertyFilter` takes the encoded string or an already-parsed
+`IPropertyFilterCondition[]`. Pass `{ prefix }` when the bag is not at
+`propertiesData` on the document.
+
+To expose it on a new query, add the argument to the schema as a `String`:
+
+```graphql
+propertiesData: String
+```
+
+Wired today: `customers` (`modules/contacts/utils.ts`), `products`
+(`modules/products/.../product.ts`) and `poscProducts` (`posclient_api`).
+
+Not wired, though the surrounding code would support it: `companies` /
+`cpCompanies` (the shared contacts `generateFilter` already handles
+`propertiesData`, but the schema never declares the argument) and
+`cpPoscProducts`.
+
+## The filter UI
+
+`PropertiesFilter` (in `ui-modules`) reads and writes the same string on the
+`propertiesData` query-string key, so the URL is the whole filter state.
+
+```tsx
+<PropertiesFilter.Bar contentType="core:customer" />   // active chips
+<PropertiesFilter.View contentType="core:customer" />  // the picker
+<PropertiesFilter />                                    // the command entry
+```
+
+Which operators a field offers comes from `OPERATOR_BY_TYPE` in
+`ui-modules/.../constants/field_operators.ts`. `propertyUtils.ts` mirrors the
+key helpers for the browser; keep the two in step.
+
+## Things that will bite you
+
+- **A malformed entry is dropped silently.** An unknown operator, a missing
+  `:`, or JSON passed instead of the DSL produces no condition and no error —
+  the query then returns everything. Check the built filter, not the input.
+- **`contains` is a regex, so it only matches strings.** A field stored as a
+  number will never match it. Number-typed fields are offered `eq`/`gt`/… for
+  exactly this reason.
+- **Row keys are not document keys.** `g:<gid>/<fid>` addresses a field for
+  filtering; inside the document the row object is keyed by the bare `<fid>`.
+- **Export columns use their own suffix.** `propertiesData.g:<gid>/<fid>#2` is
+  the second row's column — see `importExport.ts`, not this file.