@flowerforce/flowerbase 1.7.6-beta.5 → 1.7.6-beta.7

package/dist/utils/roles/machines/fieldPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fieldPermissions.d.ts","sourceRoot":"","sources":["../../../../src/utils/roles/machines/fieldPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAElC,OAAO,EAGL,IAAI,EACL,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AA4C5C,eAAO,MAAM,0BAA0B,GAAI,OAAO,IAAI,YACN,CAAA;AAEhD,eAAO,MAAM,gCAAgC,GAC3C,SAAS,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,EACzD,MAAM,MAAM,GAAG,OAAO,EACtB,UAAU;IACR,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,KACA,OAAO,CAAC,QAAQ,CAyBlB,CAAA"}
+{"version":3,"file":"fieldPermissions.d.ts","sourceRoot":"","sources":["../../../../src/utils/roles/machines/fieldPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAElC,OAAO,EAGL,IAAI,EACL,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AA0C5C,eAAO,MAAM,0BAA0B,GAAI,OAAO,IAAI,YACN,CAAA;AAEhD,eAAO,MAAM,gCAAgC,GAC3C,SAAS,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,EACzD,MAAM,MAAM,GAAG,OAAO,EACtB,UAAU;IACR,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,KACA,OAAO,CAAC,QAAQ,CAkClB,CAAA"}

package/dist/utils/roles/machines/fieldPermissions.js

@@ -26,12 +26,9 @@ const getAdditionalFieldPermission = (additionalFields, fieldName) => {
     return undefined;
 };
 const canReadField = (context, permission) => __awaiter(void 0, void 0, void 0, function* () {
-    if (!permission)
-        return false;
-    const read = yield (0, helpers_1.evaluateExpression)(context.params, permission.read, context.user);
-    if (read)
-        return true;
-    return yield (0, helpers_1.evaluateExpression)(context.params, permission.write, context.user);
+    if (!permission || typeof permission.read === 'undefined')
+        return undefined;
+    return yield (0, helpers_1.evaluateExpression)(context.params, permission.read, context.user);
 });
 const canWriteField = (context, permission) => __awaiter(void 0, void 0, void 0, function* () {
     if (!permission)
@@ -49,14 +46,23 @@ const filterDocumentByFieldPermissions = (context, mode, options) => __awaiter(v
     const fields = (_b = context.role.fields) !== null && _b !== void 0 ? _b : {};
     const additionalFields = context.role.additional_fields;
     for (const [key, value] of Object.entries(source)) {
+        if (mode === 'read' && key === '_id') {
+            document[key] = value;
+            continue;
+        }
         const fieldPermission = fields[key];
         const permission = fieldPermission !== null && fieldPermission !== void 0 ? fieldPermission : getAdditionalFieldPermission(additionalFields, key);
         let allowed = (options === null || options === void 0 ? void 0 : options.defaultAllow) === true;
         if (permission) {
-            allowed =
-                mode === 'read'
-                    ? yield canReadField(context, permission)
-                    : yield canWriteField(context, permission);
+            if (mode === 'read') {
+                const readAllowed = yield canReadField(context, permission);
+                if (typeof readAllowed !== 'undefined') {
+                    allowed = readAllowed;
+                }
+            }
+            else {
+                allowed = yield canWriteField(context, permission);
+            }
         }
         if (allowed) {
             document[key] = value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowerforce/flowerbase",
-  "version": "1.7.6-beta.5",
+  "version": "1.7.6-beta.7",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/utils/__tests__/checkIsValidFieldNameFn.test.ts

@@ -32,8 +32,8 @@ describe('checkIsValidFieldNameFn', () => {
 
     const result = await checkIsValidFieldNameFn(context)
     expect(result).toEqual({
-      name: 'Alice',
-      email: 'alice@example.com'
+      _id: mockId,
+      name: 'Alice'
     })
   })
 
@@ -56,8 +56,58 @@ describe('checkIsValidFieldNameFn', () => {
 
     const result = await checkIsValidFieldNameFn(context)
     expect(result).toEqual({
-      phone: '123456789',
-      address: 'Unknown'
+      _id: mockId,
+      phone: '123456789'
+    })
+  })
+
+  it('keeps fields readable when top-level read is true and the field only defines write rules', async () => {
+    const mockedRole = {
+      name: 'test',
+      apply_when: { '%%true': true },
+      read: true,
+      fields: {
+        avatar: { write: false },
+        name: { write: true }
+      }
+    } as Role
+    const context = {
+      user: mockUser,
+      role: mockedRole,
+      params: {
+        type: 'read',
+        cursor: { _id: mockId, avatar: 'avatar.png', name: 'Alice' }
+      }
+    } as MachineContext
+
+    const result = await checkIsValidFieldNameFn(context)
+    expect(result).toEqual({
+      _id: mockId,
+      avatar: 'avatar.png',
+      name: 'Alice'
+    })
+  })
+
+  it('always keeps _id in read results even when no field read rule is defined', async () => {
+    const mockedRole = {
+      name: 'test',
+      apply_when: { '%%true': true },
+      fields: {
+        name: { read: true }
+      }
+    } as Role
+    const context = {
+      user: mockUser,
+      role: mockedRole,
+      params: {
+        type: 'read',
+        cursor: { _id: mockId, email: 'alice@example.com' }
+      }
+    } as MachineContext
+
+    const result = await checkIsValidFieldNameFn(context)
+    expect(result).toEqual({
+      _id: mockId
     })
   })
 
@@ -122,6 +172,8 @@ describe('checkIsValidFieldNameFn', () => {
     } as MachineContext
 
     const result = await checkIsValidFieldNameFn(context)
-    expect(result).toEqual({})
+    expect(result).toEqual({
+      _id: mockId
+    })
   })
 })

package/src/utils/roles/machines/fieldPermissions.ts

@@ -35,10 +35,8 @@ const canReadField = async (
   context: Pick<MachineContext, 'params' | 'user'>,
   permission?: FieldPermissionExpression
 ) => {
-  if (!permission) return false
-  const read = await evaluateExpression(context.params, permission.read, context.user)
-  if (read) return true
-  return await evaluateExpression(context.params, permission.write, context.user)
+  if (!permission || typeof permission.read === 'undefined') return undefined
+  return await evaluateExpression(context.params, permission.read, context.user)
 }
 
 const canWriteField = async (
@@ -67,14 +65,23 @@ export const filterDocumentByFieldPermissions = async (
   const additionalFields = context.role.additional_fields
 
   for (const [key, value] of Object.entries(source)) {
+    if (mode === 'read' && key === '_id') {
+      document[key] = value
+      continue
+    }
+
     const fieldPermission = fields[key]
     const permission = fieldPermission ?? getAdditionalFieldPermission(additionalFields, key)
     let allowed = options?.defaultAllow === true
     if (permission) {
-      allowed =
-        mode === 'read'
-          ? await canReadField(context, permission)
-          : await canWriteField(context, permission)
+      if (mode === 'read') {
+        const readAllowed = await canReadField(context, permission)
+        if (typeof readAllowed !== 'undefined') {
+          allowed = readAllowed
+        }
+      } else {
+        allowed = await canWriteField(context, permission)
+      }
     }
 
     if (allowed) {