@holoyan/adonisjs-permissions 0.1.0

package/build/src/services/permissions/permissions_service.d.ts

@@ -0,0 +1,92 @@
+import { ModelQueryBuilderContract } from '@adonisjs/lucid/types/model';
+import ModelPermission from '../../models/model_permission.js';
+import Permission from '../../models/permission.js';
+import { ModelPermissionsQuery } from '../../types.js';
+import BaseService from '../base_service.js';
+export default class PermissionsService extends BaseService {
+    /**
+     * return all permissions, including fodbidden
+     */
+    all(modelType: string, modelId: number, includeForbiddens?: boolean): Promise<Permission[]>;
+    /**
+     * return only global assigned permissions, through role or direct
+     */
+    global(modelType: string, modelId: number, includeForbiddens?: boolean): Promise<Permission[]>;
+    /**
+     * get all permissions which is assigned to concrete resource
+     */
+    onResource(modelType: string, modelId: number, includeForbiddens?: boolean): Promise<Permission[]>;
+    /**
+     * all direct permissions
+     */
+    direct(modelType: string, modelId: number, includeForbiddens?: boolean): ModelQueryBuilderContract<typeof Permission, Permission>;
+    directGlobal(modelType: string, modelId: number, includeForbiddens?: boolean): ModelQueryBuilderContract<typeof Permission, Permission>;
+    /**
+     * return direct and resource assigned permissions
+     */
+    directResource(modelType: string, modelId: number, includeForbiddens?: boolean): ModelQueryBuilderContract<typeof Permission, Permission>;
+    /**
+     * @param modelType
+     * @param modelId
+     * @param permisison
+     * @returns
+     */
+    hasAnyDirect(modelType: string, modelId: number, permisisons: (string | Permission)[], entityType: string | null, entityId: number | null): Promise<boolean>;
+    hasAllDirect(modelType: string, modelId: number, permisisons: (string | Permission)[], entityType: string | null, entityId: number | null): Promise<boolean>;
+    /**
+     * has all permissions
+     */
+    hasAll(modelType: string, modelId: number, permisisons: (string | Permission)[], entityType: string | null, entityId: number | null): Promise<boolean>;
+    /**
+     * has any of permissions
+     */
+    hasAny(modelType: string, modelId: number, permisison: (string | Permission)[], entityType: string | null, entityId: number | null): Promise<boolean>;
+    /**
+     * has all permissions
+     */
+    containsAll(modelType: string, modelId: number, permisison: (string | Permission)[]): Promise<boolean>;
+    /**
+     * has any of permissions
+     */
+    containsAny(modelType: string, modelId: number, permisison: (string | Permission)[]): Promise<boolean>;
+    /**
+     * has all permissions
+     */
+    containsAllDirect(modelType: string, modelId: number, permisison: (string | Permission)[]): Promise<boolean>;
+    /**
+     * has any of permissions
+     */
+    containsAnyDirect(modelType: string, modelId: number, permisison: (string | Permission)[]): Promise<boolean>;
+    /**
+     * check if permission is forbidden, if there is same permission with allowed=false then return true;
+     */
+    forbidden(modelType: string, modelId: number, permisison: string | Permission, entityType: string | null, entityId: number | null): boolean;
+    /**
+     * give permission to model
+     */
+    giveAll(modelType: string, modelId: number, slugs: string[], entityType: string | null, entityId: number | null, allowed: boolean): Promise<ModelPermission[]>;
+    revokeAll(modelType: string, modelId: number, permissions: string[], entityType: string | null, entityId: number | null): ModelQueryBuilderContract<typeof ModelPermission, ModelPermission>;
+    flush(modelType: string, modelId: number): ModelQueryBuilderContract<typeof ModelPermission, any>;
+    /**
+     * sync permissions, remove everything outside of the list
+     */
+    sync(modelType: string, modelId: number, permissionId: string[]): Promise<ModelPermission[]>;
+    /**
+     * forbid permission on model
+     */
+    forbid(modelType: string, modelId: number, permissionSlug: string, entityType: string | null, entityId: number | null): Promise<ModelPermission[]>;
+    /**
+     * forbid permission on model
+     */
+    forbidAll(modelType: string, modelId: number, permissionsSlug: string[], entityType: string | null, entityId: number | null): Promise<ModelPermission[]>;
+    /**
+     * to remove forbidden permission on model
+     */
+    unforbidAll(modelType: string, modelId: number, permissionsSlug: string[], entityType: string | null, entityId: number | null): Promise<any[]>;
+    findBySlug(slug: string, allowed?: boolean): Promise<Permission>;
+    private modelPermissionQueryWithForbiddenCheck;
+    private modelPermissionQuery;
+    reverseModelPermissionQuery(conditions: Partial<ModelPermissionsQuery>): ModelQueryBuilderContract<typeof ModelPermission, ModelPermission>;
+    findAssignableEntity(permisison: string[], entityClass: string | null, entityId: number | null, allowed: boolean): ModelQueryBuilderContract<typeof Permission, Permission>;
+    private applyTargetRestriction;
+}

package/build/src/services/permissions/permissions_service.js

@@ -0,0 +1,438 @@
+import ModelPermission from '../../models/model_permission.js';
+import ModelRole from '../../models/model_role.js';
+import Permission from '../../models/permission.js';
+import Role from '../../models/role.js';
+import BaseService from '../base_service.js';
+import { morphMap } from '../helper.js';
+export default class PermissionsService extends BaseService {
+    /**
+     * return all permissions, including fodbidden
+     */
+    async all(modelType, modelId, includeForbiddens = false) {
+        const map = await morphMap();
+        return this.modelPermissionQuery({
+            modelType,
+            modelId,
+            directPermissions: map.getAlias(Role) === modelType,
+            includeForbiddens,
+        })
+            .groupBy(Permission.table + '.id')
+            .select(Permission.table + '.*');
+    }
+    /**
+     * return only global assigned permissions, through role or direct
+     */
+    async global(modelType, modelId, includeForbiddens = false) {
+        const map = await morphMap();
+        return this.modelPermissionQuery({
+            modelType,
+            modelId,
+            directPermissions: map.getAlias(Role) === modelType,
+            includeForbiddens,
+        })
+            .where(Permission.table + '.entity_type', '*')
+            .whereNull(Permission.table + '.entity_id')
+            .groupBy(Permission.table + '.id')
+            .select(Permission.table + '.*');
+    }
+    /**
+     * get all permissions which is assigned to concrete resource
+     */
+    async onResource(modelType, modelId, includeForbiddens = false) {
+        const map = await morphMap();
+        return this.modelPermissionQuery({
+            modelType,
+            modelId,
+            directPermissions: map.getAlias(Role) === modelType,
+            includeForbiddens,
+        })
+            .where(Permission.table + '.entity_type', '!=', '*')
+            .groupBy(Permission.table + '.id')
+            .select(Permission.table + '.*');
+    }
+    /**
+     * all direct permissions
+     */
+    direct(modelType, modelId, includeForbiddens = false) {
+        return this.modelPermissionQuery({
+            modelType,
+            modelId,
+            directPermissions: true,
+            includeForbiddens,
+        })
+            .groupBy(Permission.table + '.id')
+            .select(Permission.table + '.*');
+    }
+    directGlobal(modelType, modelId, includeForbiddens = false) {
+        return this.modelPermissionQuery({
+            modelType,
+            modelId,
+            directPermissions: true,
+            includeForbiddens,
+        })
+            .whereNull(Permission.table + '.entity_id')
+            .groupBy(Permission.table + '.id')
+            .select(Permission.table + '.*');
+    }
+    /**
+     * return direct and resource assigned permissions
+     */
+    directResource(modelType, modelId, includeForbiddens = false) {
+        return this.modelPermissionQuery({
+            modelType,
+            modelId,
+            directPermissions: true,
+            includeForbiddens,
+        })
+            .whereNotNull(Permission.table + '.entity_id')
+            .groupBy(Permission.table + '.id')
+            .select(Permission.table + '.*');
+    }
+    /**
+     * @param modelType
+     * @param modelId
+     * @param permisison
+     * @returns
+     */
+    async hasAnyDirect(modelType, modelId, permisisons, entityType, entityId) {
+        const { slugs, ids } = this.formatList(permisisons);
+        const q = this.modelPermissionQueryWithForbiddenCheck({
+            modelType,
+            modelId,
+            directPermissions: true,
+            permissionSlugs: slugs,
+            permissionIds: ids,
+        });
+        this.applyTargetRestriction(q, entityType, entityId);
+        const r = await q.groupBy(Permission.table + '.id').select(Permission.table + '.id');
+        return r.length > 0;
+    }
+    async hasAllDirect(modelType, modelId, permisisons, entityType, entityId) {
+        const { slugs, ids } = this.formatList(permisisons);
+        const q = this.modelPermissionQueryWithForbiddenCheck({
+            modelType,
+            modelId,
+            directPermissions: true,
+            permissionSlugs: slugs,
+            permissionIds: ids,
+        });
+        this.applyTargetRestriction(q, entityType, entityId);
+        const r = await q.groupBy(Permission.table + '.id').select(Permission.table + '.id');
+        return r.length >= permisisons.length;
+    }
+    /**
+     * has all permissions
+     */
+    async hasAll(modelType, modelId, permisisons, entityType, entityId) {
+        const map = await morphMap();
+        const { slugs, ids } = this.formatList(permisisons);
+        const q = this.modelPermissionQueryWithForbiddenCheck({
+            modelType,
+            modelId,
+            directPermissions: map.getAlias(Role) === modelType,
+            permissionSlugs: slugs,
+            permissionIds: ids,
+        });
+        this.applyTargetRestriction(q, entityType, entityId);
+        const r = await q.groupBy(Permission.table + '.id').select(Permission.table + '.id');
+        return r.length >= permisisons.length;
+    }
+    /**
+     * has any of permissions
+     */
+    async hasAny(modelType, modelId, permisison, entityType, entityId) {
+        const map = await morphMap();
+        const { slugs, ids } = this.formatList(permisison);
+        const q = this.modelPermissionQueryWithForbiddenCheck({
+            modelType,
+            modelId,
+            directPermissions: map.getAlias(Role) === modelType,
+            permissionSlugs: slugs,
+            permissionIds: ids,
+        });
+        this.applyTargetRestriction(q, entityType, entityId);
+        const r = await q.groupBy(Permission.table + '.id').select(Permission.table + '.id');
+        return r.length > 0;
+    }
+    /**
+     * has all permissions
+     */
+    async containsAll(modelType, modelId, permisison) {
+        const map = await morphMap();
+        const { slugs, ids } = this.formatList(permisison);
+        const q = this.modelPermissionQuery({
+            modelType,
+            modelId,
+            directPermissions: map.getAlias(Role) === modelType,
+            permissionSlugs: slugs,
+            permissionIds: ids,
+        }).groupBy(Permission.table + '.id');
+        const r = await q.select(Permission.table + '.id');
+        return r.length >= permisison.length;
+    }
+    /**
+     * has any of permissions
+     */
+    async containsAny(modelType, modelId, permisison) {
+        const map = await morphMap();
+        const { slugs, ids } = this.formatList(permisison);
+        const q = this.modelPermissionQuery({
+            modelType,
+            modelId,
+            directPermissions: map.getAlias(Role) === modelType,
+            permissionSlugs: slugs,
+            permissionIds: ids,
+        }).groupBy(Permission.table + '.id');
+        const r = await q.select(Permission.table + '.id');
+        // @ts-ignore
+        return r.length > 0;
+    }
+    /**
+     * has all permissions
+     */
+    async containsAllDirect(modelType, modelId, permisison) {
+        const { slugs, ids } = this.formatList(permisison);
+        const q = this.modelPermissionQuery({
+            modelType,
+            modelId,
+            directPermissions: true,
+            permissionSlugs: slugs,
+            permissionIds: ids,
+        }).groupBy(Permission.table + '.id');
+        const r = await q.select(Permission.table + '.id');
+        return r.length >= permisison.length;
+    }
+    /**
+     * has any of permissions
+     */
+    async containsAnyDirect(modelType, modelId, permisison) {
+        const { slugs, ids } = this.formatList(permisison);
+        const q = this.modelPermissionQuery({
+            modelType,
+            modelId,
+            directPermissions: true,
+            permissionSlugs: slugs,
+            permissionIds: ids,
+        }).groupBy(Permission.table + '.id');
+        const r = await q.select(Permission.table + '.id');
+        // @ts-ignore
+        return r.length > 0;
+    }
+    /**
+     * check if permission is forbidden, if there is same permission with allowed=false then return true;
+     */
+    forbidden(modelType, modelId, permisison, entityType, entityId) {
+        return !this.hasAny(modelType, modelId, [permisison], entityType, entityId);
+    }
+    /**
+     * give permission to model
+     */
+    async giveAll(modelType, modelId, slugs, entityType, entityId, allowed) {
+        // if entityType is not null then we need to assigne permission for specific entity
+        let permissions = await this.findAssignableEntity(slugs, entityType, entityId, allowed);
+        //if no permissions then we will create permission for this specific entity
+        let createManyData = [];
+        let permissionIds = [];
+        for (const slug of slugs) {
+            const found = permissions.find((i) => i.slug === slug);
+            if (!found) {
+                createManyData.push({
+                    slug,
+                    title: slug,
+                    entityType,
+                    entityId,
+                    allowed,
+                });
+            }
+            else {
+                permissionIds.push(found.id);
+            }
+        }
+        if (createManyData.length) {
+            const newPermissions = await Permission.createMany(createManyData);
+            newPermissions.map((i) => permissionIds.push(i.id));
+        }
+        let modelPermissionMany = permissionIds.map((i) => ({
+            modelType: modelType,
+            modelId: modelId,
+            permissionId: i,
+        }));
+        return ModelPermission.createMany(modelPermissionMany);
+    }
+    revokeAll(modelType, modelId, permissions, entityType, entityId) {
+        const q = ModelPermission.query()
+            .leftJoin(Permission.table + ' as p', 'p.id', '=', ModelPermission.table + '.permission_id')
+            .whereIn('p.slug', permissions)
+            .where('p.allowed', true)
+            .where(ModelPermission.table + '.model_type', modelType)
+            .where(ModelPermission.table + '.model_id', modelId);
+        if (entityType) {
+            q.where('p.entity_type', entityType);
+            if (entityId) {
+                q.where('p.entity_id', entityId);
+            }
+        }
+        return q;
+    }
+    flush(modelType, modelId) {
+        return ModelPermission.query()
+            .where(ModelPermission.table + '.model_type', modelType)
+            .where(ModelPermission.table + '.model_id', modelId)
+            .delete();
+    }
+    /**
+     * sync permissions, remove everything outside of the list
+     */
+    async sync(modelType, modelId, permissionId) {
+        await ModelPermission.query().where('model_type', modelType).where('model_id', modelId).delete();
+        const many = await this.giveAll(modelType, modelId, permissionId, null, null, true);
+        return many;
+    }
+    /**
+     * forbid permission on model
+     */
+    async forbid(modelType, modelId, permissionSlug, entityType, entityId) {
+        return this.forbidAll(modelType, modelId, [permissionSlug], entityType, entityId);
+    }
+    /**
+     * forbid permission on model
+     */
+    async forbidAll(modelType, modelId, permissionsSlug, entityType, entityId) {
+        return this.giveAll(modelType, modelId, permissionsSlug, entityType, entityId, false);
+    }
+    /**
+     * to remove forbidden permission on model
+     */
+    async unforbidAll(modelType, modelId, permissionsSlug, entityType, entityId) {
+        // todo replace using reverseModelPermissionQuery() method
+        const q = ModelPermission.query()
+            .leftJoin(Permission.table + ' as p', 'p.id', '=', ModelPermission.table + '.permission_id')
+            .where('model_type', modelType)
+            .where('model_id', modelId)
+            .whereIn('p.slug', permissionsSlug)
+            .where('p.allowed', false);
+        if (entityType) {
+            q.where('p.entity_type', entityType);
+            if (entityId) {
+                q.where('p.entity_id', entityId);
+            }
+        }
+        return q.delete();
+    }
+    findBySlug(slug, allowed = true) {
+        return Permission.query().where('slug', slug).where('allowed', allowed).firstOrFail();
+    }
+    modelPermissionQueryWithForbiddenCheck(conditions) {
+        const q = this.modelPermissionQuery(conditions);
+        q.whereNotExists((subQuery) => {
+            subQuery
+                .from(Permission.table + ' as p2')
+                .join(ModelPermission.table + ' as mp2', 'mp2.permission_id', '=', 'p2.id')
+                .where('p2.allowed', false)
+                .whereRaw('p2.slug=' + Permission.table + '.slug')
+                .whereRaw('mp2.id=mp.id');
+        });
+        return q;
+    }
+    modelPermissionQuery(conditions) {
+        const { modelId, modelType, permissionSlugs, directPermissions, includeForbiddens } = conditions;
+        const q = Permission.query().join(ModelPermission.table + ' as mp', 'mp.permission_id', '=', Permission.table + '.id');
+        if (modelId && modelType) {
+            if (directPermissions) {
+                q.where('mp.model_type', modelType).where('mp.model_id', modelId);
+            }
+            else {
+                q.join(ModelRole.table + ' as mr', (joinQuery) => {
+                    joinQuery.onVal('mr.model_type', modelType).onVal('mr.model_id', modelId);
+                }).where((subQuery) => {
+                    subQuery
+                        .where((query) => {
+                        query.where('mp.model_type', modelType).where('mp.model_id', modelId);
+                    })
+                        .orWhere((query) => {
+                        query.whereRaw('mr.role_id=mp.model_id').where('mp.model_type', 'roles');
+                    });
+                });
+            }
+        }
+        if (!includeForbiddens) {
+            q.whereNotExists((subQuery) => {
+                subQuery
+                    .from(Permission.table + ' as p2')
+                    .join(ModelPermission.table + ' as mp2', 'mp2.permission_id', '=', 'p2.id')
+                    .where('p2.allowed', false)
+                    .whereRaw('p2.slug=' + Permission.table + '.slug')
+                    .whereRaw('mp2.id=mp.id');
+            });
+        }
+        if (permissionSlugs) {
+            q.whereIn(Permission.table + '.slug', permissionSlugs);
+        }
+        return q;
+    }
+    reverseModelPermissionQuery(conditions) {
+        const { modelId, modelType, permissionSlugs, directPermissions } = conditions;
+        const q = ModelPermission.query().leftJoin(Permission.table + ' as p', 'p.id', '=', ModelPermission.table + '.permission_id');
+        if (modelId && modelType) {
+            if (directPermissions) {
+                q.where(ModelPermission.table + '.model_type', modelType).where(ModelPermission.table + '.model_id', modelId);
+            }
+            else {
+                q.join(ModelRole.table + ' as mr', (joinQuery) => {
+                    joinQuery.onVal('mr.model_type', modelType).andOnVal('mr.model_id', modelId);
+                }).where((subQuery) => {
+                    subQuery
+                        .where((query) => {
+                        query
+                            .where(ModelPermission.table + '.model_type', modelType)
+                            .where(ModelPermission.table + '.model_id', modelId);
+                    })
+                        .orWhere((query) => {
+                        query
+                            .whereRaw('mr.role_id=' + ModelPermission.table + '.model_id')
+                            .where(ModelPermission.table + '.model_type', 'roles');
+                    });
+                });
+            }
+        }
+        if (permissionSlugs) {
+            q.whereIn('p.slug', permissionSlugs);
+        }
+        return q;
+    }
+    findAssignableEntity(permisison, entityClass, entityId, allowed) {
+        const q = Permission.query().whereIn('slug', permisison).where('allowed', allowed);
+        if (entityClass) {
+            q.where('entity_type', entityClass);
+            if (entityId) {
+                q.where('entity_id', entityId);
+            }
+            else {
+                q.whereNull('entity_id');
+            }
+        }
+        else {
+            q.whereNull('entity_type').whereNull('entity_id');
+        }
+        return q;
+    }
+    applyTargetRestriction(q, entityType, entityId) {
+        if (entityType) {
+            q.where((query) => {
+                query
+                    .where(Permission.table + '.entity_type', entityType)
+                    .orWhereNull(Permission.table + '.entity_type');
+            });
+            if (entityId) {
+                q.where((query) => {
+                    query
+                        .where(Permission.table + '.entity_id', entityId)
+                        .orWhereNull(Permission.table + '.entity_id');
+                });
+            }
+        }
+        else {
+            q.whereNull(Permission.table + '.entity_type').whereNull(Permission.table + '.entity_id');
+        }
+    }
+}

package/build/src/services/roles/role_has_model_permissions.d.ts

@@ -0,0 +1,66 @@
+import Permission from '../../models/permission.js';
+import Role from '../../models/role.js';
+import ModelService from '../model_service.js';
+import PermissionsService from '../permissions/permissions_service.js';
+import { AclModel } from '../../types.js';
+export declare class RoleHasModelPermissions {
+    private role;
+    private permissionService;
+    private modelService;
+    constructor(role: Role, permissionService: PermissionsService, modelService: ModelService);
+    models(): import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<typeof import("../../models/model_role.js").default, import("../../models/model_role.js").default>;
+    modelsFor(modelType: string): Promise<any>;
+    /**
+     * todo
+     * @param model
+     */
+    permissions(): Promise<Permission[]>;
+    globalPermissions(): Promise<Permission[]>;
+    onResourcePermissions(): Promise<Permission[]>;
+    containsPermission(permisison: string | Permission): Promise<boolean>;
+    /**
+     *
+     * @param permisisons
+     * @returns
+     */
+    containsAllPermissions(permisisons: (string | Permission)[]): Promise<boolean>;
+    /**
+     *
+     * @param permisisons
+     * @returns
+     */
+    containsAnyPermissions(permisisons: (string | Permission)[]): Promise<boolean>;
+    hasPermission(permisison: string | Permission, target?: AclModel | Function): Promise<boolean>;
+    /**
+     *
+     * @param permisisons
+     * @returns
+     */
+    hasAllPermissions(permisisons: (string | Permission)[], target?: AclModel | Function): Promise<boolean>;
+    /**
+     *
+     * @param permisisons
+     * @returns
+     */
+    hasAnyPermissions(permisisons: (string | Permission)[], target?: AclModel | Function): Promise<boolean>;
+    /**
+     *
+     * @param permisison
+     * @returns
+     */
+    can(permisison: string | Permission): Promise<boolean>;
+    canAll(permisisons: (string | Permission)[]): Promise<boolean>;
+    canAny(permisisons: (string | Permission)[]): Promise<boolean>;
+    forbidden(permisison: string | Permission, target?: AclModel | Function): Promise<boolean>;
+    assign(permisison: string, target?: AclModel | Function): Promise<import("../../models/model_permission.js").default[]>;
+    give(permisison: string, target?: AclModel | Function): Promise<import("../../models/model_permission.js").default[]>;
+    giveAll(permisisons: string[], target?: AclModel | Function): Promise<import("../../models/model_permission.js").default[]>;
+    assingAll(permisisons: string[], target?: AclModel | Function): Promise<import("../../models/model_permission.js").default[]>;
+    revokePermission(permisison: string): Promise<import("../../models/model_permission.js").default[]>;
+    revoke(permisison: string): Promise<import("../../models/model_permission.js").default[]>;
+    revokeAll(permisisons: string[], target?: AclModel | Function): Promise<import("../../models/model_permission.js").default[]>;
+    revokeAllPermissions(permisisons: string[]): Promise<import("../../models/model_permission.js").default[]>;
+    flush(): Promise<any[]>;
+    forbid(permisison: string, target?: AclModel | Function): Promise<import("../../models/model_permission.js").default[]>;
+    unforbid(permisison: string, target?: AclModel | Function): Promise<any[]>;
+}