@holoyan/adonisjs-permissions 0.5.2 → 0.6.4

package/build/configure.js

@@ -30,4 +30,13 @@ export async function configure(_command) {
     await codemods.updateRcFile((rcFile) => {
         rcFile.addProvider('@holoyan/adonisjs-permissions/role_permission_provider');
     });
+    /**
+     * Publish and register middleware
+     */
+    await codemods.makeUsingStub(stubsRoot, 'middlewares/acl_middleware.stub', {});
+    await codemods.registerMiddleware('server', [
+        {
+            path: '#middleware/acl_middleware',
+        },
+    ]);
 }

package/build/index.d.ts

@@ -8,7 +8,8 @@ export declare const Permission: typeof permission;
 export declare const Role: typeof role;
 export { configure } from './configure.js';
 export { stubsRoot } from './stubs/main.js';
-export { Acl } from './src/acl.js';
+export { Acl, AclManager } from './src/acl.js';
 export { MorphMap, getClassPath } from './src/decorators.js';
 export * as morphMapModel from './src/morph_map.js';
 export { hasPermissions } from './src/mixins/has_permissions.js';
+export { Scope } from './src/scope.js';

package/build/index.js

@@ -16,7 +16,8 @@ export const Permission = permission;
 export const Role = role;
 export { configure } from './configure.js';
 export { stubsRoot } from './stubs/main.js';
-export { Acl } from './src/acl.js';
+export { Acl, AclManager } from './src/acl.js';
 export { MorphMap, getClassPath } from './src/decorators.js';
 export * as morphMapModel from './src/morph_map.js';
 export { hasPermissions } from './src/mixins/has_permissions.js';
+export { Scope } from './src/scope.js';

package/build/providers/role_permission_provider.js

@@ -3,8 +3,9 @@ import Role from '../src/models/role.js';
 import ModelPermission from '../src/models/model_permission.js';
 import ModelRole from '../src/models/model_role.js';
 import ModelManager from '../src/model_manager.js';
-import { Acl } from '../src/acl.js';
+import { AclManager } from '../src/acl.js';
 import MorphMap from '../src/morph_map.js';
+import { Scope } from '../src/scope.js';
 export default class RolePermissionProvider {
     app;
     constructor(app) {
@@ -24,10 +25,11 @@ export default class RolePermissionProvider {
         modelManager.setModel('role', Role);
         modelManager.setModel('modelPermission', ModelPermission);
         modelManager.setModel('modelRole', ModelRole);
-        Acl.setModelManager(modelManager);
+        modelManager.setModel('scope', Scope);
+        AclManager.setModelManager(modelManager);
         const map = await this.app.container.make('morphMap');
         map.set('permissions', Permission);
         map.set('roles', Role);
-        Acl.setMorphMap(map);
+        AclManager.setMorphMap(map);
     }
 }

package/build/src/acl.d.ts

@@ -1,16 +1,24 @@
 import { RoleHasModelPermissions } from './services/roles/role_has_model_permissions.js';
 import { ModelHasRolePermissions } from './services/model_has_role_permissions.js';
-import { AclModel, MorphInterface, PermissionInterface, RoleInterface } from './types.js';
-import PermissionHasModelRoles from './services/permissions/permission_has_model_roles.js';
+import { AclModel, MorphInterface, PermissionInterface, RoleInterface, ScopeInterface } from './types.js';
 import ModelManager from './model_manager.js';
 import EmptyPermission from './services/permissions/empty_permission.js';
 import EmptyRoles from './services/roles/empty_roles.js';
-export declare class Acl {
+export declare class AclManager {
     private static modelManager;
     private static map;
     static setModelManager(manager: ModelManager): void;
     static setMorphMap(map: MorphInterface): void;
-    static model(model: AclModel): ModelHasRolePermissions;
-    static role(role?: RoleInterface): RoleHasModelPermissions | EmptyRoles;
-    static permission(permission?: PermissionInterface): PermissionHasModelRoles | EmptyPermission;
+    private _scope?;
+    private allowScopeRewriting;
+    constructor(allowScopeRewriting?: boolean);
+    model(model: AclModel): ModelHasRolePermissions;
+    role(): EmptyRoles;
+    role(role: RoleInterface): RoleHasModelPermissions;
+    permission(): EmptyPermission;
+    permission(permission: PermissionInterface): EmptyPermission;
+    private createNewScope;
+    scope(scope: ScopeInterface): this;
+    getScope(): ScopeInterface;
 }
+export declare const Acl: AclManager;

package/build/src/acl.js

@@ -6,7 +6,7 @@ import PermissionHasModelRoles from './services/permissions/permission_has_model
 import ModelService from './services/model_service.js';
 import EmptyPermission from './services/permissions/empty_permission.js';
 import EmptyRoles from './services/roles/empty_roles.js';
-export class Acl {
+export class AclManager {
     static modelManager;
     static map;
     static setModelManager(manager) {
@@ -15,23 +15,44 @@ export class Acl {
     static setMorphMap(map) {
         this.map = map;
     }
-    static model(model) {
-        return new ModelHasRolePermissions(model, new RolesService(this.modelManager.getModel('role'), this.modelManager.getModel('modelPermission'), this.modelManager.getModel('modelRole'), this.map), new PermissionsService(this.modelManager.getModel('permission'), this.modelManager.getModel('role'), this.modelManager.getModel('modelPermission'), this.modelManager.getModel('modelRole'), this.map), this.map);
+    _scope;
+    allowScopeRewriting = true;
+    constructor(allowScopeRewriting) {
+        if (allowScopeRewriting !== undefined) {
+            this.allowScopeRewriting = allowScopeRewriting;
+        }
+    }
+    model(model) {
+        const scope = this._scope || this.createNewScope();
+        return new ModelHasRolePermissions(model, new RolesService(AclManager.modelManager.getModel('role'), AclManager.modelManager.getModel('modelPermission'), AclManager.modelManager.getModel('modelRole'), AclManager.map, scope), new PermissionsService(AclManager.modelManager.getModel('permission'), AclManager.modelManager.getModel('role'), AclManager.modelManager.getModel('modelPermission'), AclManager.modelManager.getModel('modelRole'), AclManager.map, scope), AclManager.map, scope);
     }
-    static role(role) {
+    role(role) {
+        const scope = this._scope || this.createNewScope();
         if (role) {
-            return new RoleHasModelPermissions(role, new PermissionsService(this.modelManager.getModel('permission'), this.modelManager.getModel('role'), this.modelManager.getModel('modelPermission'), this.modelManager.getModel('modelRole'), this.map), new ModelService(this.modelManager.getModel('modelPermission'), this.modelManager.getModel('modelRole'), this.map), this.map);
-        }
-        else {
-            return new EmptyRoles(this.modelManager.getModel('role'));
+            return new RoleHasModelPermissions(role, new PermissionsService(AclManager.modelManager.getModel('permission'), AclManager.modelManager.getModel('role'), AclManager.modelManager.getModel('modelPermission'), AclManager.modelManager.getModel('modelRole'), AclManager.map, scope), new ModelService(AclManager.modelManager.getModel('modelPermission'), AclManager.modelManager.getModel('modelRole'), AclManager.map), AclManager.map, scope);
         }
+        return new EmptyRoles(AclManager.modelManager.getModel('role'), scope);
     }
-    static permission(permission) {
+    permission(permission) {
+        const scope = this._scope || this.createNewScope();
         if (permission) {
-            return new PermissionHasModelRoles(permission, new RolesService(this.modelManager.getModel('role'), this.modelManager.getModel('modelPermission'), this.modelManager.getModel('modelRole'), this.map), new PermissionsService(this.modelManager.getModel('permission'), this.modelManager.getModel('role'), this.modelManager.getModel('modelPermission'), this.modelManager.getModel('modelRole'), this.map), new ModelService(this.modelManager.getModel('modelPermission'), this.modelManager.getModel('modelRole'), this.map), this.modelManager.getModel('modelPermission'), this.modelManager.getModel('modelRole'), this.map);
+            return new PermissionHasModelRoles(permission, new RolesService(AclManager.modelManager.getModel('role'), AclManager.modelManager.getModel('modelPermission'), AclManager.modelManager.getModel('modelRole'), AclManager.map, scope), new PermissionsService(AclManager.modelManager.getModel('permission'), AclManager.modelManager.getModel('role'), AclManager.modelManager.getModel('modelPermission'), AclManager.modelManager.getModel('modelRole'), AclManager.map, scope), new ModelService(AclManager.modelManager.getModel('modelPermission'), AclManager.modelManager.getModel('modelRole'), AclManager.map), AclManager.modelManager.getModel('modelPermission'), AclManager.modelManager.getModel('modelRole'), AclManager.map, scope);
         }
-        else {
-            return new EmptyPermission(this.modelManager.getModel('permission'));
+        return new EmptyPermission(AclManager.modelManager.getModel('permission'), scope);
+    }
+    createNewScope() {
+        const ScopeClass = AclManager.modelManager.getModel('scope');
+        return new ScopeClass();
+    }
+    scope(scope) {
+        if (!this.allowScopeRewriting) {
+            throw new Error('Scope method call is not available on global Acl object, use AclManager to create new scoped acl object');
         }
+        this._scope = scope;
+        return this;
+    }
+    getScope() {
+        return this._scope || this.createNewScope();
     }
 }
+export const Acl = new AclManager(false);

package/build/src/mixins/has_permissions.d.ts

@@ -4,7 +4,7 @@ import { AclModel, RoleInterface } from '../types.js';
 export declare function hasPermissions(): <Model extends NormalizeConstructor<import("@adonisjs/lucid/types/model").LucidModel>>(superclass: Model) => {
     new (...args: any[]): {
         getModelId(): number;
-        roles(): Promise<import("../types.js").RoleModel<import("@adonisjs/lucid/types/model").LucidModel>[]>;
+        roles(): import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel, import("../types.js").RoleModel<import("@adonisjs/lucid/types/model").LucidModel>>;
         hasRole(role: string | RoleInterface): Promise<boolean>;
         hasAllRoles(...roles: (string | RoleInterface)[]): Promise<boolean>;
         hasAnyRole(...roles: (string | RoleInterface)[]): Promise<boolean>;
@@ -28,7 +28,6 @@ export declare function hasPermissions(): <Model extends NormalizeConstructor<im
         hasAnyDirectPermission(permissions: (string | Permission)[], target?: AclModel | Function): Promise<boolean>;
         hasDirectPermission(permission: string | Permission, target?: AclModel | Function): Promise<boolean>;
         hasAllPermissionsDirect(permissions: (string | Permission)[], target?: AclModel | Function): Promise<boolean>;
-        can(permission: string | Permission, target?: AclModel | Function): Promise<boolean>;
         canAll(permissions: (string | Permission)[], target?: AclModel | Function): Promise<boolean>;
         canAny(permissions: (string | Permission)[], target?: AclModel | Function): Promise<boolean>;
         assignDirectPermission(permission: string, target?: AclModel | Function): Promise<import("@adonisjs/lucid/types/model").LucidRow[]>;

package/build/src/mixins/has_permissions.js

@@ -79,9 +79,6 @@ export function hasPermissions() {
             async hasAllPermissionsDirect(permissions, target) {
                 return Acl.model(this).hasAllPermissionsDirect(permissions, target);
             }
-            can(permission, target) {
-                return Acl.model(this).can(permission, target);
-            }
             canAll(permissions, target) {
                 return Acl.model(this).canAll(permissions, target);
             }

package/build/src/model_manager.d.ts

@@ -1,7 +1,7 @@
-import { BaseModel } from '@adonisjs/lucid/orm';
+import { ModelManagerBindings } from './types.js';
 export default class ModelManager {
     private models;
-    setModel(key: string, className: typeof BaseModel): void;
+    setModel<Binding extends keyof ModelManagerBindings>(key: Binding, className: ModelManagerBindings[Binding]): void;
     has(key: string): boolean;
-    getModel(key: string): import("@adonisjs/lucid/types/model").LucidModel;
+    getModel<Binding extends keyof ModelManagerBindings>(key: Binding): ModelManagerBindings[Binding];
 }

package/build/src/scope.d.ts

@@ -0,0 +1,7 @@
+import { ScopeInterface } from './types.js';
+export declare class Scope implements ScopeInterface {
+    private currentScope;
+    set(scope: number): this;
+    get(): number;
+    default(): number;
+}

package/build/src/scope.js

@@ -0,0 +1,14 @@
+const DEFAULT_SCOPE = 0;
+export class Scope {
+    currentScope = DEFAULT_SCOPE;
+    set(scope) {
+        this.currentScope = scope;
+        return this;
+    }
+    get() {
+        return this.currentScope;
+    }
+    default() {
+        return DEFAULT_SCOPE;
+    }
+}

package/build/src/services/model_has_role_permissions.d.ts

@@ -1,4 +1,4 @@
-import { AclModel, MorphInterface, PermissionInterface, RoleInterface } from '../types.js';
+import { AclModel, MorphInterface, PermissionInterface, RoleInterface, ScopeInterface } from '../types.js';
 import PermissionsService from './permissions/permissions_service.js';
 import RolesService from './roles/roles_service.js';
 export declare class ModelHasRolePermissions {
@@ -6,12 +6,16 @@ export declare class ModelHasRolePermissions {
     private roleService;
     private permissionsService;
     private map;
-    constructor(model: AclModel, roleService: RolesService, permissionsService: PermissionsService, map: MorphInterface);
-    roles(): Promise<import("../types.js").RoleModel<import("@adonisjs/lucid/types/model").LucidModel>[]>;
+    private scope;
+    constructor(model: AclModel, roleService: RolesService, permissionsService: PermissionsService, map: MorphInterface, scope: ScopeInterface);
+    on(scope: number): this;
+    getScope(): number;
+    roles(): import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel, import("../types.js").RoleModel<import("@adonisjs/lucid/types/model").LucidModel>>;
     hasRole(role: string | RoleInterface): Promise<boolean>;
     hasAllRoles(...roles: (string | RoleInterface)[]): Promise<boolean>;
     hasAnyRole(...roles: (string | RoleInterface)[]): Promise<boolean>;
     assignRole(role: string | RoleInterface): Promise<boolean>;
+    assign(role: string | RoleInterface): Promise<boolean>;
     assignAllRoles(...roles: (string | RoleInterface)[]): Promise<boolean>;
     revokeRole(role: string | number | RoleInterface): Promise<boolean>;
     revokeAllRoles(...roles: (string | number | RoleInterface)[]): Promise<boolean>;
@@ -19,9 +23,12 @@ export declare class ModelHasRolePermissions {
     permissions(includeForbiddings?: boolean): Promise<import("../types.js").PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>[]>;
     globalPermissions(includeForbiddings?: boolean): Promise<import("../types.js").PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>[]>;
     onResourcePermissions(includeForbiddings?: boolean): Promise<import("../types.js").PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>[]>;
+    directPermissions(includeForbiddings?: boolean): import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel, import("../types.js").PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>>;
+    rolePermissions(includeForbiddings?: boolean): Promise<import("../types.js").PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>[]>;
     directGlobalPermissions(includeForbiddings?: boolean): Promise<import("../types.js").PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>[]>;
     directResourcePermissions(includeForbiddings?: boolean): Promise<import("../types.js").PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>[]>;
     containsPermission(permission: string | PermissionInterface): Promise<boolean>;
+    contains(permission: string | PermissionInterface): Promise<boolean>;
     containsAllPermissions(permissions: (string | PermissionInterface)[]): Promise<boolean>;
     containsAnyPermission(permissions: (string | PermissionInterface)[]): Promise<boolean>;
     containsDirectPermission(permission: string | PermissionInterface): Promise<boolean>;
@@ -40,6 +47,8 @@ export declare class ModelHasRolePermissions {
     assignDirectAllPermissions(permissions: string[], target?: AclModel | Function): Promise<import("@adonisjs/lucid/types/model").LucidRow[]>;
     allow(permission: string, target?: AclModel | Function): Promise<import("@adonisjs/lucid/types/model").LucidRow[]>;
     revokePermission(permission: string, target?: AclModel | Function): Promise<any[]>;
+    revoke(permission: string, target?: AclModel | Function): Promise<any[]>;
+    revokeAll(permissions: string[], target?: AclModel | Function): Promise<any[]>;
     revokeAllPermissions(permissions: string[], target?: AclModel | Function): Promise<any[]>;
     flushPermissions(): Promise<any[]>;
     flush(): Promise<boolean>;

package/build/src/services/model_has_role_permissions.js

@@ -4,14 +4,23 @@ export class ModelHasRolePermissions {
     roleService;
     permissionsService;
     map;
-    constructor(model, roleService, permissionsService, map) {
+    scope;
+    constructor(model, roleService, permissionsService, map, scope) {
         this.model = model;
         this.roleService = roleService;
         this.permissionsService = permissionsService;
         this.map = map;
+        this.scope = scope;
+    }
+    on(scope) {
+        this.scope.set(scope);
+        return this;
+    }
+    getScope() {
+        return this.scope.get();
     }
     // roles related section BEGIN
-    async roles() {
+    roles() {
         return this.roleService.all(this.map.getAlias(this.model), this.model.getModelId());
     }
     hasRole(role) {
@@ -26,6 +35,9 @@ export class ModelHasRolePermissions {
     assignRole(role) {
         return this.roleService.assign(role, this.map.getAlias(this.model), this.model.getModelId());
     }
+    assign(role) {
+        return this.assignRole(role);
+    }
     assignAllRoles(...roles) {
         return this.roleService.assignAll(roles, this.map.getAlias(this.model), this.model.getModelId());
     }
@@ -50,6 +62,12 @@ export class ModelHasRolePermissions {
     async onResourcePermissions(includeForbiddings = false) {
         return this.permissionsService.onResource(this.map.getAlias(this.model), this.model.getModelId(), includeForbiddings);
     }
+    directPermissions(includeForbiddings = false) {
+        return this.permissionsService.direct(this.map.getAlias(this.model), this.model.getModelId(), includeForbiddings);
+    }
+    rolePermissions(includeForbiddings = false) {
+        return this.permissionsService.throughRoles(this.map.getAlias(this.model), this.model.getModelId(), includeForbiddings);
+    }
     async directGlobalPermissions(includeForbiddings = false) {
         return this.permissionsService.directGlobal(this.map.getAlias(this.model), this.model.getModelId(), includeForbiddings);
     }
@@ -60,6 +78,9 @@ export class ModelHasRolePermissions {
         const result = await this.permissionsService.containsAny(this.map.getAlias(this.model), this.model.getModelId(), [permission]);
         return result;
     }
+    async contains(permission) {
+        return this.containsPermission(permission);
+    }
     async containsAllPermissions(permissions) {
         const result = await this.permissionsService.containsAll(this.map.getAlias(this.model), this.model.getModelId(), permissions);
         return result;
@@ -124,6 +145,12 @@ export class ModelHasRolePermissions {
     async revokePermission(permission, target) {
         return this.revokeAllPermissions([permission], target);
     }
+    async revoke(permission, target) {
+        return this.revokeAllPermissions([permission], target);
+    }
+    async revokeAll(permissions, target) {
+        return this.revokeAllPermissions(permissions, target);
+    }
     async revokeAllPermissions(permissions, target) {
         const entity = await destructTarget(this.map, target);
         return this.permissionsService.revokeAll(this.map.getAlias(this.model), this.model.getModelId(), permissions, entity.targetClass, entity.targetId);

package/build/src/services/permissions/empty_permission.d.ts

@@ -1,8 +1,12 @@
 import { BaseModel } from '@adonisjs/lucid/orm';
+import { ScopeInterface } from '../../types.js';
 export default class EmptyPermission {
     private permissionClassName;
+    private scope;
     private permissionQuery;
-    constructor(permissionClassName: typeof BaseModel);
+    constructor(permissionClassName: typeof BaseModel, scope: ScopeInterface);
+    on(scope: number): this;
+    getScope(): number;
     delete(permission: string): import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel, any>;
     query(): import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel, import("../../types.js").PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>>;
 }

package/build/src/services/permissions/empty_permission.js

@@ -1,11 +1,20 @@
 import { getPermissionModelQuery } from '../query_helper.js';
 export default class EmptyPermission {
     permissionClassName;
+    scope;
     permissionQuery;
-    constructor(permissionClassName) {
+    constructor(permissionClassName, scope) {
         this.permissionClassName = permissionClassName;
+        this.scope = scope;
         this.permissionQuery = getPermissionModelQuery(this.permissionClassName);
     }
+    on(scope) {
+        this.scope.set(scope);
+        return this;
+    }
+    getScope() {
+        return this.scope.get();
+    }
     delete(permission) {
         // get all permissions by slug
         // if there is permission with allowed false then check if it has `links`

package/build/src/services/permissions/permission_has_model_roles.d.ts

@@ -1,4 +1,4 @@
-import { AclModel, MorphInterface, PermissionInterface } from '../../types.js';
+import { AclModel, MorphInterface, PermissionInterface, ScopeInterface } from '../../types.js';
 import ModelService from '../model_service.js';
 import RolesService from '../roles/roles_service.js';
 import PermissionsService from './permissions_service.js';
@@ -11,11 +11,14 @@ export default class PermissionHasModelRoles {
     private modelPermissionClassName;
     private roleClassName;
     private map;
+    private scope;
     private modelPermissionQuery;
     private roleQuery;
     private readonly roleTable;
-    constructor(permission: PermissionInterface, roleService: RolesService, permissionService: PermissionsService, modelService: ModelService, modelPermissionClassName: typeof BaseModel, roleClassName: typeof BaseModel, map: MorphInterface);
+    constructor(permission: PermissionInterface, roleService: RolesService, permissionService: PermissionsService, modelService: ModelService, modelPermissionClassName: typeof BaseModel, roleClassName: typeof BaseModel, map: MorphInterface, scope: ScopeInterface);
     models(): import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel, import("../../types.js").ModelPermissionModel<import("@adonisjs/lucid/types/model").LucidModel>>;
+    on(scope: number): this;
+    getScope(): number;
     modelsFor(modelType: string): Promise<any>;
     roles(): Promise<import("../../types.js").RoleModel<import("@adonisjs/lucid/types/model").LucidModel>[]>;
     belongsToRole(role: string | number): Promise<boolean>;

package/build/src/services/permissions/permission_has_model_roles.js

@@ -8,11 +8,12 @@ export default class PermissionHasModelRoles {
     modelPermissionClassName;
     roleClassName;
     map;
+    scope;
     modelPermissionQuery;
     // private readonly modelPermissionTable
     roleQuery;
     roleTable;
-    constructor(permission, roleService, permissionService, modelService, modelPermissionClassName, roleClassName, map) {
+    constructor(permission, roleService, permissionService, modelService, modelPermissionClassName, roleClassName, map, scope) {
         this.permission = permission;
         this.roleService = roleService;
         this.permissionService = permissionService;
@@ -20,6 +21,7 @@ export default class PermissionHasModelRoles {
         this.modelPermissionClassName = modelPermissionClassName;
         this.roleClassName = roleClassName;
         this.map = map;
+        this.scope = scope;
         this.modelPermissionQuery = getModelPermissionModelQuery(this.modelPermissionClassName);
         // this.modelPermissionTable = this.modelPermissionClassName.table
         this.roleQuery = getRoleModelQuery(this.roleClassName);
@@ -28,6 +30,13 @@ export default class PermissionHasModelRoles {
     models() {
         return this.modelService.allByPermission(this.permission.getModelId());
     }
+    on(scope) {
+        this.scope.set(scope);
+        return this;
+    }
+    getScope() {
+        return this.scope.get();
+    }
     modelsFor(modelType) {
         return this.modelService.allByPermissionFor(modelType, this.permission.getModelId());
     }

package/build/src/services/permissions/permissions_service.d.ts

@@ -1,5 +1,5 @@
 import { ModelQueryBuilderContract } from '@adonisjs/lucid/types/model';
-import { ModelPermissionsQuery, MorphInterface, PermissionInterface, PermissionModel } from '../../types.js';
+import { ModelPermissionsQuery, MorphInterface, PermissionInterface, PermissionModel, ScopeInterface } from '../../types.js';
 import BaseService from '../base_service.js';
 import { BaseModel } from '@adonisjs/lucid/orm';
 export default class PermissionsService extends BaseService {
@@ -8,12 +8,13 @@ export default class PermissionsService extends BaseService {
     private modelPermissionClassName;
     private modelRoleClassName;
     private map;
-    private permissionQuery;
+    private scope;
     private readonly permissionTable;
     private modelPermissionQuery;
     private readonly modelPermissionTable;
     private readonly modelRoleTable;
-    constructor(permissionClassName: typeof BaseModel, roleClassName: typeof BaseModel, modelPermissionClassName: typeof BaseModel, modelRoleClassName: typeof BaseModel, map: MorphInterface);
+    constructor(permissionClassName: typeof BaseModel, roleClassName: typeof BaseModel, modelPermissionClassName: typeof BaseModel, modelRoleClassName: typeof BaseModel, map: MorphInterface, scope: ScopeInterface);
+    private get permissionQuery();
     /**
      * return all permissions, including forbidden
      */
@@ -30,6 +31,7 @@ export default class PermissionsService extends BaseService {
      * all direct permissions
      */
     direct(modelType: string, modelId: number, includeForbiddings?: boolean): ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel, PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>>;
+    throughRoles(modelType: string, modelId: number, includeForbiddings?: boolean): Promise<PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>[]>;
     directGlobal(modelType: string, modelId: number, includeForbiddings?: boolean): ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel, PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>>;
     /**
      * return direct and resource assigned permissions
@@ -98,7 +100,13 @@ export default class PermissionsService extends BaseService {
     findBySlug(slug: string, allowed?: boolean): Promise<PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>>;
     private modelPermissionQueryWithForbiddenCheck;
     private modelPermissionQueryBuilder;
+    /**
+     * @deprecated
+     * @param conditions
+     */
     reverseModelPermissionQuery(conditions: Partial<ModelPermissionsQuery>): ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel, import("../../types.js").ModelPermissionModel<import("@adonisjs/lucid/types/model").LucidModel>>;
     findAssignableEntity(permission: string[], entityClass: string | null, entityId: number | null, allowed: boolean): ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel, PermissionModel<import("@adonisjs/lucid/types/model").LucidModel>>;
     private applyTargetRestriction;
+    private applyScopes;
+    private applyModelPermissionScopes;
 }

package/build/src/services/permissions/permissions_service.js

@@ -6,7 +6,8 @@ export default class PermissionsService extends BaseService {
     modelPermissionClassName;
     modelRoleClassName;
     map;
-    permissionQuery;
+    scope;
+    // private permissionQuery
     permissionTable;
     // private roleQuery
     // private readonly roleTable
@@ -14,14 +15,15 @@ export default class PermissionsService extends BaseService {
     modelPermissionTable;
     // private modelRoleQuery
     modelRoleTable;
-    constructor(permissionClassName, roleClassName, modelPermissionClassName, modelRoleClassName, map) {
+    constructor(permissionClassName, roleClassName, modelPermissionClassName, modelRoleClassName, map, scope) {
         super();
         this.permissionClassName = permissionClassName;
         this.roleClassName = roleClassName;
         this.modelPermissionClassName = modelPermissionClassName;
         this.modelRoleClassName = modelRoleClassName;
         this.map = map;
-        this.permissionQuery = getPermissionModelQuery(this.permissionClassName);
+        this.scope = scope;
+        // this.permissionQuery = getPermissionModelQuery(this.permissionClassName)
         this.permissionTable = this.permissionClassName.table;
         // this.roleQuery = getRoleModelQuery(this.roleClassName)
         // this.roleTable = this.roleClassName.table
@@ -30,6 +32,11 @@ export default class PermissionsService extends BaseService {
         // this.modelRoleQuery = getModelRoleModelQuery(this.modelRoleClassName)
         this.modelRoleTable = this.modelRoleClassName.table;
     }
+    get permissionQuery() {
+        const q = getPermissionModelQuery(this.permissionClassName);
+        this.applyScopes(q);
+        return q;
+    }
     /**
      * return all permissions, including forbidden
      */
@@ -85,6 +92,16 @@ export default class PermissionsService extends BaseService {
             .distinct(this.permissionTable + '.id')
             .select(this.permissionTable + '.*');
     }
+    async throughRoles(modelType, modelId, includeForbiddings = false) {
+        return this.modelPermissionQueryBuilder({
+            modelType,
+            modelId,
+            includeForbiddings,
+            throughRoles: true,
+        })
+            .distinct(this.permissionTable + '.id')
+            .select(this.permissionTable + '.*');
+    }
     directGlobal(modelType, modelId, includeForbiddings = false) {
         return this.modelPermissionQueryBuilder({
             modelType,
@@ -106,7 +123,7 @@ export default class PermissionsService extends BaseService {
             directPermissions: true,
             includeForbiddings,
         })
-            .whereNotNull(this.permissionTable + '.entity_id')
+            .where(this.permissionTable + '.entity_type', '!=', '*')
             .distinct(this.permissionTable + '.id')
             .select(this.permissionTable + '.*');
     }
@@ -312,6 +329,7 @@ export default class PermissionsService extends BaseService {
             .where('p.allowed', true)
             .where(this.modelPermissionTable + '.model_type', modelType)
             .where(this.modelPermissionTable + '.model_id', modelId);
+        this.applyModelPermissionScopes(q, 'p');
         if (entityType) {
             q.where('p.entity_type', entityType);
             if (entityId) {
@@ -352,13 +370,13 @@ export default class PermissionsService extends BaseService {
      * to remove forbidden permission on model
      */
     async unforbidAll(modelType, modelId, permissionsSlug, entityType, entityId) {
-        // todo replace using reverseModelPermissionQuery() method
         const q = this.modelPermissionQuery
             .leftJoin(this.permissionTable + ' as p', 'p.id', '=', this.modelPermissionTable + '.permission_id')
             .where('model_type', modelType)
             .where('model_id', modelId)
             .whereIn('p.slug', permissionsSlug)
             .where('p.allowed', false);
+        this.applyModelPermissionScopes(q, 'p');
         if (entityType) {
             q.where('p.entity_type', entityType);
             if (entityId) {
@@ -384,15 +402,21 @@ export default class PermissionsService extends BaseService {
             else {
                 q.leftJoin(this.modelRoleTable + ' as mr', (joinQuery) => {
                     joinQuery.onVal('mr.model_type', modelType).onVal('mr.model_id', modelId);
-                }).where((subQuery) => {
-                    subQuery
-                        .where((query) => {
-                        query.where('mp.model_type', modelType).where('mp.model_id', modelId);
-                    })
-                        .orWhere((query) => {
-                        query.whereRaw('mr.role_id=mp.model_id').where('mp.model_type', 'roles');
-                    });
                 });
+                if (conditions.throughRoles) {
+                    q.whereRaw('mr.role_id=mp.model_id').where('mp.model_type', 'roles');
+                }
+                else {
+                    q.where((subQuery) => {
+                        subQuery
+                            .where((query) => {
+                            query.where('mp.model_type', modelType).where('mp.model_id', modelId);
+                        })
+                            .orWhere((query) => {
+                            query.whereRaw('mr.role_id=mp.model_id').where('mp.model_type', 'roles');
+                        });
+                    });
+                }
             }
         }
         if (!includeForbiddings) {
@@ -402,6 +426,7 @@ export default class PermissionsService extends BaseService {
                     .leftJoin(this.modelPermissionTable + ' as mp2', 'mp2.permission_id', '=', 'p2.id')
                     .where('p2.allowed', false)
                     .whereRaw('p2.slug=' + this.permissionTable + '.slug')
+                    .whereRaw('p2.scope=' + this.permissionTable + '.scope')
                     .select('p2.slug')
                     .groupBy('p2.slug');
                 if (conditions.entity) {
@@ -414,6 +439,10 @@ export default class PermissionsService extends BaseService {
         }
         return q;
     }
+    /**
+     * @deprecated
+     * @param conditions
+     */
     reverseModelPermissionQuery(conditions) {
         const { modelId, modelType, permissionSlugs, directPermissions } = conditions;
         const q = this.modelPermissionQuery.leftJoin(this.permissionTable + ' as p', 'p.id', '=', this.modelPermissionTable + '.permission_id');
@@ -478,4 +507,10 @@ export default class PermissionsService extends BaseService {
             q.where(table + '.entity_type', '*').whereNull(table + '.entity_id');
         }
     }
+    applyScopes(q) {
+        q.where(this.permissionTable + '.scope', this.scope.get());
+    }
+    applyModelPermissionScopes(q, table) {
+        q.where(table + '.scope', this.scope.get());
+    }
 }