@nixxie-cms/core 1.0.0

package/src/lib/core/access-control.ts

@@ -0,0 +1,434 @@
+import { assertInputObjectType } from 'graphql'
+
+import { allowAll } from '../../access'
+import type {
+  ActionAccessControlFunction,
+  BaseItem,
+  BaseListTypeInfo,
+  CreateListItemAccessControl,
+  DeleteListItemAccessControl,
+  FieldAccessControl,
+  FieldAccessControlFunction,
+  FieldCreateItemAccessArgs,
+  FieldReadItemAccessArgs,
+  FieldUpdateItemAccessArgs,
+  NixxieContext,
+  ListAccessControl,
+  ListFilterAccessControl,
+  ListOperationAccessControl,
+  UpdateListItemAccessControl,
+} from '../../types'
+import { coerceAndValidateForGraphQLInput } from '../coerceAndValidateForGraphQLInput'
+import { accessDeniedError, accessReturnError, extensionError, formatKeys } from './graphql-errors'
+import type { InitialisedAction, InitialisedList } from './initialise-lists'
+import { type InputFilter, type UniqueInputFilter, resolveUniqueWhereInput } from './where-inputs'
+
+export function cannotForItem(operation: string, list: InitialisedList) {
+  if (operation === 'create')
+    return `You cannot ${operation} that ${list.graphql.names.outputTypeName}`
+  return `You cannot ${operation} that ${list.graphql.names.outputTypeName} - it may not exist`
+}
+
+export function cannotActionForItem(action: InitialisedAction, list: InitialisedList) {
+  return `You cannot execute action "${action.actionKey}" for that ${list.graphql.names.outputTypeName}`
+}
+
+export function cannotForItemFields(
+  operation: string,
+  list: InitialisedList,
+  fieldsDenied: string[]
+) {
+  return `You cannot ${operation} that ${list.graphql.names.outputTypeName} - you cannot ${operation} the fields ${formatKeys(fieldsDenied)}`
+}
+
+export async function getOperationFieldAccess(
+  item: BaseItem,
+  list: InitialisedList,
+  fieldKey: string,
+  context: NixxieContext,
+  operation: 'read'
+): Promise<boolean> {
+  if (context.__internal.sudo) return true
+
+  const { listKey } = list
+  let result
+  try {
+    result = await list.fields[fieldKey].access.read({
+      operation: 'read',
+      session: context.session,
+      listKey,
+      fieldKey,
+      context,
+      item,
+    })
+  } catch (error: any) {
+    throw extensionError('Access control', [
+      { error, tag: `${list.listKey}.${fieldKey}.access.${operation}` },
+    ])
+  }
+
+  if (typeof result !== 'boolean') {
+    throw accessReturnError([
+      { tag: `${listKey}.access.operation.${operation}`, returned: typeof result },
+    ])
+  }
+
+  return result
+}
+
+export async function getOperationAccess(
+  list: InitialisedList,
+  context: NixxieContext,
+  operation: 'query' | 'create' | 'update' | 'delete'
+) {
+  if (context.__internal.sudo) return true
+
+  const { listKey } = list
+  let result
+  try {
+    if (operation === 'query') {
+      result = await list.access.operation.query({
+        operation,
+        session: context.session,
+        listKey,
+        context,
+      })
+    } else if (operation === 'create') {
+      result = await list.access.operation.create({
+        operation,
+        session: context.session,
+        listKey,
+        context,
+      })
+    } else if (operation === 'update') {
+      result = await list.access.operation.update({
+        operation,
+        session: context.session,
+        listKey,
+        context,
+      })
+    } else if (operation === 'delete') {
+      result = await list.access.operation.delete({
+        operation,
+        session: context.session,
+        listKey,
+        context,
+      })
+    }
+  } catch (error: any) {
+    throw extensionError('Access control', [
+      { error, tag: `${listKey}.access.operation.${operation}` },
+    ])
+  }
+
+  if (typeof result !== 'boolean') {
+    throw accessReturnError([
+      { tag: `${listKey}.access.operation.${operation}`, returned: typeof result },
+    ])
+  }
+
+  return result
+}
+
+export async function getAccessFilters(
+  list: InitialisedList,
+  context: NixxieContext,
+  operation: keyof typeof list.access.filter
+): Promise<boolean | InputFilter> {
+  if (context.__internal.sudo) return true
+
+  try {
+    let filters
+    if (operation === 'query') {
+      filters = await list.access.filter.query({
+        operation,
+        session: context.session,
+        listKey: list.listKey,
+        context,
+      })
+    } else if (operation === 'update') {
+      filters = await list.access.filter.update({
+        operation,
+        session: context.session,
+        listKey: list.listKey,
+        context,
+      })
+    } else if (operation === 'delete') {
+      filters = await list.access.filter.delete({
+        operation,
+        session: context.session,
+        listKey: list.listKey,
+        context,
+      })
+    }
+
+    if (typeof filters === 'boolean') return filters
+    if (!filters) return false // shouldn't happen, but, Typescript
+
+    const schema = context.sudo().graphql.schema
+    const whereInput = assertInputObjectType(schema.getType(list.graphql.names.whereInputName))
+    const result = coerceAndValidateForGraphQLInput(schema, whereInput, filters)
+    if (result.kind === 'valid') return result.value
+    throw result.error
+  } catch (error: any) {
+    throw extensionError('Access control', [
+      { error, tag: `${list.listKey}.access.filter.${operation}` },
+    ])
+  }
+}
+
+export async function enforceListLevelAccessControl(
+  context: NixxieContext,
+  operation: 'create' | 'update' | 'delete',
+  list: InitialisedList,
+  inputData: Record<string, unknown>,
+  item: BaseItem | undefined
+) {
+  if (context.__internal.sudo) return
+
+  let accepted: unknown // should be boolean, but dont trust, it might accidentally be a filter
+  try {
+    // apply access.item.* controls
+    if (operation === 'create') {
+      const itemAccessControl = list.access.item[operation]
+      accepted = await itemAccessControl({
+        operation,
+        session: context.session,
+        listKey: list.listKey,
+        context,
+        inputData,
+      })
+    } else if (operation === 'update' && item !== undefined) {
+      const itemAccessControl = list.access.item[operation]
+      accepted = await itemAccessControl({
+        operation,
+        session: context.session,
+        listKey: list.listKey,
+        context,
+        item,
+        inputData,
+      })
+    } else if (operation === 'delete' && item !== undefined) {
+      const itemAccessControl = list.access.item[operation]
+      accepted = await itemAccessControl({
+        operation,
+        session: context.session,
+        listKey: list.listKey,
+        context,
+        item,
+      })
+    }
+  } catch (error: any) {
+    throw extensionError('Access control', [
+      { error, tag: `${list.listKey}.access.item.${operation}` },
+    ])
+  }
+
+  // short circuit the safe path
+  if (accepted === true) return
+
+  if (typeof accepted !== 'boolean') {
+    throw accessReturnError([
+      {
+        tag: `${list.listKey}.access.item.${operation}`,
+        returned: typeof accepted,
+      },
+    ])
+  }
+
+  throw accessDeniedError(cannotForItem(operation, list))
+}
+
+export async function enforceFieldLevelAccessControl(
+  context: NixxieContext,
+  operation: 'create' | 'update',
+  list: InitialisedList,
+  inputData: Record<string, unknown>,
+  item: BaseItem | undefined
+) {
+  if (context.__internal.sudo) return
+
+  const nonBooleans: { tag: string; returned: string }[] = []
+  const fieldsDenied: string[] = []
+  const accessErrors: { error: Error; tag: string }[] = []
+
+  await Promise.allSettled(
+    Object.keys(inputData).map(async fieldKey => {
+      let accepted: unknown // should be boolean, but dont trust
+      try {
+        // apply fields.[fieldKey].access.* controls
+        if (operation === 'create') {
+          const fieldAccessControl = list.fields[fieldKey].access[operation]
+          accepted = await fieldAccessControl({
+            operation,
+            session: context.session,
+            listKey: list.listKey,
+            fieldKey,
+            context,
+            inputData: inputData as any, // FIXME
+          })
+        } else if (operation === 'update' && item !== undefined) {
+          const fieldAccessControl = list.fields[fieldKey].access[operation]
+          accepted = await fieldAccessControl({
+            operation,
+            session: context.session,
+            listKey: list.listKey,
+            fieldKey,
+            context,
+            item,
+            inputData,
+          })
+        }
+      } catch (error: any) {
+        accessErrors.push({ error, tag: `${list.listKey}.${fieldKey}.access.${operation}` })
+        return
+      }
+
+      // short circuit the safe path
+      if (accepted === true) return
+      fieldsDenied.push(fieldKey)
+
+      // wrong type?
+      if (typeof accepted !== 'boolean') {
+        nonBooleans.push({
+          tag: `${list.listKey}.${fieldKey}.access.${operation}`,
+          returned: typeof accepted,
+        })
+      }
+    })
+  )
+
+  if (nonBooleans.length) {
+    throw accessReturnError(nonBooleans)
+  }
+
+  if (accessErrors.length) {
+    throw extensionError('Access control', accessErrors)
+  }
+
+  if (fieldsDenied.length) {
+    throw accessDeniedError(cannotForItemFields(operation, list, fieldsDenied))
+  }
+}
+
+export type ResolvedFieldAccessControl = {
+  read: FieldAccessControlFunction<FieldReadItemAccessArgs<BaseListTypeInfo>>
+  create: FieldAccessControlFunction<FieldCreateItemAccessArgs<BaseListTypeInfo>>
+  update: FieldAccessControlFunction<FieldUpdateItemAccessArgs<BaseListTypeInfo>>
+  // delete: not supported
+}
+
+export function parseFieldAccessControl(
+  access: FieldAccessControl<BaseListTypeInfo> | undefined
+): ResolvedFieldAccessControl {
+  if (typeof access === 'function') {
+    return {
+      read: access,
+      create: access,
+      update: access,
+    }
+  }
+
+  return {
+    read: access?.read ?? allowAll,
+    create: access?.create ?? allowAll,
+    update: access?.update ?? allowAll,
+  }
+}
+
+export type ResolvedActionAccessControl = ActionAccessControlFunction<BaseListTypeInfo>
+
+export type ResolvedListAccessControl = {
+  operation: {
+    query: ListOperationAccessControl<'query', BaseListTypeInfo>
+    create: ListOperationAccessControl<'create', BaseListTypeInfo>
+    update: ListOperationAccessControl<'update', BaseListTypeInfo>
+    delete: ListOperationAccessControl<'delete', BaseListTypeInfo>
+  }
+  filter: {
+    query: ListFilterAccessControl<'query', BaseListTypeInfo>
+    // create: not supported
+    update: ListFilterAccessControl<'update', BaseListTypeInfo>
+    delete: ListFilterAccessControl<'delete', BaseListTypeInfo>
+  }
+  item: {
+    // query: not supported
+    create: CreateListItemAccessControl<BaseListTypeInfo>
+    update: UpdateListItemAccessControl<BaseListTypeInfo>
+    delete: DeleteListItemAccessControl<BaseListTypeInfo>
+  }
+}
+
+export function parseListAccessControl(
+  access: ListAccessControl<BaseListTypeInfo>
+): ResolvedListAccessControl {
+  if (typeof access === 'function') {
+    return {
+      operation: {
+        query: access,
+        create: access,
+        update: access,
+        delete: access,
+      },
+      filter: {
+        query: allowAll,
+        update: allowAll,
+        delete: allowAll,
+      },
+      item: {
+        create: allowAll,
+        update: allowAll,
+        delete: allowAll,
+      },
+    }
+  }
+
+  let { operation, filter, item } = access
+  if (typeof operation === 'function') {
+    operation = {
+      query: operation,
+      create: operation,
+      update: operation,
+      delete: operation,
+    }
+  }
+
+  return {
+    operation: {
+      query: operation.query,
+      create: operation.create,
+      update: operation.update,
+      delete: operation.delete,
+    },
+    filter: {
+      query: filter?.query ?? allowAll,
+      // create: not supported
+      update: filter?.update ?? allowAll,
+      delete: filter?.delete ?? allowAll,
+    },
+    item: {
+      // query: not supported
+      create: item?.create ?? allowAll,
+      update: item?.update ?? allowAll,
+      delete: item?.delete ?? allowAll,
+    },
+  }
+}
+
+export async function checkUniqueItemExists(
+  uniqueInput: UniqueInputFilter,
+  foreignList: InitialisedList,
+  context: NixxieContext,
+  operation: string
+) {
+  // Validate and resolve the input filter
+  const uniqueWhere = await resolveUniqueWhereInput(uniqueInput, foreignList, context)
+
+  // Check whether the item exists (from this users POV).
+  try {
+    const item = await context.db[foreignList.listKey].findOne({ where: uniqueInput })
+    if (item !== null) return uniqueWhere
+  } catch (err) {}
+
+  throw accessDeniedError(cannotForItem(operation, foreignList))
+}

package/src/lib/core/field-assertions.ts

@@ -0,0 +1,118 @@
+import { GNonNull } from '@graphql-ts/schema'
+import { g } from '../..'
+import { allowAll } from '../../access'
+import type { InitialisedField } from './initialise-lists'
+
+export type ListForValidation = { listKey: string; fields: Record<string, InitialisedField> }
+
+export function assertFieldsValid(list: ListForValidation) {
+  assertNoConflictingExtraOutputFields(list)
+  assertIdFieldGraphQLTypesCorrect(list)
+  assertNoFieldKeysThatConflictWithFilterCombinators(list)
+  assertUniqueWhereInputsValid(list)
+  assertFieldsIsNonNullAllowed(list)
+}
+
+function assertFieldsIsNonNullAllowed(list: ListForValidation) {
+  for (const [fieldKey, field] of Object.entries(list.fields)) {
+    if (field.access.read !== allowAll) {
+      if (field.graphql.isNonNull.read) {
+        throw new Error(
+          `The field at ${list.listKey}.${fieldKey} sets graphql.isNonNull.read: true, and has 'read' field access control, this is not allowed.\n` +
+            `Either disable graphql.read.isNonNull, or disable 'read' field access control.`
+        )
+      }
+    }
+  }
+}
+
+function assertUniqueWhereInputsValid(list: ListForValidation) {
+  for (const [fieldKey, { dbField, input }] of Object.entries(list.fields)) {
+    if (input?.uniqueWhere) {
+      if (dbField.kind !== 'scalar' && dbField.kind !== 'enum' && dbField.kind !== 'relation') {
+        throw new Error(
+          `Only scalar db fields can provide a uniqueWhere input currently but the field at ${list.listKey}.${fieldKey} specifies a uniqueWhere input`
+        )
+      }
+
+      if (dbField.kind !== 'relation' && dbField.index !== 'unique' && fieldKey !== 'id') {
+        throw new Error(
+          `Fields must have a unique index or be the idField to specify a uniqueWhere input but the field at ${list.listKey}.${fieldKey} specifies a uniqueWhere input without a unique index`
+        )
+      }
+    }
+  }
+}
+
+function assertNoFieldKeysThatConflictWithFilterCombinators(list: ListForValidation) {
+  for (const fieldKey of Object.keys(list.fields)) {
+    if (fieldKey === 'AND' || fieldKey === 'OR' || fieldKey === 'NOT') {
+      throw new Error(
+        `Fields cannot be named ${fieldKey} but there is a field named ${fieldKey} on ${list.listKey}`
+      )
+    }
+  }
+}
+
+function assertNoConflictingExtraOutputFields(list: ListForValidation) {
+  const fieldKeys = new Set(Object.keys(list.fields))
+  const alreadyFoundFields: Record<string, string> = {}
+  for (const [fieldKey, field] of Object.entries(list.fields)) {
+    if (field.extraOutputFields) {
+      for (const outputTypeFieldName of Object.keys(field.extraOutputFields)) {
+        // note that this and the case handled below are fundamentally the same thing but i want different errors for each of them
+        if (fieldKeys.has(outputTypeFieldName)) {
+          throw new Error(
+            `The field ${fieldKey} on the ${list.listKey} list defines an extra GraphQL output field named ${outputTypeFieldName} which conflicts with the Nixxie field type named ${outputTypeFieldName} on the same list`
+          )
+        }
+        const alreadyFoundField = alreadyFoundFields[outputTypeFieldName]
+        if (alreadyFoundField !== undefined) {
+          throw new Error(
+            `The field ${fieldKey} on the ${list.listKey} list defines an extra GraphQL output field named ${outputTypeFieldName} which conflicts with the Nixxie field type named ${alreadyFoundField} which also defines an extra GraphQL output field named ${outputTypeFieldName}`
+          )
+        }
+        alreadyFoundFields[outputTypeFieldName] = fieldKey
+      }
+    }
+  }
+}
+
+function assertIdFieldGraphQLTypesCorrect(list: ListForValidation) {
+  const idField = list.fields.id
+  if (idField.input?.uniqueWhere === undefined) {
+    throw new Error(
+      `The idField on a list must define a uniqueWhere GraphQL input with the ID GraphQL scalar type but the idField for ${list.listKey} does not define one`
+    )
+  }
+  if (idField.input.uniqueWhere.arg.type !== g.ID) {
+    throw new Error(
+      `The idField on a list must define a uniqueWhere GraphQL input with the ID GraphQL scalar type but the idField for ${
+        list.listKey
+      } defines the type ${idField.input.uniqueWhere.arg.type.toString()}`
+    )
+  }
+  // we may want to loosen these constraints in the future
+  if (idField.input.create !== undefined) {
+    throw new Error(
+      `The idField on a list must not define a create GraphQL input but the idField for ${list.listKey} does define one`
+    )
+  }
+  if (idField.input.update !== undefined) {
+    throw new Error(
+      `The idField on a list must not define an update GraphQL input but the idField for ${list.listKey} does define one`
+    )
+  }
+  if (idField.graphql.isEnabled.read === false) {
+    throw new Error(
+      `The idField on a list must not have graphql.isEnabled.read be set to false but ${list.listKey} does`
+    )
+  }
+  if (!(idField.output.type instanceof GNonNull) || idField.output.type.ofType !== g.ID) {
+    throw new Error(
+      `The idField on a list must define a GraphQL output field with a non-nullable ID GraphQL scalar type but the idField for ${
+        list.listKey
+      } defines the type ${idField.output.type.toString()}`
+    )
+  }
+}

package/src/lib/core/filter-order-access.ts

@@ -0,0 +1,48 @@
+import type { NixxieContext } from '../../types'
+import { accessReturnError, extensionError, filterAccessError } from './graphql-errors'
+import type { InitialisedList } from './initialise-lists'
+
+export async function checkFilterOrderAccess(
+  things: { fieldKey: string; list: InitialisedList }[],
+  context: NixxieContext,
+  operation: 'filter' | 'orderBy'
+) {
+  const func = operation === 'filter' ? 'isFilterable' : 'isOrderable'
+  const failures: string[] = []
+  const returnTypeErrors: any[] = []
+  const accessErrors: any[] = []
+  for (const { fieldKey, list } of things) {
+    const field = list.fields[fieldKey]
+    const rule = field.graphql.isEnabled[operation]
+    if (!rule) throw new Error('Assert failed')
+
+    if (typeof rule === 'function') {
+      let result
+      try {
+        result = await rule({ context, session: context.session, listKey: list.listKey, fieldKey })
+      } catch (error: any) {
+        accessErrors.push({ error, tag: `${list.listKey}.${fieldKey}.${func}` })
+        continue
+      }
+      const resultType = typeof result
+
+      // It's important that we don't cast objects to truthy values, as there's a strong chance that the user
+      // has made a mistake.
+      if (resultType !== 'boolean') {
+        returnTypeErrors.push({ tag: `${list.listKey}.${fieldKey}.${func}`, returned: resultType })
+      } else if (!result) {
+        failures.push(`${list.listKey}.${fieldKey}`)
+      }
+    }
+  }
+  if (accessErrors.length) {
+    throw extensionError(func, accessErrors)
+  }
+
+  if (returnTypeErrors.length) {
+    throw accessReturnError(returnTypeErrors)
+  }
+  if (failures.length) {
+    throw filterAccessError({ operation, fieldKeys: failures })
+  }
+}

package/src/lib/core/graphql-errors.ts

@@ -0,0 +1,76 @@
+import { GraphQLError } from 'graphql'
+
+export const userInputError = (msg: string) =>
+  new GraphQLError(`Input error: ${msg}`, { extensions: { code: 'KS_USER_INPUT_ERROR' } })
+
+export const accessDeniedError = (msg: string, code = 'KS_ACCESS_DENIED') =>
+  new GraphQLError(`Access denied: ${msg}`, { extensions: { code } })
+
+export const validationFailureError = (messages: string[]) => {
+  const s = messages.map(m => `  - ${m}`).join('\n')
+  return new GraphQLError(`You provided invalid data for this operation.\n${s}`, {
+    extensions: { code: 'KS_VALIDATION_FAILURE' },
+  })
+}
+
+export const extensionError = (extension: string, things: { error: Error; tag: string }[]) => {
+  const s = things.map(t => `  - ${t.tag}: ${t.error.message}`).join('\n')
+  return new GraphQLError(`An error occurred while running "${extension}".\n${s}`, {
+    extensions: {
+      code: 'KS_EXTENSION_ERROR',
+      debug: things.map(t => ({ stacktrace: t.error.stack, message: t.error.message })),
+    },
+  })
+}
+
+export const resolverError = (things: { error: Error; tag: string }[]) => {
+  const s = things.map(t => `  - ${t.tag}: ${t.error.message}`).join('\n')
+  return new GraphQLError(`An error occurred while resolving input fields.\n${s}`, {
+    extensions: {
+      code: 'KS_RESOLVER_ERROR',
+      debug: things.map(t => ({ stacktrace: t.error.stack, message: t.error.message })),
+    },
+  })
+}
+
+export const relationshipError = (things: { error: Error; tag: string }[]) => {
+  const s = things
+    .map(t => `  - ${t.tag}: ${t.error.message}`)
+    .sort()
+    .join('\n')
+  return new GraphQLError(`An error occurred while resolving relationship fields.\n${s}`, {
+    extensions: {
+      code: 'KS_RELATIONSHIP_ERROR',
+      debug: things.map(t => ({ stacktrace: t.error.stack, message: t.error.message })),
+    },
+  })
+}
+
+export const accessReturnError = (things: { tag: string; returned: string }[]) => {
+  const s = things.map(t => `  - ${t.tag}: Returned: ${t.returned}. Expected: boolean.`).join('\n')
+  return new GraphQLError(`Invalid values returned from access control function.\n${s}`, {
+    extensions: {
+      code: 'KS_ACCESS_RETURN_ERROR',
+    },
+  })
+}
+
+export const limitsExceededError = (_: { type: string; limit: number; list: string }) =>
+  new GraphQLError('Your request exceeded server limits', {
+    extensions: {
+      code: 'KS_LIMITS_EXCEEDED',
+    },
+  })
+
+export function formatKeys(keys: string[]) {
+  if (keys.length < 4) return keys.join(', ')
+  return keys.slice(0, 3).join(', ') + ` and ${keys.length - 3} others...`
+}
+
+export const filterAccessError = ({
+  operation,
+  fieldKeys,
+}: {
+  operation: 'filter' | 'orderBy'
+  fieldKeys: string[]
+}) => accessDeniedError(`You cannot ${operation} by ${formatKeys(fieldKeys)}`, `KS_FILTER_DENIED`)