@nocobase/acl 0.7.0-alpha.0

package/esm/acl.js

@@ -0,0 +1,202 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import EventEmitter from 'events';
+import compose from 'koa-compose';
+import lodash from 'lodash';
+import { AclAvailableAction } from './acl-available-action';
+import { ACLAvailableStrategy, predicate } from './acl-available-strategy';
+import { ACLRole } from './acl-role';
+import { AllowManager } from './allow-manager';
+const parse = require('json-templates');
+export class ACL extends EventEmitter {
+    constructor() {
+        super();
+        this.availableActions = new Map();
+        this.availableStrategy = new Map();
+        this.middlewares = [];
+        this.allowManager = new AllowManager(this);
+        this.roles = new Map();
+        this.actionAlias = new Map();
+        this.configResources = [];
+        this.beforeGrantAction((ctx) => {
+            if (lodash.isPlainObject(ctx.params) && ctx.params.own) {
+                ctx.params = lodash.merge(ctx.params, predicate.own);
+            }
+        });
+        this.beforeGrantAction((ctx) => {
+            const actionName = this.resolveActionAlias(ctx.actionName);
+            if (lodash.isPlainObject(ctx.params)) {
+                if ((actionName === 'create' || actionName === 'update') && ctx.params.fields) {
+                    ctx.params = Object.assign(Object.assign({}, lodash.omit(ctx.params, 'fields')), { whitelist: ctx.params.fields });
+                }
+                if (actionName === 'view' && ctx.params.fields) {
+                    const appendFields = ['id', 'createdAt', 'updatedAt'];
+                    ctx.params = Object.assign(Object.assign({}, lodash.omit(ctx.params, 'fields')), { fields: [...ctx.params.fields, ...appendFields] });
+                }
+            }
+        });
+        this.middlewares.push(this.allowManager.aclMiddleware());
+    }
+    define(options) {
+        const roleName = options.role;
+        const role = new ACLRole(this, roleName);
+        if (options.strategy) {
+            role.strategy = options.strategy;
+        }
+        const actions = options.actions || {};
+        for (const [actionName, actionParams] of Object.entries(actions)) {
+            role.grantAction(actionName, actionParams);
+        }
+        this.roles.set(roleName, role);
+        return role;
+    }
+    getRole(name) {
+        return this.roles.get(name);
+    }
+    removeRole(name) {
+        return this.roles.delete(name);
+    }
+    registerConfigResources(names) {
+        names.forEach((name) => this.registerConfigResource(name));
+    }
+    registerConfigResource(name) {
+        this.configResources.push(name);
+    }
+    isConfigResource(name) {
+        return this.configResources.includes(name);
+    }
+    setAvailableAction(name, options) {
+        this.availableActions.set(name, new AclAvailableAction(name, options));
+        if (options.aliases) {
+            const aliases = lodash.isArray(options.aliases) ? options.aliases : [options.aliases];
+            for (const alias of aliases) {
+                this.actionAlias.set(alias, name);
+            }
+        }
+    }
+    getAvailableAction(name) {
+        const actionName = this.actionAlias.get(name) || name;
+        return this.availableActions.get(actionName);
+    }
+    getAvailableActions() {
+        return this.availableActions;
+    }
+    setAvailableStrategy(name, options) {
+        this.availableStrategy.set(name, new ACLAvailableStrategy(this, options));
+    }
+    beforeGrantAction(listener) {
+        this.addListener('beforeGrantAction', listener);
+    }
+    can({ role, resource, action }) {
+        const aclRole = this.roles.get(role);
+        if (!aclRole) {
+            return null;
+        }
+        const aclResource = aclRole.getResource(resource);
+        if (aclResource) {
+            const actionParams = aclResource.getAction(action);
+            if (actionParams) {
+                // handle single action config
+                return {
+                    role,
+                    resource,
+                    action,
+                    params: actionParams,
+                };
+            }
+        }
+        if (!aclRole.strategy) {
+            return null;
+        }
+        const roleStrategy = lodash.isString(aclRole.strategy)
+            ? this.availableStrategy.get(aclRole.strategy)
+            : new ACLAvailableStrategy(this, aclRole.strategy);
+        if (!roleStrategy) {
+            return null;
+        }
+        const roleStrategyParams = roleStrategy.allow(resource, this.resolveActionAlias(action));
+        if (roleStrategyParams) {
+            const result = { role, resource, action };
+            if (lodash.isPlainObject(roleStrategyParams)) {
+                result['params'] = roleStrategyParams;
+            }
+            return result;
+        }
+        return null;
+    }
+    isAvailableAction(actionName) {
+        return this.availableActions.has(this.resolveActionAlias(actionName));
+    }
+    resolveActionAlias(action) {
+        return this.actionAlias.get(action) ? this.actionAlias.get(action) : action;
+    }
+    use(fn) {
+        this.middlewares.push(fn);
+    }
+    allow(resourceName, actionNames, condition) {
+        if (!Array.isArray(actionNames)) {
+            actionNames = [actionNames];
+        }
+        for (const actionName of actionNames) {
+            this.allowManager.allow(resourceName, actionName, condition);
+        }
+    }
+    parseJsonTemplate(json, ctx) {
+        return parse(json)({
+            ctx: {
+                state: JSON.parse(JSON.stringify(ctx.state)),
+            },
+        });
+    }
+    middleware() {
+        const acl = this;
+        const filterParams = (ctx, resourceName, params) => {
+            var _a;
+            if ((_a = params === null || params === void 0 ? void 0 : params.filter) === null || _a === void 0 ? void 0 : _a.createdById) {
+                const collection = ctx.db.getCollection(resourceName);
+                if (collection && !collection.getField('createdById')) {
+                    return lodash.omit(params, 'filter.createdById');
+                }
+            }
+            return params;
+        };
+        return function ACLMiddleware(ctx, next) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const roleName = ctx.state.currentRole || 'anonymous';
+                const { resourceName, actionName } = ctx.action;
+                const resourcerAction = ctx.action;
+                ctx.can = (options) => {
+                    return acl.can(Object.assign({ role: roleName }, options));
+                };
+                ctx.permission = {
+                    can: ctx.can({ resource: resourceName, action: actionName }),
+                };
+                return compose(acl.middlewares)(ctx, () => __awaiter(this, void 0, void 0, function* () {
+                    const permission = ctx.permission;
+                    if (permission.skip) {
+                        return next();
+                    }
+                    if (!permission.can || typeof permission.can !== 'object') {
+                        ctx.throw(403, 'No permissions');
+                        return;
+                    }
+                    const { params } = permission.can;
+                    if (params) {
+                        const filteredParams = filterParams(ctx, resourceName, params);
+                        const parsedParams = acl.parseJsonTemplate(filteredParams, ctx);
+                        resourcerAction.mergeParams(parsedParams);
+                    }
+                    yield next();
+                }));
+            });
+        };
+    }
+}
+//# sourceMappingURL=acl.js.map

package/esm/acl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl.js","sourceRoot":"","sources":["../src/acl.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,YAAY,MAAM,QAAQ,CAAC;AAClC,OAAO,OAAO,MAAM,aAAa,CAAC;AAClC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAA0B,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAA4B,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrG,OAAO,EAAE,OAAO,EAAoB,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAoCxC,MAAM,OAAO,GAAI,SAAQ,YAAY;IAanC;QACE,KAAK,EAAE,CAAC;QAbA,qBAAgB,GAAG,IAAI,GAAG,EAA8B,CAAC;QACzD,sBAAiB,GAAG,IAAI,GAAG,EAAgC,CAAC;QAC5D,gBAAW,GAAG,EAAE,CAAC;QAEpB,iBAAY,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAE7C,UAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;QAEnC,gBAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAExC,oBAAe,GAAa,EAAE,CAAC;QAK7B,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7B,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;gBACtD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;aACtD;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAE3D,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;gBACpC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE;oBAC7E,GAAG,CAAC,MAAM,mCACL,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,KACpC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAC7B,CAAC;iBACH;gBAED,IAAI,UAAU,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE;oBAC9C,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;oBACtD,GAAG,CAAC,MAAM,mCACL,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,KACpC,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,GAChD,CAAC;iBACH;aACF;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,OAAsB;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEzC,IAAI,OAAO,CAAC,QAAQ,EAAE;YACpB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;SAClC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAEtC,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAChE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;SAC5C;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,uBAAuB,CAAC,KAAe;QACrC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,sBAAsB,CAAC,IAAY;QACjC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,kBAAkB,CAAC,IAAY,EAAE,OAA+B;QAC9D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAEvE,IAAI,OAAO,CAAC,OAAO,EAAE;YACnB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;gBAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;aACnC;SACF;IACH,CAAC;IAED,kBAAkB,CAAC,IAAY;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACtD,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,oBAAoB,CAAC,IAAY,EAAE,OAA8C;QAC/E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,iBAAiB,CAAC,QAAmB;QACnC,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAW;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAErC,IAAI,CAAC,OAAO,EAAE;YACZ,OAAO,IAAI,CAAC;SACb;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,WAAW,EAAE;YACf,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAEnD,IAAI,YAAY,EAAE;gBAChB,8BAA8B;gBAC9B,OAAO;oBACL,IAAI;oBACJ,QAAQ;oBACR,MAAM;oBACN,MAAM,EAAE,YAAY;iBACrB,CAAC;aACH;SACF;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACrB,OAAO,IAAI,CAAC;SACb;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC9C,CAAC,CAAC,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAErD,IAAI,CAAC,YAAY,EAAE;YACjB,OAAO,IAAI,CAAC;SACb;QAED,MAAM,kBAAkB,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAEzF,IAAI,kBAAkB,EAAE;YACtB,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAE1C,IAAI,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE;gBAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC;aACvC;YAED,OAAO,MAAM,CAAC;SACf;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAES,iBAAiB,CAAC,UAAkB;QAC5C,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC;IAEM,kBAAkB,CAAC,MAAc;QACtC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9E,CAAC;IAED,GAAG,CAAC,EAAO;QACT,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,YAAoB,EAAE,WAA8B,EAAE,SAAe;QACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;YAC/B,WAAW,GAAG,CAAC,WAAW,CAAC,CAAC;SAC7B;QAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE;YACpC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;SAC9D;IACH,CAAC;IAED,iBAAiB,CAAC,IAAS,EAAE,GAAQ;QACnC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;YACjB,GAAG,EAAE;gBACH,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;aAC7C;SACF,CAAC,CAAC;IACL,CAAC;IAED,UAAU;QACR,MAAM,GAAG,GAAG,IAAI,CAAC;QAEjB,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE;;YACjD,IAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,0CAAE,WAAW,EAAE;gBAC/B,MAAM,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACtD,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;oBACrD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;iBAClD;aACF;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,OAAO,SAAe,aAAa,CAAC,GAAG,EAAE,IAAI;;gBAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,WAAW,CAAC;gBACtD,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAEhD,MAAM,eAAe,GAAW,GAAG,CAAC,MAAM,CAAC;gBAE3C,GAAG,CAAC,GAAG,GAAG,CAAC,OAA8B,EAAE,EAAE;oBAC3C,OAAO,GAAG,CAAC,GAAG,iBAAG,IAAI,EAAE,QAAQ,IAAK,OAAO,EAAG,CAAC;gBACjD,CAAC,CAAC;gBAEF,GAAG,CAAC,UAAU,GAAG;oBACf,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;iBAC7D,CAAC;gBAEF,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAS,EAAE;oBAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;oBAElC,IAAI,UAAU,CAAC,IAAI,EAAE;wBACnB,OAAO,IAAI,EAAE,CAAC;qBACf;oBAED,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAAE;wBACzD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;wBACjC,OAAO;qBACR;oBAED,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC;oBAElC,IAAI,MAAM,EAAE;wBACV,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;wBAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,iBAAiB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;wBAChE,eAAe,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;qBAC3C;oBAED,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC,CAAA,CAAC,CAAC;YACL,CAAC;SAAA,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { Action } from '@nocobase/resourcer';\nimport EventEmitter from 'events';\nimport compose from 'koa-compose';\nimport lodash from 'lodash';\nimport { AclAvailableAction, AvailableActionOptions } from './acl-available-action';\nimport { ACLAvailableStrategy, AvailableStrategyOptions, predicate } from './acl-available-strategy';\nimport { ACLRole, RoleActionParams } from './acl-role';\nimport { AllowManager } from './allow-manager';\nconst parse = require('json-templates');\n\ninterface CanResult {\n  role: string;\n  resource: string;\n  action: string;\n  params?: any;\n}\n\nexport interface DefineOptions {\n  role: string;\n  allowConfigure?: boolean;\n  strategy?: string | Omit<AvailableStrategyOptions, 'acl'>;\n  actions?: {\n    [key: string]: RoleActionParams;\n  };\n  routes?: any;\n}\n\nexport interface ListenerContext {\n  acl: ACL;\n  role: ACLRole;\n  path: string;\n  actionName: string;\n  resourceName: string;\n  params: RoleActionParams;\n}\n\ntype Listener = (ctx: ListenerContext) => void;\n\ninterface CanArgs {\n  role: string;\n  resource: string;\n  action: string;\n}\n\nexport class ACL extends EventEmitter {\n  protected availableActions = new Map<string, AclAvailableAction>();\n  protected availableStrategy = new Map<string, ACLAvailableStrategy>();\n  protected middlewares = [];\n\n  public allowManager = new AllowManager(this);\n\n  roles = new Map<string, ACLRole>();\n\n  actionAlias = new Map<string, string>();\n\n  configResources: string[] = [];\n\n  constructor() {\n    super();\n\n    this.beforeGrantAction((ctx) => {\n      if (lodash.isPlainObject(ctx.params) && ctx.params.own) {\n        ctx.params = lodash.merge(ctx.params, predicate.own);\n      }\n    });\n\n    this.beforeGrantAction((ctx) => {\n      const actionName = this.resolveActionAlias(ctx.actionName);\n\n      if (lodash.isPlainObject(ctx.params)) {\n        if ((actionName === 'create' || actionName === 'update') && ctx.params.fields) {\n          ctx.params = {\n            ...lodash.omit(ctx.params, 'fields'),\n            whitelist: ctx.params.fields,\n          };\n        }\n\n        if (actionName === 'view' && ctx.params.fields) {\n          const appendFields = ['id', 'createdAt', 'updatedAt'];\n          ctx.params = {\n            ...lodash.omit(ctx.params, 'fields'),\n            fields: [...ctx.params.fields, ...appendFields],\n          };\n        }\n      }\n    });\n\n    this.middlewares.push(this.allowManager.aclMiddleware());\n  }\n\n  define(options: DefineOptions): ACLRole {\n    const roleName = options.role;\n    const role = new ACLRole(this, roleName);\n\n    if (options.strategy) {\n      role.strategy = options.strategy;\n    }\n\n    const actions = options.actions || {};\n\n    for (const [actionName, actionParams] of Object.entries(actions)) {\n      role.grantAction(actionName, actionParams);\n    }\n\n    this.roles.set(roleName, role);\n\n    return role;\n  }\n\n  getRole(name: string): ACLRole {\n    return this.roles.get(name);\n  }\n\n  removeRole(name: string) {\n    return this.roles.delete(name);\n  }\n\n  registerConfigResources(names: string[]) {\n    names.forEach((name) => this.registerConfigResource(name));\n  }\n\n  registerConfigResource(name: string) {\n    this.configResources.push(name);\n  }\n\n  isConfigResource(name: string) {\n    return this.configResources.includes(name);\n  }\n\n  setAvailableAction(name: string, options: AvailableActionOptions) {\n    this.availableActions.set(name, new AclAvailableAction(name, options));\n\n    if (options.aliases) {\n      const aliases = lodash.isArray(options.aliases) ? options.aliases : [options.aliases];\n      for (const alias of aliases) {\n        this.actionAlias.set(alias, name);\n      }\n    }\n  }\n\n  getAvailableAction(name: string) {\n    const actionName = this.actionAlias.get(name) || name;\n    return this.availableActions.get(actionName);\n  }\n\n  getAvailableActions() {\n    return this.availableActions;\n  }\n\n  setAvailableStrategy(name: string, options: Omit<AvailableStrategyOptions, 'acl'>) {\n    this.availableStrategy.set(name, new ACLAvailableStrategy(this, options));\n  }\n\n  beforeGrantAction(listener?: Listener) {\n    this.addListener('beforeGrantAction', listener);\n  }\n\n  can({ role, resource, action }: CanArgs): CanResult | null {\n    const aclRole = this.roles.get(role);\n\n    if (!aclRole) {\n      return null;\n    }\n\n    const aclResource = aclRole.getResource(resource);\n\n    if (aclResource) {\n      const actionParams = aclResource.getAction(action);\n\n      if (actionParams) {\n        // handle single action config\n        return {\n          role,\n          resource,\n          action,\n          params: actionParams,\n        };\n      }\n    }\n\n    if (!aclRole.strategy) {\n      return null;\n    }\n\n    const roleStrategy = lodash.isString(aclRole.strategy)\n      ? this.availableStrategy.get(aclRole.strategy)\n      : new ACLAvailableStrategy(this, aclRole.strategy);\n\n    if (!roleStrategy) {\n      return null;\n    }\n\n    const roleStrategyParams = roleStrategy.allow(resource, this.resolveActionAlias(action));\n\n    if (roleStrategyParams) {\n      const result = { role, resource, action };\n\n      if (lodash.isPlainObject(roleStrategyParams)) {\n        result['params'] = roleStrategyParams;\n      }\n\n      return result;\n    }\n\n    return null;\n  }\n\n  protected isAvailableAction(actionName: string) {\n    return this.availableActions.has(this.resolveActionAlias(actionName));\n  }\n\n  public resolveActionAlias(action: string) {\n    return this.actionAlias.get(action) ? this.actionAlias.get(action) : action;\n  }\n\n  use(fn: any) {\n    this.middlewares.push(fn);\n  }\n\n  allow(resourceName: string, actionNames: string[] | string, condition?: any) {\n    if (!Array.isArray(actionNames)) {\n      actionNames = [actionNames];\n    }\n\n    for (const actionName of actionNames) {\n      this.allowManager.allow(resourceName, actionName, condition);\n    }\n  }\n\n  parseJsonTemplate(json: any, ctx: any) {\n    return parse(json)({\n      ctx: {\n        state: JSON.parse(JSON.stringify(ctx.state)),\n      },\n    });\n  }\n\n  middleware() {\n    const acl = this;\n\n    const filterParams = (ctx, resourceName, params) => {\n      if (params?.filter?.createdById) {\n        const collection = ctx.db.getCollection(resourceName);\n        if (collection && !collection.getField('createdById')) {\n          return lodash.omit(params, 'filter.createdById');\n        }\n      }\n\n      return params;\n    };\n\n    return async function ACLMiddleware(ctx, next) {\n      const roleName = ctx.state.currentRole || 'anonymous';\n      const { resourceName, actionName } = ctx.action;\n\n      const resourcerAction: Action = ctx.action;\n\n      ctx.can = (options: Omit<CanArgs, 'role'>) => {\n        return acl.can({ role: roleName, ...options });\n      };\n\n      ctx.permission = {\n        can: ctx.can({ resource: resourceName, action: actionName }),\n      };\n\n      return compose(acl.middlewares)(ctx, async () => {\n        const permission = ctx.permission;\n\n        if (permission.skip) {\n          return next();\n        }\n\n        if (!permission.can || typeof permission.can !== 'object') {\n          ctx.throw(403, 'No permissions');\n          return;\n        }\n\n        const { params } = permission.can;\n\n        if (params) {\n          const filteredParams = filterParams(ctx, resourceName, params);\n          const parsedParams = acl.parseJsonTemplate(filteredParams, ctx);\n          resourcerAction.mergeParams(parsedParams);\n        }\n\n        await next();\n      });\n    };\n  }\n}\n"]}

package/esm/allow-manager.d.ts

@@ -0,0 +1,13 @@
+import { ACL } from './acl';
+declare type ConditionFunc = (ctx: any) => Promise<boolean>;
+export declare class AllowManager {
+    acl: ACL;
+    protected skipActions: Map<string, Map<string, string | true | ConditionFunc>>;
+    protected registeredCondition: Map<string, ConditionFunc>;
+    constructor(acl: ACL);
+    allow(resourceName: string, actionName: string, condition?: string | ConditionFunc): void;
+    getAllowedConditions(resourceName: string, actionName: string): Array<ConditionFunc | true>;
+    registerAllowCondition(name: string, condition: ConditionFunc): void;
+    aclMiddleware(): (ctx: any, next: any) => Promise<void>;
+}
+export {};

package/esm/allow-manager.js

@@ -0,0 +1,80 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+export class AllowManager {
+    constructor(acl) {
+        this.acl = acl;
+        this.skipActions = new Map();
+        this.registeredCondition = new Map();
+        this.registerAllowCondition('loggedIn', (ctx) => {
+            return ctx.state.currentUser;
+        });
+        this.registerAllowCondition('allowConfigure', (ctx) => __awaiter(this, void 0, void 0, function* () {
+            const roleName = ctx.state.currentRole;
+            if (!roleName) {
+                return false;
+            }
+            const roleInstance = yield ctx.db.getRepository('roles').findOne({
+                name: roleName,
+            });
+            return roleInstance === null || roleInstance === void 0 ? void 0 : roleInstance.get('allowConfigure');
+        }));
+    }
+    allow(resourceName, actionName, condition) {
+        const actionMap = this.skipActions.get(resourceName) || new Map();
+        actionMap.set(actionName, condition || true);
+        this.skipActions.set(resourceName, actionMap);
+    }
+    getAllowedConditions(resourceName, actionName) {
+        const fetchActionSteps = ['*', resourceName];
+        const results = [];
+        for (const fetchActionStep of fetchActionSteps) {
+            const resource = this.skipActions.get(fetchActionStep);
+            if (resource) {
+                const condition = resource.get('*') || resource.get(actionName);
+                if (condition) {
+                    results.push(typeof condition === 'string' ? this.registeredCondition.get(condition) : condition);
+                }
+            }
+        }
+        return results;
+    }
+    registerAllowCondition(name, condition) {
+        this.registeredCondition.set(name, condition);
+    }
+    aclMiddleware() {
+        return (ctx, next) => __awaiter(this, void 0, void 0, function* () {
+            const { resourceName, actionName } = ctx.action;
+            const skippedConditions = ctx.app.acl.allowManager.getAllowedConditions(resourceName, actionName);
+            let skip = false;
+            for (const skippedCondition of skippedConditions) {
+                if (skippedCondition) {
+                    let skipResult = false;
+                    if (typeof skippedCondition === 'function') {
+                        skipResult = yield skippedCondition(ctx);
+                    }
+                    else if (skippedCondition) {
+                        skipResult = true;
+                    }
+                    if (skipResult) {
+                        skip = true;
+                        break;
+                    }
+                }
+            }
+            if (skip) {
+                ctx.permission = {
+                    skip: true,
+                };
+            }
+            yield next();
+        });
+    }
+}
+//# sourceMappingURL=allow-manager.js.map

package/esm/allow-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-manager.js","sourceRoot":"","sources":["../src/allow-manager.ts"],"names":[],"mappings":";;;;;;;;;AAIA,MAAM,OAAO,YAAY;IAKvB,YAAmB,GAAQ;QAAR,QAAG,GAAH,GAAG,CAAK;QAJjB,gBAAW,GAAG,IAAI,GAAG,EAAsD,CAAC;QAE5E,wBAAmB,GAAG,IAAI,GAAG,EAAyB,CAAC;QAG/D,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAC9C,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAO,GAAG,EAAE,EAAE;YAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;YACvC,IAAI,CAAC,QAAQ,EAAE;gBACb,OAAO,KAAK,CAAC;aACd;YAED,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;gBAC/D,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;YAEH,OAAO,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7C,CAAC,CAAA,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAoB,EAAE,UAAkB,EAAE,SAAkC;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,GAAG,EAAkC,CAAC;QAClG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;QAE7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,oBAAoB,CAAC,YAAoB,EAAE,UAAkB;QAC3D,MAAM,gBAAgB,GAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,EAAE,CAAC;QAEnB,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE;gBACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAChE,IAAI,SAAS,EAAE;oBACb,OAAO,CAAC,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;iBACnG;aACF;SACF;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sBAAsB,CAAC,IAAY,EAAE,SAAwB;QAC3D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,aAAa;QACX,OAAO,CAAO,GAAG,EAAE,IAAI,EAAE,EAAE;YACzB,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAChD,MAAM,iBAAiB,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,oBAAoB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAClG,IAAI,IAAI,GAAG,KAAK,CAAC;YAEjB,KAAK,MAAM,gBAAgB,IAAI,iBAAiB,EAAE;gBAChD,IAAI,gBAAgB,EAAE;oBACpB,IAAI,UAAU,GAAG,KAAK,CAAC;oBAEvB,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;wBAC1C,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;qBAC1C;yBAAM,IAAI,gBAAgB,EAAE;wBAC3B,UAAU,GAAG,IAAI,CAAC;qBACnB;oBAED,IAAI,UAAU,EAAE;wBACd,IAAI,GAAG,IAAI,CAAC;wBACZ,MAAM;qBACP;iBACF;aACF;YAED,IAAI,IAAI,EAAE;gBACR,GAAG,CAAC,UAAU,GAAG;oBACf,IAAI,EAAE,IAAI;iBACX,CAAC;aACH;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAA,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { ACL } from './acl';\n\ntype ConditionFunc = (ctx: any) => Promise<boolean>;\n\nexport class AllowManager {\n  protected skipActions = new Map<string, Map<string, string | ConditionFunc | true>>();\n\n  protected registeredCondition = new Map<string, ConditionFunc>();\n\n  constructor(public acl: ACL) {\n    this.registerAllowCondition('loggedIn', (ctx) => {\n      return ctx.state.currentUser;\n    });\n\n    this.registerAllowCondition('allowConfigure', async (ctx) => {\n      const roleName = ctx.state.currentRole;\n      if (!roleName) {\n        return false;\n      }\n\n      const roleInstance = await ctx.db.getRepository('roles').findOne({\n        name: roleName,\n      });\n\n      return roleInstance?.get('allowConfigure');\n    });\n  }\n\n  allow(resourceName: string, actionName: string, condition?: string | ConditionFunc) {\n    const actionMap = this.skipActions.get(resourceName) || new Map<string, string | ConditionFunc>();\n    actionMap.set(actionName, condition || true);\n\n    this.skipActions.set(resourceName, actionMap);\n  }\n\n  getAllowedConditions(resourceName: string, actionName: string): Array<ConditionFunc | true> {\n    const fetchActionSteps: string[] = ['*', resourceName];\n\n    const results = [];\n\n    for (const fetchActionStep of fetchActionSteps) {\n      const resource = this.skipActions.get(fetchActionStep);\n      if (resource) {\n        const condition = resource.get('*') || resource.get(actionName);\n        if (condition) {\n          results.push(typeof condition === 'string' ? this.registeredCondition.get(condition) : condition);\n        }\n      }\n    }\n\n    return results;\n  }\n\n  registerAllowCondition(name: string, condition: ConditionFunc) {\n    this.registeredCondition.set(name, condition);\n  }\n\n  aclMiddleware() {\n    return async (ctx, next) => {\n      const { resourceName, actionName } = ctx.action;\n      const skippedConditions = ctx.app.acl.allowManager.getAllowedConditions(resourceName, actionName);\n      let skip = false;\n\n      for (const skippedCondition of skippedConditions) {\n        if (skippedCondition) {\n          let skipResult = false;\n\n          if (typeof skippedCondition === 'function') {\n            skipResult = await skippedCondition(ctx);\n          } else if (skippedCondition) {\n            skipResult = true;\n          }\n\n          if (skipResult) {\n            skip = true;\n            break;\n          }\n        }\n      }\n\n      if (skip) {\n        ctx.permission = {\n          skip: true,\n        };\n      }\n      await next();\n    };\n  }\n}\n"]}

package/esm/index.d.ts

@@ -0,0 +1,6 @@
+export * from './acl';
+export * from './acl-available-action';
+export * from './acl-available-strategy';
+export * from './acl-resource';
+export * from './acl-role';
+export * from './skip-middleware';

package/esm/index.js

@@ -0,0 +1,7 @@
+export * from './acl';
+export * from './acl-available-action';
+export * from './acl-available-strategy';
+export * from './acl-resource';
+export * from './acl-role';
+export * from './skip-middleware';
+//# sourceMappingURL=index.js.map

package/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC","sourcesContent":["export * from './acl';\nexport * from './acl-available-action';\nexport * from './acl-available-strategy';\nexport * from './acl-resource';\nexport * from './acl-role';\nexport * from './skip-middleware';\n\n"]}

package/esm/skip-middleware.d.ts

@@ -0,0 +1,6 @@
+export declare const skip: (options: ACLSkipOptions) => (ctx: any, next: any) => Promise<void>;
+interface ACLSkipOptions {
+    resourceName: string;
+    actionName: string;
+}
+export {};

package/esm/skip-middleware.js

@@ -0,0 +1,23 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+export const skip = (options) => {
+    return function ACLSkipMiddleware(ctx, next) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { resourceName, actionName } = ctx.action;
+            if (resourceName === options.resourceName && actionName === options.actionName) {
+                ctx.permission = {
+                    skip: true,
+                };
+            }
+            yield next();
+        });
+    };
+};
+//# sourceMappingURL=skip-middleware.js.map

package/esm/skip-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skip-middleware.js","sourceRoot":"","sources":["../src/skip-middleware.ts"],"names":[],"mappings":";;;;;;;;;AAAA,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAuB,EAAE,EAAE;IAC9C,OAAO,SAAe,iBAAiB,CAAC,GAAG,EAAE,IAAI;;YAC/C,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAChD,IAAI,YAAY,KAAK,OAAO,CAAC,YAAY,IAAI,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE;gBAC9E,GAAG,CAAC,UAAU,GAAG;oBACf,IAAI,EAAE,IAAI;iBACX,CAAC;aACH;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;KAAA,CAAC;AACJ,CAAC,CAAC","sourcesContent":["export const skip = (options: ACLSkipOptions) => {\n  return async function ACLSkipMiddleware(ctx, next) {\n    const { resourceName, actionName } = ctx.action;\n    if (resourceName === options.resourceName && actionName === options.actionName) {\n      ctx.permission = {\n        skip: true,\n      };\n    }\n    await next();\n  };\n};\n\ninterface ACLSkipOptions {\n  resourceName: string;\n  actionName: string;\n}\n"]}

package/lib/acl-available-action.d.ts

@@ -0,0 +1,16 @@
+export interface AvailableActionOptions {
+    /**
+     * @deprecated
+     */
+    type: 'new-data' | 'old-data';
+    displayName?: string;
+    aliases?: string[] | string;
+    resource?: string;
+    onNewRecord?: boolean;
+    allowConfigureFields?: boolean;
+}
+export declare class AclAvailableAction {
+    name: string;
+    options: AvailableActionOptions;
+    constructor(name: string, options: AvailableActionOptions);
+}

package/lib/acl-available-action.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AclAvailableAction = void 0;
+class AclAvailableAction {
+    constructor(name, options) {
+        this.name = name;
+        this.options = options;
+    }
+}
+exports.AclAvailableAction = AclAvailableAction;
+//# sourceMappingURL=acl-available-action.js.map

package/lib/acl-available-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-available-action.js","sourceRoot":"","sources":["../src/acl-available-action.ts"],"names":[],"mappings":";;;AAcA,MAAa,kBAAkB;IAC7B,YAAmB,IAAY,EAAS,OAA+B;QAApD,SAAI,GAAJ,IAAI,CAAQ;QAAS,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;CAC5E;AAFD,gDAEC","sourcesContent":["export interface AvailableActionOptions {\n  /**\n   * @deprecated\n   */\n  type: 'new-data' | 'old-data';\n  displayName?: string;\n  aliases?: string[] | string;\n  resource?: string;\n  // 对新数据进行操作\n  onNewRecord?: boolean;\n  // 允许配置字段\n  allowConfigureFields?: boolean;\n}\n\nexport class AclAvailableAction {\n  constructor(public name: string, public options: AvailableActionOptions) {}\n}\n"]}

package/lib/acl-available-strategy.d.ts

@@ -0,0 +1,29 @@
+import { ACL } from './acl';
+declare type StrategyValue = false | '*' | string | string[];
+export interface AvailableStrategyOptions {
+    displayName?: string;
+    actions?: false | string | string[];
+    allowConfigure?: boolean;
+    resource?: '*';
+}
+export declare function strategyValueMatched(strategy: StrategyValue, value: string): boolean;
+export declare const predicate: {
+    own: {
+        filter: {
+            createdById: string;
+        };
+    };
+    all: {};
+};
+export declare class ACLAvailableStrategy {
+    acl: ACL;
+    options: AvailableStrategyOptions;
+    actionsAsObject: {
+        [key: string]: string;
+    };
+    allowConfigure: boolean;
+    constructor(acl: ACL, options: AvailableStrategyOptions);
+    matchAction(actionName: string): any;
+    allow(resourceName: string, actionName: string): any;
+}
+export {};

package/lib/acl-available-strategy.js

@@ -0,0 +1,68 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACLAvailableStrategy = exports.predicate = exports.strategyValueMatched = void 0;
+const lodash_1 = __importDefault(require("lodash"));
+function strategyValueMatched(strategy, value) {
+    if (strategy === '*') {
+        return true;
+    }
+    if (lodash_1.default.isString(strategy) && strategy === value) {
+        return true;
+    }
+    if (lodash_1.default.isArray(strategy) && strategy.includes(value)) {
+        return true;
+    }
+    return false;
+}
+exports.strategyValueMatched = strategyValueMatched;
+exports.predicate = {
+    own: {
+        filter: {
+            createdById: '{{ ctx.state.currentUser.id }}',
+        },
+    },
+    all: {},
+};
+class ACLAvailableStrategy {
+    constructor(acl, options) {
+        this.acl = acl;
+        this.options = options;
+        this.allowConfigure = options.allowConfigure;
+        let actions = this.options.actions;
+        if (lodash_1.default.isString(actions) && actions != '*') {
+            actions = [actions];
+        }
+        if (lodash_1.default.isArray(actions)) {
+            this.actionsAsObject = actions.reduce((carry, action) => {
+                const [actionName, predicate] = action.split(':');
+                carry[actionName] = predicate;
+                return carry;
+            }, {});
+        }
+    }
+    matchAction(actionName) {
+        var _a;
+        if (this.options.actions == '*') {
+            return true;
+        }
+        if ((_a = this.actionsAsObject) === null || _a === void 0 ? void 0 : _a.hasOwnProperty(actionName)) {
+            const predicateName = this.actionsAsObject[actionName];
+            if (predicateName) {
+                return exports.predicate[predicateName];
+            }
+            return true;
+        }
+        return false;
+    }
+    allow(resourceName, actionName) {
+        if (this.acl.isConfigResource(resourceName) && this.allowConfigure) {
+            return true;
+        }
+        return this.matchAction(this.acl.resolveActionAlias(actionName));
+    }
+}
+exports.ACLAvailableStrategy = ACLAvailableStrategy;
+//# sourceMappingURL=acl-available-strategy.js.map

package/lib/acl-available-strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-available-strategy.js","sourceRoot":"","sources":["../src/acl-available-strategy.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAW5B,SAAgB,oBAAoB,CAAC,QAAuB,EAAE,KAAa;IACzE,IAAI,QAAQ,KAAK,GAAG,EAAE;QACpB,OAAO,IAAI,CAAC;KACb;IAED,IAAI,gBAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,KAAK,EAAE;QACnD,OAAO,IAAI,CAAC;KACb;IAED,IAAI,gBAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACxD,OAAO,IAAI,CAAC;KACb;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAdD,oDAcC;AAEY,QAAA,SAAS,GAAG;IACvB,GAAG,EAAE;QACH,MAAM,EAAE;YACN,WAAW,EAAE,gCAAgC;SAC9C;KACF;IACD,GAAG,EAAE,EAAE;CACR,CAAC;AAEF,MAAa,oBAAoB;IAO/B,YAAY,GAAQ,EAAE,OAAiC;QACrD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAE7C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACnC,IAAI,gBAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,GAAG,EAAE;YAC9C,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;SACrB;QAED,IAAI,gBAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAC3B,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACtD,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAClD,KAAK,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;gBAC9B,OAAO,KAAK,CAAC;YACf,CAAC,EAAE,EAAE,CAAC,CAAC;SACR;IACH,CAAC;IAED,WAAW,CAAC,UAAkB;;QAC5B,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,EAAE;YAC/B,OAAO,IAAI,CAAC;SACb;QAED,IAAI,MAAA,IAAI,CAAC,eAAe,0CAAE,cAAc,CAAC,UAAU,CAAC,EAAE;YACpD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,aAAa,EAAE;gBACjB,OAAO,iBAAS,CAAC,aAAa,CAAC,CAAC;aACjC;YAED,OAAO,IAAI,CAAC;SACb;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,YAAoB,EAAE,UAAkB;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE;YAClE,OAAO,IAAI,CAAC;SACb;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;CACF;AAlDD,oDAkDC","sourcesContent":["import lodash from 'lodash';\nimport { ACL } from './acl';\ntype StrategyValue = false | '*' | string | string[];\n\nexport interface AvailableStrategyOptions {\n  displayName?: string;\n  actions?: false | string | string[];\n  allowConfigure?: boolean;\n  resource?: '*';\n}\n\nexport function strategyValueMatched(strategy: StrategyValue, value: string) {\n  if (strategy === '*') {\n    return true;\n  }\n\n  if (lodash.isString(strategy) && strategy === value) {\n    return true;\n  }\n\n  if (lodash.isArray(strategy) && strategy.includes(value)) {\n    return true;\n  }\n\n  return false;\n}\n\nexport const predicate = {\n  own: {\n    filter: {\n      createdById: '{{ ctx.state.currentUser.id }}',\n    },\n  },\n  all: {},\n};\n\nexport class ACLAvailableStrategy {\n  acl: ACL;\n  options: AvailableStrategyOptions;\n  actionsAsObject: { [key: string]: string };\n\n  allowConfigure: boolean;\n\n  constructor(acl: ACL, options: AvailableStrategyOptions) {\n    this.acl = acl;\n    this.options = options;\n    this.allowConfigure = options.allowConfigure;\n\n    let actions = this.options.actions;\n    if (lodash.isString(actions) && actions != '*') {\n      actions = [actions];\n    }\n\n    if (lodash.isArray(actions)) {\n      this.actionsAsObject = actions.reduce((carry, action) => {\n        const [actionName, predicate] = action.split(':');\n        carry[actionName] = predicate;\n        return carry;\n      }, {});\n    }\n  }\n\n  matchAction(actionName: string) {\n    if (this.options.actions == '*') {\n      return true;\n    }\n\n    if (this.actionsAsObject?.hasOwnProperty(actionName)) {\n      const predicateName = this.actionsAsObject[actionName];\n      if (predicateName) {\n        return predicate[predicateName];\n      }\n\n      return true;\n    }\n\n    return false;\n  }\n\n  allow(resourceName: string, actionName: string) {\n    if (this.acl.isConfigResource(resourceName) && this.allowConfigure) {\n      return true;\n    }\n\n    return this.matchAction(this.acl.resolveActionAlias(actionName));\n  }\n}\n"]}

package/lib/acl-resource.d.ts

@@ -0,0 +1,25 @@
+import { ACLRole, RoleActionParams } from './acl-role';
+import { ACL } from './acl';
+export declare type ResourceActions = {
+    [key: string]: RoleActionParams;
+};
+interface AclResourceOptions {
+    name: string;
+    role: ACLRole;
+    actions?: ResourceActions;
+}
+export declare class ACLResource {
+    actions: Map<string, RoleActionParams>;
+    acl: ACL;
+    role: ACLRole;
+    name: string;
+    constructor(options: AclResourceOptions);
+    getActions(): {};
+    getAction(name: string): RoleActionParams;
+    setAction(name: string, params: RoleActionParams): void;
+    setActions(actions: {
+        [key: string]: RoleActionParams;
+    }): void;
+    removeAction(name: string): void;
+}
+export {};

package/lib/acl-resource.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACLResource = void 0;
+class ACLResource {
+    constructor(options) {
+        this.actions = new Map();
+        this.acl = options.role.acl;
+        this.role = options.role;
+        this.name = options.name;
+        const actionsOption = options.actions || {};
+        for (const actionName of Object.keys(actionsOption)) {
+            this.actions.set(actionName, actionsOption[actionName]);
+        }
+    }
+    getActions() {
+        return Array.from(this.actions.keys()).reduce((carry, key) => {
+            carry[key] = this.actions.get(key);
+            return carry;
+        }, {});
+    }
+    getAction(name) {
+        return this.actions.get(name) || this.actions.get(this.acl.resolveActionAlias(name));
+    }
+    setAction(name, params) {
+        const context = {
+            role: this.role,
+            acl: this.role.acl,
+            params: params || {},
+            path: `${this.name}:${name}`,
+            resourceName: this.name,
+            actionName: name,
+        };
+        this.acl.emit('beforeGrantAction', context);
+        this.actions.set(name, context.params);
+    }
+    setActions(actions) {
+        for (const actionName of Object.keys(actions)) {
+            this.setAction(actionName, actions[actionName]);
+        }
+    }
+    removeAction(name) {
+        this.actions.delete(name);
+    }
+}
+exports.ACLResource = ACLResource;
+//# sourceMappingURL=acl-resource.js.map

package/lib/acl-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-resource.js","sourceRoot":"","sources":["../src/acl-resource.ts"],"names":[],"mappings":";;;AAWA,MAAa,WAAW;IAMtB,YAAY,OAA2B;QALvC,YAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;QAM5C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAE5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAEzB,MAAM,aAAa,GAAoB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAC7D,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;YACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;SACzD;IACH,CAAC;IAED,UAAU;QACR,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3D,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,MAAwB;QAC9C,MAAM,OAAO,GAAoB;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YAClB,MAAM,EAAE,MAAM,IAAI,EAAE;YACpB,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE;YAC5B,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,UAAU,EAAE,IAAI;SACjB,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAE5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,UAAU,CAAC,OAA4C;QACrD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAC7C,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;SACjD;IACH,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF;AArDD,kCAqDC","sourcesContent":["import { ACLRole, RoleActionParams } from './acl-role';\nimport { ACL, ListenerContext } from './acl';\n\nexport type ResourceActions = { [key: string]: RoleActionParams };\n\ninterface AclResourceOptions {\n  name: string;\n  role: ACLRole;\n  actions?: ResourceActions;\n}\n\nexport class ACLResource {\n  actions = new Map<string, RoleActionParams>();\n  acl: ACL;\n  role: ACLRole;\n  name: string;\n\n  constructor(options: AclResourceOptions) {\n    this.acl = options.role.acl;\n\n    this.role = options.role;\n    this.name = options.name;\n\n    const actionsOption: ResourceActions = options.actions || {};\n    for (const actionName of Object.keys(actionsOption)) {\n      this.actions.set(actionName, actionsOption[actionName]);\n    }\n  }\n\n  getActions() {\n    return Array.from(this.actions.keys()).reduce((carry, key) => {\n      carry[key] = this.actions.get(key);\n      return carry;\n    }, {});\n  }\n\n  getAction(name: string) {\n    return this.actions.get(name) || this.actions.get(this.acl.resolveActionAlias(name));\n  }\n\n  setAction(name: string, params: RoleActionParams) {\n    const context: ListenerContext = {\n      role: this.role,\n      acl: this.role.acl,\n      params: params || {},\n      path: `${this.name}:${name}`,\n      resourceName: this.name,\n      actionName: name,\n    };\n\n    this.acl.emit('beforeGrantAction', context);\n\n    this.actions.set(name, context.params);\n  }\n\n  setActions(actions: { [key: string]: RoleActionParams }) {\n    for (const actionName of Object.keys(actions)) {\n      this.setAction(actionName, actions[actionName]);\n    }\n  }\n\n  removeAction(name: string) {\n    this.actions.delete(name);\n  }\n}\n"]}