@nocobase/acl 0.7.0-alpha.0

package/lib/acl-role.d.ts

@@ -0,0 +1,38 @@
+import { ACL, DefineOptions } from './acl';
+import { AvailableStrategyOptions } from './acl-available-strategy';
+import { ACLResource } from './acl-resource';
+export interface RoleActionParams {
+    fields?: string[];
+    filter?: any;
+    own?: boolean;
+    whitelist?: string[];
+    blacklist?: string[];
+    [key: string]: any;
+}
+interface ResourceActionsOptions {
+    [actionName: string]: RoleActionParams;
+}
+export declare class ACLRole {
+    acl: ACL;
+    name: string;
+    strategy: string | AvailableStrategyOptions;
+    resources: Map<string, ACLResource>;
+    constructor(acl: ACL, name: string);
+    getResource(name: string): ACLResource | undefined;
+    setResource(name: string, resource: ACLResource): void;
+    setStrategy(value: string | AvailableStrategyOptions): void;
+    grantResource(resourceName: string, options: ResourceActionsOptions): void;
+    getResourceActionsParams(resourceName: string): {};
+    revokeResource(resourceName: any): void;
+    grantAction(path: string, options?: RoleActionParams): void;
+    getActionParams(path: string): RoleActionParams;
+    revokeAction(path: string): void;
+    toJSON(): DefineOptions;
+    protected getResourceActionFromPath(path: string): {
+        resourceName: string;
+        actionName: string;
+        resource: ACLResource;
+        action: any;
+    };
+}
+export {};

package/lib/acl-role.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACLRole = void 0;
+const acl_resource_1 = require("./acl-resource");
+class ACLRole {
+    constructor(acl, name) {
+        this.acl = acl;
+        this.name = name;
+        this.resources = new Map();
+    }
+    getResource(name) {
+        return this.resources.get(name);
+    }
+    setResource(name, resource) {
+        this.resources.set(name, resource);
+    }
+    setStrategy(value) {
+        this.strategy = value;
+    }
+    grantResource(resourceName, options) {
+        const resource = new acl_resource_1.ACLResource({
+            role: this,
+            name: resourceName,
+        });
+        for (const [actionName, actionParams] of Object.entries(options)) {
+            resource.setAction(actionName, actionParams);
+        }
+        this.resources.set(resourceName, resource);
+    }
+    getResourceActionsParams(resourceName) {
+        const resource = this.getResource(resourceName);
+        return resource.getActions();
+    }
+    revokeResource(resourceName) {
+        for (const key of [...this.resources.keys()]) {
+            if (key === resourceName || key.includes(`${resourceName}.`)) {
+                this.resources.delete(key);
+            }
+        }
+    }
+    grantAction(path, options) {
+        let { resource, resourceName, actionName } = this.getResourceActionFromPath(path);
+        if (!resource) {
+            resource = new acl_resource_1.ACLResource({
+                role: this,
+                name: resourceName,
+            });
+            this.resources.set(resourceName, resource);
+        }
+        resource.setAction(actionName, options);
+    }
+    getActionParams(path) {
+        const { action } = this.getResourceActionFromPath(path);
+        return action;
+    }
+    revokeAction(path) {
+        const { resource, actionName } = this.getResourceActionFromPath(path);
+        resource.removeAction(actionName);
+    }
+    toJSON() {
+        const actions = {};
+        for (const resourceName of this.resources.keys()) {
+            const resourceActions = this.getResourceActionsParams(resourceName);
+            for (const actionName of Object.keys(resourceActions)) {
+                actions[`${resourceName}:${actionName}`] = resourceActions[actionName];
+            }
+        }
+        return {
+            role: this.name,
+            strategy: this.strategy,
+            actions,
+        };
+    }
+    getResourceActionFromPath(path) {
+        const [resourceName, actionName] = path.split(':');
+        const resource = this.resources.get(resourceName);
+        let action = null;
+        if (resource) {
+            action = resource.getAction(actionName);
+        }
+        return {
+            resourceName,
+            actionName,
+            resource,
+            action,
+        };
+    }
+}
+exports.ACLRole = ACLRole;
+//# sourceMappingURL=acl-role.js.map

package/lib/acl-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-role.js","sourceRoot":"","sources":["../src/acl-role.ts"],"names":[],"mappings":";;;AAEA,iDAA6C;AAe7C,MAAa,OAAO;IAIlB,YAAmB,GAAQ,EAAS,IAAY;QAA7B,QAAG,GAAH,GAAG,CAAK;QAAS,SAAI,GAAJ,IAAI,CAAQ;QAFhD,cAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEQ,CAAC;IAEpD,WAAW,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,WAAW,CAAC,IAAY,EAAE,QAAqB;QAC7C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAEM,WAAW,CAAC,KAAwC;QACzD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;IACxB,CAAC;IAEM,aAAa,CAAC,YAAoB,EAAE,OAA+B;QACxE,MAAM,QAAQ,GAAG,IAAI,0BAAW,CAAC;YAC/B,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QAEH,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAChE,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;SAC9C;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAEM,wBAAwB,CAAC,YAAoB;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC/B,CAAC;IAEM,cAAc,CAAC,YAAY;QAChC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE;YAC5C,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE;gBAC5D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;aAC5B;SACF;IACH,CAAC;IAEM,WAAW,CAAC,IAAY,EAAE,OAA0B;QACzD,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAElF,IAAI,CAAC,QAAQ,EAAE;YACb,QAAQ,GAAG,IAAI,0BAAW,CAAC;gBACzB,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;SAC5C;QAED,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAEM,eAAe,CAAC,IAAY;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,YAAY,CAAC,IAAY;QAC9B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACtE,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAEM,MAAM;QACX,MAAM,OAAO,GAAG,EAAE,CAAC;QAEnB,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;YAChD,MAAM,eAAe,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACpE,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE;gBACrD,OAAO,CAAC,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;aACxE;SACF;QAED,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO;SACR,CAAC;IACJ,CAAC;IAES,yBAAyB,CAAC,IAAY;QAC9C,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAElD,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,QAAQ,EAAE;YACZ,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;SACzC;QAED,OAAO;YACL,YAAY;YACZ,UAAU;YACV,QAAQ;YACR,MAAM;SACP,CAAC;IACJ,CAAC;CACF;AAvGD,0BAuGC","sourcesContent":["import { ACL, DefineOptions } from './acl';\nimport { AvailableStrategyOptions } from './acl-available-strategy';\nimport { ACLResource } from './acl-resource';\n\nexport interface RoleActionParams {\n  fields?: string[];\n  filter?: any;\n  own?: boolean;\n  whitelist?: string[];\n  blacklist?: string[];\n  [key: string]: any;\n}\n\ninterface ResourceActionsOptions {\n  [actionName: string]: RoleActionParams;\n}\n\nexport class ACLRole {\n  strategy: string | AvailableStrategyOptions;\n  resources = new Map<string, ACLResource>();\n\n  constructor(public acl: ACL, public name: string) {}\n\n  getResource(name: string): ACLResource | undefined {\n    return this.resources.get(name);\n  }\n\n  setResource(name: string, resource: ACLResource) {\n    this.resources.set(name, resource);\n  }\n\n  public setStrategy(value: string | AvailableStrategyOptions) {\n    this.strategy = value;\n  }\n\n  public grantResource(resourceName: string, options: ResourceActionsOptions) {\n    const resource = new ACLResource({\n      role: this,\n      name: resourceName,\n    });\n\n    for (const [actionName, actionParams] of Object.entries(options)) {\n      resource.setAction(actionName, actionParams);\n    }\n\n    this.resources.set(resourceName, resource);\n  }\n\n  public getResourceActionsParams(resourceName: string) {\n    const resource = this.getResource(resourceName);\n    return resource.getActions();\n  }\n\n  public revokeResource(resourceName) {\n    for (const key of [...this.resources.keys()]) {\n      if (key === resourceName || key.includes(`${resourceName}.`)) {\n        this.resources.delete(key);\n      }\n    }\n  }\n\n  public grantAction(path: string, options?: RoleActionParams) {\n    let { resource, resourceName, actionName } = this.getResourceActionFromPath(path);\n\n    if (!resource) {\n      resource = new ACLResource({\n        role: this,\n        name: resourceName,\n      });\n\n      this.resources.set(resourceName, resource);\n    }\n\n    resource.setAction(actionName, options);\n  }\n\n  public getActionParams(path: string): RoleActionParams {\n    const { action } = this.getResourceActionFromPath(path);\n    return action;\n  }\n\n  public revokeAction(path: string) {\n    const { resource, actionName } = this.getResourceActionFromPath(path);\n    resource.removeAction(actionName);\n  }\n\n  public toJSON(): DefineOptions {\n    const actions = {};\n\n    for (const resourceName of this.resources.keys()) {\n      const resourceActions = this.getResourceActionsParams(resourceName);\n      for (const actionName of Object.keys(resourceActions)) {\n        actions[`${resourceName}:${actionName}`] = resourceActions[actionName];\n      }\n    }\n\n    return {\n      role: this.name,\n      strategy: this.strategy,\n      actions,\n    };\n  }\n\n  protected getResourceActionFromPath(path: string) {\n    const [resourceName, actionName] = path.split(':');\n\n    const resource = this.resources.get(resourceName);\n\n    let action = null;\n    if (resource) {\n      action = resource.getAction(actionName);\n    }\n\n    return {\n      resourceName,\n      actionName,\n      resource,\n      action,\n    };\n  }\n}\n"]}

package/lib/acl.d.ts

@@ -0,0 +1,64 @@
+/// <reference types="node" />
+import EventEmitter from 'events';
+import { AclAvailableAction, AvailableActionOptions } from './acl-available-action';
+import { ACLAvailableStrategy, AvailableStrategyOptions } from './acl-available-strategy';
+import { ACLRole, RoleActionParams } from './acl-role';
+import { AllowManager } from './allow-manager';
+interface CanResult {
+    role: string;
+    resource: string;
+    action: string;
+    params?: any;
+}
+export interface DefineOptions {
+    role: string;
+    allowConfigure?: boolean;
+    strategy?: string | Omit<AvailableStrategyOptions, 'acl'>;
+    actions?: {
+        [key: string]: RoleActionParams;
+    };
+    routes?: any;
+}
+export interface ListenerContext {
+    acl: ACL;
+    role: ACLRole;
+    path: string;
+    actionName: string;
+    resourceName: string;
+    params: RoleActionParams;
+}
+declare type Listener = (ctx: ListenerContext) => void;
+interface CanArgs {
+    role: string;
+    resource: string;
+    action: string;
+}
+export declare class ACL extends EventEmitter {
+    protected availableActions: Map<string, AclAvailableAction>;
+    protected availableStrategy: Map<string, ACLAvailableStrategy>;
+    protected middlewares: any[];
+    allowManager: AllowManager;
+    roles: Map<string, ACLRole>;
+    actionAlias: Map<string, string>;
+    configResources: string[];
+    constructor();
+    define(options: DefineOptions): ACLRole;
+    getRole(name: string): ACLRole;
+    removeRole(name: string): boolean;
+    registerConfigResources(names: string[]): void;
+    registerConfigResource(name: string): void;
+    isConfigResource(name: string): boolean;
+    setAvailableAction(name: string, options: AvailableActionOptions): void;
+    getAvailableAction(name: string): AclAvailableAction;
+    getAvailableActions(): Map<string, AclAvailableAction>;
+    setAvailableStrategy(name: string, options: Omit<AvailableStrategyOptions, 'acl'>): void;
+    beforeGrantAction(listener?: Listener): void;
+    can({ role, resource, action }: CanArgs): CanResult | null;
+    protected isAvailableAction(actionName: string): boolean;
+    resolveActionAlias(action: string): string;
+    use(fn: any): void;
+    allow(resourceName: string, actionNames: string[] | string, condition?: any): void;
+    parseJsonTemplate(json: any, ctx: any): any;
+    middleware(): (ctx: any, next: any) => Promise<void>;
+}
+export {};

package/lib/acl.js

@@ -0,0 +1,209 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACL = void 0;
+const events_1 = __importDefault(require("events"));
+const koa_compose_1 = __importDefault(require("koa-compose"));
+const lodash_1 = __importDefault(require("lodash"));
+const acl_available_action_1 = require("./acl-available-action");
+const acl_available_strategy_1 = require("./acl-available-strategy");
+const acl_role_1 = require("./acl-role");
+const allow_manager_1 = require("./allow-manager");
+const parse = require('json-templates');
+class ACL extends events_1.default {
+    constructor() {
+        super();
+        this.availableActions = new Map();
+        this.availableStrategy = new Map();
+        this.middlewares = [];
+        this.allowManager = new allow_manager_1.AllowManager(this);
+        this.roles = new Map();
+        this.actionAlias = new Map();
+        this.configResources = [];
+        this.beforeGrantAction((ctx) => {
+            if (lodash_1.default.isPlainObject(ctx.params) && ctx.params.own) {
+                ctx.params = lodash_1.default.merge(ctx.params, acl_available_strategy_1.predicate.own);
+            }
+        });
+        this.beforeGrantAction((ctx) => {
+            const actionName = this.resolveActionAlias(ctx.actionName);
+            if (lodash_1.default.isPlainObject(ctx.params)) {
+                if ((actionName === 'create' || actionName === 'update') && ctx.params.fields) {
+                    ctx.params = Object.assign(Object.assign({}, lodash_1.default.omit(ctx.params, 'fields')), { whitelist: ctx.params.fields });
+                }
+                if (actionName === 'view' && ctx.params.fields) {
+                    const appendFields = ['id', 'createdAt', 'updatedAt'];
+                    ctx.params = Object.assign(Object.assign({}, lodash_1.default.omit(ctx.params, 'fields')), { fields: [...ctx.params.fields, ...appendFields] });
+                }
+            }
+        });
+        this.middlewares.push(this.allowManager.aclMiddleware());
+    }
+    define(options) {
+        const roleName = options.role;
+        const role = new acl_role_1.ACLRole(this, roleName);
+        if (options.strategy) {
+            role.strategy = options.strategy;
+        }
+        const actions = options.actions || {};
+        for (const [actionName, actionParams] of Object.entries(actions)) {
+            role.grantAction(actionName, actionParams);
+        }
+        this.roles.set(roleName, role);
+        return role;
+    }
+    getRole(name) {
+        return this.roles.get(name);
+    }
+    removeRole(name) {
+        return this.roles.delete(name);
+    }
+    registerConfigResources(names) {
+        names.forEach((name) => this.registerConfigResource(name));
+    }
+    registerConfigResource(name) {
+        this.configResources.push(name);
+    }
+    isConfigResource(name) {
+        return this.configResources.includes(name);
+    }
+    setAvailableAction(name, options) {
+        this.availableActions.set(name, new acl_available_action_1.AclAvailableAction(name, options));
+        if (options.aliases) {
+            const aliases = lodash_1.default.isArray(options.aliases) ? options.aliases : [options.aliases];
+            for (const alias of aliases) {
+                this.actionAlias.set(alias, name);
+            }
+        }
+    }
+    getAvailableAction(name) {
+        const actionName = this.actionAlias.get(name) || name;
+        return this.availableActions.get(actionName);
+    }
+    getAvailableActions() {
+        return this.availableActions;
+    }
+    setAvailableStrategy(name, options) {
+        this.availableStrategy.set(name, new acl_available_strategy_1.ACLAvailableStrategy(this, options));
+    }
+    beforeGrantAction(listener) {
+        this.addListener('beforeGrantAction', listener);
+    }
+    can({ role, resource, action }) {
+        const aclRole = this.roles.get(role);
+        if (!aclRole) {
+            return null;
+        }
+        const aclResource = aclRole.getResource(resource);
+        if (aclResource) {
+            const actionParams = aclResource.getAction(action);
+            if (actionParams) {
+                // handle single action config
+                return {
+                    role,
+                    resource,
+                    action,
+                    params: actionParams,
+                };
+            }
+        }
+        if (!aclRole.strategy) {
+            return null;
+        }
+        const roleStrategy = lodash_1.default.isString(aclRole.strategy)
+            ? this.availableStrategy.get(aclRole.strategy)
+            : new acl_available_strategy_1.ACLAvailableStrategy(this, aclRole.strategy);
+        if (!roleStrategy) {
+            return null;
+        }
+        const roleStrategyParams = roleStrategy.allow(resource, this.resolveActionAlias(action));
+        if (roleStrategyParams) {
+            const result = { role, resource, action };
+            if (lodash_1.default.isPlainObject(roleStrategyParams)) {
+                result['params'] = roleStrategyParams;
+            }
+            return result;
+        }
+        return null;
+    }
+    isAvailableAction(actionName) {
+        return this.availableActions.has(this.resolveActionAlias(actionName));
+    }
+    resolveActionAlias(action) {
+        return this.actionAlias.get(action) ? this.actionAlias.get(action) : action;
+    }
+    use(fn) {
+        this.middlewares.push(fn);
+    }
+    allow(resourceName, actionNames, condition) {
+        if (!Array.isArray(actionNames)) {
+            actionNames = [actionNames];
+        }
+        for (const actionName of actionNames) {
+            this.allowManager.allow(resourceName, actionName, condition);
+        }
+    }
+    parseJsonTemplate(json, ctx) {
+        return parse(json)({
+            ctx: {
+                state: JSON.parse(JSON.stringify(ctx.state)),
+            },
+        });
+    }
+    middleware() {
+        const acl = this;
+        const filterParams = (ctx, resourceName, params) => {
+            var _a;
+            if ((_a = params === null || params === void 0 ? void 0 : params.filter) === null || _a === void 0 ? void 0 : _a.createdById) {
+                const collection = ctx.db.getCollection(resourceName);
+                if (collection && !collection.getField('createdById')) {
+                    return lodash_1.default.omit(params, 'filter.createdById');
+                }
+            }
+            return params;
+        };
+        return function ACLMiddleware(ctx, next) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const roleName = ctx.state.currentRole || 'anonymous';
+                const { resourceName, actionName } = ctx.action;
+                const resourcerAction = ctx.action;
+                ctx.can = (options) => {
+                    return acl.can(Object.assign({ role: roleName }, options));
+                };
+                ctx.permission = {
+                    can: ctx.can({ resource: resourceName, action: actionName }),
+                };
+                return (0, koa_compose_1.default)(acl.middlewares)(ctx, () => __awaiter(this, void 0, void 0, function* () {
+                    const permission = ctx.permission;
+                    if (permission.skip) {
+                        return next();
+                    }
+                    if (!permission.can || typeof permission.can !== 'object') {
+                        ctx.throw(403, 'No permissions');
+                        return;
+                    }
+                    const { params } = permission.can;
+                    if (params) {
+                        const filteredParams = filterParams(ctx, resourceName, params);
+                        const parsedParams = acl.parseJsonTemplate(filteredParams, ctx);
+                        resourcerAction.mergeParams(parsedParams);
+                    }
+                    yield next();
+                }));
+            });
+        };
+    }
+}
+exports.ACL = ACL;
+//# sourceMappingURL=acl.js.map

package/lib/acl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl.js","sourceRoot":"","sources":["../src/acl.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AACA,oDAAkC;AAClC,8DAAkC;AAClC,oDAA4B;AAC5B,iEAAoF;AACpF,qEAAqG;AACrG,yCAAuD;AACvD,mDAA+C;AAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAoCxC,MAAa,GAAI,SAAQ,gBAAY;IAanC;QACE,KAAK,EAAE,CAAC;QAbA,qBAAgB,GAAG,IAAI,GAAG,EAA8B,CAAC;QACzD,sBAAiB,GAAG,IAAI,GAAG,EAAgC,CAAC;QAC5D,gBAAW,GAAG,EAAE,CAAC;QAEpB,iBAAY,GAAG,IAAI,4BAAY,CAAC,IAAI,CAAC,CAAC;QAE7C,UAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;QAEnC,gBAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAExC,oBAAe,GAAa,EAAE,CAAC;QAK7B,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7B,IAAI,gBAAM,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;gBACtD,GAAG,CAAC,MAAM,GAAG,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,kCAAS,CAAC,GAAG,CAAC,CAAC;aACtD;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAE3D,IAAI,gBAAM,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;gBACpC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE;oBAC7E,GAAG,CAAC,MAAM,mCACL,gBAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,KACpC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAC7B,CAAC;iBACH;gBAED,IAAI,UAAU,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE;oBAC9C,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;oBACtD,GAAG,CAAC,MAAM,mCACL,gBAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,KACpC,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,GAChD,CAAC;iBACH;aACF;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,OAAsB;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,kBAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEzC,IAAI,OAAO,CAAC,QAAQ,EAAE;YACpB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;SAClC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAEtC,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAChE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;SAC5C;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,uBAAuB,CAAC,KAAe;QACrC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,sBAAsB,CAAC,IAAY;QACjC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,kBAAkB,CAAC,IAAY,EAAE,OAA+B;QAC9D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,yCAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAEvE,IAAI,OAAO,CAAC,OAAO,EAAE;YACnB,MAAM,OAAO,GAAG,gBAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;gBAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;aACnC;SACF;IACH,CAAC;IAED,kBAAkB,CAAC,IAAY;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACtD,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,oBAAoB,CAAC,IAAY,EAAE,OAA8C;QAC/E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,6CAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,iBAAiB,CAAC,QAAmB;QACnC,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAW;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAErC,IAAI,CAAC,OAAO,EAAE;YACZ,OAAO,IAAI,CAAC;SACb;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,WAAW,EAAE;YACf,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAEnD,IAAI,YAAY,EAAE;gBAChB,8BAA8B;gBAC9B,OAAO;oBACL,IAAI;oBACJ,QAAQ;oBACR,MAAM;oBACN,MAAM,EAAE,YAAY;iBACrB,CAAC;aACH;SACF;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACrB,OAAO,IAAI,CAAC;SACb;QAED,MAAM,YAAY,GAAG,gBAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC9C,CAAC,CAAC,IAAI,6CAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAErD,IAAI,CAAC,YAAY,EAAE;YACjB,OAAO,IAAI,CAAC;SACb;QAED,MAAM,kBAAkB,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAEzF,IAAI,kBAAkB,EAAE;YACtB,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAE1C,IAAI,gBAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE;gBAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC;aACvC;YAED,OAAO,MAAM,CAAC;SACf;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAES,iBAAiB,CAAC,UAAkB;QAC5C,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC;IAEM,kBAAkB,CAAC,MAAc;QACtC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9E,CAAC;IAED,GAAG,CAAC,EAAO;QACT,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,YAAoB,EAAE,WAA8B,EAAE,SAAe;QACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;YAC/B,WAAW,GAAG,CAAC,WAAW,CAAC,CAAC;SAC7B;QAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE;YACpC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;SAC9D;IACH,CAAC;IAED,iBAAiB,CAAC,IAAS,EAAE,GAAQ;QACnC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;YACjB,GAAG,EAAE;gBACH,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;aAC7C;SACF,CAAC,CAAC;IACL,CAAC;IAED,UAAU;QACR,MAAM,GAAG,GAAG,IAAI,CAAC;QAEjB,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE;;YACjD,IAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,0CAAE,WAAW,EAAE;gBAC/B,MAAM,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACtD,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;oBACrD,OAAO,gBAAM,CAAC,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;iBAClD;aACF;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,OAAO,SAAe,aAAa,CAAC,GAAG,EAAE,IAAI;;gBAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,WAAW,CAAC;gBACtD,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAEhD,MAAM,eAAe,GAAW,GAAG,CAAC,MAAM,CAAC;gBAE3C,GAAG,CAAC,GAAG,GAAG,CAAC,OAA8B,EAAE,EAAE;oBAC3C,OAAO,GAAG,CAAC,GAAG,iBAAG,IAAI,EAAE,QAAQ,IAAK,OAAO,EAAG,CAAC;gBACjD,CAAC,CAAC;gBAEF,GAAG,CAAC,UAAU,GAAG;oBACf,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;iBAC7D,CAAC;gBAEF,OAAO,IAAA,qBAAO,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAS,EAAE;oBAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;oBAElC,IAAI,UAAU,CAAC,IAAI,EAAE;wBACnB,OAAO,IAAI,EAAE,CAAC;qBACf;oBAED,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAAE;wBACzD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;wBACjC,OAAO;qBACR;oBAED,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC;oBAElC,IAAI,MAAM,EAAE;wBACV,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;wBAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,iBAAiB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;wBAChE,eAAe,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;qBAC3C;oBAED,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC,CAAA,CAAC,CAAC;YACL,CAAC;SAAA,CAAC;IACJ,CAAC;CACF;AArPD,kBAqPC","sourcesContent":["import { Action } from '@nocobase/resourcer';\nimport EventEmitter from 'events';\nimport compose from 'koa-compose';\nimport lodash from 'lodash';\nimport { AclAvailableAction, AvailableActionOptions } from './acl-available-action';\nimport { ACLAvailableStrategy, AvailableStrategyOptions, predicate } from './acl-available-strategy';\nimport { ACLRole, RoleActionParams } from './acl-role';\nimport { AllowManager } from './allow-manager';\nconst parse = require('json-templates');\n\ninterface CanResult {\n  role: string;\n  resource: string;\n  action: string;\n  params?: any;\n}\n\nexport interface DefineOptions {\n  role: string;\n  allowConfigure?: boolean;\n  strategy?: string | Omit<AvailableStrategyOptions, 'acl'>;\n  actions?: {\n    [key: string]: RoleActionParams;\n  };\n  routes?: any;\n}\n\nexport interface ListenerContext {\n  acl: ACL;\n  role: ACLRole;\n  path: string;\n  actionName: string;\n  resourceName: string;\n  params: RoleActionParams;\n}\n\ntype Listener = (ctx: ListenerContext) => void;\n\ninterface CanArgs {\n  role: string;\n  resource: string;\n  action: string;\n}\n\nexport class ACL extends EventEmitter {\n  protected availableActions = new Map<string, AclAvailableAction>();\n  protected availableStrategy = new Map<string, ACLAvailableStrategy>();\n  protected middlewares = [];\n\n  public allowManager = new AllowManager(this);\n\n  roles = new Map<string, ACLRole>();\n\n  actionAlias = new Map<string, string>();\n\n  configResources: string[] = [];\n\n  constructor() {\n    super();\n\n    this.beforeGrantAction((ctx) => {\n      if (lodash.isPlainObject(ctx.params) && ctx.params.own) {\n        ctx.params = lodash.merge(ctx.params, predicate.own);\n      }\n    });\n\n    this.beforeGrantAction((ctx) => {\n      const actionName = this.resolveActionAlias(ctx.actionName);\n\n      if (lodash.isPlainObject(ctx.params)) {\n        if ((actionName === 'create' || actionName === 'update') && ctx.params.fields) {\n          ctx.params = {\n            ...lodash.omit(ctx.params, 'fields'),\n            whitelist: ctx.params.fields,\n          };\n        }\n\n        if (actionName === 'view' && ctx.params.fields) {\n          const appendFields = ['id', 'createdAt', 'updatedAt'];\n          ctx.params = {\n            ...lodash.omit(ctx.params, 'fields'),\n            fields: [...ctx.params.fields, ...appendFields],\n          };\n        }\n      }\n    });\n\n    this.middlewares.push(this.allowManager.aclMiddleware());\n  }\n\n  define(options: DefineOptions): ACLRole {\n    const roleName = options.role;\n    const role = new ACLRole(this, roleName);\n\n    if (options.strategy) {\n      role.strategy = options.strategy;\n    }\n\n    const actions = options.actions || {};\n\n    for (const [actionName, actionParams] of Object.entries(actions)) {\n      role.grantAction(actionName, actionParams);\n    }\n\n    this.roles.set(roleName, role);\n\n    return role;\n  }\n\n  getRole(name: string): ACLRole {\n    return this.roles.get(name);\n  }\n\n  removeRole(name: string) {\n    return this.roles.delete(name);\n  }\n\n  registerConfigResources(names: string[]) {\n    names.forEach((name) => this.registerConfigResource(name));\n  }\n\n  registerConfigResource(name: string) {\n    this.configResources.push(name);\n  }\n\n  isConfigResource(name: string) {\n    return this.configResources.includes(name);\n  }\n\n  setAvailableAction(name: string, options: AvailableActionOptions) {\n    this.availableActions.set(name, new AclAvailableAction(name, options));\n\n    if (options.aliases) {\n      const aliases = lodash.isArray(options.aliases) ? options.aliases : [options.aliases];\n      for (const alias of aliases) {\n        this.actionAlias.set(alias, name);\n      }\n    }\n  }\n\n  getAvailableAction(name: string) {\n    const actionName = this.actionAlias.get(name) || name;\n    return this.availableActions.get(actionName);\n  }\n\n  getAvailableActions() {\n    return this.availableActions;\n  }\n\n  setAvailableStrategy(name: string, options: Omit<AvailableStrategyOptions, 'acl'>) {\n    this.availableStrategy.set(name, new ACLAvailableStrategy(this, options));\n  }\n\n  beforeGrantAction(listener?: Listener) {\n    this.addListener('beforeGrantAction', listener);\n  }\n\n  can({ role, resource, action }: CanArgs): CanResult | null {\n    const aclRole = this.roles.get(role);\n\n    if (!aclRole) {\n      return null;\n    }\n\n    const aclResource = aclRole.getResource(resource);\n\n    if (aclResource) {\n      const actionParams = aclResource.getAction(action);\n\n      if (actionParams) {\n        // handle single action config\n        return {\n          role,\n          resource,\n          action,\n          params: actionParams,\n        };\n      }\n    }\n\n    if (!aclRole.strategy) {\n      return null;\n    }\n\n    const roleStrategy = lodash.isString(aclRole.strategy)\n      ? this.availableStrategy.get(aclRole.strategy)\n      : new ACLAvailableStrategy(this, aclRole.strategy);\n\n    if (!roleStrategy) {\n      return null;\n    }\n\n    const roleStrategyParams = roleStrategy.allow(resource, this.resolveActionAlias(action));\n\n    if (roleStrategyParams) {\n      const result = { role, resource, action };\n\n      if (lodash.isPlainObject(roleStrategyParams)) {\n        result['params'] = roleStrategyParams;\n      }\n\n      return result;\n    }\n\n    return null;\n  }\n\n  protected isAvailableAction(actionName: string) {\n    return this.availableActions.has(this.resolveActionAlias(actionName));\n  }\n\n  public resolveActionAlias(action: string) {\n    return this.actionAlias.get(action) ? this.actionAlias.get(action) : action;\n  }\n\n  use(fn: any) {\n    this.middlewares.push(fn);\n  }\n\n  allow(resourceName: string, actionNames: string[] | string, condition?: any) {\n    if (!Array.isArray(actionNames)) {\n      actionNames = [actionNames];\n    }\n\n    for (const actionName of actionNames) {\n      this.allowManager.allow(resourceName, actionName, condition);\n    }\n  }\n\n  parseJsonTemplate(json: any, ctx: any) {\n    return parse(json)({\n      ctx: {\n        state: JSON.parse(JSON.stringify(ctx.state)),\n      },\n    });\n  }\n\n  middleware() {\n    const acl = this;\n\n    const filterParams = (ctx, resourceName, params) => {\n      if (params?.filter?.createdById) {\n        const collection = ctx.db.getCollection(resourceName);\n        if (collection && !collection.getField('createdById')) {\n          return lodash.omit(params, 'filter.createdById');\n        }\n      }\n\n      return params;\n    };\n\n    return async function ACLMiddleware(ctx, next) {\n      const roleName = ctx.state.currentRole || 'anonymous';\n      const { resourceName, actionName } = ctx.action;\n\n      const resourcerAction: Action = ctx.action;\n\n      ctx.can = (options: Omit<CanArgs, 'role'>) => {\n        return acl.can({ role: roleName, ...options });\n      };\n\n      ctx.permission = {\n        can: ctx.can({ resource: resourceName, action: actionName }),\n      };\n\n      return compose(acl.middlewares)(ctx, async () => {\n        const permission = ctx.permission;\n\n        if (permission.skip) {\n          return next();\n        }\n\n        if (!permission.can || typeof permission.can !== 'object') {\n          ctx.throw(403, 'No permissions');\n          return;\n        }\n\n        const { params } = permission.can;\n\n        if (params) {\n          const filteredParams = filterParams(ctx, resourceName, params);\n          const parsedParams = acl.parseJsonTemplate(filteredParams, ctx);\n          resourcerAction.mergeParams(parsedParams);\n        }\n\n        await next();\n      });\n    };\n  }\n}\n"]}

package/lib/allow-manager.d.ts

@@ -0,0 +1,13 @@
+import { ACL } from './acl';
+declare type ConditionFunc = (ctx: any) => Promise<boolean>;
+export declare class AllowManager {
+    acl: ACL;
+    protected skipActions: Map<string, Map<string, string | true | ConditionFunc>>;
+    protected registeredCondition: Map<string, ConditionFunc>;
+    constructor(acl: ACL);
+    allow(resourceName: string, actionName: string, condition?: string | ConditionFunc): void;
+    getAllowedConditions(resourceName: string, actionName: string): Array<ConditionFunc | true>;
+    registerAllowCondition(name: string, condition: ConditionFunc): void;
+    aclMiddleware(): (ctx: any, next: any) => Promise<void>;
+}
+export {};

package/lib/allow-manager.js

@@ -0,0 +1,84 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AllowManager = void 0;
+class AllowManager {
+    constructor(acl) {
+        this.acl = acl;
+        this.skipActions = new Map();
+        this.registeredCondition = new Map();
+        this.registerAllowCondition('loggedIn', (ctx) => {
+            return ctx.state.currentUser;
+        });
+        this.registerAllowCondition('allowConfigure', (ctx) => __awaiter(this, void 0, void 0, function* () {
+            const roleName = ctx.state.currentRole;
+            if (!roleName) {
+                return false;
+            }
+            const roleInstance = yield ctx.db.getRepository('roles').findOne({
+                name: roleName,
+            });
+            return roleInstance === null || roleInstance === void 0 ? void 0 : roleInstance.get('allowConfigure');
+        }));
+    }
+    allow(resourceName, actionName, condition) {
+        const actionMap = this.skipActions.get(resourceName) || new Map();
+        actionMap.set(actionName, condition || true);
+        this.skipActions.set(resourceName, actionMap);
+    }
+    getAllowedConditions(resourceName, actionName) {
+        const fetchActionSteps = ['*', resourceName];
+        const results = [];
+        for (const fetchActionStep of fetchActionSteps) {
+            const resource = this.skipActions.get(fetchActionStep);
+            if (resource) {
+                const condition = resource.get('*') || resource.get(actionName);
+                if (condition) {
+                    results.push(typeof condition === 'string' ? this.registeredCondition.get(condition) : condition);
+                }
+            }
+        }
+        return results;
+    }
+    registerAllowCondition(name, condition) {
+        this.registeredCondition.set(name, condition);
+    }
+    aclMiddleware() {
+        return (ctx, next) => __awaiter(this, void 0, void 0, function* () {
+            const { resourceName, actionName } = ctx.action;
+            const skippedConditions = ctx.app.acl.allowManager.getAllowedConditions(resourceName, actionName);
+            let skip = false;
+            for (const skippedCondition of skippedConditions) {
+                if (skippedCondition) {
+                    let skipResult = false;
+                    if (typeof skippedCondition === 'function') {
+                        skipResult = yield skippedCondition(ctx);
+                    }
+                    else if (skippedCondition) {
+                        skipResult = true;
+                    }
+                    if (skipResult) {
+                        skip = true;
+                        break;
+                    }
+                }
+            }
+            if (skip) {
+                ctx.permission = {
+                    skip: true,
+                };
+            }
+            yield next();
+        });
+    }
+}
+exports.AllowManager = AllowManager;
+//# sourceMappingURL=allow-manager.js.map

package/lib/allow-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-manager.js","sourceRoot":"","sources":["../src/allow-manager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,MAAa,YAAY;IAKvB,YAAmB,GAAQ;QAAR,QAAG,GAAH,GAAG,CAAK;QAJjB,gBAAW,GAAG,IAAI,GAAG,EAAsD,CAAC;QAE5E,wBAAmB,GAAG,IAAI,GAAG,EAAyB,CAAC;QAG/D,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAC9C,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAO,GAAG,EAAE,EAAE;YAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;YACvC,IAAI,CAAC,QAAQ,EAAE;gBACb,OAAO,KAAK,CAAC;aACd;YAED,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;gBAC/D,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;YAEH,OAAO,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7C,CAAC,CAAA,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAoB,EAAE,UAAkB,EAAE,SAAkC;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,GAAG,EAAkC,CAAC;QAClG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;QAE7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,oBAAoB,CAAC,YAAoB,EAAE,UAAkB;QAC3D,MAAM,gBAAgB,GAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,EAAE,CAAC;QAEnB,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE;gBACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAChE,IAAI,SAAS,EAAE;oBACb,OAAO,CAAC,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;iBACnG;aACF;SACF;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sBAAsB,CAAC,IAAY,EAAE,SAAwB;QAC3D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,aAAa;QACX,OAAO,CAAO,GAAG,EAAE,IAAI,EAAE,EAAE;YACzB,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAChD,MAAM,iBAAiB,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,oBAAoB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAClG,IAAI,IAAI,GAAG,KAAK,CAAC;YAEjB,KAAK,MAAM,gBAAgB,IAAI,iBAAiB,EAAE;gBAChD,IAAI,gBAAgB,EAAE;oBACpB,IAAI,UAAU,GAAG,KAAK,CAAC;oBAEvB,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;wBAC1C,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;qBAC1C;yBAAM,IAAI,gBAAgB,EAAE;wBAC3B,UAAU,GAAG,IAAI,CAAC;qBACnB;oBAED,IAAI,UAAU,EAAE;wBACd,IAAI,GAAG,IAAI,CAAC;wBACZ,MAAM;qBACP;iBACF;aACF;YAED,IAAI,IAAI,EAAE;gBACR,GAAG,CAAC,UAAU,GAAG;oBACf,IAAI,EAAE,IAAI;iBACX,CAAC;aACH;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAA,CAAC;IACJ,CAAC;CACF;AApFD,oCAoFC","sourcesContent":["import { ACL } from './acl';\n\ntype ConditionFunc = (ctx: any) => Promise<boolean>;\n\nexport class AllowManager {\n  protected skipActions = new Map<string, Map<string, string | ConditionFunc | true>>();\n\n  protected registeredCondition = new Map<string, ConditionFunc>();\n\n  constructor(public acl: ACL) {\n    this.registerAllowCondition('loggedIn', (ctx) => {\n      return ctx.state.currentUser;\n    });\n\n    this.registerAllowCondition('allowConfigure', async (ctx) => {\n      const roleName = ctx.state.currentRole;\n      if (!roleName) {\n        return false;\n      }\n\n      const roleInstance = await ctx.db.getRepository('roles').findOne({\n        name: roleName,\n      });\n\n      return roleInstance?.get('allowConfigure');\n    });\n  }\n\n  allow(resourceName: string, actionName: string, condition?: string | ConditionFunc) {\n    const actionMap = this.skipActions.get(resourceName) || new Map<string, string | ConditionFunc>();\n    actionMap.set(actionName, condition || true);\n\n    this.skipActions.set(resourceName, actionMap);\n  }\n\n  getAllowedConditions(resourceName: string, actionName: string): Array<ConditionFunc | true> {\n    const fetchActionSteps: string[] = ['*', resourceName];\n\n    const results = [];\n\n    for (const fetchActionStep of fetchActionSteps) {\n      const resource = this.skipActions.get(fetchActionStep);\n      if (resource) {\n        const condition = resource.get('*') || resource.get(actionName);\n        if (condition) {\n          results.push(typeof condition === 'string' ? this.registeredCondition.get(condition) : condition);\n        }\n      }\n    }\n\n    return results;\n  }\n\n  registerAllowCondition(name: string, condition: ConditionFunc) {\n    this.registeredCondition.set(name, condition);\n  }\n\n  aclMiddleware() {\n    return async (ctx, next) => {\n      const { resourceName, actionName } = ctx.action;\n      const skippedConditions = ctx.app.acl.allowManager.getAllowedConditions(resourceName, actionName);\n      let skip = false;\n\n      for (const skippedCondition of skippedConditions) {\n        if (skippedCondition) {\n          let skipResult = false;\n\n          if (typeof skippedCondition === 'function') {\n            skipResult = await skippedCondition(ctx);\n          } else if (skippedCondition) {\n            skipResult = true;\n          }\n\n          if (skipResult) {\n            skip = true;\n            break;\n          }\n        }\n      }\n\n      if (skip) {\n        ctx.permission = {\n          skip: true,\n        };\n      }\n      await next();\n    };\n  }\n}\n"]}

package/lib/index.d.ts

@@ -0,0 +1,6 @@
+export * from './acl';
+export * from './acl-available-action';
+export * from './acl-available-strategy';
+export * from './acl-resource';
+export * from './acl-role';
+export * from './skip-middleware';

package/lib/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./acl"), exports);
+__exportStar(require("./acl-available-action"), exports);
+__exportStar(require("./acl-available-strategy"), exports);
+__exportStar(require("./acl-resource"), exports);
+__exportStar(require("./acl-role"), exports);
+__exportStar(require("./skip-middleware"), exports);
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAAsB;AACtB,yDAAuC;AACvC,2DAAyC;AACzC,iDAA+B;AAC/B,6CAA2B;AAC3B,oDAAkC","sourcesContent":["export * from './acl';\nexport * from './acl-available-action';\nexport * from './acl-available-strategy';\nexport * from './acl-resource';\nexport * from './acl-role';\nexport * from './skip-middleware';\n\n"]}

package/lib/skip-middleware.d.ts

@@ -0,0 +1,6 @@
+export declare const skip: (options: ACLSkipOptions) => (ctx: any, next: any) => Promise<void>;
+interface ACLSkipOptions {
+    resourceName: string;
+    actionName: string;
+}
+export {};

package/lib/skip-middleware.js

@@ -0,0 +1,27 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.skip = void 0;
+const skip = (options) => {
+    return function ACLSkipMiddleware(ctx, next) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { resourceName, actionName } = ctx.action;
+            if (resourceName === options.resourceName && actionName === options.actionName) {
+                ctx.permission = {
+                    skip: true,
+                };
+            }
+            yield next();
+        });
+    };
+};
+exports.skip = skip;
+//# sourceMappingURL=skip-middleware.js.map

package/lib/skip-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skip-middleware.js","sourceRoot":"","sources":["../src/skip-middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAO,MAAM,IAAI,GAAG,CAAC,OAAuB,EAAE,EAAE;IAC9C,OAAO,SAAe,iBAAiB,CAAC,GAAG,EAAE,IAAI;;YAC/C,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAChD,IAAI,YAAY,KAAK,OAAO,CAAC,YAAY,IAAI,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE;gBAC9E,GAAG,CAAC,UAAU,GAAG;oBACf,IAAI,EAAE,IAAI;iBACX,CAAC;aACH;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;KAAA,CAAC;AACJ,CAAC,CAAC;AAVW,QAAA,IAAI,QAUf","sourcesContent":["export const skip = (options: ACLSkipOptions) => {\n  return async function ACLSkipMiddleware(ctx, next) {\n    const { resourceName, actionName } = ctx.action;\n    if (resourceName === options.resourceName && actionName === options.actionName) {\n      ctx.permission = {\n        skip: true,\n      };\n    }\n    await next();\n  };\n};\n\ninterface ACLSkipOptions {\n  resourceName: string;\n  actionName: string;\n}\n"]}