@nocobase/acl 0.9.2-alpha.4 → 0.9.4-alpha.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/acl-resource.js +16 -1
- package/lib/acl.d.ts +5 -5
- package/lib/acl.js +79 -74
- package/package.json +4 -5
package/lib/acl-resource.js
CHANGED
|
@@ -4,6 +4,14 @@ Object.defineProperty(exports, "__esModule", {
|
|
|
4
4
|
value: true
|
|
5
5
|
});
|
|
6
6
|
exports.ACLResource = void 0;
|
|
7
|
+
function _lodash() {
|
|
8
|
+
const data = _interopRequireDefault(require("lodash"));
|
|
9
|
+
_lodash = function _lodash() {
|
|
10
|
+
return data;
|
|
11
|
+
};
|
|
12
|
+
return data;
|
|
13
|
+
}
|
|
14
|
+
function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
|
|
7
15
|
class ACLResource {
|
|
8
16
|
constructor(options) {
|
|
9
17
|
this.actions = new Map();
|
|
@@ -26,7 +34,14 @@ class ACLResource {
|
|
|
26
34
|
}, {});
|
|
27
35
|
}
|
|
28
36
|
getAction(name) {
|
|
29
|
-
|
|
37
|
+
const result = this.actions.get(name) || this.actions.get(this.acl.resolveActionAlias(name));
|
|
38
|
+
if (!result) {
|
|
39
|
+
return null;
|
|
40
|
+
}
|
|
41
|
+
if (Array.isArray(result.fields) && result.fields.length > 0) {
|
|
42
|
+
result.fields = _lodash().default.uniq(result.fields);
|
|
43
|
+
}
|
|
44
|
+
return _lodash().default.cloneDeep(result);
|
|
30
45
|
}
|
|
31
46
|
setAction(name, params) {
|
|
32
47
|
const context = {
|
package/lib/acl.d.ts
CHANGED
|
@@ -37,17 +37,16 @@ interface CanArgs {
|
|
|
37
37
|
ctx?: any;
|
|
38
38
|
}
|
|
39
39
|
export declare class ACL extends EventEmitter {
|
|
40
|
-
protected availableActions: Map<string, ACLAvailableAction>;
|
|
41
40
|
availableStrategy: Map<string, ACLAvailableStrategy>;
|
|
42
|
-
protected fixedParamsManager: FixedParamsManager;
|
|
43
|
-
protected middlewares: Toposort<any>;
|
|
44
41
|
allowManager: AllowManager;
|
|
45
42
|
snippetManager: SnippetManager;
|
|
46
43
|
roles: Map<string, ACLRole>;
|
|
47
44
|
actionAlias: Map<string, string>;
|
|
48
45
|
configResources: string[];
|
|
46
|
+
protected availableActions: Map<string, ACLAvailableAction>;
|
|
47
|
+
protected fixedParamsManager: FixedParamsManager;
|
|
48
|
+
protected middlewares: Toposort<any>;
|
|
49
49
|
constructor();
|
|
50
|
-
protected addCoreMiddleware(): void;
|
|
51
50
|
define(options: DefineOptions): ACLRole;
|
|
52
51
|
getRole(name: string): ACLRole;
|
|
53
52
|
removeRole(name: string): boolean;
|
|
@@ -60,7 +59,6 @@ export declare class ACL extends EventEmitter {
|
|
|
60
59
|
setAvailableStrategy(name: string, options: AvailableStrategyOptions): void;
|
|
61
60
|
beforeGrantAction(listener?: Listener): void;
|
|
62
61
|
can(options: CanArgs): CanResult | null;
|
|
63
|
-
protected isAvailableAction(actionName: string): boolean;
|
|
64
62
|
resolveActionAlias(action: string): string;
|
|
65
63
|
use(fn: any, options?: ToposortOptions): void;
|
|
66
64
|
allow(resourceName: string, actionNames: string[] | string, condition?: string | ConditionFunc): void;
|
|
@@ -70,5 +68,7 @@ export declare class ACL extends EventEmitter {
|
|
|
70
68
|
getActionParams(ctx: any): Promise<void>;
|
|
71
69
|
addFixedParams(resource: string, action: string, merger: Merger): void;
|
|
72
70
|
registerSnippet(snippet: SnippetOptions): void;
|
|
71
|
+
protected addCoreMiddleware(): void;
|
|
72
|
+
protected isAvailableAction(actionName: string): boolean;
|
|
73
73
|
}
|
|
74
74
|
export {};
|
package/lib/acl.js
CHANGED
|
@@ -39,6 +39,8 @@ var _allowManager = require("./allow-manager");
|
|
|
39
39
|
var _fixedParamsManager = _interopRequireDefault(require("./fixed-params-manager"));
|
|
40
40
|
var _snippetManager = _interopRequireDefault(require("./snippet-manager"));
|
|
41
41
|
function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
|
|
42
|
+
function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
|
|
43
|
+
function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
|
|
42
44
|
function _createForOfIteratorHelper(o, allowArrayLike) { var it = typeof Symbol !== "undefined" && o[Symbol.iterator] || o["@@iterator"]; if (!it) { if (Array.isArray(o) || (it = _unsupportedIterableToArray(o)) || allowArrayLike && o && typeof o.length === "number") { if (it) o = it; var i = 0; var F = function F() {}; return { s: F, n: function n() { if (i >= o.length) return { done: true }; return { done: false, value: o[i++] }; }, e: function e(_e2) { throw _e2; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var normalCompletion = true, didErr = false, err; return { s: function s() { it = it.call(o); }, n: function n() { var step = it.next(); normalCompletion = step.done; return step; }, e: function e(_e3) { didErr = true; err = _e3; }, f: function f() { try { if (!normalCompletion && it.return != null) it.return(); } finally { if (didErr) throw err; } } }; }
|
|
43
45
|
function _slicedToArray(arr, i) { return _arrayWithHoles(arr) || _iterableToArrayLimit(arr, i) || _unsupportedIterableToArray(arr, i) || _nonIterableRest(); }
|
|
44
46
|
function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
|
|
@@ -46,8 +48,6 @@ function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o =
|
|
|
46
48
|
function _arrayLikeToArray(arr, len) { if (len == null || len > arr.length) len = arr.length; for (var i = 0, arr2 = new Array(len); i < len; i++) arr2[i] = arr[i]; return arr2; }
|
|
47
49
|
function _iterableToArrayLimit(arr, i) { var _i = null == arr ? null : "undefined" != typeof Symbol && arr[Symbol.iterator] || arr["@@iterator"]; if (null != _i) { var _s, _e, _x, _r, _arr = [], _n = !0, _d = !1; try { if (_x = (_i = _i.call(arr)).next, 0 === i) { if (Object(_i) !== _i) return; _n = !1; } else for (; !(_n = (_s = _x.call(_i)).done) && (_arr.push(_s.value), _arr.length !== i); _n = !0); } catch (err) { _d = !0, _e = err; } finally { try { if (!_n && null != _i.return && (_r = _i.return(), Object(_r) !== _r)) return; } finally { if (_d) throw _e; } } return _arr; } }
|
|
48
50
|
function _arrayWithHoles(arr) { if (Array.isArray(arr)) return arr; }
|
|
49
|
-
function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
|
|
50
|
-
function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
|
|
51
51
|
function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); enumerableOnly && (symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
|
|
52
52
|
function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? ownKeys(Object(source), !0).forEach(function (key) { _defineProperty(target, key, source[key]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)) : ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } return target; }
|
|
53
53
|
function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
|
|
@@ -56,15 +56,15 @@ function _toPrimitive(input, hint) { if (typeof input !== "object" || input ===
|
|
|
56
56
|
class ACL extends _events().default {
|
|
57
57
|
constructor() {
|
|
58
58
|
super();
|
|
59
|
-
this.availableActions = new Map();
|
|
60
59
|
this.availableStrategy = new Map();
|
|
61
|
-
this.fixedParamsManager = new _fixedParamsManager.default();
|
|
62
|
-
this.middlewares = void 0;
|
|
63
60
|
this.allowManager = new _allowManager.AllowManager(this);
|
|
64
61
|
this.snippetManager = new _snippetManager.default();
|
|
65
62
|
this.roles = new Map();
|
|
66
63
|
this.actionAlias = new Map();
|
|
67
64
|
this.configResources = [];
|
|
65
|
+
this.availableActions = new Map();
|
|
66
|
+
this.fixedParamsManager = new _fixedParamsManager.default();
|
|
67
|
+
this.middlewares = void 0;
|
|
68
68
|
this.middlewares = new (_utils().Toposort)();
|
|
69
69
|
this.beforeGrantAction(ctx => {
|
|
70
70
|
if (_lodash().default.isPlainObject(ctx.params) && ctx.params.own) {
|
|
@@ -93,63 +93,6 @@ class ACL extends _events().default {
|
|
|
93
93
|
});
|
|
94
94
|
this.addCoreMiddleware();
|
|
95
95
|
}
|
|
96
|
-
addCoreMiddleware() {
|
|
97
|
-
const acl = this;
|
|
98
|
-
const filterParams = (ctx, resourceName, params) => {
|
|
99
|
-
var _params$filter;
|
|
100
|
-
if (params === null || params === void 0 ? void 0 : (_params$filter = params.filter) === null || _params$filter === void 0 ? void 0 : _params$filter.createdById) {
|
|
101
|
-
const collection = ctx.db.getCollection(resourceName);
|
|
102
|
-
if (!collection || !collection.getField('createdById')) {
|
|
103
|
-
return _lodash().default.omit(params, 'filter.createdById');
|
|
104
|
-
}
|
|
105
|
-
}
|
|
106
|
-
return params;
|
|
107
|
-
};
|
|
108
|
-
this.middlewares.add( /*#__PURE__*/function () {
|
|
109
|
-
var _ref = _asyncToGenerator(function* (ctx, next) {
|
|
110
|
-
var _ctx$log, _permission$can, _ctx$log2;
|
|
111
|
-
const resourcerAction = ctx.action;
|
|
112
|
-
const _ctx$action = ctx.action,
|
|
113
|
-
resourceName = _ctx$action.resourceName,
|
|
114
|
-
actionName = _ctx$action.actionName;
|
|
115
|
-
const permission = ctx.permission;
|
|
116
|
-
((_ctx$log = ctx.log) === null || _ctx$log === void 0 ? void 0 : _ctx$log.info) && ctx.log.info('ctx permission', permission);
|
|
117
|
-
if ((!permission.can || typeof permission.can !== 'object') && !permission.skip) {
|
|
118
|
-
ctx.throw(403, 'No permissions');
|
|
119
|
-
return;
|
|
120
|
-
}
|
|
121
|
-
const params = ((_permission$can = permission.can) === null || _permission$can === void 0 ? void 0 : _permission$can.params) || acl.fixedParamsManager.getParams(resourceName, actionName);
|
|
122
|
-
((_ctx$log2 = ctx.log) === null || _ctx$log2 === void 0 ? void 0 : _ctx$log2.info) && ctx.log.info('acl params', params);
|
|
123
|
-
if (params && resourcerAction.mergeParams) {
|
|
124
|
-
var _ctx$log3;
|
|
125
|
-
const filteredParams = filterParams(ctx, resourceName, params);
|
|
126
|
-
const parsedParams = yield acl.parseJsonTemplate(filteredParams, ctx);
|
|
127
|
-
ctx.permission.parsedParams = parsedParams;
|
|
128
|
-
((_ctx$log3 = ctx.log) === null || _ctx$log3 === void 0 ? void 0 : _ctx$log3.info) && ctx.log.info('acl parsedParams', parsedParams);
|
|
129
|
-
ctx.permission.rawParams = _lodash().default.cloneDeep(resourcerAction.params);
|
|
130
|
-
resourcerAction.mergeParams(parsedParams, {
|
|
131
|
-
appends: (x, y) => {
|
|
132
|
-
if (!x) {
|
|
133
|
-
return [];
|
|
134
|
-
}
|
|
135
|
-
if (!y) {
|
|
136
|
-
return x;
|
|
137
|
-
}
|
|
138
|
-
return x.filter(i => y.includes(i.split('.').shift()));
|
|
139
|
-
}
|
|
140
|
-
});
|
|
141
|
-
ctx.permission.mergedParams = _lodash().default.cloneDeep(resourcerAction.params);
|
|
142
|
-
}
|
|
143
|
-
yield next();
|
|
144
|
-
});
|
|
145
|
-
return function (_x, _x2) {
|
|
146
|
-
return _ref.apply(this, arguments);
|
|
147
|
-
};
|
|
148
|
-
}(), {
|
|
149
|
-
tag: 'core',
|
|
150
|
-
group: 'core'
|
|
151
|
-
});
|
|
152
|
-
}
|
|
153
96
|
define(options) {
|
|
154
97
|
const roleName = options.role;
|
|
155
98
|
const role = new _aclRole.ACLRole(this, roleName);
|
|
@@ -272,9 +215,6 @@ class ACL extends _events().default {
|
|
|
272
215
|
}
|
|
273
216
|
return null;
|
|
274
217
|
}
|
|
275
|
-
isAvailableAction(actionName) {
|
|
276
|
-
return this.availableActions.has(this.resolveActionAlias(actionName));
|
|
277
|
-
}
|
|
278
218
|
resolveActionAlias(action) {
|
|
279
219
|
return this.actionAlias.get(action) ? this.actionAlias.get(action) : action;
|
|
280
220
|
}
|
|
@@ -339,13 +279,14 @@ class ACL extends _events().default {
|
|
|
339
279
|
return /*#__PURE__*/function () {
|
|
340
280
|
var _ACLMiddleware = _asyncToGenerator(function* (ctx, next) {
|
|
341
281
|
const roleName = ctx.state.currentRole || 'anonymous';
|
|
342
|
-
const _ctx$
|
|
343
|
-
resourceName = _ctx$
|
|
344
|
-
actionName = _ctx$
|
|
282
|
+
const _ctx$action = ctx.action,
|
|
283
|
+
resourceName = _ctx$action.resourceName,
|
|
284
|
+
actionName = _ctx$action.actionName;
|
|
345
285
|
ctx.can = options => {
|
|
346
|
-
|
|
286
|
+
const canResult = acl.can(_objectSpread({
|
|
347
287
|
role: roleName
|
|
348
288
|
}, options));
|
|
289
|
+
return canResult;
|
|
349
290
|
};
|
|
350
291
|
ctx.permission = {
|
|
351
292
|
can: ctx.can({
|
|
@@ -355,7 +296,7 @@ class ACL extends _events().default {
|
|
|
355
296
|
};
|
|
356
297
|
return (0, _koaCompose().default)(acl.middlewares.nodes)(ctx, next);
|
|
357
298
|
});
|
|
358
|
-
function ACLMiddleware(
|
|
299
|
+
function ACLMiddleware(_x2, _x3) {
|
|
359
300
|
return _ACLMiddleware.apply(this, arguments);
|
|
360
301
|
}
|
|
361
302
|
return ACLMiddleware;
|
|
@@ -365,13 +306,17 @@ class ACL extends _events().default {
|
|
|
365
306
|
var _this = this;
|
|
366
307
|
return _asyncToGenerator(function* () {
|
|
367
308
|
const roleName = ctx.state.currentRole || 'anonymous';
|
|
368
|
-
const _ctx$
|
|
369
|
-
resourceName = _ctx$
|
|
370
|
-
actionName = _ctx$
|
|
309
|
+
const _ctx$action2 = ctx.action,
|
|
310
|
+
resourceName = _ctx$action2.resourceName,
|
|
311
|
+
actionName = _ctx$action2.actionName;
|
|
371
312
|
ctx.can = options => {
|
|
372
|
-
|
|
313
|
+
const can = _this.can(_objectSpread({
|
|
373
314
|
role: roleName
|
|
374
315
|
}, options));
|
|
316
|
+
if (!can) {
|
|
317
|
+
return null;
|
|
318
|
+
}
|
|
319
|
+
return _lodash().default.cloneDeep(can);
|
|
375
320
|
};
|
|
376
321
|
ctx.permission = {
|
|
377
322
|
can: ctx.can({
|
|
@@ -388,5 +333,65 @@ class ACL extends _events().default {
|
|
|
388
333
|
registerSnippet(snippet) {
|
|
389
334
|
this.snippetManager.register(snippet);
|
|
390
335
|
}
|
|
336
|
+
addCoreMiddleware() {
|
|
337
|
+
const acl = this;
|
|
338
|
+
const filterParams = (ctx, resourceName, params) => {
|
|
339
|
+
var _params$filter;
|
|
340
|
+
if (params === null || params === void 0 ? void 0 : (_params$filter = params.filter) === null || _params$filter === void 0 ? void 0 : _params$filter.createdById) {
|
|
341
|
+
const collection = ctx.db.getCollection(resourceName);
|
|
342
|
+
if (!collection || !collection.getField('createdById')) {
|
|
343
|
+
return _lodash().default.omit(params, 'filter.createdById');
|
|
344
|
+
}
|
|
345
|
+
}
|
|
346
|
+
return params;
|
|
347
|
+
};
|
|
348
|
+
this.middlewares.add( /*#__PURE__*/function () {
|
|
349
|
+
var _ref2 = _asyncToGenerator(function* (ctx, next) {
|
|
350
|
+
var _ctx$log, _permission$can, _ctx$log2;
|
|
351
|
+
const resourcerAction = ctx.action;
|
|
352
|
+
const _ctx$action3 = ctx.action,
|
|
353
|
+
resourceName = _ctx$action3.resourceName,
|
|
354
|
+
actionName = _ctx$action3.actionName;
|
|
355
|
+
const permission = ctx.permission;
|
|
356
|
+
((_ctx$log = ctx.log) === null || _ctx$log === void 0 ? void 0 : _ctx$log.info) && ctx.log.info('ctx permission', permission);
|
|
357
|
+
if ((!permission.can || typeof permission.can !== 'object') && !permission.skip) {
|
|
358
|
+
ctx.throw(403, 'No permissions');
|
|
359
|
+
return;
|
|
360
|
+
}
|
|
361
|
+
const params = ((_permission$can = permission.can) === null || _permission$can === void 0 ? void 0 : _permission$can.params) || acl.fixedParamsManager.getParams(resourceName, actionName);
|
|
362
|
+
((_ctx$log2 = ctx.log) === null || _ctx$log2 === void 0 ? void 0 : _ctx$log2.info) && ctx.log.info('acl params', params);
|
|
363
|
+
if (params && resourcerAction.mergeParams) {
|
|
364
|
+
var _ctx$log3;
|
|
365
|
+
const filteredParams = filterParams(ctx, resourceName, params);
|
|
366
|
+
const parsedParams = yield acl.parseJsonTemplate(filteredParams, ctx);
|
|
367
|
+
ctx.permission.parsedParams = parsedParams;
|
|
368
|
+
((_ctx$log3 = ctx.log) === null || _ctx$log3 === void 0 ? void 0 : _ctx$log3.info) && ctx.log.info('acl parsedParams', parsedParams);
|
|
369
|
+
ctx.permission.rawParams = _lodash().default.cloneDeep(resourcerAction.params);
|
|
370
|
+
resourcerAction.mergeParams(parsedParams, {
|
|
371
|
+
appends: (x, y) => {
|
|
372
|
+
if (!x) {
|
|
373
|
+
return [];
|
|
374
|
+
}
|
|
375
|
+
if (!y) {
|
|
376
|
+
return x;
|
|
377
|
+
}
|
|
378
|
+
return x.filter(i => y.includes(i.split('.').shift()));
|
|
379
|
+
}
|
|
380
|
+
});
|
|
381
|
+
ctx.permission.mergedParams = _lodash().default.cloneDeep(resourcerAction.params);
|
|
382
|
+
}
|
|
383
|
+
yield next();
|
|
384
|
+
});
|
|
385
|
+
return function (_x4, _x5) {
|
|
386
|
+
return _ref2.apply(this, arguments);
|
|
387
|
+
};
|
|
388
|
+
}(), {
|
|
389
|
+
tag: 'core',
|
|
390
|
+
group: 'core'
|
|
391
|
+
});
|
|
392
|
+
}
|
|
393
|
+
isAvailableAction(actionName) {
|
|
394
|
+
return this.availableActions.has(this.resolveActionAlias(actionName));
|
|
395
|
+
}
|
|
391
396
|
}
|
|
392
397
|
exports.ACL = ACL;
|
package/package.json
CHANGED
|
@@ -1,14 +1,13 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@nocobase/acl",
|
|
3
|
-
"version": "0.9.
|
|
3
|
+
"version": "0.9.4-alpha.1",
|
|
4
4
|
"description": "",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"main": "./lib/index.js",
|
|
7
7
|
"types": "./lib/index.d.ts",
|
|
8
8
|
"dependencies": {
|
|
9
|
-
"@nocobase/resourcer": "0.9.
|
|
10
|
-
"@nocobase/utils": "0.9.
|
|
11
|
-
"json-templates": "^4.2.0",
|
|
9
|
+
"@nocobase/resourcer": "0.9.4-alpha.1",
|
|
10
|
+
"@nocobase/utils": "0.9.4-alpha.1",
|
|
12
11
|
"minimatch": "^5.1.1"
|
|
13
12
|
},
|
|
14
13
|
"repository": {
|
|
@@ -16,5 +15,5 @@
|
|
|
16
15
|
"url": "git+https://github.com/nocobase/nocobase.git",
|
|
17
16
|
"directory": "packages/acl"
|
|
18
17
|
},
|
|
19
|
-
"gitHead": "
|
|
18
|
+
"gitHead": "0b4936be557be918dbdf8196dadcbc7eb395906d"
|
|
20
19
|
}
|