@nocobase/acl 2.2.0-alpha.7 → 2.2.0-alpha.9

package/lib/acl.d.ts

@@ -61,6 +61,22 @@ interface CanArgs {
     ctx?: any;
     roles?: string[];
 }
+export interface ResolveActionParamsOptions {
+    resourceName: string;
+    actionName: string;
+    rawResourceName?: string;
+    params?: any;
+    useCurrentRepository?: boolean;
+}
+export interface ResolvedActionParams {
+    actionName: string;
+    resourceName: string;
+    rawResourceName: string;
+    can: CanResult | null;
+    rawParams: any;
+    parsedParams?: any;
+    mergedParams: any;
+}
 export declare class ACL extends EventEmitter {
     /**
      * @internal
@@ -118,10 +134,12 @@ export declare class ACL extends EventEmitter {
      * @internal
      */
     getActionParams(ctx: any): Promise<void>;
+    resolveActionParams(ctx: any, options: ResolveActionParamsOptions): Promise<ResolvedActionParams>;
     addGeneralFixedParams(merger: GeneralMerger): void;
     addFixedParams(resource: string, action: string, merger: Merger): void;
     registerSnippet(snippet: SnippetOptions): void;
     protected addCoreMiddleware(): void;
+    private resolvePermissionParams;
     protected isAvailableAction(actionName: string): boolean;
 }
 export declare function createUserProvider(options: {

package/lib/acl.js

@@ -288,16 +288,7 @@ const _ACL = class _ACL extends import_events.default {
       ctx.acl = acl;
       const roleName = ctx.state.currentRole || "anonymous";
       const { resourceName: rawResourceName, actionName } = ctx.action;
-      let resourceName = rawResourceName;
-      if (rawResourceName.includes(".")) {
-        resourceName = rawResourceName.split(".").pop();
-      }
-      if (ctx.getCurrentRepository) {
-        const currentRepository = ctx.getCurrentRepository();
-        if (currentRepository && currentRepository.targetCollection) {
-          resourceName = ctx.getCurrentRepository().targetCollection.name;
-        }
-      }
+      const resourceName = resolveResourceName(ctx, rawResourceName, true);
       ctx.can = (options) => {
         const roles = ctx.state.currentRoles || [roleName];
         const can = acl.can({ roles, ...options });
@@ -318,19 +309,9 @@ const _ACL = class _ACL extends import_events.default {
    * @internal
    */
   async getActionParams(ctx) {
-    var _a;
-    const roleNames = ((_a = ctx.state.currentRoles) == null ? void 0 : _a.length) ? ctx.state.currentRoles : "anonymous";
+    const roleNames = getRoleNames(ctx);
     const { resourceName: rawResourceName, actionName } = ctx.action;
-    let resourceName = rawResourceName;
-    if (rawResourceName.includes(".")) {
-      resourceName = rawResourceName.split(".").pop();
-    }
-    if (ctx.getCurrentRepository) {
-      const currentRepository = ctx.getCurrentRepository();
-      if (currentRepository && currentRepository.targetCollection) {
-        resourceName = ctx.getCurrentRepository().targetCollection.name;
-      }
-    }
+    const resourceName = resolveResourceName(ctx, rawResourceName, true);
     ctx.can = (options) => {
       const can = this.can({ roles: roleNames, ...options });
       if (can) {
@@ -346,6 +327,25 @@ const _ACL = class _ACL extends import_events.default {
     await (0, import_koa_compose.default)(this.middlewares.nodes)(ctx, async () => {
     });
   }
+  async resolveActionParams(ctx, options) {
+    const rawResourceName = options.rawResourceName || options.resourceName;
+    const resourceName = resolveResourceName(ctx, options.resourceName, options.useCurrentRepository === true);
+    const roleNames = getRoleNames(ctx);
+    const can = this.can({
+      roles: roleNames,
+      resource: resourceName,
+      action: options.actionName,
+      rawResourceName
+    });
+    return this.resolvePermissionParams(ctx, {
+      actionName: options.actionName,
+      can,
+      params: options.params,
+      rawResourceName,
+      resourceName,
+      skip: false
+    });
+  }
   addGeneralFixedParams(merger) {
     this.fixedParamsManager.addGeneralParams(merger);
   }
@@ -359,60 +359,25 @@ const _ACL = class _ACL extends import_events.default {
     const acl = this;
     this.middlewares.add(
       async (ctx, next) => {
-        var _a, _b, _c, _d, _e, _f;
+        var _a, _b;
         const resourcerAction = ctx.action;
         const { resourceName, actionName } = ctx.permission;
         const permission = ctx.permission;
         ((_a = ctx.log) == null ? void 0 : _a.debug) && ctx.log.debug("ctx permission", permission);
-        if ((!permission.can || typeof permission.can !== "object") && !permission.skip) {
-          ctx.throw(403, "No permissions");
-          return;
-        }
-        const params = ((_b = permission.can) == null ? void 0 : _b.params) || acl.fixedParamsManager.getParams(resourceName, actionName);
-        ((_c = ctx.log) == null ? void 0 : _c.debug) && ctx.log.debug("acl params", params);
         try {
-          if (params && resourcerAction.mergeParams) {
-            const db = ctx.database ?? ctx.db;
-            const collection = (_d = db == null ? void 0 : db.getCollection) == null ? void 0 : _d.call(db, resourceName);
-            checkFilterParams(collection, params == null ? void 0 : params.filter);
-            const parsedFilter = await parseJsonTemplate(params.filter, {
-              state: ctx.state,
-              timezone: getTimezone(ctx),
-              userProvider: createUserProvider({
-                db: ctx.db,
-                currentUser: (_e = ctx.state) == null ? void 0 : _e.currentUser
-              })
-            });
-            const parsedParams = params.filter ? { ...params, filter: parsedFilter ?? params.filter } : params;
-            ctx.permission.parsedParams = parsedParams;
-            ((_f = ctx.log) == null ? void 0 : _f.debug) && ctx.log.debug("acl parsedParams", parsedParams);
-            ctx.permission.rawParams = import_lodash.default.cloneDeep(resourcerAction.params);
-            if (parsedParams.appends && resourcerAction.params.fields) {
-              for (const queryField of resourcerAction.params.fields) {
-                if (parsedParams.appends.indexOf(queryField) !== -1) {
-                  if (!resourcerAction.params.appends) {
-                    resourcerAction.params.appends = [];
-                  }
-                  resourcerAction.params.appends.push(queryField);
-                  resourcerAction.params.fields = resourcerAction.params.fields.filter((f) => f !== queryField);
-                }
-              }
-            }
-            const isEmptyFields = resourcerAction.params.fields && resourcerAction.params.fields.length === 0;
-            resourcerAction.mergeParams(parsedParams, {
-              appends: /* @__PURE__ */ __name((x, y) => {
-                if (!x) {
-                  return [];
-                }
-                if (!y) {
-                  return x;
-                }
-                return x.filter((i) => y.includes(i.split(".").shift()));
-              }, "appends")
-            });
-            if (isEmptyFields) {
-              resourcerAction.params.fields = [];
-            }
+          const result = await acl.resolvePermissionParams(ctx, {
+            actionName,
+            can: permission.can,
+            params: resourcerAction.params,
+            rawResourceName: ctx.action.resourceName,
+            resourceName,
+            skip: permission.skip
+          });
+          if (result.parsedParams && resourcerAction.mergeParams) {
+            ctx.permission.parsedParams = result.parsedParams;
+            ((_b = ctx.log) == null ? void 0 : _b.debug) && ctx.log.debug("acl parsedParams", result.parsedParams);
+            ctx.permission.rawParams = result.rawParams;
+            resourcerAction.params = result.mergedParams;
             ctx.permission.mergedParams = import_lodash.default.cloneDeep(resourcerAction.params);
           }
         } catch (e) {
@@ -430,12 +395,129 @@ const _ACL = class _ACL extends import_events.default {
       }
     );
   }
+  async resolvePermissionParams(ctx, options) {
+    var _a, _b, _c;
+    const { actionName, can, rawResourceName, resourceName } = options;
+    const rawParams = import_lodash.default.cloneDeep(options.params || {});
+    if ((!can || typeof can !== "object") && !options.skip) {
+      throw new import_no_permission_error.NoPermissionError("No permissions");
+    }
+    const params = (can == null ? void 0 : can.params) || this.fixedParamsManager.getParams(resourceName, actionName);
+    ((_a = ctx.log) == null ? void 0 : _a.debug) && ctx.log.debug("acl params", params);
+    if (!params) {
+      return {
+        actionName,
+        can,
+        mergedParams: rawParams,
+        rawParams,
+        rawResourceName,
+        resourceName
+      };
+    }
+    const db = ctx.database ?? ctx.db;
+    const collection = (_b = db == null ? void 0 : db.getCollection) == null ? void 0 : _b.call(db, resourceName);
+    checkFilterParams(collection, params == null ? void 0 : params.filter);
+    const parsedFilter = await parseJsonTemplate(params.filter, {
+      state: ctx.state,
+      timezone: getTimezone(ctx),
+      userProvider: createUserProvider({
+        db: ctx.db,
+        currentUser: (_c = ctx.state) == null ? void 0 : _c.currentUser
+      })
+    });
+    const parsedParams = params.filter ? { ...params, filter: parsedFilter ?? params.filter } : params;
+    const mergedParams = mergeActionParams(rawParams, parsedParams);
+    return {
+      actionName,
+      can,
+      mergedParams,
+      parsedParams,
+      rawParams,
+      rawResourceName,
+      resourceName
+    };
+  }
   isAvailableAction(actionName) {
     return this.availableActions.has(this.resolveActionAlias(actionName));
   }
 };
 __name(_ACL, "ACL");
 let ACL = _ACL;
+function getRoleNames(ctx) {
+  var _a;
+  if ((_a = ctx.state.currentRoles) == null ? void 0 : _a.length) {
+    return ctx.state.currentRoles;
+  }
+  return [ctx.state.currentRole || "anonymous"];
+}
+__name(getRoleNames, "getRoleNames");
+function resolveResourceName(ctx, rawResourceName, useCurrentRepository) {
+  const repository = resolveResourceRepository(ctx, rawResourceName, useCurrentRepository);
+  const collection = (repository == null ? void 0 : repository.targetCollection) || (repository == null ? void 0 : repository.collection);
+  if (collection == null ? void 0 : collection.name) {
+    return collection.name;
+  }
+  return rawResourceName.includes(".") ? rawResourceName.split(".").pop() : rawResourceName;
+}
+__name(resolveResourceName, "resolveResourceName");
+function resolveResourceRepository(ctx, resourceName, useCurrentRepository) {
+  var _a, _b, _c;
+  if (useCurrentRepository && ctx.getCurrentRepository) {
+    return ctx.getCurrentRepository();
+  }
+  const collectionManager = (_a = ctx.dataSource) == null ? void 0 : _a.collectionManager;
+  if (collectionManager == null ? void 0 : collectionManager.getRepository) {
+    try {
+      return collectionManager.getRepository(resourceName, (_b = ctx.action) == null ? void 0 : _b.sourceId);
+    } catch (error) {
+    }
+  }
+  const db = ctx.database ?? ctx.db;
+  if (db == null ? void 0 : db.getRepository) {
+    try {
+      return db.getRepository(resourceName, (_c = ctx.action) == null ? void 0 : _c.sourceId);
+    } catch (error) {
+    }
+  }
+}
+__name(resolveResourceRepository, "resolveResourceRepository");
+function mergeActionParams(rawParams, parsedParams) {
+  const mergedParams = import_lodash.default.cloneDeep(rawParams || {});
+  if (parsedParams.appends && mergedParams.fields) {
+    for (const queryField of mergedParams.fields) {
+      if (parsedParams.appends.indexOf(queryField) !== -1) {
+        if (!mergedParams.appends) {
+          mergedParams.appends = [];
+        }
+        mergedParams.appends.push(queryField);
+        mergedParams.fields = mergedParams.fields.filter((f) => f !== queryField);
+      }
+    }
+  }
+  const isEmptyFields = mergedParams.fields && mergedParams.fields.length === 0;
+  (0, import_utils.assign)(mergedParams, parsedParams, {
+    appends: /* @__PURE__ */ __name((x, y) => {
+      if (!x) {
+        return [];
+      }
+      if (!y) {
+        return x;
+      }
+      return x.filter((i) => y.includes(i.split(".").shift()));
+    }, "appends"),
+    blacklist: "intersect",
+    except: "union",
+    fields: "intersect",
+    filter: "andMerge",
+    sort: "overwrite",
+    whitelist: "intersect"
+  });
+  if (isEmptyFields) {
+    mergedParams.fields = [];
+  }
+  return mergedParams;
+}
+__name(mergeActionParams, "mergeActionParams");
 function getTimezone(ctx) {
   var _a, _b, _c, _d, _e, _f;
   return ((_b = (_a = ctx == null ? void 0 : ctx.request) == null ? void 0 : _a.get) == null ? void 0 : _b.call(_a, "x-timezone")) ?? ((_d = (_c = ctx == null ? void 0 : ctx.request) == null ? void 0 : _c.header) == null ? void 0 : _d["x-timezone"]) ?? ((_f = (_e = ctx == null ? void 0 : ctx.req) == null ? void 0 : _e.headers) == null ? void 0 : _f["x-timezone"]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/acl",
-  "version": "2.2.0-alpha.7",
+  "version": "2.2.0-alpha.9",
   "description": "",
   "license": "Apache-2.0",
   "main": "./lib/index.js",
@@ -18,5 +18,5 @@
     "url": "git+https://github.com/nocobase/nocobase.git",
     "directory": "packages/acl"
   },
-  "gitHead": "34ba02960fca9ab0b6881d3db7040a8a64067bba"
+  "gitHead": "4949bf5ebcd92d77a3a0a718ed578c270e4bd570"
 }