@nocobase/plugin-acl 0.11.1-alpha.5 → 0.12.0-alpha.1

package/lib/server/server.js

@@ -1,947 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = exports.PluginACL = exports.GrantHelper = void 0;
-function _acl() {
-  const data = require("@nocobase/acl");
-  _acl = function _acl() {
-    return data;
-  };
-  return data;
-}
-function _actions() {
-  const data = require("@nocobase/actions");
-  _actions = function _actions() {
-    return data;
-  };
-  return data;
-}
-function _database() {
-  const data = require("@nocobase/database");
-  _database = function _database() {
-    return data;
-  };
-  return data;
-}
-function _server() {
-  const data = require("@nocobase/server");
-  _server = function _server() {
-    return data;
-  };
-  return data;
-}
-function _utils() {
-  const data = require("@nocobase/utils");
-  _utils = function _utils() {
-    return data;
-  };
-  return data;
-}
-function _path() {
-  const data = require("path");
-  _path = function _path() {
-    return data;
-  };
-  return data;
-}
-var _availableActions = require("./actions/available-actions");
-var _roleCheck = require("./actions/role-check");
-var _roleCollections = require("./actions/role-collections");
-var _userSetDefaultRole = require("./actions/user-setDefaultRole");
-var _setCurrentRole = require("./middlewares/setCurrentRole");
-var _RoleModel = require("./model/RoleModel");
-var _RoleResourceActionModel = require("./model/RoleResourceActionModel");
-var _RoleResourceModel = require("./model/RoleResourceModel");
-function _slicedToArray(arr, i) { return _arrayWithHoles(arr) || _iterableToArrayLimit(arr, i) || _unsupportedIterableToArray(arr, i) || _nonIterableRest(); }
-function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
-function _iterableToArrayLimit(arr, i) { var _i = null == arr ? null : "undefined" != typeof Symbol && arr[Symbol.iterator] || arr["@@iterator"]; if (null != _i) { var _s, _e, _x, _r, _arr = [], _n = !0, _d = !1; try { if (_x = (_i = _i.call(arr)).next, 0 === i) { if (Object(_i) !== _i) return; _n = !1; } else for (; !(_n = (_s = _x.call(_i)).done) && (_arr.push(_s.value), _arr.length !== i); _n = !0); } catch (err) { _d = !0, _e = err; } finally { try { if (!_n && null != _i.return && (_r = _i.return(), Object(_r) !== _r)) return; } finally { if (_d) throw _e; } } return _arr; } }
-function _arrayWithHoles(arr) { if (Array.isArray(arr)) return arr; }
-function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); enumerableOnly && (symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
-function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? ownKeys(Object(source), !0).forEach(function (key) { _defineProperty(target, key, source[key]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)) : ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } return target; }
-function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
-function _toPropertyKey(arg) { var key = _toPrimitive(arg, "string"); return typeof key === "symbol" ? key : String(key); }
-function _toPrimitive(input, hint) { if (typeof input !== "object" || input === null) return input; var prim = input[Symbol.toPrimitive]; if (prim !== undefined) { var res = prim.call(input, hint || "default"); if (typeof res !== "object") return res; throw new TypeError("@@toPrimitive must return a primitive value."); } return (hint === "string" ? String : Number)(input); }
-function _createForOfIteratorHelper(o, allowArrayLike) { var it = typeof Symbol !== "undefined" && o[Symbol.iterator] || o["@@iterator"]; if (!it) { if (Array.isArray(o) || (it = _unsupportedIterableToArray(o)) || allowArrayLike && o && typeof o.length === "number") { if (it) o = it; var i = 0; var F = function F() {}; return { s: F, n: function n() { if (i >= o.length) return { done: true }; return { done: false, value: o[i++] }; }, e: function e(_e2) { throw _e2; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var normalCompletion = true, didErr = false, err; return { s: function s() { it = it.call(o); }, n: function n() { var step = it.next(); normalCompletion = step.done; return step; }, e: function e(_e3) { didErr = true; err = _e3; }, f: function f() { try { if (!normalCompletion && it.return != null) it.return(); } finally { if (didErr) throw err; } } }; }
-function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o === "string") return _arrayLikeToArray(o, minLen); var n = Object.prototype.toString.call(o).slice(8, -1); if (n === "Object" && o.constructor) n = o.constructor.name; if (n === "Map" || n === "Set") return Array.from(o); if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen); }
-function _arrayLikeToArray(arr, len) { if (len == null || len > arr.length) len = arr.length; for (var i = 0, arr2 = new Array(len); i < len; i++) arr2[i] = arr[i]; return arr2; }
-function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
-function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
-class GrantHelper {
-  constructor() {
-    this.resourceTargetActionMap = new Map();
-    this.targetActionResourceMap = new Map();
-  }
-}
-exports.GrantHelper = GrantHelper;
-class PluginACL extends _server().Plugin {
-  constructor(...args) {
-    super(...args);
-    // association field actions config
-    this.associationFieldsActions = {};
-    this.grantHelper = new GrantHelper();
-  }
-  get acl() {
-    return this.app.acl;
-  }
-  registerAssociationFieldAction(associationType, value) {
-    this.associationFieldsActions[associationType] = value;
-  }
-  registerAssociationFieldsActions() {
-    // if grant create action to role, it should
-    // also grant add action and association target's view action
-    this.registerAssociationFieldAction('hasOne', {
-      view: {
-        associationActions: ['list', 'get', 'view']
-      },
-      create: {
-        associationActions: ['create', 'set']
-      },
-      update: {
-        associationActions: ['update', 'remove', 'set']
-      }
-    });
-    this.registerAssociationFieldAction('hasMany', {
-      view: {
-        associationActions: ['list', 'get', 'view']
-      },
-      create: {
-        associationActions: ['create', 'set', 'add']
-      },
-      update: {
-        associationActions: ['update', 'remove', 'set']
-      }
-    });
-    this.registerAssociationFieldAction('belongsTo', {
-      view: {
-        associationActions: ['list', 'get', 'view']
-      },
-      create: {
-        associationActions: ['create', 'set']
-      },
-      update: {
-        associationActions: ['update', 'remove', 'set']
-      }
-    });
-    this.registerAssociationFieldAction('belongsToMany', {
-      view: {
-        associationActions: ['list', 'get', 'view']
-      },
-      create: {
-        associationActions: ['create', 'set', 'add']
-      },
-      update: {
-        associationActions: ['update', 'remove', 'set', 'toggle']
-      }
-    });
-  }
-  writeResourceToACL(resourceModel, transaction) {
-    var _this = this;
-    return _asyncToGenerator(function* () {
-      yield resourceModel.writeToACL({
-        acl: _this.acl,
-        associationFieldsActions: _this.associationFieldsActions,
-        transaction: transaction,
-        grantHelper: _this.grantHelper
-      });
-    })();
-  }
-  writeActionToACL(actionModel, transaction) {
-    var _this2 = this;
-    return _asyncToGenerator(function* () {
-      const resource = actionModel.get('resource');
-      const role = _this2.acl.getRole(resource.get('roleName'));
-      yield actionModel.writeToACL({
-        acl: _this2.acl,
-        role,
-        resourceName: resource.get('name'),
-        associationFieldsActions: _this2.associationFieldsActions,
-        grantHelper: _this2.grantHelper
-      });
-    })();
-  }
-  writeRolesToACL() {
-    var _this3 = this;
-    return _asyncToGenerator(function* () {
-      const roles = yield _this3.app.db.getRepository('roles').find({
-        appends: ['resources', 'resources.actions']
-      });
-      var _iterator = _createForOfIteratorHelper(roles),
-        _step;
-      try {
-        for (_iterator.s(); !(_step = _iterator.n()).done;) {
-          const role = _step.value;
-          yield _this3.writeRoleToACL(role);
-        }
-      } catch (err) {
-        _iterator.e(err);
-      } finally {
-        _iterator.f();
-      }
-    })();
-  }
-  writeRoleToACL(role, transaction = null) {
-    var _this4 = this;
-    return _asyncToGenerator(function* () {
-      role.writeToAcl({
-        acl: _this4.acl
-      });
-      let resources = role.get('resources');
-      if (!resources) {
-        resources = yield role.getResources({
-          transaction
-        });
-      }
-      var _iterator2 = _createForOfIteratorHelper(resources),
-        _step2;
-      try {
-        for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
-          const resource = _step2.value;
-          yield _this4.writeResourceToACL(resource, transaction);
-        }
-      } catch (err) {
-        _iterator2.e(err);
-      } finally {
-        _iterator2.f();
-      }
-    })();
-  }
-  beforeLoad() {
-    var _this5 = this;
-    return _asyncToGenerator(function* () {
-      _this5.db.addMigrations({
-        namespace: _this5.name,
-        directory: (0, _path().resolve)(__dirname, './migrations'),
-        context: {
-          plugin: _this5
-        }
-      });
-      _this5.app.db.registerModels({
-        RoleResourceActionModel: _RoleResourceActionModel.RoleResourceActionModel,
-        RoleResourceModel: _RoleResourceModel.RoleResourceModel,
-        RoleModel: _RoleModel.RoleModel
-      });
-      _this5.app.acl.registerSnippet({
-        name: `pm.${_this5.name}.roles`,
-        actions: ['roles:*', 'roles.snippets:*', 'availableActions:list', 'roles.collections:list', 'roles.resources:*', 'uiSchemas:getProperties', 'roles.menuUiSchemas:*']
-      });
-      // change resource fields to association fields
-      _this5.app.acl.beforeGrantAction(ctx => {
-        const actionName = _this5.app.acl.resolveActionAlias(ctx.actionName);
-        const collection = _this5.app.db.getCollection(ctx.resourceName);
-        if (!collection) {
-          return;
-        }
-        const fieldsParams = ctx.params.fields;
-        if (!fieldsParams) {
-          return;
-        }
-        if (actionName == 'view' || actionName == 'export') {
-          const associationsFields = fieldsParams.filter(fieldName => {
-            const field = collection.getField(fieldName);
-            return field instanceof _database().RelationField;
-          });
-          ctx.params = _objectSpread(_objectSpread({}, ctx.params), {}, {
-            fields: _utils().lodash.difference(fieldsParams, associationsFields),
-            appends: associationsFields
-          });
-        }
-      });
-      _this5.registerAssociationFieldsActions();
-      _this5.app.resourcer.define(_availableActions.availableActionResource);
-      _this5.app.resourcer.define(_roleCollections.roleCollectionsResource);
-      _this5.app.resourcer.registerActionHandler('roles:check', _roleCheck.checkAction);
-      _this5.app.resourcer.registerActionHandler(`users:setDefaultRole`, _userSetDefaultRole.setDefaultRole);
-      _this5.db.on('users.afterCreateWithAssociations', /*#__PURE__*/function () {
-        var _ref = _asyncToGenerator(function* (model, options) {
-          const transaction = options.transaction;
-          const repository = _this5.app.db.getRepository('roles');
-          const defaultRole = yield repository.findOne({
-            filter: {
-              default: true
-            },
-            transaction
-          });
-          if (defaultRole && (yield model.countRoles({
-            transaction
-          })) == 0) {
-            yield model.addRoles(defaultRole, {
-              transaction
-            });
-          }
-        });
-        return function (_x, _x2) {
-          return _ref.apply(this, arguments);
-        };
-      }());
-      _this5.app.on('acl:writeRoleToACL', /*#__PURE__*/function () {
-        var _ref2 = _asyncToGenerator(function* (roleModel) {
-          yield _this5.writeRoleToACL(roleModel);
-        });
-        return function (_x3) {
-          return _ref2.apply(this, arguments);
-        };
-      }());
-      _this5.app.db.on('roles.afterSaveWithAssociations', /*#__PURE__*/function () {
-        var _ref3 = _asyncToGenerator(function* (model, options) {
-          const transaction = options.transaction;
-          yield _this5.writeRoleToACL(model, transaction);
-          // model is default
-          if (model.get('default')) {
-            yield _this5.app.db.getRepository('roles').update({
-              values: {
-                default: false
-              },
-              filter: {
-                'name.$ne': model.get('name')
-              },
-              hooks: false,
-              transaction
-            });
-          }
-        });
-        return function (_x4, _x5) {
-          return _ref3.apply(this, arguments);
-        };
-      }());
-      _this5.app.db.on('roles.afterDestroy', model => {
-        const roleName = model.get('name');
-        _this5.acl.removeRole(roleName);
-      });
-      _this5.app.db.on('rolesResources.afterSaveWithAssociations', /*#__PURE__*/function () {
-        var _ref4 = _asyncToGenerator(function* (model, options) {
-          yield _this5.writeResourceToACL(model, options.transaction);
-        });
-        return function (_x6, _x7) {
-          return _ref4.apply(this, arguments);
-        };
-      }());
-      _this5.app.db.on('rolesResourcesActions.afterUpdateWithAssociations', /*#__PURE__*/function () {
-        var _ref5 = _asyncToGenerator(function* (model, options) {
-          const transaction = options.transaction;
-          const resource = yield model.getResource({
-            transaction
-          });
-          yield _this5.writeResourceToACL(resource, transaction);
-        });
-        return function (_x8, _x9) {
-          return _ref5.apply(this, arguments);
-        };
-      }());
-      _this5.app.db.on('rolesResources.afterDestroy', /*#__PURE__*/function () {
-        var _ref6 = _asyncToGenerator(function* (model, options) {
-          const role = _this5.acl.getRole(model.get('roleName'));
-          if (role) {
-            role.revokeResource(model.get('name'));
-          }
-        });
-        return function (_x10, _x11) {
-          return _ref6.apply(this, arguments);
-        };
-      }());
-      _this5.app.db.on('collections.afterDestroy', /*#__PURE__*/function () {
-        var _ref7 = _asyncToGenerator(function* (model, options) {
-          const transaction = options.transaction;
-          yield _this5.app.db.getRepository('rolesResources').destroy({
-            filter: {
-              name: model.get('name')
-            },
-            transaction
-          });
-        });
-        return function (_x12, _x13) {
-          return _ref7.apply(this, arguments);
-        };
-      }());
-      _this5.app.db.on('fields.afterCreate', /*#__PURE__*/function () {
-        var _ref8 = _asyncToGenerator(function* (model, options) {
-          const transaction = options.transaction;
-          const collectionName = model.get('collectionName');
-          const fieldName = model.get('name');
-          const resourceActions = yield _this5.app.db.getRepository('rolesResourcesActions').find({
-            filter: {
-              'resource.name': collectionName
-            },
-            transaction,
-            appends: ['resource']
-          });
-          var _iterator3 = _createForOfIteratorHelper(resourceActions),
-            _step3;
-          try {
-            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
-              const resourceAction = _step3.value;
-              const fields = resourceAction.get('fields');
-              const newFields = [...fields, fieldName];
-              yield _this5.app.db.getRepository('rolesResourcesActions').update({
-                filterByTk: resourceAction.get('id'),
-                values: {
-                  fields: newFields
-                },
-                transaction
-              });
-            }
-          } catch (err) {
-            _iterator3.e(err);
-          } finally {
-            _iterator3.f();
-          }
-        });
-        return function (_x14, _x15) {
-          return _ref8.apply(this, arguments);
-        };
-      }());
-      _this5.app.db.on('fields.afterDestroy', /*#__PURE__*/function () {
-        var _ref9 = _asyncToGenerator(function* (model, options) {
-          const collectionName = model.get('collectionName');
-          const fieldName = model.get('name');
-          const resourceActions = yield _this5.app.db.getRepository('rolesResourcesActions').find({
-            filter: {
-              'resource.name': collectionName,
-              'fields.$anyOf': [fieldName]
-            },
-            transaction: options.transaction
-          });
-          var _iterator4 = _createForOfIteratorHelper(resourceActions),
-            _step4;
-          try {
-            for (_iterator4.s(); !(_step4 = _iterator4.n()).done;) {
-              const resourceAction = _step4.value;
-              const fields = resourceAction.get('fields');
-              const newFields = fields.filter(field => field != fieldName);
-              yield _this5.app.db.getRepository('rolesResourcesActions').update({
-                filterByTk: resourceAction.get('id'),
-                values: {
-                  fields: newFields
-                },
-                transaction: options.transaction
-              });
-            }
-          } catch (err) {
-            _iterator4.e(err);
-          } finally {
-            _iterator4.f();
-          }
-        });
-        return function (_x16, _x17) {
-          return _ref9.apply(this, arguments);
-        };
-      }());
-      // sync database role data to acl
-      _this5.app.on('afterLoad', /*#__PURE__*/function () {
-        var _ref10 = _asyncToGenerator(function* (app, options) {
-          if ((options === null || options === void 0 ? void 0 : options.method) === 'install' || (options === null || options === void 0 ? void 0 : options.method) === 'upgrade') {
-            return;
-          }
-          const exists = yield _this5.app.db.collectionExistsInDb('roles');
-          if (exists) {
-            yield _this5.writeRolesToACL();
-          }
-        });
-        return function (_x18, _x19) {
-          return _ref10.apply(this, arguments);
-        };
-      }());
-      _this5.app.on('afterInstall', /*#__PURE__*/function () {
-        var _ref11 = _asyncToGenerator(function* (app, options) {
-          const exists = yield _this5.app.db.collectionExistsInDb('roles');
-          if (exists) {
-            yield _this5.writeRolesToACL();
-          }
-        });
-        return function (_x20, _x21) {
-          return _ref11.apply(this, arguments);
-        };
-      }());
-      _this5.app.on('afterInstallPlugin', /*#__PURE__*/function () {
-        var _ref12 = _asyncToGenerator(function* (plugin) {
-          if (plugin.getName() !== 'users') {
-            return;
-          }
-          const User = _this5.db.getCollection('users');
-          yield User.repository.update({
-            values: {
-              roles: ['root', 'admin', 'member']
-            },
-            forceUpdate: true
-          });
-          const RolesUsers = _this5.db.getCollection('rolesUsers');
-          yield RolesUsers.repository.update({
-            filter: {
-              userId: 1,
-              roleName: 'root'
-            },
-            values: {
-              default: true
-            }
-          });
-        });
-        return function (_x22) {
-          return _ref12.apply(this, arguments);
-        };
-      }());
-      _this5.app.on('beforeInstallPlugin', /*#__PURE__*/function () {
-        var _ref13 = _asyncToGenerator(function* (plugin) {
-          if (plugin.getName() !== 'users') {
-            return;
-          }
-          const roles = _this5.app.db.getRepository('roles');
-          yield roles.createMany({
-            records: [{
-              name: 'root',
-              title: '{{t("Root")}}',
-              hidden: true,
-              snippets: ['ui.*', 'pm', 'pm.*']
-            }, {
-              name: 'admin',
-              title: '{{t("Admin")}}',
-              allowConfigure: true,
-              allowNewMenu: true,
-              strategy: {
-                actions: ['create', 'view', 'update', 'destroy']
-              },
-              snippets: ['ui.*', 'pm', 'pm.*']
-            }, {
-              name: 'member',
-              title: '{{t("Member")}}',
-              allowNewMenu: true,
-              strategy: {
-                actions: ['view', 'update:own', 'destroy:own', 'create']
-              },
-              default: true,
-              snippets: ['!ui.*', '!pm', '!pm.*']
-            }]
-          });
-          const rolesResourcesScopes = _this5.app.db.getRepository('rolesResourcesScopes');
-          yield rolesResourcesScopes.createMany({
-            records: [{
-              key: 'all',
-              name: '{{t("All records")}}',
-              scope: {}
-            }, {
-              key: 'own',
-              name: '{{t("Own records")}}',
-              scope: {
-                createdById: '{{ ctx.state.currentUser.id }}'
-              }
-            }]
-          });
-        });
-        return function (_x23) {
-          return _ref13.apply(this, arguments);
-        };
-      }());
-      _this5.app.resourcer.use(_setCurrentRole.setCurrentRole, {
-        tag: 'setCurrentRole',
-        before: 'acl',
-        after: 'auth'
-      });
-      _this5.app.acl.allow('users', 'setDefaultRole', 'loggedIn');
-      _this5.app.acl.allow('roles', 'check', 'loggedIn');
-      _this5.app.acl.allow('*', '*', ctx => {
-        return ctx.state.currentRole === 'root';
-      });
-      _this5.app.acl.addFixedParams('collections', 'destroy', () => {
-        return {
-          filter: {
-            $and: [{
-              'name.$ne': 'roles'
-            }, {
-              'name.$ne': 'rolesUsers'
-            }]
-          }
-        };
-      });
-      _this5.app.acl.addFixedParams('rolesResourcesScopes', 'destroy', () => {
-        return {
-          filter: {
-            $and: [{
-              'key.$ne': 'all'
-            }, {
-              'key.$ne': 'own'
-            }]
-          }
-        };
-      });
-      _this5.app.acl.addFixedParams('rolesResourcesScopes', 'update', () => {
-        return {
-          filter: {
-            $and: [{
-              'key.$ne': 'all'
-            }, {
-              'key.$ne': 'own'
-            }]
-          }
-        };
-      });
-      _this5.app.acl.addFixedParams('roles', 'destroy', () => {
-        return {
-          filter: {
-            $and: [{
-              'name.$ne': 'root'
-            }, {
-              'name.$ne': 'admin'
-            }, {
-              'name.$ne': 'member'
-            }]
-          }
-        };
-      });
-      _this5.app.resourcer.use( /*#__PURE__*/function () {
-        var _ref14 = _asyncToGenerator(function* (ctx, next) {
-          const _ctx$action = ctx.action,
-            actionName = _ctx$action.actionName,
-            resourceName = _ctx$action.resourceName,
-            params = _ctx$action.params;
-          const _ref15 = params || {},
-            showAnonymous = _ref15.showAnonymous;
-          if (actionName === 'list' && resourceName === 'roles') {
-            if (!showAnonymous) {
-              ctx.action.mergeParams({
-                filter: {
-                  'name.$ne': 'anonymous'
-                }
-              });
-            }
-          }
-          if (actionName === 'update' && resourceName === 'roles.resources') {
-            ctx.action.mergeParams({
-              updateAssociationValues: ['actions']
-            });
-          }
-          yield next();
-        });
-        return function (_x24, _x25) {
-          return _ref14.apply(this, arguments);
-        };
-      }());
-      _this5.app.acl.use( /*#__PURE__*/function () {
-        var _ref16 = _asyncToGenerator(function* (ctx, next) {
-          const _ctx$action2 = ctx.action,
-            actionName = _ctx$action2.actionName,
-            resourceName = _ctx$action2.resourceName;
-          if (actionName === 'get' || actionName === 'list') {
-            var _ctx$permission, _ctx$permission$can, _ctx$permission$can$p;
-            if (!Array.isArray(ctx === null || ctx === void 0 ? void 0 : (_ctx$permission = ctx.permission) === null || _ctx$permission === void 0 ? void 0 : (_ctx$permission$can = _ctx$permission.can) === null || _ctx$permission$can === void 0 ? void 0 : (_ctx$permission$can$p = _ctx$permission$can.params) === null || _ctx$permission$can$p === void 0 ? void 0 : _ctx$permission$can$p.fields)) {
-              return next();
-            }
-            let collection;
-            if (resourceName.includes('.')) {
-              var _ctx$db$getCollection, _ctx$db$getCollection2;
-              const _resourceName$split = resourceName.split('.'),
-                _resourceName$split2 = _slicedToArray(_resourceName$split, 2),
-                collectionName = _resourceName$split2[0],
-                associationName = _resourceName$split2[1];
-              const field = (_ctx$db$getCollection = ctx.db.getCollection(collectionName)) === null || _ctx$db$getCollection === void 0 ? void 0 : (_ctx$db$getCollection2 = _ctx$db$getCollection.getField) === null || _ctx$db$getCollection2 === void 0 ? void 0 : _ctx$db$getCollection2.call(_ctx$db$getCollection, associationName);
-              if (field.target) {
-                collection = ctx.db.getCollection(field.target);
-              }
-            } else {
-              collection = ctx.db.getCollection(resourceName);
-            }
-            if (collection && collection.hasField('createdById')) {
-              ctx.permission.can.params.fields.push('createdById');
-            }
-          }
-          return next();
-        });
-        return function (_x26, _x27) {
-          return _ref16.apply(this, arguments);
-        };
-      }());
-      const parseJsonTemplate = _this5.app.acl.parseJsonTemplate;
-      _this5.app.acl.use( /*#__PURE__*/function () {
-        var _ref17 = _asyncToGenerator(function* (ctx, next) {
-          const _ctx$action3 = ctx.action,
-            actionName = _ctx$action3.actionName,
-            resourceName = _ctx$action3.resourceName,
-            resourceOf = _ctx$action3.resourceOf;
-          // is association request
-          if (resourceName.includes('.') && resourceOf) {
-            var _ctx$permission2, _ctx$permission2$can, _availableAction$opti;
-            if (!(ctx !== null && ctx !== void 0 && (_ctx$permission2 = ctx.permission) !== null && _ctx$permission2 !== void 0 && (_ctx$permission2$can = _ctx$permission2.can) !== null && _ctx$permission2$can !== void 0 && _ctx$permission2$can.params)) {
-              return next();
-            }
-            // 关联数据去掉 filter
-            delete ctx.permission.can.params.filter;
-            // 关联数据能不能处理取决于 source 是否有权限
-            const _resourceName$split3 = resourceName.split('.'),
-              _resourceName$split4 = _slicedToArray(_resourceName$split3, 1),
-              collectionName = _resourceName$split4[0];
-            const action = ctx.can({
-              resource: collectionName,
-              action: actionName
-            });
-            const availableAction = _this5.app.acl.getAvailableAction(actionName);
-            if (availableAction !== null && availableAction !== void 0 && (_availableAction$opti = availableAction.options) !== null && _availableAction$opti !== void 0 && _availableAction$opti.onNewRecord) {
-              if (action) {
-                ctx.permission.skip = true;
-              } else {
-                ctx.permission.can = false;
-              }
-            } else {
-              var _action$params;
-              const filter = yield parseJsonTemplate((action === null || action === void 0 ? void 0 : (_action$params = action.params) === null || _action$params === void 0 ? void 0 : _action$params.filter) || {}, ctx);
-              const sourceInstance = yield ctx.db.getRepository(collectionName).findOne({
-                filterByTk: resourceOf,
-                filter
-              });
-              if (!sourceInstance) {
-                ctx.permission.can = false;
-              }
-            }
-          }
-          yield next();
-        });
-        return function (_x28, _x29) {
-          return _ref17.apply(this, arguments);
-        };
-      }(), {
-        before: 'core'
-      });
-      // throw error when user has no fixed params permissions
-      _this5.app.acl.use( /*#__PURE__*/function () {
-        var _ref18 = _asyncToGenerator(function* (ctx, next) {
-          var _ctx$permission3, _ctx$permission3$can;
-          const action = (_ctx$permission3 = ctx.permission) === null || _ctx$permission3 === void 0 ? void 0 : (_ctx$permission3$can = _ctx$permission3.can) === null || _ctx$permission3$can === void 0 ? void 0 : _ctx$permission3$can.action;
-          if (action == 'destroy' && !ctx.action.resourceName.includes('.')) {
-            const repository = _actions().utils.getRepositoryFromParams(ctx);
-            // params after merge with fixed params
-            const filteredCount = yield repository.count(ctx.permission.mergedParams);
-            // params user requested
-            const queryCount = yield repository.count(ctx.permission.rawParams);
-            if (queryCount > filteredCount) {
-              ctx.throw(403, 'No permissions');
-              return;
-            }
-          }
-          yield next();
-        });
-        return function (_x30, _x31) {
-          return _ref18.apply(this, arguments);
-        };
-      }(), {
-        after: 'core',
-        group: 'after'
-      });
-      const withACLMeta = /*#__PURE__*/function () {
-        var _ref19 = _asyncToGenerator(function* (ctx, next) {
-          var _ctx$body;
-          yield next();
-          if (!ctx.action || !ctx.get('X-With-ACL-Meta') || ctx.status !== 200) {
-            return;
-          }
-          const _ctx$action4 = ctx.action,
-            resourceName = _ctx$action4.resourceName,
-            actionName = _ctx$action4.actionName;
-          if (!['list', 'get'].includes(actionName)) {
-            return;
-          }
-          const collection = ctx.db.getCollection(resourceName);
-          if (!collection) {
-            return;
-          }
-          const Model = collection.model;
-          const primaryKeyField = Model.primaryKeyField || Model.primaryKeyAttribute;
-          const dataPath = (_ctx$body = ctx.body) !== null && _ctx$body !== void 0 && _ctx$body.rows ? 'body.rows' : 'body';
-          let listData = _utils().lodash.get(ctx, dataPath);
-          if (actionName == 'get') {
-            listData = _utils().lodash.castArray(listData);
-          }
-          const inspectActions = ['view', 'update', 'destroy'];
-          const actionsParams = [];
-          for (var _i2 = 0, _inspectActions = inspectActions; _i2 < _inspectActions.length; _i2++) {
-            var _actionCtx$permission, _actionCtx$permission2;
-            const action = _inspectActions[_i2];
-            const actionCtx = {
-              db: ctx.db,
-              action: {
-                actionName: action,
-                name: action,
-                params: {},
-                resourceName: ctx.action.resourceName,
-                resourceOf: ctx.action.resourceOf,
-                mergeParams() {}
-              },
-              state: {
-                currentRole: ctx.state.currentRole,
-                currentUser: (() => {
-                  if (!ctx.state.currentUser) {
-                    return null;
-                  }
-                  if (ctx.state.currentUser.toJSON) {
-                    var _ctx$state$currentUse;
-                    return (_ctx$state$currentUse = ctx.state.currentUser) === null || _ctx$state$currentUse === void 0 ? void 0 : _ctx$state$currentUse.toJSON();
-                  }
-                  return ctx.state.currentUser;
-                })()
-              },
-              permission: {},
-              throw(...args) {
-                throw new (_acl().NoPermissionError)(...args);
-              }
-            };
-            try {
-              yield _this5.app.acl.getActionParams(actionCtx);
-            } catch (e) {
-              if (e instanceof _acl().NoPermissionError) {
-                continue;
-              }
-              throw e;
-            }
-            actionsParams.push([action, ((_actionCtx$permission = actionCtx.permission) === null || _actionCtx$permission === void 0 ? void 0 : _actionCtx$permission.can) === null && !actionCtx.permission.skip ? null : ((_actionCtx$permission2 = actionCtx.permission) === null || _actionCtx$permission2 === void 0 ? void 0 : _actionCtx$permission2.parsedParams) || {}, actionCtx]);
-          }
-          const ids = (() => {
-            if (collection.options.tree) {
-              if (listData.length == 0) return [];
-              const getAllNodeIds = data => [data[primaryKeyField], ...(data.children || []).flatMap(getAllNodeIds)];
-              return listData.map(tree => getAllNodeIds(tree.toJSON())).flat();
-            }
-            return listData.map(item => item[primaryKeyField]);
-          })();
-          const conditions = [];
-          const allAllowed = [];
-          for (var _i3 = 0, _actionsParams = actionsParams; _i3 < _actionsParams.length; _i3++) {
-            const _actionsParams$_i = _slicedToArray(_actionsParams[_i3], 3),
-              action = _actionsParams$_i[0],
-              params = _actionsParams$_i[1],
-              actionCtx = _actionsParams$_i[2];
-            if (!params) {
-              continue;
-            }
-            if (_utils().lodash.isEmpty(params) || _utils().lodash.isEmpty(params.filter)) {
-              allAllowed.push(action);
-              continue;
-            }
-            const queryParams = collection.repository.buildQueryOptions(_objectSpread(_objectSpread({}, params), {}, {
-              context: actionCtx
-            }));
-            const actionSql = ctx.db.sequelize.queryInterface.queryGenerator.selectQuery(Model.getTableName(), {
-              where: (() => {
-                const filterObj = queryParams.where;
-                if (!_this5.db.options.underscored) {
-                  return filterObj;
-                }
-                const isAssociationKey = key => {
-                  return key.startsWith('$') && key.endsWith('$');
-                };
-                // change camelCase to snake_case
-                const iterate = (rootObj, path = []) => {
-                  const obj = path.length == 0 ? rootObj : _utils().lodash.get(rootObj, path);
-                  if (Array.isArray(obj)) {
-                    for (let i = 0; i < obj.length; i++) {
-                      if (obj[i] === null) {
-                        continue;
-                      }
-                      if (typeof obj[i] === 'object') {
-                        iterate(rootObj, [...path, i]);
-                      }
-                    }
-                    return;
-                  }
-                  Reflect.ownKeys(obj).forEach(key => {
-                    if (Array.isArray(obj) && key == 'length') {
-                      return;
-                    }
-                    if (typeof obj[key] === 'object' && obj[key] !== null || typeof obj[key] === 'symbol') {
-                      iterate(rootObj, [...path, key]);
-                    }
-                    if (typeof key === 'string' && key !== (0, _database().snakeCase)(key)) {
-                      const setKey = isAssociationKey(key) ? (() => {
-                        const parts = key.split('.');
-                        parts[parts.length - 1] = _utils().lodash.snakeCase(parts[parts.length - 1]);
-                        const result = parts.join('.');
-                        return result.endsWith('$') ? result : `${result}$`;
-                      })() : (0, _database().snakeCase)(key);
-                      const setValue = _utils().lodash.cloneDeep(obj[key]);
-                      _utils().lodash.unset(rootObj, [...path, key]);
-                      _utils().lodash.set(rootObj, [...path, setKey], setValue);
-                    }
-                  });
-                };
-                iterate(filterObj);
-                return filterObj;
-              })(),
-              attributes: [primaryKeyField],
-              includeIgnoreAttributes: false
-            }, Model);
-            const whereCase = actionSql.match(/WHERE (.*?);/)[1];
-            conditions.push({
-              whereCase,
-              action,
-              include: queryParams.include
-            });
-          }
-          const results = yield collection.model.findAll({
-            where: {
-              [primaryKeyField]: ids
-            },
-            attributes: [primaryKeyField, ...conditions.map(condition => {
-              return [ctx.db.sequelize.literal(`CASE WHEN ${condition.whereCase} THEN 1 ELSE 0 END`), condition.action];
-            })],
-            include: conditions.map(condition => condition.include).flat()
-          });
-          const allowedActions = inspectActions.map(action => {
-            if (allAllowed.includes(action)) {
-              return [action, ids];
-            }
-            return [action, results.filter(item => Boolean(item.get(action))).map(item => item.get(primaryKeyField))];
-          }).reduce((acc, [action, ids]) => {
-            acc[action] = ids;
-            return acc;
-          }, {});
-          if (actionName == 'get') {
-            ctx.bodyMeta = _objectSpread(_objectSpread({}, ctx.bodyMeta || {}), {}, {
-              allowedActions: allowedActions
-            });
-          }
-          if (actionName == 'list') {
-            ctx.body.allowedActions = allowedActions;
-          }
-        });
-        return function withACLMeta(_x32, _x33) {
-          return _ref19.apply(this, arguments);
-        };
-      }();
-      // append allowedActions to list & get response
-      _this5.app.use( /*#__PURE__*/function () {
-        var _ref20 = _asyncToGenerator(function* (ctx, next) {
-          try {
-            yield withACLMeta(ctx, next);
-          } catch (error) {
-            ctx.logger.error(error);
-          }
-        });
-        return function (_x34, _x35) {
-          return _ref20.apply(this, arguments);
-        };
-      }(), {
-        after: 'restApi',
-        group: 'after'
-      });
-    })();
-  }
-  install() {
-    var _this6 = this;
-    return _asyncToGenerator(function* () {
-      const repo = _this6.db.getRepository('collections');
-      if (repo) {
-        yield repo.db2cm('roles');
-      }
-    })();
-  }
-  load() {
-    var _this7 = this;
-    return _asyncToGenerator(function* () {
-      yield _this7.importCollections((0, _path().resolve)(__dirname, 'collections'));
-      _this7.db.extendCollection({
-        name: 'rolesUischemas',
-        namespace: 'acl.acl',
-        duplicator: 'required'
-      });
-    })();
-  }
-}
-exports.PluginACL = PluginACL;
-var _default = PluginACL;
-exports.default = _default;