@nocobase/plugin-acl 0.7.0-alpha.1

package/esm/model/RoleResourceActionModel.js

@@ -0,0 +1,65 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Model } from '@nocobase/database';
+export class RoleResourceActionModel extends Model {
+    writeToACL(options) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            // @ts-ignore
+            const db = this.constructor.database;
+            const { resourceName, role, acl, associationFieldsActions, grantHelper } = options;
+            const actionName = this.get('name');
+            const fields = this.get('fields');
+            const actionPath = `${resourceName}:${actionName}`;
+            const actionParams = {
+                fields,
+            };
+            // @ts-ignore
+            const scope = yield this.getScope();
+            if (scope) {
+                actionParams['own'] = scope.get('key') === 'own';
+                actionParams['filter'] = scope.get('scope');
+            }
+            role.grantAction(actionPath, actionParams);
+            const collection = db.getCollection(resourceName);
+            if (!collection) {
+                return;
+            }
+            const availableAction = acl.resolveActionAlias(actionName);
+            for (const field of fields) {
+                const collectionField = collection.getField(field);
+                const fieldType = collectionField.get('interface');
+                const fieldActions = (_a = associationFieldsActions === null || associationFieldsActions === void 0 ? void 0 : associationFieldsActions[fieldType]) === null || _a === void 0 ? void 0 : _a[availableAction];
+                const fieldTarget = collectionField.get('target');
+                if (fieldActions) {
+                    const associationActions = fieldActions.associationActions || [];
+                    associationActions.forEach((associationAction) => {
+                        const actionName = `${resourceName}.${fieldTarget}:${associationAction}`;
+                        role.grantAction(actionName);
+                    });
+                    const targetActions = fieldActions.targetActions || [];
+                    targetActions.forEach((targetAction) => {
+                        const targetActionPath = `${fieldTarget}:${targetAction}`;
+                        grantHelper.resourceTargetActionMap.set(resourceName, [
+                            ...(grantHelper.resourceTargetActionMap.get(resourceName) || []),
+                            targetActionPath,
+                        ]);
+                        grantHelper.targetActionResourceMap.set(targetActionPath, [
+                            ...(grantHelper.targetActionResourceMap.get(targetActionPath) || []),
+                            resourceName,
+                        ]);
+                        role.grantAction(targetActionPath);
+                    });
+                }
+            }
+        });
+    }
+}
+//# sourceMappingURL=RoleResourceActionModel.js.map

package/esm/model/RoleResourceActionModel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleResourceActionModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceActionModel.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAY,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC1C,UAAU,CAAC,OAMhB;;;YACC,aAAa;YACb,MAAM,EAAE,GAAa,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAE/C,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YAEnF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;YAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAQ,CAAC;YAEzC,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;YACnD,MAAM,YAAY,GAAG;gBACnB,MAAM;aACP,CAAC;YAEF,aAAa;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAEpC,IAAI,KAAK,EAAE;gBACT,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;gBACjD,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aAC7C;YAED,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAElD,IAAI,CAAC,UAAU,EAAE;gBACf,OAAO;aACR;YAED,MAAM,eAAe,GAAG,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAE3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;gBAC1B,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;gBAE7D,MAAM,YAAY,GAA2B,MAAA,wBAAwB,aAAxB,wBAAwB,uBAAxB,wBAAwB,CAAG,SAAS,CAAC,0CAAG,eAAe,CAAC,CAAC;gBAEtG,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAElD,IAAI,YAAY,EAAE;oBAChB,MAAM,kBAAkB,GAAG,YAAY,CAAC,kBAAkB,IAAI,EAAE,CAAC;oBACjE,kBAAkB,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,EAAE;wBAC/C,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;wBACzE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;oBAC/B,CAAC,CAAC,CAAC;oBAEH,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC;oBAEvD,aAAa,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;wBACrC,MAAM,gBAAgB,GAAG,GAAG,WAAW,IAAI,YAAY,EAAE,CAAC;wBAE1D,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE;4BACpD,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;4BAChE,gBAAgB;yBACjB,CAAC,CAAC;wBAEH,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,EAAE;4BACxD,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;4BACpE,YAAY;yBACb,CAAC,CAAC;wBAEH,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;oBACrC,CAAC,CAAC,CAAC;iBACJ;aACF;;KACF;CACF","sourcesContent":["import { ACL, ACLRole } from '@nocobase/acl';\nimport { Database, Model } from '@nocobase/database';\nimport { AssociationFieldAction, AssociationFieldsActions, GrantHelper } from '../server';\n\nexport class RoleResourceActionModel extends Model {\n  async writeToACL(options: {\n    acl: ACL;\n    role: ACLRole;\n    resourceName: string;\n    associationFieldsActions: AssociationFieldsActions;\n    grantHelper: GrantHelper;\n  }) {\n    // @ts-ignore\n    const db: Database = this.constructor.database;\n\n    const { resourceName, role, acl, associationFieldsActions, grantHelper } = options;\n\n    const actionName = this.get('name') as string;\n\n    const fields = this.get('fields') as any;\n\n    const actionPath = `${resourceName}:${actionName}`;\n    const actionParams = {\n      fields,\n    };\n\n    // @ts-ignore\n    const scope = await this.getScope();\n\n    if (scope) {\n      actionParams['own'] = scope.get('key') === 'own';\n      actionParams['filter'] = scope.get('scope');\n    }\n\n    role.grantAction(actionPath, actionParams);\n\n    const collection = db.getCollection(resourceName);\n\n    if (!collection) {\n      return;\n    }\n\n    const availableAction = acl.resolveActionAlias(actionName);\n\n    for (const field of fields) {\n      const collectionField = collection.getField(field);\n      const fieldType = collectionField.get('interface') as string;\n\n      const fieldActions: AssociationFieldAction = associationFieldsActions?.[fieldType]?.[availableAction];\n\n      const fieldTarget = collectionField.get('target');\n\n      if (fieldActions) {\n        const associationActions = fieldActions.associationActions || [];\n        associationActions.forEach((associationAction) => {\n          const actionName = `${resourceName}.${fieldTarget}:${associationAction}`;\n          role.grantAction(actionName);\n        });\n\n        const targetActions = fieldActions.targetActions || [];\n\n        targetActions.forEach((targetAction) => {\n          const targetActionPath = `${fieldTarget}:${targetAction}`;\n\n          grantHelper.resourceTargetActionMap.set(resourceName, [\n            ...(grantHelper.resourceTargetActionMap.get(resourceName) || []),\n            targetActionPath,\n          ]);\n\n          grantHelper.targetActionResourceMap.set(targetActionPath, [\n            ...(grantHelper.targetActionResourceMap.get(targetActionPath) || []),\n            resourceName,\n          ]);\n\n          role.grantAction(targetActionPath);\n        });\n      }\n    }\n  }\n}\n"]}

package/esm/model/RoleResourceModel.d.ts

@@ -0,0 +1,16 @@
+import { Model } from '@nocobase/database';
+import { ACL, ACLRole } from '@nocobase/acl';
+import { AssociationFieldsActions, GrantHelper } from '../server';
+export declare class RoleResourceModel extends Model {
+    revoke(options: {
+        role: ACLRole;
+        resourceName: string;
+        grantHelper: GrantHelper;
+    }): Promise<void>;
+    writeToACL(options: {
+        acl: ACL;
+        associationFieldsActions: AssociationFieldsActions;
+        grantHelper: GrantHelper;
+        transaction: any;
+    }): Promise<void>;
+}

package/esm/model/RoleResourceModel.js

@@ -0,0 +1,55 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Model } from '@nocobase/database';
+export class RoleResourceModel extends Model {
+    revoke(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { role, resourceName, grantHelper } = options;
+            role.revokeResource(resourceName);
+            const targetActions = grantHelper.resourceTargetActionMap.get(resourceName) || [];
+            for (const targetAction of targetActions) {
+                const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter((item) => resourceName !== item);
+                grantHelper.targetActionResourceMap.set(targetAction, targetActionResource);
+                if (targetActionResource.length == 0) {
+                    role.revokeAction(targetAction);
+                }
+            }
+            grantHelper.resourceTargetActionMap.set(resourceName, []);
+        });
+    }
+    writeToACL(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { acl, associationFieldsActions, grantHelper } = options;
+            const resourceName = this.get('name');
+            const roleName = this.get('roleName');
+            const role = acl.getRole(roleName);
+            // revoke resource of role
+            yield this.revoke({ role, resourceName, grantHelper });
+            // @ts-ignore
+            if (this.usingActionsConfig === false) {
+                return;
+            }
+            // @ts-ignore
+            const actions = yield this.getActions({
+                transaction: options.transaction,
+            });
+            for (const action of actions) {
+                yield action.writeToACL({
+                    acl,
+                    role,
+                    resourceName,
+                    associationFieldsActions,
+                    grantHelper: options.grantHelper,
+                });
+            }
+        });
+    }
+}
+//# sourceMappingURL=RoleResourceModel.js.map

package/esm/model/RoleResourceModel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleResourceModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceModel.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAY,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAKrD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACpC,MAAM,CAAC,OAA0E;;YACrF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAElC,MAAM,aAAa,GAAG,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YAElF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE;gBACxC,MAAM,oBAAoB,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/F,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,KAAK,IAAI,CAChC,CAAC;gBAEF,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;gBAC5E,IAAI,oBAAoB,CAAC,MAAM,IAAI,CAAC,EAAE;oBACpC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;iBACjC;aACF;YAED,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;KAAA;IAEK,UAAU,CAAC,OAKhB;;YACC,MAAM,EAAE,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAW,CAAC;YAChD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAEnC,0BAA0B;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAEvD,aAAa;YACb,IAAI,IAAI,CAAC,kBAAkB,KAAK,KAAK,EAAE;gBACrC,OAAO;aACR;YAED,aAAa;YACb,MAAM,OAAO,GAA8B,MAAM,IAAI,CAAC,UAAU,CAAC;gBAC/D,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;YAEH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE;gBAC5B,MAAM,MAAM,CAAC,UAAU,CAAC;oBACtB,GAAG;oBACH,IAAI;oBACJ,YAAY;oBACZ,wBAAwB;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;aACJ;QACH,CAAC;KAAA;CACF","sourcesContent":["import { Database, Model } from '@nocobase/database';\nimport { ACL, ACLRole } from '@nocobase/acl';\nimport { RoleResourceActionModel } from './RoleResourceActionModel';\nimport { AssociationFieldsActions, GrantHelper } from '../server';\n\nexport class RoleResourceModel extends Model {\n  async revoke(options: { role: ACLRole; resourceName: string; grantHelper: GrantHelper }) {\n    const { role, resourceName, grantHelper } = options;\n    role.revokeResource(resourceName);\n\n    const targetActions = grantHelper.resourceTargetActionMap.get(resourceName) || [];\n\n    for (const targetAction of targetActions) {\n      const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter(\n        (item) => resourceName !== item,\n      );\n\n      grantHelper.targetActionResourceMap.set(targetAction, targetActionResource);\n      if (targetActionResource.length == 0) {\n        role.revokeAction(targetAction);\n      }\n    }\n\n    grantHelper.resourceTargetActionMap.set(resourceName, []);\n  }\n\n  async writeToACL(options: {\n    acl: ACL;\n    associationFieldsActions: AssociationFieldsActions;\n    grantHelper: GrantHelper;\n    transaction: any;\n  }) {\n    const { acl, associationFieldsActions, grantHelper } = options;\n    const resourceName = this.get('name') as string;\n    const roleName = this.get('roleName') as string;\n    const role = acl.getRole(roleName);\n\n    // revoke resource of role\n    await this.revoke({ role, resourceName, grantHelper });\n\n    // @ts-ignore\n    if (this.usingActionsConfig === false) {\n      return;\n    }\n\n    // @ts-ignore\n    const actions: RoleResourceActionModel[] = await this.getActions({\n      transaction: options.transaction,\n    });\n\n    for (const action of actions) {\n      await action.writeToACL({\n        acl,\n        role,\n        resourceName,\n        associationFieldsActions,\n        grantHelper: options.grantHelper,\n      });\n    }\n  }\n}\n"]}

package/esm/server.d.ts

@@ -0,0 +1,33 @@
+import { Plugin } from '@nocobase/server';
+import { RoleResourceActionModel } from './model/RoleResourceActionModel';
+import { RoleResourceModel } from './model/RoleResourceModel';
+export interface AssociationFieldAction {
+    associationActions: string[];
+    targetActions?: string[];
+}
+interface AssociationFieldActions {
+    [availableActionName: string]: AssociationFieldAction;
+}
+export interface AssociationFieldsActions {
+    [associationType: string]: AssociationFieldActions;
+}
+export declare class GrantHelper {
+    resourceTargetActionMap: Map<string, string[]>;
+    targetActionResourceMap: Map<string, string[]>;
+    constructor();
+}
+export declare class PluginACL extends Plugin {
+    associationFieldsActions: AssociationFieldsActions;
+    grantHelper: GrantHelper;
+    get acl(): import("@nocobase/acl").ACL;
+    registerAssociationFieldAction(associationType: string, value: AssociationFieldActions): void;
+    registerAssociationFieldsActions(): void;
+    writeResourceToACL(resourceModel: RoleResourceModel, transaction: any): Promise<void>;
+    writeActionToACL(actionModel: RoleResourceActionModel, transaction: any): Promise<void>;
+    writeRolesToACL(): Promise<void>;
+    beforeLoad(): Promise<void>;
+    install(): Promise<void>;
+    load(): Promise<void>;
+    getName(): string;
+}
+export default PluginACL;

package/esm/server.js

@@ -0,0 +1,366 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Plugin } from '@nocobase/server';
+import { resolve } from 'path';
+import { availableActionResource } from './actions/available-actions';
+import { checkAction } from './actions/role-check';
+import { roleCollectionsResource } from './actions/role-collections';
+import { RoleModel } from './model/RoleModel';
+import { RoleResourceActionModel } from './model/RoleResourceActionModel';
+import { RoleResourceModel } from './model/RoleResourceModel';
+export class GrantHelper {
+    constructor() {
+        this.resourceTargetActionMap = new Map();
+        this.targetActionResourceMap = new Map();
+    }
+}
+export class PluginACL extends Plugin {
+    constructor() {
+        super(...arguments);
+        this.associationFieldsActions = {};
+        this.grantHelper = new GrantHelper();
+    }
+    get acl() {
+        return this.app.acl;
+    }
+    registerAssociationFieldAction(associationType, value) {
+        this.associationFieldsActions[associationType] = value;
+    }
+    registerAssociationFieldsActions() {
+        this.registerAssociationFieldAction('linkTo', {
+            view: {
+                associationActions: ['list', 'get'],
+            },
+            create: {
+                associationActions: ['add'],
+                targetActions: ['view'],
+            },
+            update: {
+                associationActions: ['add', 'remove', 'toggle'],
+                targetActions: ['view'],
+            },
+        });
+        this.registerAssociationFieldAction('attachments', {
+            view: {
+                associationActions: ['list', 'get'],
+            },
+            add: {
+                associationActions: ['upload', 'add'],
+            },
+            update: {
+                associationActions: ['update', 'add', 'remove', 'toggle'],
+            },
+        });
+        this.registerAssociationFieldAction('subTable', {
+            view: {
+                associationActions: ['list', 'get'],
+            },
+            create: {
+                associationActions: ['create'],
+            },
+            update: {
+                associationActions: ['update', 'destroy'],
+            },
+        });
+    }
+    writeResourceToACL(resourceModel, transaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield resourceModel.writeToACL({
+                acl: this.acl,
+                associationFieldsActions: this.associationFieldsActions,
+                transaction: transaction,
+                grantHelper: this.grantHelper,
+            });
+        });
+    }
+    writeActionToACL(actionModel, transaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const resource = actionModel.get('resource');
+            const role = this.acl.getRole(resource.get('roleName'));
+            yield actionModel.writeToACL({
+                acl: this.acl,
+                role,
+                resourceName: resource.get('name'),
+                associationFieldsActions: this.associationFieldsActions,
+                grantHelper: this.grantHelper,
+            });
+        });
+    }
+    writeRolesToACL() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const roles = (yield this.app.db.getRepository('roles').find({
+                appends: ['resources', 'resources.actions'],
+            }));
+            for (const role of roles) {
+                role.writeToAcl({ acl: this.acl });
+                for (const resource of role.get('resources')) {
+                    yield this.writeResourceToACL(resource, null);
+                }
+            }
+        });
+    }
+    beforeLoad() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.app.db.registerModels({
+                RoleResourceActionModel,
+                RoleResourceModel,
+                RoleModel,
+            });
+            this.registerAssociationFieldsActions();
+            this.app.resourcer.define(availableActionResource);
+            this.app.resourcer.define(roleCollectionsResource);
+            this.app.resourcer.registerActionHandler('roles:check', checkAction);
+            this.app.db.on('roles.afterSaveWithAssociations', (model, options) => __awaiter(this, void 0, void 0, function* () {
+                const { transaction } = options;
+                model.writeToAcl({
+                    acl: this.acl,
+                });
+                for (const resource of (yield model.getResources({ transaction }))) {
+                    yield this.writeResourceToACL(resource, transaction);
+                }
+                // model is default
+                if (model.get('default')) {
+                    yield this.app.db.getRepository('roles').update({
+                        values: {
+                            default: false,
+                        },
+                        filter: {
+                            'name.$ne': model.get('name'),
+                        },
+                        hooks: false,
+                        transaction,
+                    });
+                }
+            }));
+            this.app.db.on('roles.afterDestroy', (model) => {
+                const roleName = model.get('name');
+                this.acl.removeRole(roleName);
+            });
+            this.app.db.on('rolesResources.afterSaveWithAssociations', (model, options) => __awaiter(this, void 0, void 0, function* () {
+                yield this.writeResourceToACL(model, options.transaction);
+            }));
+            this.app.db.on('rolesResourcesActions.afterUpdateWithAssociations', (model, options) => __awaiter(this, void 0, void 0, function* () {
+                const { transaction } = options;
+                const resource = yield model.getResource({
+                    transaction,
+                });
+                yield this.writeResourceToACL(resource, transaction);
+            }));
+            this.app.db.on('rolesResources.afterDestroy', (model, options) => __awaiter(this, void 0, void 0, function* () {
+                const role = this.acl.getRole(model.get('roleName'));
+                role.revokeResource(model.get('name'));
+            }));
+            this.app.db.on('collections.afterDestroy', (model, options) => __awaiter(this, void 0, void 0, function* () {
+                const { transaction } = options;
+                yield this.app.db.getRepository('rolesResources').destroy({
+                    filter: {
+                        name: model.get('name'),
+                    },
+                    transaction,
+                });
+            }));
+            this.app.db.on('fields.afterCreate', (model, options) => __awaiter(this, void 0, void 0, function* () {
+                const { transaction } = options;
+                const collectionName = model.get('collectionName');
+                const fieldName = model.get('name');
+                const resourceActions = (yield this.app.db.getRepository('rolesResourcesActions').find({
+                    filter: {
+                        'resource.name': collectionName,
+                    },
+                    transaction,
+                    appends: ['resource'],
+                }));
+                for (const resourceAction of resourceActions) {
+                    const fields = resourceAction.get('fields');
+                    const newFields = [...fields, fieldName];
+                    yield this.app.db.getRepository('rolesResourcesActions').update({
+                        filterByTk: resourceAction.get('id'),
+                        values: {
+                            fields: newFields,
+                        },
+                        transaction,
+                    });
+                }
+            }));
+            this.app.db.on('fields.afterDestroy', (model, options) => __awaiter(this, void 0, void 0, function* () {
+                const collectionName = model.get('collectionName');
+                const fieldName = model.get('name');
+                const resourceActions = yield this.app.db.getRepository('rolesResourcesActions').find({
+                    filter: {
+                        'resource.name': collectionName,
+                        'fields.$anyOf': [fieldName],
+                    },
+                    transaction: options.transaction,
+                });
+                for (const resourceAction of resourceActions) {
+                    const fields = resourceAction.get('fields');
+                    const newFields = fields.filter((field) => field != fieldName);
+                    yield this.app.db.getRepository('rolesResourcesActions').update({
+                        filterByTk: resourceAction.get('id'),
+                        values: {
+                            fields: newFields,
+                        },
+                        transaction: options.transaction,
+                    });
+                }
+            }));
+            // sync database role data to acl
+            this.app.on('beforeStart', () => __awaiter(this, void 0, void 0, function* () {
+                yield this.writeRolesToACL();
+            }));
+            this.app.on('beforeInstallPlugin', (plugin) => __awaiter(this, void 0, void 0, function* () {
+                if (plugin.constructor.name !== 'UsersPlugin') {
+                    return;
+                }
+                const roles = this.app.db.getRepository('roles');
+                yield roles.createMany({
+                    records: [
+                        {
+                            name: 'root',
+                            title: '{{t("Root")}}',
+                            hidden: true,
+                        },
+                        {
+                            name: 'admin',
+                            title: '{{t("Admin")}}',
+                            allowConfigure: true,
+                            allowNewMenu: true,
+                            strategy: { actions: ['create', 'export', 'view', 'update', 'destroy'] },
+                        },
+                        {
+                            name: 'member',
+                            title: '{{t("Member")}}',
+                            allowNewMenu: true,
+                            strategy: { actions: ['view', 'update:own', 'destroy:own', 'create'] },
+                            default: true,
+                        },
+                    ],
+                });
+                const rolesResourcesScopes = this.app.db.getRepository('rolesResourcesScopes');
+                yield rolesResourcesScopes.createMany({
+                    records: [
+                        {
+                            key: 'all',
+                            name: '{{t("All records")}}',
+                            scope: {},
+                        },
+                        {
+                            key: 'own',
+                            name: '{{t("Own records")}}',
+                            scope: {
+                                createdById: '{{ ctx.state.currentUser.id }}',
+                            },
+                        },
+                    ],
+                });
+            }));
+            this.app.acl.allow('roles', 'check', 'loggedIn');
+            this.app.acl.allow('roles', ['create', 'update', 'destroy'], 'allowConfigure');
+            this.app.acl.allow('roles.menuUiSchemas', ['set', 'toggle', 'list'], 'allowConfigure');
+            this.app.acl.allow('*', '*', (ctx) => {
+                return ctx.state.currentRole === 'root';
+            });
+            this.app.resourcer.use((ctx, next) => __awaiter(this, void 0, void 0, function* () {
+                const { actionName, resourceName, params } = ctx.action;
+                const { showAnonymous } = params || {};
+                if (actionName === 'list' && resourceName === 'roles') {
+                    if (!showAnonymous) {
+                        ctx.action.mergeParams({
+                            filter: {
+                                'name.$ne': 'anonymous',
+                            },
+                        });
+                    }
+                }
+                yield next();
+            }));
+            this.app.acl.use((ctx, next) => __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c, _d, _e;
+                const { actionName, resourceName } = ctx.action;
+                if (actionName === 'get' || actionName === 'list') {
+                    if (!Array.isArray((_c = (_b = (_a = ctx === null || ctx === void 0 ? void 0 : ctx.permission) === null || _a === void 0 ? void 0 : _a.can) === null || _b === void 0 ? void 0 : _b.params) === null || _c === void 0 ? void 0 : _c.fields)) {
+                        return next();
+                    }
+                    let collection;
+                    if (resourceName.includes('.')) {
+                        const [collectionName, associationName] = resourceName.split('.');
+                        const field = (_e = (_d = ctx.db.getCollection(collectionName)) === null || _d === void 0 ? void 0 : _d.getField) === null || _e === void 0 ? void 0 : _e.call(_d, associationName);
+                        if (field.target) {
+                            collection = ctx.db.getCollection(field.target);
+                        }
+                    }
+                    else {
+                        collection = ctx.db.getCollection(resourceName);
+                    }
+                    if (collection && collection.hasField('createdById')) {
+                        ctx.permission.can.params.fields.push('createdById');
+                    }
+                }
+                return next();
+            }));
+            const parseJsonTemplate = this.app.acl.parseJsonTemplate;
+            this.app.acl.use((ctx, next) => __awaiter(this, void 0, void 0, function* () {
+                var _f, _g, _h, _j;
+                const { actionName, resourceName, resourceOf } = ctx.action;
+                if (resourceName.includes('.') && resourceOf) {
+                    if (!((_g = (_f = ctx === null || ctx === void 0 ? void 0 : ctx.permission) === null || _f === void 0 ? void 0 : _f.can) === null || _g === void 0 ? void 0 : _g.params)) {
+                        return next();
+                    }
+                    // 关联数据去掉 filter
+                    delete ctx.permission.can.params.filter;
+                    // 关联数据能不能处理取决于 source 是否有权限
+                    const [collectionName] = resourceName.split('.');
+                    const action = ctx.can({ resource: collectionName, action: actionName });
+                    const availableAction = this.app.acl.getAvailableAction(actionName);
+                    if ((_h = availableAction === null || availableAction === void 0 ? void 0 : availableAction.options) === null || _h === void 0 ? void 0 : _h.onNewRecord) {
+                        if (action) {
+                            ctx.permission.skip = true;
+                        }
+                        else {
+                            ctx.permission.can = false;
+                        }
+                    }
+                    else {
+                        const filter = parseJsonTemplate(((_j = action === null || action === void 0 ? void 0 : action.params) === null || _j === void 0 ? void 0 : _j.filter) || {}, ctx);
+                        const sourceInstance = yield ctx.db.getRepository(collectionName).findOne({
+                            filterByTk: resourceOf,
+                            filter,
+                        });
+                        if (!sourceInstance) {
+                            ctx.permission.can = false;
+                        }
+                    }
+                }
+                yield next();
+            }));
+        });
+    }
+    install() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const repo = this.db.getRepository('collections');
+            if (repo) {
+                yield repo.db2cm('roles');
+            }
+        });
+    }
+    load() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.app.db.import({
+                directory: resolve(__dirname, 'collections'),
+            });
+            this.app.resourcer.use(this.acl.middleware());
+        });
+    }
+    getName() {
+        return this.getPackageName(__dirname);
+    }
+}
+export default PluginACL;
+//# sourceMappingURL=server.js.map

package/esm/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";;;;;;;;;AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAe9D,MAAM,OAAO,WAAW;IAItB;QAHA,4BAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;QACtD,4BAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEvC,CAAC;CACjB;AAED,MAAM,OAAO,SAAU,SAAQ,MAAM;IAArC;;QACE,6BAAwB,GAA6B,EAAE,CAAC;QAExD,gBAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IAyWlC,CAAC;IAvWC,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,8BAA8B,CAAC,eAAuB,EAAE,KAA8B;QACpF,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;IAED,gCAAgC;QAC9B,IAAI,CAAC,8BAA8B,CAAC,QAAQ,EAAE;YAC5C,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,KAAK,CAAC;gBAC3B,aAAa,EAAE,CAAC,MAAM,CAAC;aACxB;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;gBAC/C,aAAa,EAAE,CAAC,MAAM,CAAC;aACxB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,CAAC,aAAa,EAAE;YACjD,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,GAAG,EAAE;gBACH,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;aACtC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;aAC1D;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,CAAC,UAAU,EAAE;YAC9C,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,CAAC;aAC/B;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;IAEK,kBAAkB,CAAC,aAAgC,EAAE,WAAW;;YACpE,MAAM,aAAa,CAAC,UAAU,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,WAAW;gBACxB,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,gBAAgB,CAAC,WAAoC,EAAE,WAAW;;YACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAW,CAAC,CAAC;YAClE,MAAM,WAAW,CAAC,UAAU,CAAC;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI;gBACJ,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAW;gBAC5C,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,eAAe;;YACnB,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;gBAC3D,OAAO,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;aAC5C,CAAC,CAAgB,CAAC;YACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;gBACxB,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAwB,EAAE;oBACnE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;iBAC/C;aACF;QACH,CAAC;KAAA;IAEK,UAAU;;YACd,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC;gBACzB,uBAAuB;gBACvB,iBAAiB;gBACjB,SAAS;aACV,CAAC,CAAC;YAEH,IAAI,CAAC,gCAAgC,EAAE,CAAC;YAExC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAEnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAErE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,iCAAiC,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBACzE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhC,KAAK,CAAC,UAAU,CAAC;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;gBAEH,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAwB,EAAE;oBACzF,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;iBACtD;gBAED,mBAAmB;gBACnB,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;oBACxB,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBAC9C,MAAM,EAAE;4BACN,OAAO,EAAE,KAAK;yBACf;wBACD,MAAM,EAAE;4BACN,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;yBAC9B;wBACD,KAAK,EAAE,KAAK;wBACZ,WAAW;qBACZ,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,0CAA0C,EAAE,CAAO,KAAwB,EAAE,OAAO,EAAE,EAAE;gBACrG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC5D,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,mDAAmD,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC3F,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAChC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;oBACvC,WAAW;iBACZ,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACvD,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,6BAA6B,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBACrE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,0BAA0B,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAClE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAChC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC;oBACxD,MAAM,EAAE;wBACN,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;qBACxB;oBACD,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC5D,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhC,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,eAAe,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC;oBACrF,MAAM,EAAE;wBACN,eAAe,EAAE,cAAc;qBAChC;oBACD,WAAW;oBACX,OAAO,EAAE,CAAC,UAAU,CAAC;iBACtB,CAAC,CAA8B,CAAC;gBAEjC,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;oBACxD,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,CAAC;oBAEzC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;wBAC9D,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAW;wBAC9C,MAAM,EAAE;4BACN,MAAM,EAAE,SAAS;yBAClB;wBACD,WAAW;qBACZ,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC;oBACpF,MAAM,EAAE;wBACN,eAAe,EAAE,cAAc;wBAC/B,eAAe,EAAE,CAAC,SAAS,CAAC;qBAC7B;oBACD,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;gBAEH,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;oBACxD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;oBAE/D,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;wBAC9D,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAW;wBAC9C,MAAM,EAAE;4BACN,MAAM,EAAE,SAAS;yBAClB;wBACD,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,iCAAiC;YACjC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,GAAS,EAAE;gBACpC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAO,MAAM,EAAE,EAAE;gBAClD,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE;oBAC7C,OAAO;iBACR;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM,KAAK,CAAC,UAAU,CAAC;oBACrB,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,KAAK,EAAE,eAAe;4BACtB,MAAM,EAAE,IAAI;yBACb;wBACD;4BACE,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,gBAAgB;4BACvB,cAAc,EAAE,IAAI;4BACpB,YAAY,EAAE,IAAI;4BAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;yBACzE;wBACD;4BACE,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,iBAAiB;4BACxB,YAAY,EAAE,IAAI;4BAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE;4BACtE,OAAO,EAAE,IAAI;yBACd;qBACF;iBACF,CAAC,CAAC;gBACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;gBAC/E,MAAM,oBAAoB,CAAC,UAAU,CAAC;oBACpC,OAAO,EAAE;wBACP;4BACE,GAAG,EAAE,KAAK;4BACV,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE,EAAE;yBACV;wBACD;4BACE,GAAG,EAAE,KAAK;4BACV,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE;gCACL,WAAW,EAAE,gCAAgC;6BAC9C;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAE/E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAEvF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;gBACnC,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAO,GAAG,EAAE,IAAI,EAAE,EAAE;gBACzC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBACxD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;gBACvC,IAAI,UAAU,KAAK,MAAM,IAAI,YAAY,KAAK,OAAO,EAAE;oBACrD,IAAI,CAAC,aAAa,EAAE;wBAClB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;4BACrB,MAAM,EAAE;gCACN,UAAU,EAAE,WAAW;6BACxB;yBACF,CAAC,CAAC;qBACJ;iBACF;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAO,GAAY,EAAE,IAAI,EAAE,EAAE;;gBAC5C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAChD,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE;oBACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,0CAAE,GAAG,0CAAE,MAAM,0CAAE,MAAM,CAAC,EAAE;wBACxD,OAAO,IAAI,EAAE,CAAC;qBACf;oBACD,IAAI,UAAsB,CAAC;oBAC3B,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;wBAC9B,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBAClE,MAAM,KAAK,GAAG,MAAA,MAAA,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,0CAAE,QAAQ,mDAAG,eAAe,CAAC,CAAC;wBAChF,IAAI,KAAK,CAAC,MAAM,EAAE;4BAChB,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;yBACjD;qBACF;yBAAM;wBACL,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;qBACjD;oBACD,IAAI,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;wBACpD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;qBACtD;iBACF;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAO,GAAY,EAAE,IAAI,EAAE,EAAE;;gBAC5C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE;oBAC5C,IAAI,CAAC,CAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,0CAAE,GAAG,0CAAE,MAAM,CAAA,EAAE;wBACjC,OAAO,IAAI,EAAE,CAAC;qBACf;oBACD,gBAAgB;oBAChB,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;oBACxC,4BAA4B;oBAC5B,MAAM,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBACzE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;oBACpE,IAAI,MAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,0CAAE,WAAW,EAAE;wBACzC,IAAI,MAAM,EAAE;4BACV,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;yBAC5B;6BAAM;4BACL,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;yBAC5B;qBACF;yBAAM;wBACL,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,0CAAE,MAAM,KAAI,EAAE,EAAE,GAAG,CAAC,CAAC;wBACpE,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC;4BACxE,UAAU,EAAE,UAAU;4BACtB,MAAM;yBACP,CAAC,CAAC;wBACH,IAAI,CAAC,cAAc,EAAE;4BACnB,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;yBAC5B;qBACF;iBACF;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAA,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,OAAO;;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAM,aAAa,CAAC,CAAC;YACvD,IAAI,IAAI,EAAE;gBACR,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC3B;QACH,CAAC;KAAA;IAEK,IAAI;;YACR,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;gBACvB,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAChD,CAAC;KAAA;IAED,OAAO;QACL,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACF;AAED,eAAe,SAAS,CAAC","sourcesContent":["import { Context } from '@nocobase/actions';\nimport { Collection } from '@nocobase/database';\nimport { Plugin } from '@nocobase/server';\nimport { resolve } from 'path';\nimport { availableActionResource } from './actions/available-actions';\nimport { checkAction } from './actions/role-check';\nimport { roleCollectionsResource } from './actions/role-collections';\nimport { RoleModel } from './model/RoleModel';\nimport { RoleResourceActionModel } from './model/RoleResourceActionModel';\nimport { RoleResourceModel } from './model/RoleResourceModel';\n\nexport interface AssociationFieldAction {\n  associationActions: string[];\n  targetActions?: string[];\n}\n\ninterface AssociationFieldActions {\n  [availableActionName: string]: AssociationFieldAction;\n}\n\nexport interface AssociationFieldsActions {\n  [associationType: string]: AssociationFieldActions;\n}\n\nexport class GrantHelper {\n  resourceTargetActionMap = new Map<string, string[]>();\n  targetActionResourceMap = new Map<string, string[]>();\n\n  constructor() {}\n}\n\nexport class PluginACL extends Plugin {\n  associationFieldsActions: AssociationFieldsActions = {};\n\n  grantHelper = new GrantHelper();\n\n  get acl() {\n    return this.app.acl;\n  }\n\n  registerAssociationFieldAction(associationType: string, value: AssociationFieldActions) {\n    this.associationFieldsActions[associationType] = value;\n  }\n\n  registerAssociationFieldsActions() {\n    this.registerAssociationFieldAction('linkTo', {\n      view: {\n        associationActions: ['list', 'get'],\n      },\n      create: {\n        associationActions: ['add'],\n        targetActions: ['view'],\n      },\n      update: {\n        associationActions: ['add', 'remove', 'toggle'],\n        targetActions: ['view'],\n      },\n    });\n\n    this.registerAssociationFieldAction('attachments', {\n      view: {\n        associationActions: ['list', 'get'],\n      },\n      add: {\n        associationActions: ['upload', 'add'],\n      },\n      update: {\n        associationActions: ['update', 'add', 'remove', 'toggle'],\n      },\n    });\n\n    this.registerAssociationFieldAction('subTable', {\n      view: {\n        associationActions: ['list', 'get'],\n      },\n      create: {\n        associationActions: ['create'],\n      },\n      update: {\n        associationActions: ['update', 'destroy'],\n      },\n    });\n  }\n\n  async writeResourceToACL(resourceModel: RoleResourceModel, transaction) {\n    await resourceModel.writeToACL({\n      acl: this.acl,\n      associationFieldsActions: this.associationFieldsActions,\n      transaction: transaction,\n      grantHelper: this.grantHelper,\n    });\n  }\n\n  async writeActionToACL(actionModel: RoleResourceActionModel, transaction) {\n    const resource = actionModel.get('resource') as RoleResourceModel;\n    const role = this.acl.getRole(resource.get('roleName') as string);\n    await actionModel.writeToACL({\n      acl: this.acl,\n      role,\n      resourceName: resource.get('name') as string,\n      associationFieldsActions: this.associationFieldsActions,\n      grantHelper: this.grantHelper,\n    });\n  }\n\n  async writeRolesToACL() {\n    const roles = (await this.app.db.getRepository('roles').find({\n      appends: ['resources', 'resources.actions'],\n    })) as RoleModel[];\n    for (const role of roles) {\n      role.writeToAcl({ acl: this.acl });\n      for (const resource of role.get('resources') as RoleResourceModel[]) {\n        await this.writeResourceToACL(resource, null);\n      }\n    }\n  }\n\n  async beforeLoad() {\n    this.app.db.registerModels({\n      RoleResourceActionModel,\n      RoleResourceModel,\n      RoleModel,\n    });\n\n    this.registerAssociationFieldsActions();\n\n    this.app.resourcer.define(availableActionResource);\n    this.app.resourcer.define(roleCollectionsResource);\n\n    this.app.resourcer.registerActionHandler('roles:check', checkAction);\n\n    this.app.db.on('roles.afterSaveWithAssociations', async (model, options) => {\n      const { transaction } = options;\n\n      model.writeToAcl({\n        acl: this.acl,\n      });\n\n      for (const resource of (await model.getResources({ transaction })) as RoleResourceModel[]) {\n        await this.writeResourceToACL(resource, transaction);\n      }\n\n      // model is default\n      if (model.get('default')) {\n        await this.app.db.getRepository('roles').update({\n          values: {\n            default: false,\n          },\n          filter: {\n            'name.$ne': model.get('name'),\n          },\n          hooks: false,\n          transaction,\n        });\n      }\n    });\n\n    this.app.db.on('roles.afterDestroy', (model) => {\n      const roleName = model.get('name');\n      this.acl.removeRole(roleName);\n    });\n\n    this.app.db.on('rolesResources.afterSaveWithAssociations', async (model: RoleResourceModel, options) => {\n      await this.writeResourceToACL(model, options.transaction);\n    });\n\n    this.app.db.on('rolesResourcesActions.afterUpdateWithAssociations', async (model, options) => {\n      const { transaction } = options;\n      const resource = await model.getResource({\n        transaction,\n      });\n\n      await this.writeResourceToACL(resource, transaction);\n    });\n\n    this.app.db.on('rolesResources.afterDestroy', async (model, options) => {\n      const role = this.acl.getRole(model.get('roleName'));\n      role.revokeResource(model.get('name'));\n    });\n\n    this.app.db.on('collections.afterDestroy', async (model, options) => {\n      const { transaction } = options;\n      await this.app.db.getRepository('rolesResources').destroy({\n        filter: {\n          name: model.get('name'),\n        },\n        transaction,\n      });\n    });\n\n    this.app.db.on('fields.afterCreate', async (model, options) => {\n      const { transaction } = options;\n\n      const collectionName = model.get('collectionName');\n      const fieldName = model.get('name');\n\n      const resourceActions = (await this.app.db.getRepository('rolesResourcesActions').find({\n        filter: {\n          'resource.name': collectionName,\n        },\n        transaction,\n        appends: ['resource'],\n      })) as RoleResourceActionModel[];\n\n      for (const resourceAction of resourceActions) {\n        const fields = resourceAction.get('fields') as string[];\n        const newFields = [...fields, fieldName];\n\n        await this.app.db.getRepository('rolesResourcesActions').update({\n          filterByTk: resourceAction.get('id') as number,\n          values: {\n            fields: newFields,\n          },\n          transaction,\n        });\n      }\n    });\n\n    this.app.db.on('fields.afterDestroy', async (model, options) => {\n      const collectionName = model.get('collectionName');\n      const fieldName = model.get('name');\n\n      const resourceActions = await this.app.db.getRepository('rolesResourcesActions').find({\n        filter: {\n          'resource.name': collectionName,\n          'fields.$anyOf': [fieldName],\n        },\n        transaction: options.transaction,\n      });\n\n      for (const resourceAction of resourceActions) {\n        const fields = resourceAction.get('fields') as string[];\n        const newFields = fields.filter((field) => field != fieldName);\n\n        await this.app.db.getRepository('rolesResourcesActions').update({\n          filterByTk: resourceAction.get('id') as number,\n          values: {\n            fields: newFields,\n          },\n          transaction: options.transaction,\n        });\n      }\n    });\n\n    // sync database role data to acl\n    this.app.on('beforeStart', async () => {\n      await this.writeRolesToACL();\n    });\n\n    this.app.on('beforeInstallPlugin', async (plugin) => {\n      if (plugin.constructor.name !== 'UsersPlugin') {\n        return;\n      }\n      const roles = this.app.db.getRepository('roles');\n      await roles.createMany({\n        records: [\n          {\n            name: 'root',\n            title: '{{t(\"Root\")}}',\n            hidden: true,\n          },\n          {\n            name: 'admin',\n            title: '{{t(\"Admin\")}}',\n            allowConfigure: true,\n            allowNewMenu: true,\n            strategy: { actions: ['create', 'export', 'view', 'update', 'destroy'] },\n          },\n          {\n            name: 'member',\n            title: '{{t(\"Member\")}}',\n            allowNewMenu: true,\n            strategy: { actions: ['view', 'update:own', 'destroy:own', 'create'] },\n            default: true,\n          },\n        ],\n      });\n      const rolesResourcesScopes = this.app.db.getRepository('rolesResourcesScopes');\n      await rolesResourcesScopes.createMany({\n        records: [\n          {\n            key: 'all',\n            name: '{{t(\"All records\")}}',\n            scope: {},\n          },\n          {\n            key: 'own',\n            name: '{{t(\"Own records\")}}',\n            scope: {\n              createdById: '{{ ctx.state.currentUser.id }}',\n            },\n          },\n        ],\n      });\n    });\n\n    this.app.acl.allow('roles', 'check', 'loggedIn');\n    this.app.acl.allow('roles', ['create', 'update', 'destroy'], 'allowConfigure');\n\n    this.app.acl.allow('roles.menuUiSchemas', ['set', 'toggle', 'list'], 'allowConfigure');\n\n    this.app.acl.allow('*', '*', (ctx) => {\n      return ctx.state.currentRole === 'root';\n    });\n\n    this.app.resourcer.use(async (ctx, next) => {\n      const { actionName, resourceName, params } = ctx.action;\n      const { showAnonymous } = params || {};\n      if (actionName === 'list' && resourceName === 'roles') {\n        if (!showAnonymous) {\n          ctx.action.mergeParams({\n            filter: {\n              'name.$ne': 'anonymous',\n            },\n          });\n        }\n      }\n      await next();\n    });\n\n    this.app.acl.use(async (ctx: Context, next) => {\n      const { actionName, resourceName } = ctx.action;\n      if (actionName === 'get' || actionName === 'list') {\n        if (!Array.isArray(ctx?.permission?.can?.params?.fields)) {\n          return next();\n        }\n        let collection: Collection;\n        if (resourceName.includes('.')) {\n          const [collectionName, associationName] = resourceName.split('.');\n          const field = ctx.db.getCollection(collectionName)?.getField?.(associationName);\n          if (field.target) {\n            collection = ctx.db.getCollection(field.target);\n          }\n        } else {\n          collection = ctx.db.getCollection(resourceName);\n        }\n        if (collection && collection.hasField('createdById')) {\n          ctx.permission.can.params.fields.push('createdById');\n        }\n      }\n      return next();\n    });\n\n    const parseJsonTemplate = this.app.acl.parseJsonTemplate;\n    this.app.acl.use(async (ctx: Context, next) => {\n      const { actionName, resourceName, resourceOf } = ctx.action;\n      if (resourceName.includes('.') && resourceOf) {\n        if (!ctx?.permission?.can?.params) {\n          return next();\n        }\n        // 关联数据去掉 filter\n        delete ctx.permission.can.params.filter;\n        // 关联数据能不能处理取决于 source 是否有权限\n        const [collectionName] = resourceName.split('.');\n        const action = ctx.can({ resource: collectionName, action: actionName });\n        const availableAction = this.app.acl.getAvailableAction(actionName);\n        if (availableAction?.options?.onNewRecord) {\n          if (action) {\n            ctx.permission.skip = true;\n          } else {\n            ctx.permission.can = false;\n          }\n        } else {\n          const filter = parseJsonTemplate(action?.params?.filter || {}, ctx);\n          const sourceInstance = await ctx.db.getRepository(collectionName).findOne({\n            filterByTk: resourceOf,\n            filter,\n          });\n          if (!sourceInstance) {\n            ctx.permission.can = false;\n          }\n        }\n      }\n      await next();\n    });\n  }\n\n  async install() {\n    const repo = this.db.getRepository<any>('collections');\n    if (repo) {\n      await repo.db2cm('roles');\n    }\n  }\n\n  async load() {\n    await this.app.db.import({\n      directory: resolve(__dirname, 'collections'),\n    });\n\n    this.app.resourcer.use(this.acl.middleware());\n  }\n\n  getName(): string {\n    return this.getPackageName(__dirname);\n  }\n}\n\nexport default PluginACL;\n"]}

package/lib/actions/available-actions.d.ts

@@ -0,0 +1,7 @@
+declare const availableActionResource: {
+    name: string;
+    actions: {
+        list(ctx: any, next: any): Promise<void>;
+    };
+};
+export { availableActionResource };