@nocobase/plugin-acl 0.7.0-alpha.30 → 0.7.0-alpha.31
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/esm/model/RoleResourceActionModel.js +4 -2
- package/esm/model/RoleResourceActionModel.js.map +1 -1
- package/esm/model/RoleResourceModel.js +3 -3
- package/esm/model/RoleResourceModel.js.map +1 -1
- package/esm/server.js +3 -0
- package/esm/server.js.map +1 -1
- package/lib/model/RoleResourceActionModel.js +4 -2
- package/lib/model/RoleResourceActionModel.js.map +1 -1
- package/lib/model/RoleResourceModel.js +3 -3
- package/lib/model/RoleResourceModel.js.map +1 -1
- package/lib/server.js +3 -0
- package/lib/server.js.map +1 -1
- package/package.json +5 -5
|
@@ -39,6 +39,7 @@ export class RoleResourceActionModel extends Model {
|
|
|
39
39
|
const fieldActions = (_a = associationFieldsActions === null || associationFieldsActions === void 0 ? void 0 : associationFieldsActions[fieldType]) === null || _a === void 0 ? void 0 : _a[availableAction];
|
|
40
40
|
const fieldTarget = collectionField.get('target');
|
|
41
41
|
if (fieldActions) {
|
|
42
|
+
// grant association actions to role
|
|
42
43
|
const associationActions = fieldActions.associationActions || [];
|
|
43
44
|
associationActions.forEach((associationAction) => {
|
|
44
45
|
const actionName = `${resourceName}.${fieldTarget}:${associationAction}`;
|
|
@@ -47,13 +48,14 @@ export class RoleResourceActionModel extends Model {
|
|
|
47
48
|
const targetActions = fieldActions.targetActions || [];
|
|
48
49
|
targetActions.forEach((targetAction) => {
|
|
49
50
|
const targetActionPath = `${fieldTarget}:${targetAction}`;
|
|
50
|
-
|
|
51
|
+
// set resource target action with current resourceName
|
|
52
|
+
grantHelper.resourceTargetActionMap.set(`${role.name}.${resourceName}`, [
|
|
51
53
|
...(grantHelper.resourceTargetActionMap.get(resourceName) || []),
|
|
52
54
|
targetActionPath,
|
|
53
55
|
]);
|
|
54
56
|
grantHelper.targetActionResourceMap.set(targetActionPath, [
|
|
55
57
|
...(grantHelper.targetActionResourceMap.get(targetActionPath) || []),
|
|
56
|
-
resourceName
|
|
58
|
+
`${role.name}.${resourceName}`,
|
|
57
59
|
]);
|
|
58
60
|
role.grantAction(targetActionPath);
|
|
59
61
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RoleResourceActionModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceActionModel.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAY,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC1C,UAAU,CAAC,OAMhB;;;YACC,aAAa;YACb,MAAM,EAAE,GAAa,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAE/C,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YAEnF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;YAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAQ,CAAC;YAEzC,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;YACnD,MAAM,YAAY,GAAG;gBACnB,MAAM;aACP,CAAC;YAEF,aAAa;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAEpC,IAAI,KAAK,EAAE;gBACT,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;gBACjD,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aAC7C;YAED,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAElD,IAAI,CAAC,UAAU,EAAE;gBACf,OAAO;aACR;YAED,MAAM,eAAe,GAAG,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAE3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;gBAC1B,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;gBAE7D,MAAM,YAAY,GAA2B,MAAA,wBAAwB,aAAxB,wBAAwB,uBAAxB,wBAAwB,CAAG,SAAS,CAAC,0CAAG,eAAe,CAAC,CAAC;gBAEtG,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAElD,IAAI,YAAY,EAAE;oBAChB,MAAM,kBAAkB,GAAG,YAAY,CAAC,kBAAkB,IAAI,EAAE,CAAC;oBACjE,kBAAkB,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,EAAE;wBAC/C,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;wBACzE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;oBAC/B,CAAC,CAAC,CAAC;oBAEH,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC;oBAEvD,aAAa,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;wBACrC,MAAM,gBAAgB,GAAG,GAAG,WAAW,IAAI,YAAY,EAAE,CAAC;wBAE1D,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE;
|
|
1
|
+
{"version":3,"file":"RoleResourceActionModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceActionModel.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAY,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC1C,UAAU,CAAC,OAMhB;;;YACC,aAAa;YACb,MAAM,EAAE,GAAa,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAE/C,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YAEnF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;YAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAQ,CAAC;YAEzC,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;YACnD,MAAM,YAAY,GAAG;gBACnB,MAAM;aACP,CAAC;YAEF,aAAa;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAEpC,IAAI,KAAK,EAAE;gBACT,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;gBACjD,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aAC7C;YAED,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAElD,IAAI,CAAC,UAAU,EAAE;gBACf,OAAO;aACR;YAED,MAAM,eAAe,GAAG,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAE3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;gBAC1B,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;gBAE7D,MAAM,YAAY,GAA2B,MAAA,wBAAwB,aAAxB,wBAAwB,uBAAxB,wBAAwB,CAAG,SAAS,CAAC,0CAAG,eAAe,CAAC,CAAC;gBAEtG,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAElD,IAAI,YAAY,EAAE;oBAChB,oCAAoC;oBACpC,MAAM,kBAAkB,GAAG,YAAY,CAAC,kBAAkB,IAAI,EAAE,CAAC;oBACjE,kBAAkB,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,EAAE;wBAC/C,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;wBACzE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;oBAC/B,CAAC,CAAC,CAAC;oBAEH,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC;oBAEvD,aAAa,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;wBACrC,MAAM,gBAAgB,GAAG,GAAG,WAAW,IAAI,YAAY,EAAE,CAAC;wBAE1D,uDAAuD;wBACvD,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,EAAE;4BACtE,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;4BAChE,gBAAgB;yBACjB,CAAC,CAAC;wBAEH,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,EAAE;4BACxD,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;4BACpE,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE;yBAC/B,CAAC,CAAC;wBAEH,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;oBACrC,CAAC,CAAC,CAAC;iBACJ;aACF;;KACF;CACF","sourcesContent":["import { ACL, ACLRole } from '@nocobase/acl';\nimport { Database, Model } from '@nocobase/database';\nimport { AssociationFieldAction, AssociationFieldsActions, GrantHelper } from '../server';\n\nexport class RoleResourceActionModel extends Model {\n async writeToACL(options: {\n acl: ACL;\n role: ACLRole;\n resourceName: string;\n associationFieldsActions: AssociationFieldsActions;\n grantHelper: GrantHelper;\n }) {\n // @ts-ignore\n const db: Database = this.constructor.database;\n\n const { resourceName, role, acl, associationFieldsActions, grantHelper } = options;\n\n const actionName = this.get('name') as string;\n\n const fields = this.get('fields') as any;\n\n const actionPath = `${resourceName}:${actionName}`;\n const actionParams = {\n fields,\n };\n\n // @ts-ignore\n const scope = await this.getScope();\n\n if (scope) {\n actionParams['own'] = scope.get('key') === 'own';\n actionParams['filter'] = scope.get('scope');\n }\n\n role.grantAction(actionPath, actionParams);\n\n const collection = db.getCollection(resourceName);\n\n if (!collection) {\n return;\n }\n\n const availableAction = acl.resolveActionAlias(actionName);\n\n for (const field of fields) {\n const collectionField = collection.getField(field);\n const fieldType = collectionField.get('interface') as string;\n\n const fieldActions: AssociationFieldAction = associationFieldsActions?.[fieldType]?.[availableAction];\n\n const fieldTarget = collectionField.get('target');\n\n if (fieldActions) {\n // grant association actions to role\n const associationActions = fieldActions.associationActions || [];\n associationActions.forEach((associationAction) => {\n const actionName = `${resourceName}.${fieldTarget}:${associationAction}`;\n role.grantAction(actionName);\n });\n\n const targetActions = fieldActions.targetActions || [];\n\n targetActions.forEach((targetAction) => {\n const targetActionPath = `${fieldTarget}:${targetAction}`;\n\n // set resource target action with current resourceName\n grantHelper.resourceTargetActionMap.set(`${role.name}.${resourceName}`, [\n ...(grantHelper.resourceTargetActionMap.get(resourceName) || []),\n targetActionPath,\n ]);\n\n grantHelper.targetActionResourceMap.set(targetActionPath, [\n ...(grantHelper.targetActionResourceMap.get(targetActionPath) || []),\n `${role.name}.${resourceName}`,\n ]);\n\n role.grantAction(targetActionPath);\n });\n }\n }\n }\n}\n"]}
|
|
@@ -14,15 +14,15 @@ export class RoleResourceModel extends Model {
|
|
|
14
14
|
return __awaiter(this, void 0, void 0, function* () {
|
|
15
15
|
const { role, resourceName, grantHelper } = options;
|
|
16
16
|
role.revokeResource(resourceName);
|
|
17
|
-
const targetActions = grantHelper.resourceTargetActionMap.get(resourceName) || [];
|
|
17
|
+
const targetActions = grantHelper.resourceTargetActionMap.get(`${role.name}.${resourceName}`) || [];
|
|
18
18
|
for (const targetAction of targetActions) {
|
|
19
|
-
const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter((item) => resourceName !== item);
|
|
19
|
+
const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter((item) => `${role.name}.${resourceName}` !== item);
|
|
20
20
|
grantHelper.targetActionResourceMap.set(targetAction, targetActionResource);
|
|
21
21
|
if (targetActionResource.length == 0) {
|
|
22
22
|
role.revokeAction(targetAction);
|
|
23
23
|
}
|
|
24
24
|
}
|
|
25
|
-
grantHelper.resourceTargetActionMap.set(resourceName
|
|
25
|
+
grantHelper.resourceTargetActionMap.set(`${role.name}.${resourceName}`, []);
|
|
26
26
|
});
|
|
27
27
|
}
|
|
28
28
|
writeToACL(options) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RoleResourceModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceModel.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAY,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAO,WAAW,EAAW,MAAM,eAAe,CAAC;AAI1D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACpC,MAAM,CAAC,OAA0E;;YACrF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAElC,MAAM,aAAa,GAAG,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"RoleResourceModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceModel.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAY,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAO,WAAW,EAAW,MAAM,eAAe,CAAC;AAI1D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACpC,MAAM,CAAC,OAA0E;;YACrF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAElC,MAAM,aAAa,GAAG,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC;YAEpG,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE;gBACxC,MAAM,oBAAoB,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/F,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,KAAK,IAAI,CAClD,CAAC;gBAEF,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;gBAE5E,IAAI,oBAAoB,CAAC,MAAM,IAAI,CAAC,EAAE;oBACpC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;iBACjC;aACF;YAED,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;KAAA;IAEK,UAAU,CAAC,OAKhB;;YACC,MAAM,EAAE,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAW,CAAC;YAChD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAEnC,0BAA0B;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAEvD,aAAa;YACb,IAAI,IAAI,CAAC,kBAAkB,KAAK,KAAK,EAAE;gBACrC,OAAO;aACR;YAED,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC;gBAC/B,IAAI;gBACJ,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAE3C,aAAa;YACb,MAAM,OAAO,GAA8B,MAAM,IAAI,CAAC,UAAU,CAAC;gBAC/D,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;YAEH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE;gBAC5B,MAAM,MAAM,CAAC,UAAU,CAAC;oBACtB,GAAG;oBACH,IAAI;oBACJ,YAAY;oBACZ,wBAAwB;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;aACJ;QACH,CAAC;KAAA;CACF","sourcesContent":["import { Database, Model } from '@nocobase/database';\nimport { ACL, ACLResource, ACLRole } from '@nocobase/acl';\nimport { RoleResourceActionModel } from './RoleResourceActionModel';\nimport { AssociationFieldsActions, GrantHelper } from '../server';\n\nexport class RoleResourceModel extends Model {\n async revoke(options: { role: ACLRole; resourceName: string; grantHelper: GrantHelper }) {\n const { role, resourceName, grantHelper } = options;\n role.revokeResource(resourceName);\n\n const targetActions = grantHelper.resourceTargetActionMap.get(`${role.name}.${resourceName}`) || [];\n\n for (const targetAction of targetActions) {\n const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter(\n (item) => `${role.name}.${resourceName}` !== item,\n );\n\n grantHelper.targetActionResourceMap.set(targetAction, targetActionResource);\n\n if (targetActionResource.length == 0) {\n role.revokeAction(targetAction);\n }\n }\n\n grantHelper.resourceTargetActionMap.set(`${role.name}.${resourceName}`, []);\n }\n\n async writeToACL(options: {\n acl: ACL;\n associationFieldsActions: AssociationFieldsActions;\n grantHelper: GrantHelper;\n transaction: any;\n }) {\n const { acl, associationFieldsActions, grantHelper } = options;\n const resourceName = this.get('name') as string;\n const roleName = this.get('roleName') as string;\n const role = acl.getRole(roleName);\n\n // revoke resource of role\n await this.revoke({ role, resourceName, grantHelper });\n\n // @ts-ignore\n if (this.usingActionsConfig === false) {\n return;\n }\n\n const resource = new ACLResource({\n role,\n name: resourceName,\n });\n\n role.resources.set(resourceName, resource);\n\n // @ts-ignore\n const actions: RoleResourceActionModel[] = await this.getActions({\n transaction: options.transaction,\n });\n\n for (const action of actions) {\n await action.writeToACL({\n acl,\n role,\n resourceName,\n associationFieldsActions,\n grantHelper: options.grantHelper,\n });\n }\n }\n}\n"]}
|
package/esm/server.js
CHANGED
|
@@ -23,6 +23,7 @@ export class GrantHelper {
|
|
|
23
23
|
}
|
|
24
24
|
export class PluginACL extends Plugin {
|
|
25
25
|
constructor() {
|
|
26
|
+
// association field actions config
|
|
26
27
|
super(...arguments);
|
|
27
28
|
this.associationFieldsActions = {};
|
|
28
29
|
this.grantHelper = new GrantHelper();
|
|
@@ -34,6 +35,8 @@ export class PluginACL extends Plugin {
|
|
|
34
35
|
this.associationFieldsActions[associationType] = value;
|
|
35
36
|
}
|
|
36
37
|
registerAssociationFieldsActions() {
|
|
38
|
+
// if grant create action to role, it should
|
|
39
|
+
// also grant add action and association target's view action
|
|
37
40
|
this.registerAssociationFieldAction('linkTo', {
|
|
38
41
|
view: {
|
|
39
42
|
associationActions: ['list', 'get'],
|
package/esm/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";;;;;;;;;AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAe9D,MAAM,OAAO,WAAW;IAItB;QAHA,4BAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;QACtD,4BAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEvC,CAAC;CACjB;AAED,MAAM,OAAO,SAAU,SAAQ,MAAM;IAArC;;QACE,6BAAwB,GAA6B,EAAE,CAAC;QAExD,gBAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IAyWlC,CAAC;IAvWC,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,8BAA8B,CAAC,eAAuB,EAAE,KAA8B;QACpF,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;IAED,gCAAgC;QAC9B,IAAI,CAAC,8BAA8B,CAAC,QAAQ,EAAE;YAC5C,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,KAAK,CAAC;gBAC3B,aAAa,EAAE,CAAC,MAAM,CAAC;aACxB;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;gBAC/C,aAAa,EAAE,CAAC,MAAM,CAAC;aACxB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,CAAC,aAAa,EAAE;YACjD,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,GAAG,EAAE;gBACH,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;aACtC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;aAC1D;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,CAAC,UAAU,EAAE;YAC9C,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,CAAC;aAC/B;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;IAEK,kBAAkB,CAAC,aAAgC,EAAE,WAAW;;YACpE,MAAM,aAAa,CAAC,UAAU,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,WAAW;gBACxB,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,gBAAgB,CAAC,WAAoC,EAAE,WAAW;;YACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAW,CAAC,CAAC;YAClE,MAAM,WAAW,CAAC,UAAU,CAAC;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI;gBACJ,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAW;gBAC5C,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,eAAe;;YACnB,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;gBAC3D,OAAO,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;aAC5C,CAAC,CAAgB,CAAC;YACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;gBACxB,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAwB,EAAE;oBACnE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;iBAC/C;aACF;QACH,CAAC;KAAA;IAEK,UAAU;;YACd,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC;gBACzB,uBAAuB;gBACvB,iBAAiB;gBACjB,SAAS;aACV,CAAC,CAAC;YAEH,IAAI,CAAC,gCAAgC,EAAE,CAAC;YAExC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAEnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAErE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,iCAAiC,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBACzE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhC,KAAK,CAAC,UAAU,CAAC;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;gBAEH,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAwB,EAAE;oBACzF,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;iBACtD;gBAED,mBAAmB;gBACnB,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;oBACxB,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBAC9C,MAAM,EAAE;4BACN,OAAO,EAAE,KAAK;yBACf;wBACD,MAAM,EAAE;4BACN,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;yBAC9B;wBACD,KAAK,EAAE,KAAK;wBACZ,WAAW;qBACZ,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,0CAA0C,EAAE,CAAO,KAAwB,EAAE,OAAO,EAAE,EAAE;gBACrG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC5D,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,mDAAmD,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC3F,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAChC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;oBACvC,WAAW;iBACZ,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACvD,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,6BAA6B,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBACrE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,0BAA0B,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAClE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAChC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC;oBACxD,MAAM,EAAE;wBACN,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;qBACxB;oBACD,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC5D,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhC,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,eAAe,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC;oBACrF,MAAM,EAAE;wBACN,eAAe,EAAE,cAAc;qBAChC;oBACD,WAAW;oBACX,OAAO,EAAE,CAAC,UAAU,CAAC;iBACtB,CAAC,CAA8B,CAAC;gBAEjC,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;oBACxD,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,CAAC;oBAEzC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;wBAC9D,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAW;wBAC9C,MAAM,EAAE;4BACN,MAAM,EAAE,SAAS;yBAClB;wBACD,WAAW;qBACZ,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC;oBACpF,MAAM,EAAE;wBACN,eAAe,EAAE,cAAc;wBAC/B,eAAe,EAAE,CAAC,SAAS,CAAC;qBAC7B;oBACD,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;gBAEH,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;oBACxD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;oBAE/D,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;wBAC9D,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAW;wBAC9C,MAAM,EAAE;4BACN,MAAM,EAAE,SAAS;yBAClB;wBACD,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,iCAAiC;YACjC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,GAAS,EAAE;gBACpC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAO,MAAM,EAAE,EAAE;gBAClD,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE;oBAC7C,OAAO;iBACR;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM,KAAK,CAAC,UAAU,CAAC;oBACrB,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,KAAK,EAAE,eAAe;4BACtB,MAAM,EAAE,IAAI;yBACb;wBACD;4BACE,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,gBAAgB;4BACvB,cAAc,EAAE,IAAI;4BACpB,YAAY,EAAE,IAAI;4BAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;yBACzE;wBACD;4BACE,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,iBAAiB;4BACxB,YAAY,EAAE,IAAI;4BAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE;4BACtE,OAAO,EAAE,IAAI;yBACd;qBACF;iBACF,CAAC,CAAC;gBACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;gBAC/E,MAAM,oBAAoB,CAAC,UAAU,CAAC;oBACpC,OAAO,EAAE;wBACP;4BACE,GAAG,EAAE,KAAK;4BACV,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE,EAAE;yBACV;wBACD;4BACE,GAAG,EAAE,KAAK;4BACV,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE;gCACL,WAAW,EAAE,gCAAgC;6BAC9C;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAE/E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAEvF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;gBACnC,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAO,GAAG,EAAE,IAAI,EAAE,EAAE;gBACzC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBACxD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;gBACvC,IAAI,UAAU,KAAK,MAAM,IAAI,YAAY,KAAK,OAAO,EAAE;oBACrD,IAAI,CAAC,aAAa,EAAE;wBAClB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;4BACrB,MAAM,EAAE;gCACN,UAAU,EAAE,WAAW;6BACxB;yBACF,CAAC,CAAC;qBACJ;iBACF;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAO,GAAY,EAAE,IAAI,EAAE,EAAE;;gBAC5C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAChD,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE;oBACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,0CAAE,GAAG,0CAAE,MAAM,0CAAE,MAAM,CAAC,EAAE;wBACxD,OAAO,IAAI,EAAE,CAAC;qBACf;oBACD,IAAI,UAAsB,CAAC;oBAC3B,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;wBAC9B,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBAClE,MAAM,KAAK,GAAG,MAAA,MAAA,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,0CAAE,QAAQ,mDAAG,eAAe,CAAC,CAAC;wBAChF,IAAI,KAAK,CAAC,MAAM,EAAE;4BAChB,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;yBACjD;qBACF;yBAAM;wBACL,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;qBACjD;oBACD,IAAI,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;wBACpD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;qBACtD;iBACF;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAO,GAAY,EAAE,IAAI,EAAE,EAAE;;gBAC5C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE;oBAC5C,IAAI,CAAC,CAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,0CAAE,GAAG,0CAAE,MAAM,CAAA,EAAE;wBACjC,OAAO,IAAI,EAAE,CAAC;qBACf;oBACD,gBAAgB;oBAChB,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;oBACxC,4BAA4B;oBAC5B,MAAM,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBACzE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;oBACpE,IAAI,MAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,0CAAE,WAAW,EAAE;wBACzC,IAAI,MAAM,EAAE;4BACV,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;yBAC5B;6BAAM;4BACL,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;yBAC5B;qBACF;yBAAM;wBACL,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,0CAAE,MAAM,KAAI,EAAE,EAAE,GAAG,CAAC,CAAC;wBACpE,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC;4BACxE,UAAU,EAAE,UAAU;4BACtB,MAAM;yBACP,CAAC,CAAC;wBACH,IAAI,CAAC,cAAc,EAAE;4BACnB,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;yBAC5B;qBACF;iBACF;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAA,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,OAAO;;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAM,aAAa,CAAC,CAAC;YACvD,IAAI,IAAI,EAAE;gBACR,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC3B;QACH,CAAC;KAAA;IAEK,IAAI;;YACR,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;gBACvB,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAChD,CAAC;KAAA;IAED,OAAO;QACL,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACF;AAED,eAAe,SAAS,CAAC","sourcesContent":["import { Context } from '@nocobase/actions';\nimport { Collection } from '@nocobase/database';\nimport { Plugin } from '@nocobase/server';\nimport { resolve } from 'path';\nimport { availableActionResource } from './actions/available-actions';\nimport { checkAction } from './actions/role-check';\nimport { roleCollectionsResource } from './actions/role-collections';\nimport { RoleModel } from './model/RoleModel';\nimport { RoleResourceActionModel } from './model/RoleResourceActionModel';\nimport { RoleResourceModel } from './model/RoleResourceModel';\n\nexport interface AssociationFieldAction {\n associationActions: string[];\n targetActions?: string[];\n}\n\ninterface AssociationFieldActions {\n [availableActionName: string]: AssociationFieldAction;\n}\n\nexport interface AssociationFieldsActions {\n [associationType: string]: AssociationFieldActions;\n}\n\nexport class GrantHelper {\n resourceTargetActionMap = new Map<string, string[]>();\n targetActionResourceMap = new Map<string, string[]>();\n\n constructor() {}\n}\n\nexport class PluginACL extends Plugin {\n associationFieldsActions: AssociationFieldsActions = {};\n\n grantHelper = new GrantHelper();\n\n get acl() {\n return this.app.acl;\n }\n\n registerAssociationFieldAction(associationType: string, value: AssociationFieldActions) {\n this.associationFieldsActions[associationType] = value;\n }\n\n registerAssociationFieldsActions() {\n this.registerAssociationFieldAction('linkTo', {\n view: {\n associationActions: ['list', 'get'],\n },\n create: {\n associationActions: ['add'],\n targetActions: ['view'],\n },\n update: {\n associationActions: ['add', 'remove', 'toggle'],\n targetActions: ['view'],\n },\n });\n\n this.registerAssociationFieldAction('attachments', {\n view: {\n associationActions: ['list', 'get'],\n },\n add: {\n associationActions: ['upload', 'add'],\n },\n update: {\n associationActions: ['update', 'add', 'remove', 'toggle'],\n },\n });\n\n this.registerAssociationFieldAction('subTable', {\n view: {\n associationActions: ['list', 'get'],\n },\n create: {\n associationActions: ['create'],\n },\n update: {\n associationActions: ['update', 'destroy'],\n },\n });\n }\n\n async writeResourceToACL(resourceModel: RoleResourceModel, transaction) {\n await resourceModel.writeToACL({\n acl: this.acl,\n associationFieldsActions: this.associationFieldsActions,\n transaction: transaction,\n grantHelper: this.grantHelper,\n });\n }\n\n async writeActionToACL(actionModel: RoleResourceActionModel, transaction) {\n const resource = actionModel.get('resource') as RoleResourceModel;\n const role = this.acl.getRole(resource.get('roleName') as string);\n await actionModel.writeToACL({\n acl: this.acl,\n role,\n resourceName: resource.get('name') as string,\n associationFieldsActions: this.associationFieldsActions,\n grantHelper: this.grantHelper,\n });\n }\n\n async writeRolesToACL() {\n const roles = (await this.app.db.getRepository('roles').find({\n appends: ['resources', 'resources.actions'],\n })) as RoleModel[];\n for (const role of roles) {\n role.writeToAcl({ acl: this.acl });\n for (const resource of role.get('resources') as RoleResourceModel[]) {\n await this.writeResourceToACL(resource, null);\n }\n }\n }\n\n async beforeLoad() {\n this.app.db.registerModels({\n RoleResourceActionModel,\n RoleResourceModel,\n RoleModel,\n });\n\n this.registerAssociationFieldsActions();\n\n this.app.resourcer.define(availableActionResource);\n this.app.resourcer.define(roleCollectionsResource);\n\n this.app.resourcer.registerActionHandler('roles:check', checkAction);\n\n this.app.db.on('roles.afterSaveWithAssociations', async (model, options) => {\n const { transaction } = options;\n\n model.writeToAcl({\n acl: this.acl,\n });\n\n for (const resource of (await model.getResources({ transaction })) as RoleResourceModel[]) {\n await this.writeResourceToACL(resource, transaction);\n }\n\n // model is default\n if (model.get('default')) {\n await this.app.db.getRepository('roles').update({\n values: {\n default: false,\n },\n filter: {\n 'name.$ne': model.get('name'),\n },\n hooks: false,\n transaction,\n });\n }\n });\n\n this.app.db.on('roles.afterDestroy', (model) => {\n const roleName = model.get('name');\n this.acl.removeRole(roleName);\n });\n\n this.app.db.on('rolesResources.afterSaveWithAssociations', async (model: RoleResourceModel, options) => {\n await this.writeResourceToACL(model, options.transaction);\n });\n\n this.app.db.on('rolesResourcesActions.afterUpdateWithAssociations', async (model, options) => {\n const { transaction } = options;\n const resource = await model.getResource({\n transaction,\n });\n\n await this.writeResourceToACL(resource, transaction);\n });\n\n this.app.db.on('rolesResources.afterDestroy', async (model, options) => {\n const role = this.acl.getRole(model.get('roleName'));\n role.revokeResource(model.get('name'));\n });\n\n this.app.db.on('collections.afterDestroy', async (model, options) => {\n const { transaction } = options;\n await this.app.db.getRepository('rolesResources').destroy({\n filter: {\n name: model.get('name'),\n },\n transaction,\n });\n });\n\n this.app.db.on('fields.afterCreate', async (model, options) => {\n const { transaction } = options;\n\n const collectionName = model.get('collectionName');\n const fieldName = model.get('name');\n\n const resourceActions = (await this.app.db.getRepository('rolesResourcesActions').find({\n filter: {\n 'resource.name': collectionName,\n },\n transaction,\n appends: ['resource'],\n })) as RoleResourceActionModel[];\n\n for (const resourceAction of resourceActions) {\n const fields = resourceAction.get('fields') as string[];\n const newFields = [...fields, fieldName];\n\n await this.app.db.getRepository('rolesResourcesActions').update({\n filterByTk: resourceAction.get('id') as number,\n values: {\n fields: newFields,\n },\n transaction,\n });\n }\n });\n\n this.app.db.on('fields.afterDestroy', async (model, options) => {\n const collectionName = model.get('collectionName');\n const fieldName = model.get('name');\n\n const resourceActions = await this.app.db.getRepository('rolesResourcesActions').find({\n filter: {\n 'resource.name': collectionName,\n 'fields.$anyOf': [fieldName],\n },\n transaction: options.transaction,\n });\n\n for (const resourceAction of resourceActions) {\n const fields = resourceAction.get('fields') as string[];\n const newFields = fields.filter((field) => field != fieldName);\n\n await this.app.db.getRepository('rolesResourcesActions').update({\n filterByTk: resourceAction.get('id') as number,\n values: {\n fields: newFields,\n },\n transaction: options.transaction,\n });\n }\n });\n\n // sync database role data to acl\n this.app.on('beforeStart', async () => {\n await this.writeRolesToACL();\n });\n\n this.app.on('beforeInstallPlugin', async (plugin) => {\n if (plugin.constructor.name !== 'UsersPlugin') {\n return;\n }\n const roles = this.app.db.getRepository('roles');\n await roles.createMany({\n records: [\n {\n name: 'root',\n title: '{{t(\"Root\")}}',\n hidden: true,\n },\n {\n name: 'admin',\n title: '{{t(\"Admin\")}}',\n allowConfigure: true,\n allowNewMenu: true,\n strategy: { actions: ['create', 'export', 'view', 'update', 'destroy'] },\n },\n {\n name: 'member',\n title: '{{t(\"Member\")}}',\n allowNewMenu: true,\n strategy: { actions: ['view', 'update:own', 'destroy:own', 'create'] },\n default: true,\n },\n ],\n });\n const rolesResourcesScopes = this.app.db.getRepository('rolesResourcesScopes');\n await rolesResourcesScopes.createMany({\n records: [\n {\n key: 'all',\n name: '{{t(\"All records\")}}',\n scope: {},\n },\n {\n key: 'own',\n name: '{{t(\"Own records\")}}',\n scope: {\n createdById: '{{ ctx.state.currentUser.id }}',\n },\n },\n ],\n });\n });\n\n this.app.acl.allow('roles', 'check', 'loggedIn');\n this.app.acl.allow('roles', ['create', 'update', 'destroy'], 'allowConfigure');\n\n this.app.acl.allow('roles.menuUiSchemas', ['set', 'toggle', 'list'], 'allowConfigure');\n\n this.app.acl.allow('*', '*', (ctx) => {\n return ctx.state.currentRole === 'root';\n });\n\n this.app.resourcer.use(async (ctx, next) => {\n const { actionName, resourceName, params } = ctx.action;\n const { showAnonymous } = params || {};\n if (actionName === 'list' && resourceName === 'roles') {\n if (!showAnonymous) {\n ctx.action.mergeParams({\n filter: {\n 'name.$ne': 'anonymous',\n },\n });\n }\n }\n await next();\n });\n\n this.app.acl.use(async (ctx: Context, next) => {\n const { actionName, resourceName } = ctx.action;\n if (actionName === 'get' || actionName === 'list') {\n if (!Array.isArray(ctx?.permission?.can?.params?.fields)) {\n return next();\n }\n let collection: Collection;\n if (resourceName.includes('.')) {\n const [collectionName, associationName] = resourceName.split('.');\n const field = ctx.db.getCollection(collectionName)?.getField?.(associationName);\n if (field.target) {\n collection = ctx.db.getCollection(field.target);\n }\n } else {\n collection = ctx.db.getCollection(resourceName);\n }\n if (collection && collection.hasField('createdById')) {\n ctx.permission.can.params.fields.push('createdById');\n }\n }\n return next();\n });\n\n const parseJsonTemplate = this.app.acl.parseJsonTemplate;\n this.app.acl.use(async (ctx: Context, next) => {\n const { actionName, resourceName, resourceOf } = ctx.action;\n if (resourceName.includes('.') && resourceOf) {\n if (!ctx?.permission?.can?.params) {\n return next();\n }\n // 关联数据去掉 filter\n delete ctx.permission.can.params.filter;\n // 关联数据能不能处理取决于 source 是否有权限\n const [collectionName] = resourceName.split('.');\n const action = ctx.can({ resource: collectionName, action: actionName });\n const availableAction = this.app.acl.getAvailableAction(actionName);\n if (availableAction?.options?.onNewRecord) {\n if (action) {\n ctx.permission.skip = true;\n } else {\n ctx.permission.can = false;\n }\n } else {\n const filter = parseJsonTemplate(action?.params?.filter || {}, ctx);\n const sourceInstance = await ctx.db.getRepository(collectionName).findOne({\n filterByTk: resourceOf,\n filter,\n });\n if (!sourceInstance) {\n ctx.permission.can = false;\n }\n }\n }\n await next();\n });\n }\n\n async install() {\n const repo = this.db.getRepository<any>('collections');\n if (repo) {\n await repo.db2cm('roles');\n }\n }\n\n async load() {\n await this.app.db.import({\n directory: resolve(__dirname, 'collections'),\n });\n\n this.app.resourcer.use(this.acl.middleware());\n }\n\n getName(): string {\n return this.getPackageName(__dirname);\n }\n}\n\nexport default PluginACL;\n"]}
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";;;;;;;;;AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAe9D,MAAM,OAAO,WAAW;IAItB;QAHA,4BAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;QACtD,4BAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEvC,CAAC;CACjB;AAED,MAAM,OAAO,SAAU,SAAQ,MAAM;IAArC;QACE,mCAAmC;;QAEnC,6BAAwB,GAA6B,EAAE,CAAC;QAExD,gBAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IA4WlC,CAAC;IA1WC,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,8BAA8B,CAAC,eAAuB,EAAE,KAA8B;QACpF,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;IAED,gCAAgC;QAC9B,4CAA4C;QAC5C,6DAA6D;QAC7D,IAAI,CAAC,8BAA8B,CAAC,QAAQ,EAAE;YAC5C,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,KAAK,CAAC;gBAC3B,aAAa,EAAE,CAAC,MAAM,CAAC;aACxB;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;gBAC/C,aAAa,EAAE,CAAC,MAAM,CAAC;aACxB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,CAAC,aAAa,EAAE;YACjD,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,GAAG,EAAE;gBACH,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;aACtC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;aAC1D;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,CAAC,UAAU,EAAE;YAC9C,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,CAAC;aAC/B;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;IAEK,kBAAkB,CAAC,aAAgC,EAAE,WAAW;;YACpE,MAAM,aAAa,CAAC,UAAU,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,WAAW;gBACxB,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,gBAAgB,CAAC,WAAoC,EAAE,WAAW;;YACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAW,CAAC,CAAC;YAClE,MAAM,WAAW,CAAC,UAAU,CAAC;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI;gBACJ,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAW;gBAC5C,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,eAAe;;YACnB,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;gBAC3D,OAAO,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;aAC5C,CAAC,CAAgB,CAAC;YAEnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;gBACxB,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAwB,EAAE;oBACnE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;iBAC/C;aACF;QACH,CAAC;KAAA;IAEK,UAAU;;YACd,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC;gBACzB,uBAAuB;gBACvB,iBAAiB;gBACjB,SAAS;aACV,CAAC,CAAC;YAEH,IAAI,CAAC,gCAAgC,EAAE,CAAC;YAExC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAEnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAErE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,iCAAiC,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBACzE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhC,KAAK,CAAC,UAAU,CAAC;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;gBAEH,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAwB,EAAE;oBACzF,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;iBACtD;gBAED,mBAAmB;gBACnB,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;oBACxB,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBAC9C,MAAM,EAAE;4BACN,OAAO,EAAE,KAAK;yBACf;wBACD,MAAM,EAAE;4BACN,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;yBAC9B;wBACD,KAAK,EAAE,KAAK;wBACZ,WAAW;qBACZ,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,0CAA0C,EAAE,CAAO,KAAwB,EAAE,OAAO,EAAE,EAAE;gBACrG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC5D,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,mDAAmD,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC3F,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAChC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;oBACvC,WAAW;iBACZ,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACvD,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,6BAA6B,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBACrE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,0BAA0B,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAClE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAChC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC;oBACxD,MAAM,EAAE;wBACN,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;qBACxB;oBACD,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC5D,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhC,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,eAAe,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC;oBACrF,MAAM,EAAE;wBACN,eAAe,EAAE,cAAc;qBAChC;oBACD,WAAW;oBACX,OAAO,EAAE,CAAC,UAAU,CAAC;iBACtB,CAAC,CAA8B,CAAC;gBAEjC,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;oBACxD,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,CAAC;oBAEzC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;wBAC9D,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAW;wBAC9C,MAAM,EAAE;4BACN,MAAM,EAAE,SAAS;yBAClB;wBACD,WAAW;qBACZ,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC;oBACpF,MAAM,EAAE;wBACN,eAAe,EAAE,cAAc;wBAC/B,eAAe,EAAE,CAAC,SAAS,CAAC;qBAC7B;oBACD,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;gBAEH,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;oBACxD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;oBAE/D,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;wBAC9D,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAW;wBAC9C,MAAM,EAAE;4BACN,MAAM,EAAE,SAAS;yBAClB;wBACD,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,iCAAiC;YACjC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,GAAS,EAAE;gBACpC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAO,MAAM,EAAE,EAAE;gBAClD,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE;oBAC7C,OAAO;iBACR;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM,KAAK,CAAC,UAAU,CAAC;oBACrB,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,KAAK,EAAE,eAAe;4BACtB,MAAM,EAAE,IAAI;yBACb;wBACD;4BACE,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,gBAAgB;4BACvB,cAAc,EAAE,IAAI;4BACpB,YAAY,EAAE,IAAI;4BAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;yBACzE;wBACD;4BACE,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,iBAAiB;4BACxB,YAAY,EAAE,IAAI;4BAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE;4BACtE,OAAO,EAAE,IAAI;yBACd;qBACF;iBACF,CAAC,CAAC;gBACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;gBAC/E,MAAM,oBAAoB,CAAC,UAAU,CAAC;oBACpC,OAAO,EAAE;wBACP;4BACE,GAAG,EAAE,KAAK;4BACV,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE,EAAE;yBACV;wBACD;4BACE,GAAG,EAAE,KAAK;4BACV,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE;gCACL,WAAW,EAAE,gCAAgC;6BAC9C;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAE/E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAEvF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;gBACnC,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAO,GAAG,EAAE,IAAI,EAAE,EAAE;gBACzC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBACxD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;gBACvC,IAAI,UAAU,KAAK,MAAM,IAAI,YAAY,KAAK,OAAO,EAAE;oBACrD,IAAI,CAAC,aAAa,EAAE;wBAClB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;4BACrB,MAAM,EAAE;gCACN,UAAU,EAAE,WAAW;6BACxB;yBACF,CAAC,CAAC;qBACJ;iBACF;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAO,GAAY,EAAE,IAAI,EAAE,EAAE;;gBAC5C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAChD,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE;oBACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,0CAAE,GAAG,0CAAE,MAAM,0CAAE,MAAM,CAAC,EAAE;wBACxD,OAAO,IAAI,EAAE,CAAC;qBACf;oBACD,IAAI,UAAsB,CAAC;oBAC3B,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;wBAC9B,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBAClE,MAAM,KAAK,GAAG,MAAA,MAAA,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,0CAAE,QAAQ,mDAAG,eAAe,CAAC,CAAC;wBAChF,IAAI,KAAK,CAAC,MAAM,EAAE;4BAChB,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;yBACjD;qBACF;yBAAM;wBACL,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;qBACjD;oBACD,IAAI,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;wBACpD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;qBACtD;iBACF;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAO,GAAY,EAAE,IAAI,EAAE,EAAE;;gBAC5C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE;oBAC5C,IAAI,CAAC,CAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,0CAAE,GAAG,0CAAE,MAAM,CAAA,EAAE;wBACjC,OAAO,IAAI,EAAE,CAAC;qBACf;oBACD,gBAAgB;oBAChB,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;oBACxC,4BAA4B;oBAC5B,MAAM,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBACzE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;oBACpE,IAAI,MAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,0CAAE,WAAW,EAAE;wBACzC,IAAI,MAAM,EAAE;4BACV,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;yBAC5B;6BAAM;4BACL,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;yBAC5B;qBACF;yBAAM;wBACL,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,0CAAE,MAAM,KAAI,EAAE,EAAE,GAAG,CAAC,CAAC;wBACpE,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC;4BACxE,UAAU,EAAE,UAAU;4BACtB,MAAM;yBACP,CAAC,CAAC;wBACH,IAAI,CAAC,cAAc,EAAE;4BACnB,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;yBAC5B;qBACF;iBACF;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAA,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,OAAO;;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAM,aAAa,CAAC,CAAC;YACvD,IAAI,IAAI,EAAE;gBACR,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC3B;QACH,CAAC;KAAA;IAEK,IAAI;;YACR,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;gBACvB,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAChD,CAAC;KAAA;IAED,OAAO;QACL,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACF;AAED,eAAe,SAAS,CAAC","sourcesContent":["import { Context } from '@nocobase/actions';\nimport { Collection } from '@nocobase/database';\nimport { Plugin } from '@nocobase/server';\nimport { resolve } from 'path';\nimport { availableActionResource } from './actions/available-actions';\nimport { checkAction } from './actions/role-check';\nimport { roleCollectionsResource } from './actions/role-collections';\nimport { RoleModel } from './model/RoleModel';\nimport { RoleResourceActionModel } from './model/RoleResourceActionModel';\nimport { RoleResourceModel } from './model/RoleResourceModel';\n\nexport interface AssociationFieldAction {\n associationActions: string[];\n targetActions?: string[];\n}\n\ninterface AssociationFieldActions {\n [availableActionName: string]: AssociationFieldAction;\n}\n\nexport interface AssociationFieldsActions {\n [associationType: string]: AssociationFieldActions;\n}\n\nexport class GrantHelper {\n resourceTargetActionMap = new Map<string, string[]>();\n targetActionResourceMap = new Map<string, string[]>();\n\n constructor() {}\n}\n\nexport class PluginACL extends Plugin {\n // association field actions config\n\n associationFieldsActions: AssociationFieldsActions = {};\n\n grantHelper = new GrantHelper();\n\n get acl() {\n return this.app.acl;\n }\n\n registerAssociationFieldAction(associationType: string, value: AssociationFieldActions) {\n this.associationFieldsActions[associationType] = value;\n }\n\n registerAssociationFieldsActions() {\n // if grant create action to role, it should\n // also grant add action and association target's view action\n this.registerAssociationFieldAction('linkTo', {\n view: {\n associationActions: ['list', 'get'],\n },\n create: {\n associationActions: ['add'],\n targetActions: ['view'],\n },\n update: {\n associationActions: ['add', 'remove', 'toggle'],\n targetActions: ['view'],\n },\n });\n\n this.registerAssociationFieldAction('attachments', {\n view: {\n associationActions: ['list', 'get'],\n },\n add: {\n associationActions: ['upload', 'add'],\n },\n update: {\n associationActions: ['update', 'add', 'remove', 'toggle'],\n },\n });\n\n this.registerAssociationFieldAction('subTable', {\n view: {\n associationActions: ['list', 'get'],\n },\n create: {\n associationActions: ['create'],\n },\n update: {\n associationActions: ['update', 'destroy'],\n },\n });\n }\n\n async writeResourceToACL(resourceModel: RoleResourceModel, transaction) {\n await resourceModel.writeToACL({\n acl: this.acl,\n associationFieldsActions: this.associationFieldsActions,\n transaction: transaction,\n grantHelper: this.grantHelper,\n });\n }\n\n async writeActionToACL(actionModel: RoleResourceActionModel, transaction) {\n const resource = actionModel.get('resource') as RoleResourceModel;\n const role = this.acl.getRole(resource.get('roleName') as string);\n await actionModel.writeToACL({\n acl: this.acl,\n role,\n resourceName: resource.get('name') as string,\n associationFieldsActions: this.associationFieldsActions,\n grantHelper: this.grantHelper,\n });\n }\n\n async writeRolesToACL() {\n const roles = (await this.app.db.getRepository('roles').find({\n appends: ['resources', 'resources.actions'],\n })) as RoleModel[];\n\n for (const role of roles) {\n role.writeToAcl({ acl: this.acl });\n for (const resource of role.get('resources') as RoleResourceModel[]) {\n await this.writeResourceToACL(resource, null);\n }\n }\n }\n\n async beforeLoad() {\n this.app.db.registerModels({\n RoleResourceActionModel,\n RoleResourceModel,\n RoleModel,\n });\n\n this.registerAssociationFieldsActions();\n\n this.app.resourcer.define(availableActionResource);\n this.app.resourcer.define(roleCollectionsResource);\n\n this.app.resourcer.registerActionHandler('roles:check', checkAction);\n\n this.app.db.on('roles.afterSaveWithAssociations', async (model, options) => {\n const { transaction } = options;\n\n model.writeToAcl({\n acl: this.acl,\n });\n\n for (const resource of (await model.getResources({ transaction })) as RoleResourceModel[]) {\n await this.writeResourceToACL(resource, transaction);\n }\n\n // model is default\n if (model.get('default')) {\n await this.app.db.getRepository('roles').update({\n values: {\n default: false,\n },\n filter: {\n 'name.$ne': model.get('name'),\n },\n hooks: false,\n transaction,\n });\n }\n });\n\n this.app.db.on('roles.afterDestroy', (model) => {\n const roleName = model.get('name');\n this.acl.removeRole(roleName);\n });\n\n this.app.db.on('rolesResources.afterSaveWithAssociations', async (model: RoleResourceModel, options) => {\n await this.writeResourceToACL(model, options.transaction);\n });\n\n this.app.db.on('rolesResourcesActions.afterUpdateWithAssociations', async (model, options) => {\n const { transaction } = options;\n const resource = await model.getResource({\n transaction,\n });\n\n await this.writeResourceToACL(resource, transaction);\n });\n\n this.app.db.on('rolesResources.afterDestroy', async (model, options) => {\n const role = this.acl.getRole(model.get('roleName'));\n role.revokeResource(model.get('name'));\n });\n\n this.app.db.on('collections.afterDestroy', async (model, options) => {\n const { transaction } = options;\n await this.app.db.getRepository('rolesResources').destroy({\n filter: {\n name: model.get('name'),\n },\n transaction,\n });\n });\n\n this.app.db.on('fields.afterCreate', async (model, options) => {\n const { transaction } = options;\n\n const collectionName = model.get('collectionName');\n const fieldName = model.get('name');\n\n const resourceActions = (await this.app.db.getRepository('rolesResourcesActions').find({\n filter: {\n 'resource.name': collectionName,\n },\n transaction,\n appends: ['resource'],\n })) as RoleResourceActionModel[];\n\n for (const resourceAction of resourceActions) {\n const fields = resourceAction.get('fields') as string[];\n const newFields = [...fields, fieldName];\n\n await this.app.db.getRepository('rolesResourcesActions').update({\n filterByTk: resourceAction.get('id') as number,\n values: {\n fields: newFields,\n },\n transaction,\n });\n }\n });\n\n this.app.db.on('fields.afterDestroy', async (model, options) => {\n const collectionName = model.get('collectionName');\n const fieldName = model.get('name');\n\n const resourceActions = await this.app.db.getRepository('rolesResourcesActions').find({\n filter: {\n 'resource.name': collectionName,\n 'fields.$anyOf': [fieldName],\n },\n transaction: options.transaction,\n });\n\n for (const resourceAction of resourceActions) {\n const fields = resourceAction.get('fields') as string[];\n const newFields = fields.filter((field) => field != fieldName);\n\n await this.app.db.getRepository('rolesResourcesActions').update({\n filterByTk: resourceAction.get('id') as number,\n values: {\n fields: newFields,\n },\n transaction: options.transaction,\n });\n }\n });\n\n // sync database role data to acl\n this.app.on('beforeStart', async () => {\n await this.writeRolesToACL();\n });\n\n this.app.on('beforeInstallPlugin', async (plugin) => {\n if (plugin.constructor.name !== 'UsersPlugin') {\n return;\n }\n const roles = this.app.db.getRepository('roles');\n await roles.createMany({\n records: [\n {\n name: 'root',\n title: '{{t(\"Root\")}}',\n hidden: true,\n },\n {\n name: 'admin',\n title: '{{t(\"Admin\")}}',\n allowConfigure: true,\n allowNewMenu: true,\n strategy: { actions: ['create', 'export', 'view', 'update', 'destroy'] },\n },\n {\n name: 'member',\n title: '{{t(\"Member\")}}',\n allowNewMenu: true,\n strategy: { actions: ['view', 'update:own', 'destroy:own', 'create'] },\n default: true,\n },\n ],\n });\n const rolesResourcesScopes = this.app.db.getRepository('rolesResourcesScopes');\n await rolesResourcesScopes.createMany({\n records: [\n {\n key: 'all',\n name: '{{t(\"All records\")}}',\n scope: {},\n },\n {\n key: 'own',\n name: '{{t(\"Own records\")}}',\n scope: {\n createdById: '{{ ctx.state.currentUser.id }}',\n },\n },\n ],\n });\n });\n\n this.app.acl.allow('roles', 'check', 'loggedIn');\n this.app.acl.allow('roles', ['create', 'update', 'destroy'], 'allowConfigure');\n\n this.app.acl.allow('roles.menuUiSchemas', ['set', 'toggle', 'list'], 'allowConfigure');\n\n this.app.acl.allow('*', '*', (ctx) => {\n return ctx.state.currentRole === 'root';\n });\n\n this.app.resourcer.use(async (ctx, next) => {\n const { actionName, resourceName, params } = ctx.action;\n const { showAnonymous } = params || {};\n if (actionName === 'list' && resourceName === 'roles') {\n if (!showAnonymous) {\n ctx.action.mergeParams({\n filter: {\n 'name.$ne': 'anonymous',\n },\n });\n }\n }\n await next();\n });\n\n this.app.acl.use(async (ctx: Context, next) => {\n const { actionName, resourceName } = ctx.action;\n if (actionName === 'get' || actionName === 'list') {\n if (!Array.isArray(ctx?.permission?.can?.params?.fields)) {\n return next();\n }\n let collection: Collection;\n if (resourceName.includes('.')) {\n const [collectionName, associationName] = resourceName.split('.');\n const field = ctx.db.getCollection(collectionName)?.getField?.(associationName);\n if (field.target) {\n collection = ctx.db.getCollection(field.target);\n }\n } else {\n collection = ctx.db.getCollection(resourceName);\n }\n if (collection && collection.hasField('createdById')) {\n ctx.permission.can.params.fields.push('createdById');\n }\n }\n return next();\n });\n\n const parseJsonTemplate = this.app.acl.parseJsonTemplate;\n this.app.acl.use(async (ctx: Context, next) => {\n const { actionName, resourceName, resourceOf } = ctx.action;\n if (resourceName.includes('.') && resourceOf) {\n if (!ctx?.permission?.can?.params) {\n return next();\n }\n // 关联数据去掉 filter\n delete ctx.permission.can.params.filter;\n // 关联数据能不能处理取决于 source 是否有权限\n const [collectionName] = resourceName.split('.');\n const action = ctx.can({ resource: collectionName, action: actionName });\n const availableAction = this.app.acl.getAvailableAction(actionName);\n if (availableAction?.options?.onNewRecord) {\n if (action) {\n ctx.permission.skip = true;\n } else {\n ctx.permission.can = false;\n }\n } else {\n const filter = parseJsonTemplate(action?.params?.filter || {}, ctx);\n const sourceInstance = await ctx.db.getRepository(collectionName).findOne({\n filterByTk: resourceOf,\n filter,\n });\n if (!sourceInstance) {\n ctx.permission.can = false;\n }\n }\n }\n await next();\n });\n }\n\n async install() {\n const repo = this.db.getRepository<any>('collections');\n if (repo) {\n await repo.db2cm('roles');\n }\n }\n\n async load() {\n await this.app.db.import({\n directory: resolve(__dirname, 'collections'),\n });\n\n this.app.resourcer.use(this.acl.middleware());\n }\n\n getName(): string {\n return this.getPackageName(__dirname);\n }\n}\n\nexport default PluginACL;\n"]}
|
|
@@ -42,6 +42,7 @@ class RoleResourceActionModel extends database_1.Model {
|
|
|
42
42
|
const fieldActions = (_a = associationFieldsActions === null || associationFieldsActions === void 0 ? void 0 : associationFieldsActions[fieldType]) === null || _a === void 0 ? void 0 : _a[availableAction];
|
|
43
43
|
const fieldTarget = collectionField.get('target');
|
|
44
44
|
if (fieldActions) {
|
|
45
|
+
// grant association actions to role
|
|
45
46
|
const associationActions = fieldActions.associationActions || [];
|
|
46
47
|
associationActions.forEach((associationAction) => {
|
|
47
48
|
const actionName = `${resourceName}.${fieldTarget}:${associationAction}`;
|
|
@@ -50,13 +51,14 @@ class RoleResourceActionModel extends database_1.Model {
|
|
|
50
51
|
const targetActions = fieldActions.targetActions || [];
|
|
51
52
|
targetActions.forEach((targetAction) => {
|
|
52
53
|
const targetActionPath = `${fieldTarget}:${targetAction}`;
|
|
53
|
-
|
|
54
|
+
// set resource target action with current resourceName
|
|
55
|
+
grantHelper.resourceTargetActionMap.set(`${role.name}.${resourceName}`, [
|
|
54
56
|
...(grantHelper.resourceTargetActionMap.get(resourceName) || []),
|
|
55
57
|
targetActionPath,
|
|
56
58
|
]);
|
|
57
59
|
grantHelper.targetActionResourceMap.set(targetActionPath, [
|
|
58
60
|
...(grantHelper.targetActionResourceMap.get(targetActionPath) || []),
|
|
59
|
-
resourceName
|
|
61
|
+
`${role.name}.${resourceName}`,
|
|
60
62
|
]);
|
|
61
63
|
role.grantAction(targetActionPath);
|
|
62
64
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RoleResourceActionModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceActionModel.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,iDAAqD;AAGrD,MAAa,uBAAwB,SAAQ,gBAAK;IAC1C,UAAU,CAAC,OAMhB;;;YACC,aAAa;YACb,MAAM,EAAE,GAAa,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAE/C,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YAEnF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;YAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAQ,CAAC;YAEzC,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;YACnD,MAAM,YAAY,GAAG;gBACnB,MAAM;aACP,CAAC;YAEF,aAAa;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAEpC,IAAI,KAAK,EAAE;gBACT,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;gBACjD,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aAC7C;YAED,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAElD,IAAI,CAAC,UAAU,EAAE;gBACf,OAAO;aACR;YAED,MAAM,eAAe,GAAG,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAE3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;gBAC1B,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;gBAE7D,MAAM,YAAY,GAA2B,MAAA,wBAAwB,aAAxB,wBAAwB,uBAAxB,wBAAwB,CAAG,SAAS,CAAC,0CAAG,eAAe,CAAC,CAAC;gBAEtG,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAElD,IAAI,YAAY,EAAE;oBAChB,MAAM,kBAAkB,GAAG,YAAY,CAAC,kBAAkB,IAAI,EAAE,CAAC;oBACjE,kBAAkB,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,EAAE;wBAC/C,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;wBACzE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;oBAC/B,CAAC,CAAC,CAAC;oBAEH,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC;oBAEvD,aAAa,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;wBACrC,MAAM,gBAAgB,GAAG,GAAG,WAAW,IAAI,YAAY,EAAE,CAAC;wBAE1D,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE;
|
|
1
|
+
{"version":3,"file":"RoleResourceActionModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceActionModel.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,iDAAqD;AAGrD,MAAa,uBAAwB,SAAQ,gBAAK;IAC1C,UAAU,CAAC,OAMhB;;;YACC,aAAa;YACb,MAAM,EAAE,GAAa,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAE/C,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YAEnF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;YAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAQ,CAAC;YAEzC,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;YACnD,MAAM,YAAY,GAAG;gBACnB,MAAM;aACP,CAAC;YAEF,aAAa;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAEpC,IAAI,KAAK,EAAE;gBACT,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;gBACjD,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aAC7C;YAED,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAElD,IAAI,CAAC,UAAU,EAAE;gBACf,OAAO;aACR;YAED,MAAM,eAAe,GAAG,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAE3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;gBAC1B,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;gBAE7D,MAAM,YAAY,GAA2B,MAAA,wBAAwB,aAAxB,wBAAwB,uBAAxB,wBAAwB,CAAG,SAAS,CAAC,0CAAG,eAAe,CAAC,CAAC;gBAEtG,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAElD,IAAI,YAAY,EAAE;oBAChB,oCAAoC;oBACpC,MAAM,kBAAkB,GAAG,YAAY,CAAC,kBAAkB,IAAI,EAAE,CAAC;oBACjE,kBAAkB,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,EAAE;wBAC/C,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;wBACzE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;oBAC/B,CAAC,CAAC,CAAC;oBAEH,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC;oBAEvD,aAAa,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;wBACrC,MAAM,gBAAgB,GAAG,GAAG,WAAW,IAAI,YAAY,EAAE,CAAC;wBAE1D,uDAAuD;wBACvD,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,EAAE;4BACtE,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;4BAChE,gBAAgB;yBACjB,CAAC,CAAC;wBAEH,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,EAAE;4BACxD,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;4BACpE,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE;yBAC/B,CAAC,CAAC;wBAEH,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;oBACrC,CAAC,CAAC,CAAC;iBACJ;aACF;;KACF;CACF;AA7ED,0DA6EC","sourcesContent":["import { ACL, ACLRole } from '@nocobase/acl';\nimport { Database, Model } from '@nocobase/database';\nimport { AssociationFieldAction, AssociationFieldsActions, GrantHelper } from '../server';\n\nexport class RoleResourceActionModel extends Model {\n async writeToACL(options: {\n acl: ACL;\n role: ACLRole;\n resourceName: string;\n associationFieldsActions: AssociationFieldsActions;\n grantHelper: GrantHelper;\n }) {\n // @ts-ignore\n const db: Database = this.constructor.database;\n\n const { resourceName, role, acl, associationFieldsActions, grantHelper } = options;\n\n const actionName = this.get('name') as string;\n\n const fields = this.get('fields') as any;\n\n const actionPath = `${resourceName}:${actionName}`;\n const actionParams = {\n fields,\n };\n\n // @ts-ignore\n const scope = await this.getScope();\n\n if (scope) {\n actionParams['own'] = scope.get('key') === 'own';\n actionParams['filter'] = scope.get('scope');\n }\n\n role.grantAction(actionPath, actionParams);\n\n const collection = db.getCollection(resourceName);\n\n if (!collection) {\n return;\n }\n\n const availableAction = acl.resolveActionAlias(actionName);\n\n for (const field of fields) {\n const collectionField = collection.getField(field);\n const fieldType = collectionField.get('interface') as string;\n\n const fieldActions: AssociationFieldAction = associationFieldsActions?.[fieldType]?.[availableAction];\n\n const fieldTarget = collectionField.get('target');\n\n if (fieldActions) {\n // grant association actions to role\n const associationActions = fieldActions.associationActions || [];\n associationActions.forEach((associationAction) => {\n const actionName = `${resourceName}.${fieldTarget}:${associationAction}`;\n role.grantAction(actionName);\n });\n\n const targetActions = fieldActions.targetActions || [];\n\n targetActions.forEach((targetAction) => {\n const targetActionPath = `${fieldTarget}:${targetAction}`;\n\n // set resource target action with current resourceName\n grantHelper.resourceTargetActionMap.set(`${role.name}.${resourceName}`, [\n ...(grantHelper.resourceTargetActionMap.get(resourceName) || []),\n targetActionPath,\n ]);\n\n grantHelper.targetActionResourceMap.set(targetActionPath, [\n ...(grantHelper.targetActionResourceMap.get(targetActionPath) || []),\n `${role.name}.${resourceName}`,\n ]);\n\n role.grantAction(targetActionPath);\n });\n }\n }\n }\n}\n"]}
|
|
@@ -17,15 +17,15 @@ class RoleResourceModel extends database_1.Model {
|
|
|
17
17
|
return __awaiter(this, void 0, void 0, function* () {
|
|
18
18
|
const { role, resourceName, grantHelper } = options;
|
|
19
19
|
role.revokeResource(resourceName);
|
|
20
|
-
const targetActions = grantHelper.resourceTargetActionMap.get(resourceName) || [];
|
|
20
|
+
const targetActions = grantHelper.resourceTargetActionMap.get(`${role.name}.${resourceName}`) || [];
|
|
21
21
|
for (const targetAction of targetActions) {
|
|
22
|
-
const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter((item) => resourceName !== item);
|
|
22
|
+
const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter((item) => `${role.name}.${resourceName}` !== item);
|
|
23
23
|
grantHelper.targetActionResourceMap.set(targetAction, targetActionResource);
|
|
24
24
|
if (targetActionResource.length == 0) {
|
|
25
25
|
role.revokeAction(targetAction);
|
|
26
26
|
}
|
|
27
27
|
}
|
|
28
|
-
grantHelper.resourceTargetActionMap.set(resourceName
|
|
28
|
+
grantHelper.resourceTargetActionMap.set(`${role.name}.${resourceName}`, []);
|
|
29
29
|
});
|
|
30
30
|
}
|
|
31
31
|
writeToACL(options) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RoleResourceModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceModel.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iDAAqD;AACrD,uCAA0D;AAI1D,MAAa,iBAAkB,SAAQ,gBAAK;IACpC,MAAM,CAAC,OAA0E;;YACrF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAElC,MAAM,aAAa,GAAG,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"RoleResourceModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceModel.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iDAAqD;AACrD,uCAA0D;AAI1D,MAAa,iBAAkB,SAAQ,gBAAK;IACpC,MAAM,CAAC,OAA0E;;YACrF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAElC,MAAM,aAAa,GAAG,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC;YAEpG,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE;gBACxC,MAAM,oBAAoB,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/F,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,KAAK,IAAI,CAClD,CAAC;gBAEF,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;gBAE5E,IAAI,oBAAoB,CAAC,MAAM,IAAI,CAAC,EAAE;oBACpC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;iBACjC;aACF;YAED,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;KAAA;IAEK,UAAU,CAAC,OAKhB;;YACC,MAAM,EAAE,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAW,CAAC;YAChD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAEnC,0BAA0B;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAEvD,aAAa;YACb,IAAI,IAAI,CAAC,kBAAkB,KAAK,KAAK,EAAE;gBACrC,OAAO;aACR;YAED,MAAM,QAAQ,GAAG,IAAI,iBAAW,CAAC;gBAC/B,IAAI;gBACJ,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAE3C,aAAa;YACb,MAAM,OAAO,GAA8B,MAAM,IAAI,CAAC,UAAU,CAAC;gBAC/D,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;YAEH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE;gBAC5B,MAAM,MAAM,CAAC,UAAU,CAAC;oBACtB,GAAG;oBACH,IAAI;oBACJ,YAAY;oBACZ,wBAAwB;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;aACJ;QACH,CAAC;KAAA;CACF;AA/DD,8CA+DC","sourcesContent":["import { Database, Model } from '@nocobase/database';\nimport { ACL, ACLResource, ACLRole } from '@nocobase/acl';\nimport { RoleResourceActionModel } from './RoleResourceActionModel';\nimport { AssociationFieldsActions, GrantHelper } from '../server';\n\nexport class RoleResourceModel extends Model {\n async revoke(options: { role: ACLRole; resourceName: string; grantHelper: GrantHelper }) {\n const { role, resourceName, grantHelper } = options;\n role.revokeResource(resourceName);\n\n const targetActions = grantHelper.resourceTargetActionMap.get(`${role.name}.${resourceName}`) || [];\n\n for (const targetAction of targetActions) {\n const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter(\n (item) => `${role.name}.${resourceName}` !== item,\n );\n\n grantHelper.targetActionResourceMap.set(targetAction, targetActionResource);\n\n if (targetActionResource.length == 0) {\n role.revokeAction(targetAction);\n }\n }\n\n grantHelper.resourceTargetActionMap.set(`${role.name}.${resourceName}`, []);\n }\n\n async writeToACL(options: {\n acl: ACL;\n associationFieldsActions: AssociationFieldsActions;\n grantHelper: GrantHelper;\n transaction: any;\n }) {\n const { acl, associationFieldsActions, grantHelper } = options;\n const resourceName = this.get('name') as string;\n const roleName = this.get('roleName') as string;\n const role = acl.getRole(roleName);\n\n // revoke resource of role\n await this.revoke({ role, resourceName, grantHelper });\n\n // @ts-ignore\n if (this.usingActionsConfig === false) {\n return;\n }\n\n const resource = new ACLResource({\n role,\n name: resourceName,\n });\n\n role.resources.set(resourceName, resource);\n\n // @ts-ignore\n const actions: RoleResourceActionModel[] = await this.getActions({\n transaction: options.transaction,\n });\n\n for (const action of actions) {\n await action.writeToACL({\n acl,\n role,\n resourceName,\n associationFieldsActions,\n grantHelper: options.grantHelper,\n });\n }\n }\n}\n"]}
|
package/lib/server.js
CHANGED
|
@@ -27,6 +27,7 @@ class GrantHelper {
|
|
|
27
27
|
exports.GrantHelper = GrantHelper;
|
|
28
28
|
class PluginACL extends server_1.Plugin {
|
|
29
29
|
constructor() {
|
|
30
|
+
// association field actions config
|
|
30
31
|
super(...arguments);
|
|
31
32
|
this.associationFieldsActions = {};
|
|
32
33
|
this.grantHelper = new GrantHelper();
|
|
@@ -38,6 +39,8 @@ class PluginACL extends server_1.Plugin {
|
|
|
38
39
|
this.associationFieldsActions[associationType] = value;
|
|
39
40
|
}
|
|
40
41
|
registerAssociationFieldsActions() {
|
|
42
|
+
// if grant create action to role, it should
|
|
43
|
+
// also grant add action and association target's view action
|
|
41
44
|
this.registerAssociationFieldAction('linkTo', {
|
|
42
45
|
view: {
|
|
43
46
|
associationActions: ['list', 'get'],
|
package/lib/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,6CAA0C;AAC1C,+BAA+B;AAC/B,mEAAsE;AACtE,qDAAmD;AACnD,iEAAqE;AACrE,iDAA8C;AAC9C,6EAA0E;AAC1E,iEAA8D;AAe9D,MAAa,WAAW;IAItB;QAHA,4BAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;QACtD,4BAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEvC,CAAC;CACjB;AALD,kCAKC;AAED,MAAa,SAAU,SAAQ,eAAM;IAArC;;QACE,6BAAwB,GAA6B,EAAE,CAAC;QAExD,gBAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IAyWlC,CAAC;IAvWC,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,8BAA8B,CAAC,eAAuB,EAAE,KAA8B;QACpF,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;IAED,gCAAgC;QAC9B,IAAI,CAAC,8BAA8B,CAAC,QAAQ,EAAE;YAC5C,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,KAAK,CAAC;gBAC3B,aAAa,EAAE,CAAC,MAAM,CAAC;aACxB;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;gBAC/C,aAAa,EAAE,CAAC,MAAM,CAAC;aACxB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,CAAC,aAAa,EAAE;YACjD,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,GAAG,EAAE;gBACH,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;aACtC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;aAC1D;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,CAAC,UAAU,EAAE;YAC9C,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,CAAC;aAC/B;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;IAEK,kBAAkB,CAAC,aAAgC,EAAE,WAAW;;YACpE,MAAM,aAAa,CAAC,UAAU,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,WAAW;gBACxB,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,gBAAgB,CAAC,WAAoC,EAAE,WAAW;;YACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAW,CAAC,CAAC;YAClE,MAAM,WAAW,CAAC,UAAU,CAAC;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI;gBACJ,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAW;gBAC5C,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,eAAe;;YACnB,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;gBAC3D,OAAO,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;aAC5C,CAAC,CAAgB,CAAC;YACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;gBACxB,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAwB,EAAE;oBACnE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;iBAC/C;aACF;QACH,CAAC;KAAA;IAEK,UAAU;;YACd,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC;gBACzB,uBAAuB,EAAvB,iDAAuB;gBACvB,iBAAiB,EAAjB,qCAAiB;gBACjB,SAAS,EAAT,qBAAS;aACV,CAAC,CAAC;YAEH,IAAI,CAAC,gCAAgC,EAAE,CAAC;YAExC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,2CAAuB,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,0CAAuB,CAAC,CAAC;YAEnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,aAAa,EAAE,wBAAW,CAAC,CAAC;YAErE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,iCAAiC,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBACzE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhC,KAAK,CAAC,UAAU,CAAC;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;gBAEH,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAwB,EAAE;oBACzF,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;iBACtD;gBAED,mBAAmB;gBACnB,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;oBACxB,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBAC9C,MAAM,EAAE;4BACN,OAAO,EAAE,KAAK;yBACf;wBACD,MAAM,EAAE;4BACN,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;yBAC9B;wBACD,KAAK,EAAE,KAAK;wBACZ,WAAW;qBACZ,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,0CAA0C,EAAE,CAAO,KAAwB,EAAE,OAAO,EAAE,EAAE;gBACrG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC5D,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,mDAAmD,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC3F,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAChC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;oBACvC,WAAW;iBACZ,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACvD,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,6BAA6B,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBACrE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,0BAA0B,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAClE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAChC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC;oBACxD,MAAM,EAAE;wBACN,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;qBACxB;oBACD,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC5D,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhC,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,eAAe,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC;oBACrF,MAAM,EAAE;wBACN,eAAe,EAAE,cAAc;qBAChC;oBACD,WAAW;oBACX,OAAO,EAAE,CAAC,UAAU,CAAC;iBACtB,CAAC,CAA8B,CAAC;gBAEjC,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;oBACxD,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,CAAC;oBAEzC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;wBAC9D,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAW;wBAC9C,MAAM,EAAE;4BACN,MAAM,EAAE,SAAS;yBAClB;wBACD,WAAW;qBACZ,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC;oBACpF,MAAM,EAAE;wBACN,eAAe,EAAE,cAAc;wBAC/B,eAAe,EAAE,CAAC,SAAS,CAAC;qBAC7B;oBACD,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;gBAEH,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;oBACxD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;oBAE/D,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;wBAC9D,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAW;wBAC9C,MAAM,EAAE;4BACN,MAAM,EAAE,SAAS;yBAClB;wBACD,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,iCAAiC;YACjC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,GAAS,EAAE;gBACpC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAO,MAAM,EAAE,EAAE;gBAClD,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE;oBAC7C,OAAO;iBACR;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM,KAAK,CAAC,UAAU,CAAC;oBACrB,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,KAAK,EAAE,eAAe;4BACtB,MAAM,EAAE,IAAI;yBACb;wBACD;4BACE,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,gBAAgB;4BACvB,cAAc,EAAE,IAAI;4BACpB,YAAY,EAAE,IAAI;4BAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;yBACzE;wBACD;4BACE,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,iBAAiB;4BACxB,YAAY,EAAE,IAAI;4BAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE;4BACtE,OAAO,EAAE,IAAI;yBACd;qBACF;iBACF,CAAC,CAAC;gBACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;gBAC/E,MAAM,oBAAoB,CAAC,UAAU,CAAC;oBACpC,OAAO,EAAE;wBACP;4BACE,GAAG,EAAE,KAAK;4BACV,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE,EAAE;yBACV;wBACD;4BACE,GAAG,EAAE,KAAK;4BACV,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE;gCACL,WAAW,EAAE,gCAAgC;6BAC9C;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAE/E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAEvF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;gBACnC,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAO,GAAG,EAAE,IAAI,EAAE,EAAE;gBACzC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBACxD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;gBACvC,IAAI,UAAU,KAAK,MAAM,IAAI,YAAY,KAAK,OAAO,EAAE;oBACrD,IAAI,CAAC,aAAa,EAAE;wBAClB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;4BACrB,MAAM,EAAE;gCACN,UAAU,EAAE,WAAW;6BACxB;yBACF,CAAC,CAAC;qBACJ;iBACF;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAO,GAAY,EAAE,IAAI,EAAE,EAAE;;gBAC5C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAChD,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE;oBACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,0CAAE,GAAG,0CAAE,MAAM,0CAAE,MAAM,CAAC,EAAE;wBACxD,OAAO,IAAI,EAAE,CAAC;qBACf;oBACD,IAAI,UAAsB,CAAC;oBAC3B,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;wBAC9B,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBAClE,MAAM,KAAK,GAAG,MAAA,MAAA,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,0CAAE,QAAQ,mDAAG,eAAe,CAAC,CAAC;wBAChF,IAAI,KAAK,CAAC,MAAM,EAAE;4BAChB,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;yBACjD;qBACF;yBAAM;wBACL,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;qBACjD;oBACD,IAAI,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;wBACpD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;qBACtD;iBACF;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAO,GAAY,EAAE,IAAI,EAAE,EAAE;;gBAC5C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE;oBAC5C,IAAI,CAAC,CAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,0CAAE,GAAG,0CAAE,MAAM,CAAA,EAAE;wBACjC,OAAO,IAAI,EAAE,CAAC;qBACf;oBACD,gBAAgB;oBAChB,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;oBACxC,4BAA4B;oBAC5B,MAAM,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBACzE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;oBACpE,IAAI,MAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,0CAAE,WAAW,EAAE;wBACzC,IAAI,MAAM,EAAE;4BACV,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;yBAC5B;6BAAM;4BACL,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;yBAC5B;qBACF;yBAAM;wBACL,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,0CAAE,MAAM,KAAI,EAAE,EAAE,GAAG,CAAC,CAAC;wBACpE,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC;4BACxE,UAAU,EAAE,UAAU;4BACtB,MAAM;yBACP,CAAC,CAAC;wBACH,IAAI,CAAC,cAAc,EAAE;4BACnB,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;yBAC5B;qBACF;iBACF;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAA,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,OAAO;;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAM,aAAa,CAAC,CAAC;YACvD,IAAI,IAAI,EAAE;gBACR,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC3B;QACH,CAAC;KAAA;IAEK,IAAI;;YACR,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;gBACvB,SAAS,EAAE,IAAA,cAAO,EAAC,SAAS,EAAE,aAAa,CAAC;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAChD,CAAC;KAAA;IAED,OAAO;QACL,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACF;AA5WD,8BA4WC;AAED,kBAAe,SAAS,CAAC","sourcesContent":["import { Context } from '@nocobase/actions';\nimport { Collection } from '@nocobase/database';\nimport { Plugin } from '@nocobase/server';\nimport { resolve } from 'path';\nimport { availableActionResource } from './actions/available-actions';\nimport { checkAction } from './actions/role-check';\nimport { roleCollectionsResource } from './actions/role-collections';\nimport { RoleModel } from './model/RoleModel';\nimport { RoleResourceActionModel } from './model/RoleResourceActionModel';\nimport { RoleResourceModel } from './model/RoleResourceModel';\n\nexport interface AssociationFieldAction {\n associationActions: string[];\n targetActions?: string[];\n}\n\ninterface AssociationFieldActions {\n [availableActionName: string]: AssociationFieldAction;\n}\n\nexport interface AssociationFieldsActions {\n [associationType: string]: AssociationFieldActions;\n}\n\nexport class GrantHelper {\n resourceTargetActionMap = new Map<string, string[]>();\n targetActionResourceMap = new Map<string, string[]>();\n\n constructor() {}\n}\n\nexport class PluginACL extends Plugin {\n associationFieldsActions: AssociationFieldsActions = {};\n\n grantHelper = new GrantHelper();\n\n get acl() {\n return this.app.acl;\n }\n\n registerAssociationFieldAction(associationType: string, value: AssociationFieldActions) {\n this.associationFieldsActions[associationType] = value;\n }\n\n registerAssociationFieldsActions() {\n this.registerAssociationFieldAction('linkTo', {\n view: {\n associationActions: ['list', 'get'],\n },\n create: {\n associationActions: ['add'],\n targetActions: ['view'],\n },\n update: {\n associationActions: ['add', 'remove', 'toggle'],\n targetActions: ['view'],\n },\n });\n\n this.registerAssociationFieldAction('attachments', {\n view: {\n associationActions: ['list', 'get'],\n },\n add: {\n associationActions: ['upload', 'add'],\n },\n update: {\n associationActions: ['update', 'add', 'remove', 'toggle'],\n },\n });\n\n this.registerAssociationFieldAction('subTable', {\n view: {\n associationActions: ['list', 'get'],\n },\n create: {\n associationActions: ['create'],\n },\n update: {\n associationActions: ['update', 'destroy'],\n },\n });\n }\n\n async writeResourceToACL(resourceModel: RoleResourceModel, transaction) {\n await resourceModel.writeToACL({\n acl: this.acl,\n associationFieldsActions: this.associationFieldsActions,\n transaction: transaction,\n grantHelper: this.grantHelper,\n });\n }\n\n async writeActionToACL(actionModel: RoleResourceActionModel, transaction) {\n const resource = actionModel.get('resource') as RoleResourceModel;\n const role = this.acl.getRole(resource.get('roleName') as string);\n await actionModel.writeToACL({\n acl: this.acl,\n role,\n resourceName: resource.get('name') as string,\n associationFieldsActions: this.associationFieldsActions,\n grantHelper: this.grantHelper,\n });\n }\n\n async writeRolesToACL() {\n const roles = (await this.app.db.getRepository('roles').find({\n appends: ['resources', 'resources.actions'],\n })) as RoleModel[];\n for (const role of roles) {\n role.writeToAcl({ acl: this.acl });\n for (const resource of role.get('resources') as RoleResourceModel[]) {\n await this.writeResourceToACL(resource, null);\n }\n }\n }\n\n async beforeLoad() {\n this.app.db.registerModels({\n RoleResourceActionModel,\n RoleResourceModel,\n RoleModel,\n });\n\n this.registerAssociationFieldsActions();\n\n this.app.resourcer.define(availableActionResource);\n this.app.resourcer.define(roleCollectionsResource);\n\n this.app.resourcer.registerActionHandler('roles:check', checkAction);\n\n this.app.db.on('roles.afterSaveWithAssociations', async (model, options) => {\n const { transaction } = options;\n\n model.writeToAcl({\n acl: this.acl,\n });\n\n for (const resource of (await model.getResources({ transaction })) as RoleResourceModel[]) {\n await this.writeResourceToACL(resource, transaction);\n }\n\n // model is default\n if (model.get('default')) {\n await this.app.db.getRepository('roles').update({\n values: {\n default: false,\n },\n filter: {\n 'name.$ne': model.get('name'),\n },\n hooks: false,\n transaction,\n });\n }\n });\n\n this.app.db.on('roles.afterDestroy', (model) => {\n const roleName = model.get('name');\n this.acl.removeRole(roleName);\n });\n\n this.app.db.on('rolesResources.afterSaveWithAssociations', async (model: RoleResourceModel, options) => {\n await this.writeResourceToACL(model, options.transaction);\n });\n\n this.app.db.on('rolesResourcesActions.afterUpdateWithAssociations', async (model, options) => {\n const { transaction } = options;\n const resource = await model.getResource({\n transaction,\n });\n\n await this.writeResourceToACL(resource, transaction);\n });\n\n this.app.db.on('rolesResources.afterDestroy', async (model, options) => {\n const role = this.acl.getRole(model.get('roleName'));\n role.revokeResource(model.get('name'));\n });\n\n this.app.db.on('collections.afterDestroy', async (model, options) => {\n const { transaction } = options;\n await this.app.db.getRepository('rolesResources').destroy({\n filter: {\n name: model.get('name'),\n },\n transaction,\n });\n });\n\n this.app.db.on('fields.afterCreate', async (model, options) => {\n const { transaction } = options;\n\n const collectionName = model.get('collectionName');\n const fieldName = model.get('name');\n\n const resourceActions = (await this.app.db.getRepository('rolesResourcesActions').find({\n filter: {\n 'resource.name': collectionName,\n },\n transaction,\n appends: ['resource'],\n })) as RoleResourceActionModel[];\n\n for (const resourceAction of resourceActions) {\n const fields = resourceAction.get('fields') as string[];\n const newFields = [...fields, fieldName];\n\n await this.app.db.getRepository('rolesResourcesActions').update({\n filterByTk: resourceAction.get('id') as number,\n values: {\n fields: newFields,\n },\n transaction,\n });\n }\n });\n\n this.app.db.on('fields.afterDestroy', async (model, options) => {\n const collectionName = model.get('collectionName');\n const fieldName = model.get('name');\n\n const resourceActions = await this.app.db.getRepository('rolesResourcesActions').find({\n filter: {\n 'resource.name': collectionName,\n 'fields.$anyOf': [fieldName],\n },\n transaction: options.transaction,\n });\n\n for (const resourceAction of resourceActions) {\n const fields = resourceAction.get('fields') as string[];\n const newFields = fields.filter((field) => field != fieldName);\n\n await this.app.db.getRepository('rolesResourcesActions').update({\n filterByTk: resourceAction.get('id') as number,\n values: {\n fields: newFields,\n },\n transaction: options.transaction,\n });\n }\n });\n\n // sync database role data to acl\n this.app.on('beforeStart', async () => {\n await this.writeRolesToACL();\n });\n\n this.app.on('beforeInstallPlugin', async (plugin) => {\n if (plugin.constructor.name !== 'UsersPlugin') {\n return;\n }\n const roles = this.app.db.getRepository('roles');\n await roles.createMany({\n records: [\n {\n name: 'root',\n title: '{{t(\"Root\")}}',\n hidden: true,\n },\n {\n name: 'admin',\n title: '{{t(\"Admin\")}}',\n allowConfigure: true,\n allowNewMenu: true,\n strategy: { actions: ['create', 'export', 'view', 'update', 'destroy'] },\n },\n {\n name: 'member',\n title: '{{t(\"Member\")}}',\n allowNewMenu: true,\n strategy: { actions: ['view', 'update:own', 'destroy:own', 'create'] },\n default: true,\n },\n ],\n });\n const rolesResourcesScopes = this.app.db.getRepository('rolesResourcesScopes');\n await rolesResourcesScopes.createMany({\n records: [\n {\n key: 'all',\n name: '{{t(\"All records\")}}',\n scope: {},\n },\n {\n key: 'own',\n name: '{{t(\"Own records\")}}',\n scope: {\n createdById: '{{ ctx.state.currentUser.id }}',\n },\n },\n ],\n });\n });\n\n this.app.acl.allow('roles', 'check', 'loggedIn');\n this.app.acl.allow('roles', ['create', 'update', 'destroy'], 'allowConfigure');\n\n this.app.acl.allow('roles.menuUiSchemas', ['set', 'toggle', 'list'], 'allowConfigure');\n\n this.app.acl.allow('*', '*', (ctx) => {\n return ctx.state.currentRole === 'root';\n });\n\n this.app.resourcer.use(async (ctx, next) => {\n const { actionName, resourceName, params } = ctx.action;\n const { showAnonymous } = params || {};\n if (actionName === 'list' && resourceName === 'roles') {\n if (!showAnonymous) {\n ctx.action.mergeParams({\n filter: {\n 'name.$ne': 'anonymous',\n },\n });\n }\n }\n await next();\n });\n\n this.app.acl.use(async (ctx: Context, next) => {\n const { actionName, resourceName } = ctx.action;\n if (actionName === 'get' || actionName === 'list') {\n if (!Array.isArray(ctx?.permission?.can?.params?.fields)) {\n return next();\n }\n let collection: Collection;\n if (resourceName.includes('.')) {\n const [collectionName, associationName] = resourceName.split('.');\n const field = ctx.db.getCollection(collectionName)?.getField?.(associationName);\n if (field.target) {\n collection = ctx.db.getCollection(field.target);\n }\n } else {\n collection = ctx.db.getCollection(resourceName);\n }\n if (collection && collection.hasField('createdById')) {\n ctx.permission.can.params.fields.push('createdById');\n }\n }\n return next();\n });\n\n const parseJsonTemplate = this.app.acl.parseJsonTemplate;\n this.app.acl.use(async (ctx: Context, next) => {\n const { actionName, resourceName, resourceOf } = ctx.action;\n if (resourceName.includes('.') && resourceOf) {\n if (!ctx?.permission?.can?.params) {\n return next();\n }\n // 关联数据去掉 filter\n delete ctx.permission.can.params.filter;\n // 关联数据能不能处理取决于 source 是否有权限\n const [collectionName] = resourceName.split('.');\n const action = ctx.can({ resource: collectionName, action: actionName });\n const availableAction = this.app.acl.getAvailableAction(actionName);\n if (availableAction?.options?.onNewRecord) {\n if (action) {\n ctx.permission.skip = true;\n } else {\n ctx.permission.can = false;\n }\n } else {\n const filter = parseJsonTemplate(action?.params?.filter || {}, ctx);\n const sourceInstance = await ctx.db.getRepository(collectionName).findOne({\n filterByTk: resourceOf,\n filter,\n });\n if (!sourceInstance) {\n ctx.permission.can = false;\n }\n }\n }\n await next();\n });\n }\n\n async install() {\n const repo = this.db.getRepository<any>('collections');\n if (repo) {\n await repo.db2cm('roles');\n }\n }\n\n async load() {\n await this.app.db.import({\n directory: resolve(__dirname, 'collections'),\n });\n\n this.app.resourcer.use(this.acl.middleware());\n }\n\n getName(): string {\n return this.getPackageName(__dirname);\n }\n}\n\nexport default PluginACL;\n"]}
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,6CAA0C;AAC1C,+BAA+B;AAC/B,mEAAsE;AACtE,qDAAmD;AACnD,iEAAqE;AACrE,iDAA8C;AAC9C,6EAA0E;AAC1E,iEAA8D;AAe9D,MAAa,WAAW;IAItB;QAHA,4BAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;QACtD,4BAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEvC,CAAC;CACjB;AALD,kCAKC;AAED,MAAa,SAAU,SAAQ,eAAM;IAArC;QACE,mCAAmC;;QAEnC,6BAAwB,GAA6B,EAAE,CAAC;QAExD,gBAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IA4WlC,CAAC;IA1WC,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,8BAA8B,CAAC,eAAuB,EAAE,KAA8B;QACpF,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;IAED,gCAAgC;QAC9B,4CAA4C;QAC5C,6DAA6D;QAC7D,IAAI,CAAC,8BAA8B,CAAC,QAAQ,EAAE;YAC5C,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,KAAK,CAAC;gBAC3B,aAAa,EAAE,CAAC,MAAM,CAAC;aACxB;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;gBAC/C,aAAa,EAAE,CAAC,MAAM,CAAC;aACxB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,CAAC,aAAa,EAAE;YACjD,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,GAAG,EAAE;gBACH,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;aACtC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;aAC1D;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,CAAC,UAAU,EAAE;YAC9C,IAAI,EAAE;gBACJ,kBAAkB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aACpC;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,CAAC;aAC/B;YACD,MAAM,EAAE;gBACN,kBAAkB,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;IAEK,kBAAkB,CAAC,aAAgC,EAAE,WAAW;;YACpE,MAAM,aAAa,CAAC,UAAU,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,WAAW;gBACxB,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,gBAAgB,CAAC,WAAoC,EAAE,WAAW;;YACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAW,CAAC,CAAC;YAClE,MAAM,WAAW,CAAC,UAAU,CAAC;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI;gBACJ,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAW;gBAC5C,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,eAAe;;YACnB,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;gBAC3D,OAAO,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;aAC5C,CAAC,CAAgB,CAAC;YAEnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;gBACxB,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAwB,EAAE;oBACnE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;iBAC/C;aACF;QACH,CAAC;KAAA;IAEK,UAAU;;YACd,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC;gBACzB,uBAAuB,EAAvB,iDAAuB;gBACvB,iBAAiB,EAAjB,qCAAiB;gBACjB,SAAS,EAAT,qBAAS;aACV,CAAC,CAAC;YAEH,IAAI,CAAC,gCAAgC,EAAE,CAAC;YAExC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,2CAAuB,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,0CAAuB,CAAC,CAAC;YAEnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,aAAa,EAAE,wBAAW,CAAC,CAAC;YAErE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,iCAAiC,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBACzE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhC,KAAK,CAAC,UAAU,CAAC;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;gBAEH,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAwB,EAAE;oBACzF,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;iBACtD;gBAED,mBAAmB;gBACnB,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;oBACxB,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBAC9C,MAAM,EAAE;4BACN,OAAO,EAAE,KAAK;yBACf;wBACD,MAAM,EAAE;4BACN,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;yBAC9B;wBACD,KAAK,EAAE,KAAK;wBACZ,WAAW;qBACZ,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,0CAA0C,EAAE,CAAO,KAAwB,EAAE,OAAO,EAAE,EAAE;gBACrG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC5D,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,mDAAmD,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC3F,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAChC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;oBACvC,WAAW;iBACZ,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACvD,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,6BAA6B,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBACrE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,0BAA0B,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAClE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAChC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC;oBACxD,MAAM,EAAE;wBACN,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;qBACxB;oBACD,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC5D,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhC,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,eAAe,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC;oBACrF,MAAM,EAAE;wBACN,eAAe,EAAE,cAAc;qBAChC;oBACD,WAAW;oBACX,OAAO,EAAE,CAAC,UAAU,CAAC;iBACtB,CAAC,CAA8B,CAAC;gBAEjC,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;oBACxD,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,CAAC;oBAEzC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;wBAC9D,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAW;wBAC9C,MAAM,EAAE;4BACN,MAAM,EAAE,SAAS;yBAClB;wBACD,WAAW;qBACZ,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7D,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC;oBACpF,MAAM,EAAE;wBACN,eAAe,EAAE,cAAc;wBAC/B,eAAe,EAAE,CAAC,SAAS,CAAC;qBAC7B;oBACD,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;gBAEH,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE;oBAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;oBACxD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;oBAE/D,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;wBAC9D,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAW;wBAC9C,MAAM,EAAE;4BACN,MAAM,EAAE,SAAS;yBAClB;wBACD,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAC;iBACJ;YACH,CAAC,CAAA,CAAC,CAAC;YAEH,iCAAiC;YACjC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,GAAS,EAAE;gBACpC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAO,MAAM,EAAE,EAAE;gBAClD,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE;oBAC7C,OAAO;iBACR;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM,KAAK,CAAC,UAAU,CAAC;oBACrB,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,KAAK,EAAE,eAAe;4BACtB,MAAM,EAAE,IAAI;yBACb;wBACD;4BACE,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,gBAAgB;4BACvB,cAAc,EAAE,IAAI;4BACpB,YAAY,EAAE,IAAI;4BAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;yBACzE;wBACD;4BACE,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,iBAAiB;4BACxB,YAAY,EAAE,IAAI;4BAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE;4BACtE,OAAO,EAAE,IAAI;yBACd;qBACF;iBACF,CAAC,CAAC;gBACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;gBAC/E,MAAM,oBAAoB,CAAC,UAAU,CAAC;oBACpC,OAAO,EAAE;wBACP;4BACE,GAAG,EAAE,KAAK;4BACV,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE,EAAE;yBACV;wBACD;4BACE,GAAG,EAAE,KAAK;4BACV,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE;gCACL,WAAW,EAAE,gCAAgC;6BAC9C;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAE/E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAEvF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;gBACnC,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAO,GAAG,EAAE,IAAI,EAAE,EAAE;gBACzC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBACxD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;gBACvC,IAAI,UAAU,KAAK,MAAM,IAAI,YAAY,KAAK,OAAO,EAAE;oBACrD,IAAI,CAAC,aAAa,EAAE;wBAClB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;4BACrB,MAAM,EAAE;gCACN,UAAU,EAAE,WAAW;6BACxB;yBACF,CAAC,CAAC;qBACJ;iBACF;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAA,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAO,GAAY,EAAE,IAAI,EAAE,EAAE;;gBAC5C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAChD,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE;oBACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,0CAAE,GAAG,0CAAE,MAAM,0CAAE,MAAM,CAAC,EAAE;wBACxD,OAAO,IAAI,EAAE,CAAC;qBACf;oBACD,IAAI,UAAsB,CAAC;oBAC3B,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;wBAC9B,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBAClE,MAAM,KAAK,GAAG,MAAA,MAAA,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,0CAAE,QAAQ,mDAAG,eAAe,CAAC,CAAC;wBAChF,IAAI,KAAK,CAAC,MAAM,EAAE;4BAChB,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;yBACjD;qBACF;yBAAM;wBACL,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;qBACjD;oBACD,IAAI,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;wBACpD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;qBACtD;iBACF;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAO,GAAY,EAAE,IAAI,EAAE,EAAE;;gBAC5C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE;oBAC5C,IAAI,CAAC,CAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,0CAAE,GAAG,0CAAE,MAAM,CAAA,EAAE;wBACjC,OAAO,IAAI,EAAE,CAAC;qBACf;oBACD,gBAAgB;oBAChB,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;oBACxC,4BAA4B;oBAC5B,MAAM,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBACzE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;oBACpE,IAAI,MAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,0CAAE,WAAW,EAAE;wBACzC,IAAI,MAAM,EAAE;4BACV,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;yBAC5B;6BAAM;4BACL,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;yBAC5B;qBACF;yBAAM;wBACL,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,0CAAE,MAAM,KAAI,EAAE,EAAE,GAAG,CAAC,CAAC;wBACpE,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC;4BACxE,UAAU,EAAE,UAAU;4BACtB,MAAM;yBACP,CAAC,CAAC;wBACH,IAAI,CAAC,cAAc,EAAE;4BACnB,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC;yBAC5B;qBACF;iBACF;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAA,CAAC,CAAC;QACL,CAAC;KAAA;IAEK,OAAO;;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAM,aAAa,CAAC,CAAC;YACvD,IAAI,IAAI,EAAE;gBACR,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC3B;QACH,CAAC;KAAA;IAEK,IAAI;;YACR,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;gBACvB,SAAS,EAAE,IAAA,cAAO,EAAC,SAAS,EAAE,aAAa,CAAC;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAChD,CAAC;KAAA;IAED,OAAO;QACL,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACF;AAjXD,8BAiXC;AAED,kBAAe,SAAS,CAAC","sourcesContent":["import { Context } from '@nocobase/actions';\nimport { Collection } from '@nocobase/database';\nimport { Plugin } from '@nocobase/server';\nimport { resolve } from 'path';\nimport { availableActionResource } from './actions/available-actions';\nimport { checkAction } from './actions/role-check';\nimport { roleCollectionsResource } from './actions/role-collections';\nimport { RoleModel } from './model/RoleModel';\nimport { RoleResourceActionModel } from './model/RoleResourceActionModel';\nimport { RoleResourceModel } from './model/RoleResourceModel';\n\nexport interface AssociationFieldAction {\n associationActions: string[];\n targetActions?: string[];\n}\n\ninterface AssociationFieldActions {\n [availableActionName: string]: AssociationFieldAction;\n}\n\nexport interface AssociationFieldsActions {\n [associationType: string]: AssociationFieldActions;\n}\n\nexport class GrantHelper {\n resourceTargetActionMap = new Map<string, string[]>();\n targetActionResourceMap = new Map<string, string[]>();\n\n constructor() {}\n}\n\nexport class PluginACL extends Plugin {\n // association field actions config\n\n associationFieldsActions: AssociationFieldsActions = {};\n\n grantHelper = new GrantHelper();\n\n get acl() {\n return this.app.acl;\n }\n\n registerAssociationFieldAction(associationType: string, value: AssociationFieldActions) {\n this.associationFieldsActions[associationType] = value;\n }\n\n registerAssociationFieldsActions() {\n // if grant create action to role, it should\n // also grant add action and association target's view action\n this.registerAssociationFieldAction('linkTo', {\n view: {\n associationActions: ['list', 'get'],\n },\n create: {\n associationActions: ['add'],\n targetActions: ['view'],\n },\n update: {\n associationActions: ['add', 'remove', 'toggle'],\n targetActions: ['view'],\n },\n });\n\n this.registerAssociationFieldAction('attachments', {\n view: {\n associationActions: ['list', 'get'],\n },\n add: {\n associationActions: ['upload', 'add'],\n },\n update: {\n associationActions: ['update', 'add', 'remove', 'toggle'],\n },\n });\n\n this.registerAssociationFieldAction('subTable', {\n view: {\n associationActions: ['list', 'get'],\n },\n create: {\n associationActions: ['create'],\n },\n update: {\n associationActions: ['update', 'destroy'],\n },\n });\n }\n\n async writeResourceToACL(resourceModel: RoleResourceModel, transaction) {\n await resourceModel.writeToACL({\n acl: this.acl,\n associationFieldsActions: this.associationFieldsActions,\n transaction: transaction,\n grantHelper: this.grantHelper,\n });\n }\n\n async writeActionToACL(actionModel: RoleResourceActionModel, transaction) {\n const resource = actionModel.get('resource') as RoleResourceModel;\n const role = this.acl.getRole(resource.get('roleName') as string);\n await actionModel.writeToACL({\n acl: this.acl,\n role,\n resourceName: resource.get('name') as string,\n associationFieldsActions: this.associationFieldsActions,\n grantHelper: this.grantHelper,\n });\n }\n\n async writeRolesToACL() {\n const roles = (await this.app.db.getRepository('roles').find({\n appends: ['resources', 'resources.actions'],\n })) as RoleModel[];\n\n for (const role of roles) {\n role.writeToAcl({ acl: this.acl });\n for (const resource of role.get('resources') as RoleResourceModel[]) {\n await this.writeResourceToACL(resource, null);\n }\n }\n }\n\n async beforeLoad() {\n this.app.db.registerModels({\n RoleResourceActionModel,\n RoleResourceModel,\n RoleModel,\n });\n\n this.registerAssociationFieldsActions();\n\n this.app.resourcer.define(availableActionResource);\n this.app.resourcer.define(roleCollectionsResource);\n\n this.app.resourcer.registerActionHandler('roles:check', checkAction);\n\n this.app.db.on('roles.afterSaveWithAssociations', async (model, options) => {\n const { transaction } = options;\n\n model.writeToAcl({\n acl: this.acl,\n });\n\n for (const resource of (await model.getResources({ transaction })) as RoleResourceModel[]) {\n await this.writeResourceToACL(resource, transaction);\n }\n\n // model is default\n if (model.get('default')) {\n await this.app.db.getRepository('roles').update({\n values: {\n default: false,\n },\n filter: {\n 'name.$ne': model.get('name'),\n },\n hooks: false,\n transaction,\n });\n }\n });\n\n this.app.db.on('roles.afterDestroy', (model) => {\n const roleName = model.get('name');\n this.acl.removeRole(roleName);\n });\n\n this.app.db.on('rolesResources.afterSaveWithAssociations', async (model: RoleResourceModel, options) => {\n await this.writeResourceToACL(model, options.transaction);\n });\n\n this.app.db.on('rolesResourcesActions.afterUpdateWithAssociations', async (model, options) => {\n const { transaction } = options;\n const resource = await model.getResource({\n transaction,\n });\n\n await this.writeResourceToACL(resource, transaction);\n });\n\n this.app.db.on('rolesResources.afterDestroy', async (model, options) => {\n const role = this.acl.getRole(model.get('roleName'));\n role.revokeResource(model.get('name'));\n });\n\n this.app.db.on('collections.afterDestroy', async (model, options) => {\n const { transaction } = options;\n await this.app.db.getRepository('rolesResources').destroy({\n filter: {\n name: model.get('name'),\n },\n transaction,\n });\n });\n\n this.app.db.on('fields.afterCreate', async (model, options) => {\n const { transaction } = options;\n\n const collectionName = model.get('collectionName');\n const fieldName = model.get('name');\n\n const resourceActions = (await this.app.db.getRepository('rolesResourcesActions').find({\n filter: {\n 'resource.name': collectionName,\n },\n transaction,\n appends: ['resource'],\n })) as RoleResourceActionModel[];\n\n for (const resourceAction of resourceActions) {\n const fields = resourceAction.get('fields') as string[];\n const newFields = [...fields, fieldName];\n\n await this.app.db.getRepository('rolesResourcesActions').update({\n filterByTk: resourceAction.get('id') as number,\n values: {\n fields: newFields,\n },\n transaction,\n });\n }\n });\n\n this.app.db.on('fields.afterDestroy', async (model, options) => {\n const collectionName = model.get('collectionName');\n const fieldName = model.get('name');\n\n const resourceActions = await this.app.db.getRepository('rolesResourcesActions').find({\n filter: {\n 'resource.name': collectionName,\n 'fields.$anyOf': [fieldName],\n },\n transaction: options.transaction,\n });\n\n for (const resourceAction of resourceActions) {\n const fields = resourceAction.get('fields') as string[];\n const newFields = fields.filter((field) => field != fieldName);\n\n await this.app.db.getRepository('rolesResourcesActions').update({\n filterByTk: resourceAction.get('id') as number,\n values: {\n fields: newFields,\n },\n transaction: options.transaction,\n });\n }\n });\n\n // sync database role data to acl\n this.app.on('beforeStart', async () => {\n await this.writeRolesToACL();\n });\n\n this.app.on('beforeInstallPlugin', async (plugin) => {\n if (plugin.constructor.name !== 'UsersPlugin') {\n return;\n }\n const roles = this.app.db.getRepository('roles');\n await roles.createMany({\n records: [\n {\n name: 'root',\n title: '{{t(\"Root\")}}',\n hidden: true,\n },\n {\n name: 'admin',\n title: '{{t(\"Admin\")}}',\n allowConfigure: true,\n allowNewMenu: true,\n strategy: { actions: ['create', 'export', 'view', 'update', 'destroy'] },\n },\n {\n name: 'member',\n title: '{{t(\"Member\")}}',\n allowNewMenu: true,\n strategy: { actions: ['view', 'update:own', 'destroy:own', 'create'] },\n default: true,\n },\n ],\n });\n const rolesResourcesScopes = this.app.db.getRepository('rolesResourcesScopes');\n await rolesResourcesScopes.createMany({\n records: [\n {\n key: 'all',\n name: '{{t(\"All records\")}}',\n scope: {},\n },\n {\n key: 'own',\n name: '{{t(\"Own records\")}}',\n scope: {\n createdById: '{{ ctx.state.currentUser.id }}',\n },\n },\n ],\n });\n });\n\n this.app.acl.allow('roles', 'check', 'loggedIn');\n this.app.acl.allow('roles', ['create', 'update', 'destroy'], 'allowConfigure');\n\n this.app.acl.allow('roles.menuUiSchemas', ['set', 'toggle', 'list'], 'allowConfigure');\n\n this.app.acl.allow('*', '*', (ctx) => {\n return ctx.state.currentRole === 'root';\n });\n\n this.app.resourcer.use(async (ctx, next) => {\n const { actionName, resourceName, params } = ctx.action;\n const { showAnonymous } = params || {};\n if (actionName === 'list' && resourceName === 'roles') {\n if (!showAnonymous) {\n ctx.action.mergeParams({\n filter: {\n 'name.$ne': 'anonymous',\n },\n });\n }\n }\n await next();\n });\n\n this.app.acl.use(async (ctx: Context, next) => {\n const { actionName, resourceName } = ctx.action;\n if (actionName === 'get' || actionName === 'list') {\n if (!Array.isArray(ctx?.permission?.can?.params?.fields)) {\n return next();\n }\n let collection: Collection;\n if (resourceName.includes('.')) {\n const [collectionName, associationName] = resourceName.split('.');\n const field = ctx.db.getCollection(collectionName)?.getField?.(associationName);\n if (field.target) {\n collection = ctx.db.getCollection(field.target);\n }\n } else {\n collection = ctx.db.getCollection(resourceName);\n }\n if (collection && collection.hasField('createdById')) {\n ctx.permission.can.params.fields.push('createdById');\n }\n }\n return next();\n });\n\n const parseJsonTemplate = this.app.acl.parseJsonTemplate;\n this.app.acl.use(async (ctx: Context, next) => {\n const { actionName, resourceName, resourceOf } = ctx.action;\n if (resourceName.includes('.') && resourceOf) {\n if (!ctx?.permission?.can?.params) {\n return next();\n }\n // 关联数据去掉 filter\n delete ctx.permission.can.params.filter;\n // 关联数据能不能处理取决于 source 是否有权限\n const [collectionName] = resourceName.split('.');\n const action = ctx.can({ resource: collectionName, action: actionName });\n const availableAction = this.app.acl.getAvailableAction(actionName);\n if (availableAction?.options?.onNewRecord) {\n if (action) {\n ctx.permission.skip = true;\n } else {\n ctx.permission.can = false;\n }\n } else {\n const filter = parseJsonTemplate(action?.params?.filter || {}, ctx);\n const sourceInstance = await ctx.db.getRepository(collectionName).findOne({\n filterByTk: resourceOf,\n filter,\n });\n if (!sourceInstance) {\n ctx.permission.can = false;\n }\n }\n }\n await next();\n });\n }\n\n async install() {\n const repo = this.db.getRepository<any>('collections');\n if (repo) {\n await repo.db2cm('roles');\n }\n }\n\n async load() {\n await this.app.db.import({\n directory: resolve(__dirname, 'collections'),\n });\n\n this.app.resourcer.use(this.acl.middleware());\n }\n\n getName(): string {\n return this.getPackageName(__dirname);\n }\n}\n\nexport default PluginACL;\n"]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@nocobase/plugin-acl",
|
|
3
|
-
"version": "0.7.0-alpha.
|
|
3
|
+
"version": "0.7.0-alpha.31",
|
|
4
4
|
"description": "",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"licenses": [
|
|
@@ -17,14 +17,14 @@
|
|
|
17
17
|
"build:esm": "tsc --project tsconfig.build.json --module es2015 --outDir esm"
|
|
18
18
|
},
|
|
19
19
|
"dependencies": {
|
|
20
|
-
"@nocobase/acl": "0.7.0-alpha.
|
|
21
|
-
"@nocobase/database": "0.7.0-alpha.
|
|
22
|
-
"@nocobase/server": "0.7.0-alpha.
|
|
20
|
+
"@nocobase/acl": "0.7.0-alpha.31",
|
|
21
|
+
"@nocobase/database": "0.7.0-alpha.31",
|
|
22
|
+
"@nocobase/server": "0.7.0-alpha.31"
|
|
23
23
|
},
|
|
24
24
|
"repository": {
|
|
25
25
|
"type": "git",
|
|
26
26
|
"url": "git+https://github.com/nocobase/nocobase.git",
|
|
27
27
|
"directory": "packages/plugins/acl"
|
|
28
28
|
},
|
|
29
|
-
"gitHead": "
|
|
29
|
+
"gitHead": "109f785637762d6bd85b1b18d75a7cfdedac383e"
|
|
30
30
|
}
|