@nocobase/plugin-acl 0.7.0-alpha.8 → 0.7.0-alpha.82

package/esm/model/RoleModel.d.ts

@@ -1,7 +0,0 @@
-import { Model } from '@nocobase/database';
-import { ACL } from '@nocobase/acl';
-export declare class RoleModel extends Model {
-    writeToAcl(options: {
-        acl: ACL;
-    }): void;
-}

package/esm/model/RoleModel.js

@@ -1,15 +0,0 @@
-import { Model } from '@nocobase/database';
-export class RoleModel extends Model {
-    writeToAcl(options) {
-        const { acl } = options;
-        const roleName = this.get('name');
-        let role = acl.getRole(roleName);
-        if (!role) {
-            role = acl.define({
-                role: roleName,
-            });
-        }
-        role.setStrategy(Object.assign(Object.assign({}, (this.get('strategy') || {})), { allowConfigure: this.get('allowConfigure') }));
-    }
-}
-//# sourceMappingURL=RoleModel.js.map

package/esm/model/RoleModel.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RoleModel.js","sourceRoot":"","sources":["../../src/model/RoleModel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,UAAU,CAAC,OAAqB;QAC9B,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;QAC5C,IAAI,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEjC,IAAI,CAAC,IAAI,EAAE;YACT,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC;gBAChB,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;SACJ;QAED,IAAI,CAAC,WAAW,iCACX,CAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAY,IAAI,EAAE,CAAC,KAC3C,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAY,IACrD,CAAC;IACL,CAAC;CACF","sourcesContent":["import { Model } from '@nocobase/database';\nimport { ACL } from '@nocobase/acl';\n\nexport class RoleModel extends Model {\n  writeToAcl(options: { acl: ACL }) {\n    const { acl } = options;\n    const roleName = this.get('name') as string;\n    let role = acl.getRole(roleName);\n\n    if (!role) {\n      role = acl.define({\n        role: roleName,\n      });\n    }\n\n    role.setStrategy({\n      ...((this.get('strategy') as object) || {}),\n      allowConfigure: this.get('allowConfigure') as boolean,\n    });\n  }\n}\n"]}

package/esm/model/RoleResourceActionModel.d.ts

@@ -1,12 +0,0 @@
-import { ACL, ACLRole } from '@nocobase/acl';
-import { Model } from '@nocobase/database';
-import { AssociationFieldsActions, GrantHelper } from '../server';
-export declare class RoleResourceActionModel extends Model {
-    writeToACL(options: {
-        acl: ACL;
-        role: ACLRole;
-        resourceName: string;
-        associationFieldsActions: AssociationFieldsActions;
-        grantHelper: GrantHelper;
-    }): Promise<void>;
-}

package/esm/model/RoleResourceActionModel.js

@@ -1,65 +0,0 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import { Model } from '@nocobase/database';
-export class RoleResourceActionModel extends Model {
-    writeToACL(options) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            // @ts-ignore
-            const db = this.constructor.database;
-            const { resourceName, role, acl, associationFieldsActions, grantHelper } = options;
-            const actionName = this.get('name');
-            const fields = this.get('fields');
-            const actionPath = `${resourceName}:${actionName}`;
-            const actionParams = {
-                fields,
-            };
-            // @ts-ignore
-            const scope = yield this.getScope();
-            if (scope) {
-                actionParams['own'] = scope.get('key') === 'own';
-                actionParams['filter'] = scope.get('scope');
-            }
-            role.grantAction(actionPath, actionParams);
-            const collection = db.getCollection(resourceName);
-            if (!collection) {
-                return;
-            }
-            const availableAction = acl.resolveActionAlias(actionName);
-            for (const field of fields) {
-                const collectionField = collection.getField(field);
-                const fieldType = collectionField.get('interface');
-                const fieldActions = (_a = associationFieldsActions === null || associationFieldsActions === void 0 ? void 0 : associationFieldsActions[fieldType]) === null || _a === void 0 ? void 0 : _a[availableAction];
-                const fieldTarget = collectionField.get('target');
-                if (fieldActions) {
-                    const associationActions = fieldActions.associationActions || [];
-                    associationActions.forEach((associationAction) => {
-                        const actionName = `${resourceName}.${fieldTarget}:${associationAction}`;
-                        role.grantAction(actionName);
-                    });
-                    const targetActions = fieldActions.targetActions || [];
-                    targetActions.forEach((targetAction) => {
-                        const targetActionPath = `${fieldTarget}:${targetAction}`;
-                        grantHelper.resourceTargetActionMap.set(resourceName, [
-                            ...(grantHelper.resourceTargetActionMap.get(resourceName) || []),
-                            targetActionPath,
-                        ]);
-                        grantHelper.targetActionResourceMap.set(targetActionPath, [
-                            ...(grantHelper.targetActionResourceMap.get(targetActionPath) || []),
-                            resourceName,
-                        ]);
-                        role.grantAction(targetActionPath);
-                    });
-                }
-            }
-        });
-    }
-}
-//# sourceMappingURL=RoleResourceActionModel.js.map

package/esm/model/RoleResourceActionModel.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RoleResourceActionModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceActionModel.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAY,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC1C,UAAU,CAAC,OAMhB;;;YACC,aAAa;YACb,MAAM,EAAE,GAAa,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAE/C,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YAEnF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;YAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAQ,CAAC;YAEzC,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;YACnD,MAAM,YAAY,GAAG;gBACnB,MAAM;aACP,CAAC;YAEF,aAAa;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAEpC,IAAI,KAAK,EAAE;gBACT,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;gBACjD,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aAC7C;YAED,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAElD,IAAI,CAAC,UAAU,EAAE;gBACf,OAAO;aACR;YAED,MAAM,eAAe,GAAG,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAE3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;gBAC1B,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;gBAE7D,MAAM,YAAY,GAA2B,MAAA,wBAAwB,aAAxB,wBAAwB,uBAAxB,wBAAwB,CAAG,SAAS,CAAC,0CAAG,eAAe,CAAC,CAAC;gBAEtG,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAElD,IAAI,YAAY,EAAE;oBAChB,MAAM,kBAAkB,GAAG,YAAY,CAAC,kBAAkB,IAAI,EAAE,CAAC;oBACjE,kBAAkB,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,EAAE;wBAC/C,MAAM,UAAU,GAAG,GAAG,YAAY,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;wBACzE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;oBAC/B,CAAC,CAAC,CAAC;oBAEH,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC;oBAEvD,aAAa,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;wBACrC,MAAM,gBAAgB,GAAG,GAAG,WAAW,IAAI,YAAY,EAAE,CAAC;wBAE1D,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE;4BACpD,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;4BAChE,gBAAgB;yBACjB,CAAC,CAAC;wBAEH,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,EAAE;4BACxD,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;4BACpE,YAAY;yBACb,CAAC,CAAC;wBAEH,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;oBACrC,CAAC,CAAC,CAAC;iBACJ;aACF;;KACF;CACF","sourcesContent":["import { ACL, ACLRole } from '@nocobase/acl';\nimport { Database, Model } from '@nocobase/database';\nimport { AssociationFieldAction, AssociationFieldsActions, GrantHelper } from '../server';\n\nexport class RoleResourceActionModel extends Model {\n  async writeToACL(options: {\n    acl: ACL;\n    role: ACLRole;\n    resourceName: string;\n    associationFieldsActions: AssociationFieldsActions;\n    grantHelper: GrantHelper;\n  }) {\n    // @ts-ignore\n    const db: Database = this.constructor.database;\n\n    const { resourceName, role, acl, associationFieldsActions, grantHelper } = options;\n\n    const actionName = this.get('name') as string;\n\n    const fields = this.get('fields') as any;\n\n    const actionPath = `${resourceName}:${actionName}`;\n    const actionParams = {\n      fields,\n    };\n\n    // @ts-ignore\n    const scope = await this.getScope();\n\n    if (scope) {\n      actionParams['own'] = scope.get('key') === 'own';\n      actionParams['filter'] = scope.get('scope');\n    }\n\n    role.grantAction(actionPath, actionParams);\n\n    const collection = db.getCollection(resourceName);\n\n    if (!collection) {\n      return;\n    }\n\n    const availableAction = acl.resolveActionAlias(actionName);\n\n    for (const field of fields) {\n      const collectionField = collection.getField(field);\n      const fieldType = collectionField.get('interface') as string;\n\n      const fieldActions: AssociationFieldAction = associationFieldsActions?.[fieldType]?.[availableAction];\n\n      const fieldTarget = collectionField.get('target');\n\n      if (fieldActions) {\n        const associationActions = fieldActions.associationActions || [];\n        associationActions.forEach((associationAction) => {\n          const actionName = `${resourceName}.${fieldTarget}:${associationAction}`;\n          role.grantAction(actionName);\n        });\n\n        const targetActions = fieldActions.targetActions || [];\n\n        targetActions.forEach((targetAction) => {\n          const targetActionPath = `${fieldTarget}:${targetAction}`;\n\n          grantHelper.resourceTargetActionMap.set(resourceName, [\n            ...(grantHelper.resourceTargetActionMap.get(resourceName) || []),\n            targetActionPath,\n          ]);\n\n          grantHelper.targetActionResourceMap.set(targetActionPath, [\n            ...(grantHelper.targetActionResourceMap.get(targetActionPath) || []),\n            resourceName,\n          ]);\n\n          role.grantAction(targetActionPath);\n        });\n      }\n    }\n  }\n}\n"]}

package/esm/model/RoleResourceModel.d.ts

@@ -1,16 +0,0 @@
-import { Model } from '@nocobase/database';
-import { ACL, ACLRole } from '@nocobase/acl';
-import { AssociationFieldsActions, GrantHelper } from '../server';
-export declare class RoleResourceModel extends Model {
-    revoke(options: {
-        role: ACLRole;
-        resourceName: string;
-        grantHelper: GrantHelper;
-    }): Promise<void>;
-    writeToACL(options: {
-        acl: ACL;
-        associationFieldsActions: AssociationFieldsActions;
-        grantHelper: GrantHelper;
-        transaction: any;
-    }): Promise<void>;
-}

package/esm/model/RoleResourceModel.js

@@ -1,55 +0,0 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import { Model } from '@nocobase/database';
-export class RoleResourceModel extends Model {
-    revoke(options) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { role, resourceName, grantHelper } = options;
-            role.revokeResource(resourceName);
-            const targetActions = grantHelper.resourceTargetActionMap.get(resourceName) || [];
-            for (const targetAction of targetActions) {
-                const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter((item) => resourceName !== item);
-                grantHelper.targetActionResourceMap.set(targetAction, targetActionResource);
-                if (targetActionResource.length == 0) {
-                    role.revokeAction(targetAction);
-                }
-            }
-            grantHelper.resourceTargetActionMap.set(resourceName, []);
-        });
-    }
-    writeToACL(options) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { acl, associationFieldsActions, grantHelper } = options;
-            const resourceName = this.get('name');
-            const roleName = this.get('roleName');
-            const role = acl.getRole(roleName);
-            // revoke resource of role
-            yield this.revoke({ role, resourceName, grantHelper });
-            // @ts-ignore
-            if (this.usingActionsConfig === false) {
-                return;
-            }
-            // @ts-ignore
-            const actions = yield this.getActions({
-                transaction: options.transaction,
-            });
-            for (const action of actions) {
-                yield action.writeToACL({
-                    acl,
-                    role,
-                    resourceName,
-                    associationFieldsActions,
-                    grantHelper: options.grantHelper,
-                });
-            }
-        });
-    }
-}
-//# sourceMappingURL=RoleResourceModel.js.map

package/esm/model/RoleResourceModel.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RoleResourceModel.js","sourceRoot":"","sources":["../../src/model/RoleResourceModel.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAY,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAKrD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACpC,MAAM,CAAC,OAA0E;;YACrF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAElC,MAAM,aAAa,GAAG,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YAElF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE;gBACxC,MAAM,oBAAoB,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/F,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,KAAK,IAAI,CAChC,CAAC;gBAEF,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;gBAC5E,IAAI,oBAAoB,CAAC,MAAM,IAAI,CAAC,EAAE;oBACpC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;iBACjC;aACF;YAED,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;KAAA;IAEK,UAAU,CAAC,OAKhB;;YACC,MAAM,EAAE,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;YAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAW,CAAC;YAChD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAEnC,0BAA0B;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAEvD,aAAa;YACb,IAAI,IAAI,CAAC,kBAAkB,KAAK,KAAK,EAAE;gBACrC,OAAO;aACR;YAED,aAAa;YACb,MAAM,OAAO,GAA8B,MAAM,IAAI,CAAC,UAAU,CAAC;gBAC/D,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;YAEH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE;gBAC5B,MAAM,MAAM,CAAC,UAAU,CAAC;oBACtB,GAAG;oBACH,IAAI;oBACJ,YAAY;oBACZ,wBAAwB;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;aACJ;QACH,CAAC;KAAA;CACF","sourcesContent":["import { Database, Model } from '@nocobase/database';\nimport { ACL, ACLRole } from '@nocobase/acl';\nimport { RoleResourceActionModel } from './RoleResourceActionModel';\nimport { AssociationFieldsActions, GrantHelper } from '../server';\n\nexport class RoleResourceModel extends Model {\n  async revoke(options: { role: ACLRole; resourceName: string; grantHelper: GrantHelper }) {\n    const { role, resourceName, grantHelper } = options;\n    role.revokeResource(resourceName);\n\n    const targetActions = grantHelper.resourceTargetActionMap.get(resourceName) || [];\n\n    for (const targetAction of targetActions) {\n      const targetActionResource = (grantHelper.targetActionResourceMap.get(targetAction) || []).filter(\n        (item) => resourceName !== item,\n      );\n\n      grantHelper.targetActionResourceMap.set(targetAction, targetActionResource);\n      if (targetActionResource.length == 0) {\n        role.revokeAction(targetAction);\n      }\n    }\n\n    grantHelper.resourceTargetActionMap.set(resourceName, []);\n  }\n\n  async writeToACL(options: {\n    acl: ACL;\n    associationFieldsActions: AssociationFieldsActions;\n    grantHelper: GrantHelper;\n    transaction: any;\n  }) {\n    const { acl, associationFieldsActions, grantHelper } = options;\n    const resourceName = this.get('name') as string;\n    const roleName = this.get('roleName') as string;\n    const role = acl.getRole(roleName);\n\n    // revoke resource of role\n    await this.revoke({ role, resourceName, grantHelper });\n\n    // @ts-ignore\n    if (this.usingActionsConfig === false) {\n      return;\n    }\n\n    // @ts-ignore\n    const actions: RoleResourceActionModel[] = await this.getActions({\n      transaction: options.transaction,\n    });\n\n    for (const action of actions) {\n      await action.writeToACL({\n        acl,\n        role,\n        resourceName,\n        associationFieldsActions,\n        grantHelper: options.grantHelper,\n      });\n    }\n  }\n}\n"]}

package/esm/server.d.ts

@@ -1,33 +0,0 @@
-import { Plugin } from '@nocobase/server';
-import { RoleResourceActionModel } from './model/RoleResourceActionModel';
-import { RoleResourceModel } from './model/RoleResourceModel';
-export interface AssociationFieldAction {
-    associationActions: string[];
-    targetActions?: string[];
-}
-interface AssociationFieldActions {
-    [availableActionName: string]: AssociationFieldAction;
-}
-export interface AssociationFieldsActions {
-    [associationType: string]: AssociationFieldActions;
-}
-export declare class GrantHelper {
-    resourceTargetActionMap: Map<string, string[]>;
-    targetActionResourceMap: Map<string, string[]>;
-    constructor();
-}
-export declare class PluginACL extends Plugin {
-    associationFieldsActions: AssociationFieldsActions;
-    grantHelper: GrantHelper;
-    get acl(): import("@nocobase/acl").ACL;
-    registerAssociationFieldAction(associationType: string, value: AssociationFieldActions): void;
-    registerAssociationFieldsActions(): void;
-    writeResourceToACL(resourceModel: RoleResourceModel, transaction: any): Promise<void>;
-    writeActionToACL(actionModel: RoleResourceActionModel, transaction: any): Promise<void>;
-    writeRolesToACL(): Promise<void>;
-    beforeLoad(): Promise<void>;
-    install(): Promise<void>;
-    load(): Promise<void>;
-    getName(): string;
-}
-export default PluginACL;

package/esm/server.js

@@ -1,366 +0,0 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import { Plugin } from '@nocobase/server';
-import { resolve } from 'path';
-import { availableActionResource } from './actions/available-actions';
-import { checkAction } from './actions/role-check';
-import { roleCollectionsResource } from './actions/role-collections';
-import { RoleModel } from './model/RoleModel';
-import { RoleResourceActionModel } from './model/RoleResourceActionModel';
-import { RoleResourceModel } from './model/RoleResourceModel';
-export class GrantHelper {
-    constructor() {
-        this.resourceTargetActionMap = new Map();
-        this.targetActionResourceMap = new Map();
-    }
-}
-export class PluginACL extends Plugin {
-    constructor() {
-        super(...arguments);
-        this.associationFieldsActions = {};
-        this.grantHelper = new GrantHelper();
-    }
-    get acl() {
-        return this.app.acl;
-    }
-    registerAssociationFieldAction(associationType, value) {
-        this.associationFieldsActions[associationType] = value;
-    }
-    registerAssociationFieldsActions() {
-        this.registerAssociationFieldAction('linkTo', {
-            view: {
-                associationActions: ['list', 'get'],
-            },
-            create: {
-                associationActions: ['add'],
-                targetActions: ['view'],
-            },
-            update: {
-                associationActions: ['add', 'remove', 'toggle'],
-                targetActions: ['view'],
-            },
-        });
-        this.registerAssociationFieldAction('attachments', {
-            view: {
-                associationActions: ['list', 'get'],
-            },
-            add: {
-                associationActions: ['upload', 'add'],
-            },
-            update: {
-                associationActions: ['update', 'add', 'remove', 'toggle'],
-            },
-        });
-        this.registerAssociationFieldAction('subTable', {
-            view: {
-                associationActions: ['list', 'get'],
-            },
-            create: {
-                associationActions: ['create'],
-            },
-            update: {
-                associationActions: ['update', 'destroy'],
-            },
-        });
-    }
-    writeResourceToACL(resourceModel, transaction) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield resourceModel.writeToACL({
-                acl: this.acl,
-                associationFieldsActions: this.associationFieldsActions,
-                transaction: transaction,
-                grantHelper: this.grantHelper,
-            });
-        });
-    }
-    writeActionToACL(actionModel, transaction) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const resource = actionModel.get('resource');
-            const role = this.acl.getRole(resource.get('roleName'));
-            yield actionModel.writeToACL({
-                acl: this.acl,
-                role,
-                resourceName: resource.get('name'),
-                associationFieldsActions: this.associationFieldsActions,
-                grantHelper: this.grantHelper,
-            });
-        });
-    }
-    writeRolesToACL() {
-        return __awaiter(this, void 0, void 0, function* () {
-            const roles = (yield this.app.db.getRepository('roles').find({
-                appends: ['resources', 'resources.actions'],
-            }));
-            for (const role of roles) {
-                role.writeToAcl({ acl: this.acl });
-                for (const resource of role.get('resources')) {
-                    yield this.writeResourceToACL(resource, null);
-                }
-            }
-        });
-    }
-    beforeLoad() {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.app.db.registerModels({
-                RoleResourceActionModel,
-                RoleResourceModel,
-                RoleModel,
-            });
-            this.registerAssociationFieldsActions();
-            this.app.resourcer.define(availableActionResource);
-            this.app.resourcer.define(roleCollectionsResource);
-            this.app.resourcer.registerActionHandler('roles:check', checkAction);
-            this.app.db.on('roles.afterSaveWithAssociations', (model, options) => __awaiter(this, void 0, void 0, function* () {
-                const { transaction } = options;
-                model.writeToAcl({
-                    acl: this.acl,
-                });
-                for (const resource of (yield model.getResources({ transaction }))) {
-                    yield this.writeResourceToACL(resource, transaction);
-                }
-                // model is default
-                if (model.get('default')) {
-                    yield this.app.db.getRepository('roles').update({
-                        values: {
-                            default: false,
-                        },
-                        filter: {
-                            'name.$ne': model.get('name'),
-                        },
-                        hooks: false,
-                        transaction,
-                    });
-                }
-            }));
-            this.app.db.on('roles.afterDestroy', (model) => {
-                const roleName = model.get('name');
-                this.acl.removeRole(roleName);
-            });
-            this.app.db.on('rolesResources.afterSaveWithAssociations', (model, options) => __awaiter(this, void 0, void 0, function* () {
-                yield this.writeResourceToACL(model, options.transaction);
-            }));
-            this.app.db.on('rolesResourcesActions.afterUpdateWithAssociations', (model, options) => __awaiter(this, void 0, void 0, function* () {
-                const { transaction } = options;
-                const resource = yield model.getResource({
-                    transaction,
-                });
-                yield this.writeResourceToACL(resource, transaction);
-            }));
-            this.app.db.on('rolesResources.afterDestroy', (model, options) => __awaiter(this, void 0, void 0, function* () {
-                const role = this.acl.getRole(model.get('roleName'));
-                role.revokeResource(model.get('name'));
-            }));
-            this.app.db.on('collections.afterDestroy', (model, options) => __awaiter(this, void 0, void 0, function* () {
-                const { transaction } = options;
-                yield this.app.db.getRepository('rolesResources').destroy({
-                    filter: {
-                        name: model.get('name'),
-                    },
-                    transaction,
-                });
-            }));
-            this.app.db.on('fields.afterCreate', (model, options) => __awaiter(this, void 0, void 0, function* () {
-                const { transaction } = options;
-                const collectionName = model.get('collectionName');
-                const fieldName = model.get('name');
-                const resourceActions = (yield this.app.db.getRepository('rolesResourcesActions').find({
-                    filter: {
-                        'resource.name': collectionName,
-                    },
-                    transaction,
-                    appends: ['resource'],
-                }));
-                for (const resourceAction of resourceActions) {
-                    const fields = resourceAction.get('fields');
-                    const newFields = [...fields, fieldName];
-                    yield this.app.db.getRepository('rolesResourcesActions').update({
-                        filterByTk: resourceAction.get('id'),
-                        values: {
-                            fields: newFields,
-                        },
-                        transaction,
-                    });
-                }
-            }));
-            this.app.db.on('fields.afterDestroy', (model, options) => __awaiter(this, void 0, void 0, function* () {
-                const collectionName = model.get('collectionName');
-                const fieldName = model.get('name');
-                const resourceActions = yield this.app.db.getRepository('rolesResourcesActions').find({
-                    filter: {
-                        'resource.name': collectionName,
-                        'fields.$anyOf': [fieldName],
-                    },
-                    transaction: options.transaction,
-                });
-                for (const resourceAction of resourceActions) {
-                    const fields = resourceAction.get('fields');
-                    const newFields = fields.filter((field) => field != fieldName);
-                    yield this.app.db.getRepository('rolesResourcesActions').update({
-                        filterByTk: resourceAction.get('id'),
-                        values: {
-                            fields: newFields,
-                        },
-                        transaction: options.transaction,
-                    });
-                }
-            }));
-            // sync database role data to acl
-            this.app.on('beforeStart', () => __awaiter(this, void 0, void 0, function* () {
-                yield this.writeRolesToACL();
-            }));
-            this.app.on('beforeInstallPlugin', (plugin) => __awaiter(this, void 0, void 0, function* () {
-                if (plugin.constructor.name !== 'UsersPlugin') {
-                    return;
-                }
-                const roles = this.app.db.getRepository('roles');
-                yield roles.createMany({
-                    records: [
-                        {
-                            name: 'root',
-                            title: '{{t("Root")}}',
-                            hidden: true,
-                        },
-                        {
-                            name: 'admin',
-                            title: '{{t("Admin")}}',
-                            allowConfigure: true,
-                            allowNewMenu: true,
-                            strategy: { actions: ['create', 'export', 'view', 'update', 'destroy'] },
-                        },
-                        {
-                            name: 'member',
-                            title: '{{t("Member")}}',
-                            allowNewMenu: true,
-                            strategy: { actions: ['view', 'update:own', 'destroy:own', 'create'] },
-                            default: true,
-                        },
-                    ],
-                });
-                const rolesResourcesScopes = this.app.db.getRepository('rolesResourcesScopes');
-                yield rolesResourcesScopes.createMany({
-                    records: [
-                        {
-                            key: 'all',
-                            name: '{{t("All records")}}',
-                            scope: {},
-                        },
-                        {
-                            key: 'own',
-                            name: '{{t("Own records")}}',
-                            scope: {
-                                createdById: '{{ ctx.state.currentUser.id }}',
-                            },
-                        },
-                    ],
-                });
-            }));
-            this.app.acl.allow('roles', 'check', 'loggedIn');
-            this.app.acl.allow('roles', ['create', 'update', 'destroy'], 'allowConfigure');
-            this.app.acl.allow('roles.menuUiSchemas', ['set', 'toggle', 'list'], 'allowConfigure');
-            this.app.acl.allow('*', '*', (ctx) => {
-                return ctx.state.currentRole === 'root';
-            });
-            this.app.resourcer.use((ctx, next) => __awaiter(this, void 0, void 0, function* () {
-                const { actionName, resourceName, params } = ctx.action;
-                const { showAnonymous } = params || {};
-                if (actionName === 'list' && resourceName === 'roles') {
-                    if (!showAnonymous) {
-                        ctx.action.mergeParams({
-                            filter: {
-                                'name.$ne': 'anonymous',
-                            },
-                        });
-                    }
-                }
-                yield next();
-            }));
-            this.app.acl.use((ctx, next) => __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c, _d, _e;
-                const { actionName, resourceName } = ctx.action;
-                if (actionName === 'get' || actionName === 'list') {
-                    if (!Array.isArray((_c = (_b = (_a = ctx === null || ctx === void 0 ? void 0 : ctx.permission) === null || _a === void 0 ? void 0 : _a.can) === null || _b === void 0 ? void 0 : _b.params) === null || _c === void 0 ? void 0 : _c.fields)) {
-                        return next();
-                    }
-                    let collection;
-                    if (resourceName.includes('.')) {
-                        const [collectionName, associationName] = resourceName.split('.');
-                        const field = (_e = (_d = ctx.db.getCollection(collectionName)) === null || _d === void 0 ? void 0 : _d.getField) === null || _e === void 0 ? void 0 : _e.call(_d, associationName);
-                        if (field.target) {
-                            collection = ctx.db.getCollection(field.target);
-                        }
-                    }
-                    else {
-                        collection = ctx.db.getCollection(resourceName);
-                    }
-                    if (collection && collection.hasField('createdById')) {
-                        ctx.permission.can.params.fields.push('createdById');
-                    }
-                }
-                return next();
-            }));
-            const parseJsonTemplate = this.app.acl.parseJsonTemplate;
-            this.app.acl.use((ctx, next) => __awaiter(this, void 0, void 0, function* () {
-                var _f, _g, _h, _j;
-                const { actionName, resourceName, resourceOf } = ctx.action;
-                if (resourceName.includes('.') && resourceOf) {
-                    if (!((_g = (_f = ctx === null || ctx === void 0 ? void 0 : ctx.permission) === null || _f === void 0 ? void 0 : _f.can) === null || _g === void 0 ? void 0 : _g.params)) {
-                        return next();
-                    }
-                    // 关联数据去掉 filter
-                    delete ctx.permission.can.params.filter;
-                    // 关联数据能不能处理取决于 source 是否有权限
-                    const [collectionName] = resourceName.split('.');
-                    const action = ctx.can({ resource: collectionName, action: actionName });
-                    const availableAction = this.app.acl.getAvailableAction(actionName);
-                    if ((_h = availableAction === null || availableAction === void 0 ? void 0 : availableAction.options) === null || _h === void 0 ? void 0 : _h.onNewRecord) {
-                        if (action) {
-                            ctx.permission.skip = true;
-                        }
-                        else {
-                            ctx.permission.can = false;
-                        }
-                    }
-                    else {
-                        const filter = parseJsonTemplate(((_j = action === null || action === void 0 ? void 0 : action.params) === null || _j === void 0 ? void 0 : _j.filter) || {}, ctx);
-                        const sourceInstance = yield ctx.db.getRepository(collectionName).findOne({
-                            filterByTk: resourceOf,
-                            filter,
-                        });
-                        if (!sourceInstance) {
-                            ctx.permission.can = false;
-                        }
-                    }
-                }
-                yield next();
-            }));
-        });
-    }
-    install() {
-        return __awaiter(this, void 0, void 0, function* () {
-            const repo = this.db.getRepository('collections');
-            if (repo) {
-                yield repo.db2cm('roles');
-            }
-        });
-    }
-    load() {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.app.db.import({
-                directory: resolve(__dirname, 'collections'),
-            });
-            this.app.resourcer.use(this.acl.middleware());
-        });
-    }
-    getName() {
-        return this.getPackageName(__dirname);
-    }
-}
-export default PluginACL;
-//# sourceMappingURL=server.js.map