@nocobase/plugin-acl 0.9.1-alpha.2 → 0.9.2-alpha.2

package/lib/server.js

@@ -4,134 +4,91 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.default = exports.PluginACL = exports.GrantHelper = void 0;
-
 function _acl() {
   const data = require("@nocobase/acl");
-
   _acl = function _acl() {
     return data;
   };
-
   return data;
 }
-
-function _actions2() {
+function _actions() {
   const data = require("@nocobase/actions");
-
-  _actions2 = function _actions2() {
+  _actions = function _actions() {
     return data;
   };
-
   return data;
 }
-
 function _database() {
   const data = require("@nocobase/database");
-
   _database = function _database() {
     return data;
   };
-
   return data;
 }
-
 function _server() {
   const data = require("@nocobase/server");
-
   _server = function _server() {
     return data;
   };
-
   return data;
 }
-
 function _lodash() {
   const data = _interopRequireDefault(require("lodash"));
-
   _lodash = function _lodash() {
     return data;
   };
-
   return data;
 }
-
 function _path() {
   const data = require("path");
-
   _path = function _path() {
     return data;
   };
-
   return data;
 }
-
 var _availableActions = require("./actions/available-actions");
-
 var _roleCheck = require("./actions/role-check");
-
 var _roleCollections = require("./actions/role-collections");
-
 var _userSetDefaultRole = require("./actions/user-setDefaultRole");
-
 var _setCurrentRole = require("./middlewares/setCurrentRole");
-
 var _RoleModel = require("./model/RoleModel");
-
 var _RoleResourceActionModel = require("./model/RoleResourceActionModel");
-
 var _RoleResourceModel = require("./model/RoleResourceModel");
-
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-
 function _slicedToArray(arr, i) { return _arrayWithHoles(arr) || _iterableToArrayLimit(arr, i) || _unsupportedIterableToArray(arr, i) || _nonIterableRest(); }
-
 function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
-
-function _iterableToArrayLimit(arr, i) { var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"]; if (_i == null) return; var _arr = []; var _n = true; var _d = false; var _s, _e; try { for (_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true) { _arr.push(_s.value); if (i && _arr.length === i) break; } } catch (err) { _d = true; _e = err; } finally { try { if (!_n && _i["return"] != null) _i["return"](); } finally { if (_d) throw _e; } } return _arr; }
-
+function _iterableToArrayLimit(arr, i) { var _i = null == arr ? null : "undefined" != typeof Symbol && arr[Symbol.iterator] || arr["@@iterator"]; if (null != _i) { var _s, _e, _x, _r, _arr = [], _n = !0, _d = !1; try { if (_x = (_i = _i.call(arr)).next, 0 === i) { if (Object(_i) !== _i) return; _n = !1; } else for (; !(_n = (_s = _x.call(_i)).done) && (_arr.push(_s.value), _arr.length !== i); _n = !0); } catch (err) { _d = !0, _e = err; } finally { try { if (!_n && null != _i.return && (_r = _i.return(), Object(_r) !== _r)) return; } finally { if (_d) throw _e; } } return _arr; } }
 function _arrayWithHoles(arr) { if (Array.isArray(arr)) return arr; }
-
 function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); enumerableOnly && (symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
-
 function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? ownKeys(Object(source), !0).forEach(function (key) { _defineProperty(target, key, source[key]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)) : ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } return target; }
-
-function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
-
+function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
+function _toPropertyKey(arg) { var key = _toPrimitive(arg, "string"); return typeof key === "symbol" ? key : String(key); }
+function _toPrimitive(input, hint) { if (typeof input !== "object" || input === null) return input; var prim = input[Symbol.toPrimitive]; if (prim !== undefined) { var res = prim.call(input, hint || "default"); if (typeof res !== "object") return res; throw new TypeError("@@toPrimitive must return a primitive value."); } return (hint === "string" ? String : Number)(input); }
 function _createForOfIteratorHelper(o, allowArrayLike) { var it = typeof Symbol !== "undefined" && o[Symbol.iterator] || o["@@iterator"]; if (!it) { if (Array.isArray(o) || (it = _unsupportedIterableToArray(o)) || allowArrayLike && o && typeof o.length === "number") { if (it) o = it; var i = 0; var F = function F() {}; return { s: F, n: function n() { if (i >= o.length) return { done: true }; return { done: false, value: o[i++] }; }, e: function e(_e2) { throw _e2; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var normalCompletion = true, didErr = false, err; return { s: function s() { it = it.call(o); }, n: function n() { var step = it.next(); normalCompletion = step.done; return step; }, e: function e(_e3) { didErr = true; err = _e3; }, f: function f() { try { if (!normalCompletion && it.return != null) it.return(); } finally { if (didErr) throw err; } } }; }
-
 function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o === "string") return _arrayLikeToArray(o, minLen); var n = Object.prototype.toString.call(o).slice(8, -1); if (n === "Object" && o.constructor) n = o.constructor.name; if (n === "Map" || n === "Set") return Array.from(o); if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen); }
-
 function _arrayLikeToArray(arr, len) { if (len == null || len > arr.length) len = arr.length; for (var i = 0, arr2 = new Array(len); i < len; i++) arr2[i] = arr[i]; return arr2; }
-
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
-
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
-
 class GrantHelper {
   constructor() {
     this.resourceTargetActionMap = new Map();
     this.targetActionResourceMap = new Map();
   }
-
 }
-
 exports.GrantHelper = GrantHelper;
-
 class PluginACL extends _server().Plugin {
   constructor(...args) {
     super(...args);
+    // association field actions config
     this.associationFieldsActions = {};
     this.grantHelper = new GrantHelper();
   }
-
   get acl() {
     return this.app.acl;
   }
-
   registerAssociationFieldAction(associationType, value) {
     this.associationFieldsActions[associationType] = value;
   }
-
   registerAssociationFieldsActions() {
     // if grant create action to role, it should
     // also grant add action and association target's view action
@@ -180,10 +137,8 @@ class PluginACL extends _server().Plugin {
       }
     });
   }
-
   writeResourceToACL(resourceModel, transaction) {
     var _this = this;
-
     return _asyncToGenerator(function* () {
       yield resourceModel.writeToACL({
         acl: _this.acl,
@@ -193,15 +148,11 @@ class PluginACL extends _server().Plugin {
       });
     })();
   }
-
   writeActionToACL(actionModel, transaction) {
     var _this2 = this;
-
     return _asyncToGenerator(function* () {
       const resource = actionModel.get('resource');
-
       const role = _this2.acl.getRole(resource.get('roleName'));
-
       yield actionModel.writeToACL({
         acl: _this2.acl,
         role,
@@ -211,28 +162,22 @@ class PluginACL extends _server().Plugin {
       });
     })();
   }
-
   writeRolesToACL() {
     var _this3 = this;
-
     return _asyncToGenerator(function* () {
       const roles = yield _this3.app.db.getRepository('roles').find({
         appends: ['resources', 'resources.actions']
       });
-
       var _iterator = _createForOfIteratorHelper(roles),
-          _step;
-
+        _step;
       try {
         for (_iterator.s(); !(_step = _iterator.n()).done;) {
           const role = _step.value;
           role.writeToAcl({
             acl: _this3.acl
           });
-
           var _iterator2 = _createForOfIteratorHelper(role.get('resources')),
-              _step2;
-
+            _step2;
           try {
             for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
               const resource = _step2.value;
@@ -251,10 +196,8 @@ class PluginACL extends _server().Plugin {
       }
     })();
   }
-
   beforeLoad() {
     var _this4 = this;
-
     return _asyncToGenerator(function* () {
       _this4.db.addMigrations({
         namespace: _this4.name,
@@ -263,34 +206,26 @@ class PluginACL extends _server().Plugin {
           plugin: _this4
         }
       });
-
       _this4.app.db.registerModels({
         RoleResourceActionModel: _RoleResourceActionModel.RoleResourceActionModel,
         RoleResourceModel: _RoleResourceModel.RoleResourceModel,
         RoleModel: _RoleModel.RoleModel
       });
-
       _this4.app.acl.registerSnippet({
         name: `pm.${_this4.name}.roles`,
         actions: ['roles:*', 'roles.snippets:*', 'availableActions:list', 'roles.collections:list', 'roles.resources:*', 'uiSchemas:getProperties', 'roles.menuUiSchemas:*']
-      }); // change resource fields to association fields
-
-
+      });
+      // change resource fields to association fields
       _this4.app.acl.beforeGrantAction(ctx => {
         const actionName = _this4.app.acl.resolveActionAlias(ctx.actionName);
-
         const collection = _this4.app.db.getCollection(ctx.resourceName);
-
         if (!collection) {
           return;
         }
-
         const fieldsParams = ctx.params.fields;
-
         if (!fieldsParams) {
           return;
         }
-
         if (actionName == 'view' || actionName == 'export') {
           const associationsFields = fieldsParams.filter(fieldName => {
             const field = collection.getField(fieldName);
@@ -302,30 +237,21 @@ class PluginACL extends _server().Plugin {
           });
         }
       });
-
       _this4.registerAssociationFieldsActions();
-
       _this4.app.resourcer.define(_availableActions.availableActionResource);
-
       _this4.app.resourcer.define(_roleCollections.roleCollectionsResource);
-
       _this4.app.resourcer.registerActionHandler('roles:check', _roleCheck.checkAction);
-
       _this4.app.resourcer.registerActionHandler(`users:setDefaultRole`, _userSetDefaultRole.setDefaultRole);
-
       _this4.db.on('users.afterCreateWithAssociations', /*#__PURE__*/function () {
         var _ref = _asyncToGenerator(function* (model, options) {
           const transaction = options.transaction;
-
           const repository = _this4.app.db.getRepository('roles');
-
           const defaultRole = yield repository.findOne({
             filter: {
               default: true
             },
             transaction
           });
-
           if (defaultRole && (yield model.countRoles({
             transaction
           })) == 0) {
@@ -334,36 +260,31 @@ class PluginACL extends _server().Plugin {
             });
           }
         });
-
         return function (_x, _x2) {
           return _ref.apply(this, arguments);
         };
       }());
-
       _this4.app.db.on('roles.afterSaveWithAssociations', /*#__PURE__*/function () {
         var _ref2 = _asyncToGenerator(function* (model, options) {
           const transaction = options.transaction;
           model.writeToAcl({
             acl: _this4.acl
           });
-
           var _iterator3 = _createForOfIteratorHelper(yield model.getResources({
-            transaction
-          })),
-              _step3;
-
+              transaction
+            })),
+            _step3;
           try {
             for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
               const resource = _step3.value;
               yield _this4.writeResourceToACL(resource, transaction);
-            } // model is default
-
+            }
+            // model is default
           } catch (err) {
             _iterator3.e(err);
           } finally {
             _iterator3.f();
           }
-
           if (model.get('default')) {
             yield _this4.app.db.getRepository('roles').update({
               values: {
@@ -377,28 +298,22 @@ class PluginACL extends _server().Plugin {
             });
           }
         });
-
         return function (_x3, _x4) {
           return _ref2.apply(this, arguments);
         };
       }());
-
       _this4.app.db.on('roles.afterDestroy', model => {
         const roleName = model.get('name');
-
         _this4.acl.removeRole(roleName);
       });
-
       _this4.app.db.on('rolesResources.afterSaveWithAssociations', /*#__PURE__*/function () {
         var _ref3 = _asyncToGenerator(function* (model, options) {
           yield _this4.writeResourceToACL(model, options.transaction);
         });
-
         return function (_x5, _x6) {
           return _ref3.apply(this, arguments);
         };
       }());
-
       _this4.app.db.on('rolesResourcesActions.afterUpdateWithAssociations', /*#__PURE__*/function () {
         var _ref4 = _asyncToGenerator(function* (model, options) {
           const transaction = options.transaction;
@@ -407,26 +322,21 @@ class PluginACL extends _server().Plugin {
           });
           yield _this4.writeResourceToACL(resource, transaction);
         });
-
         return function (_x7, _x8) {
           return _ref4.apply(this, arguments);
         };
       }());
-
       _this4.app.db.on('rolesResources.afterDestroy', /*#__PURE__*/function () {
         var _ref5 = _asyncToGenerator(function* (model, options) {
           const role = _this4.acl.getRole(model.get('roleName'));
-
           if (role) {
             role.revokeResource(model.get('name'));
           }
         });
-
         return function (_x9, _x10) {
           return _ref5.apply(this, arguments);
         };
       }());
-
       _this4.app.db.on('collections.afterDestroy', /*#__PURE__*/function () {
         var _ref6 = _asyncToGenerator(function* (model, options) {
           const transaction = options.transaction;
@@ -437,12 +347,10 @@ class PluginACL extends _server().Plugin {
             transaction
           });
         });
-
         return function (_x11, _x12) {
           return _ref6.apply(this, arguments);
         };
       }());
-
       _this4.app.db.on('fields.afterCreate', /*#__PURE__*/function () {
         var _ref7 = _asyncToGenerator(function* (model, options) {
           const transaction = options.transaction;
@@ -455,10 +363,8 @@ class PluginACL extends _server().Plugin {
             transaction,
             appends: ['resource']
           });
-
           var _iterator4 = _createForOfIteratorHelper(resourceActions),
-              _step4;
-
+            _step4;
           try {
             for (_iterator4.s(); !(_step4 = _iterator4.n()).done;) {
               const resourceAction = _step4.value;
@@ -478,12 +384,10 @@ class PluginACL extends _server().Plugin {
             _iterator4.f();
           }
         });
-
         return function (_x13, _x14) {
           return _ref7.apply(this, arguments);
         };
       }());
-
       _this4.app.db.on('fields.afterDestroy', /*#__PURE__*/function () {
         var _ref8 = _asyncToGenerator(function* (model, options) {
           const collectionName = model.get('collectionName');
@@ -495,10 +399,8 @@ class PluginACL extends _server().Plugin {
             },
             transaction: options.transaction
           });
-
           var _iterator5 = _createForOfIteratorHelper(resourceActions),
-              _step5;
-
+            _step5;
           try {
             for (_iterator5.s(); !(_step5 = _iterator5.n()).done;) {
               const resourceAction = _step5.value;
@@ -518,62 +420,49 @@ class PluginACL extends _server().Plugin {
             _iterator5.f();
           }
         });
-
         return function (_x15, _x16) {
           return _ref8.apply(this, arguments);
         };
-      }()); // sync database role data to acl
-
-
+      }());
+      // sync database role data to acl
       _this4.app.on('afterLoad', /*#__PURE__*/function () {
         var _ref9 = _asyncToGenerator(function* (app, options) {
           if ((options === null || options === void 0 ? void 0 : options.method) === 'install' || (options === null || options === void 0 ? void 0 : options.method) === 'upgrade') {
             return;
           }
-
           const exists = yield _this4.app.db.collectionExistsInDb('roles');
-
           if (exists) {
             yield _this4.writeRolesToACL();
           }
         });
-
         return function (_x17, _x18) {
           return _ref9.apply(this, arguments);
         };
       }());
-
       _this4.app.on('afterInstall', /*#__PURE__*/function () {
         var _ref10 = _asyncToGenerator(function* (app, options) {
           const exists = yield _this4.app.db.collectionExistsInDb('roles');
-
           if (exists) {
             yield _this4.writeRolesToACL();
           }
         });
-
         return function (_x19, _x20) {
           return _ref10.apply(this, arguments);
         };
       }());
-
       _this4.app.on('afterInstallPlugin', /*#__PURE__*/function () {
         var _ref11 = _asyncToGenerator(function* (plugin) {
           if (plugin.getName() !== 'users') {
             return;
           }
-
           const User = _this4.db.getCollection('users');
-
           yield User.repository.update({
             values: {
               roles: ['root', 'admin', 'member']
             },
             forceUpdate: true
           });
-
           const RolesUsers = _this4.db.getCollection('rolesUsers');
-
           yield RolesUsers.repository.update({
             filter: {
               userId: 1,
@@ -584,20 +473,16 @@ class PluginACL extends _server().Plugin {
             }
           });
         });
-
         return function (_x21) {
           return _ref11.apply(this, arguments);
         };
       }());
-
       _this4.app.on('beforeInstallPlugin', /*#__PURE__*/function () {
         var _ref12 = _asyncToGenerator(function* (plugin) {
           if (plugin.getName() !== 'users') {
             return;
           }
-
           const roles = _this4.app.db.getRepository('roles');
-
           yield roles.createMany({
             records: [{
               name: 'root',
@@ -624,9 +509,7 @@ class PluginACL extends _server().Plugin {
               snippets: ['!ui.*', '!pm', '!pm.*']
             }]
           });
-
           const rolesResourcesScopes = _this4.app.db.getRepository('rolesResourcesScopes');
-
           yield rolesResourcesScopes.createMany({
             records: [{
               key: 'all',
@@ -641,26 +524,20 @@ class PluginACL extends _server().Plugin {
             }]
           });
         });
-
         return function (_x22) {
           return _ref12.apply(this, arguments);
         };
       }());
-
       _this4.app.resourcer.use(_setCurrentRole.setCurrentRole, {
         tag: 'setCurrentRole',
         before: 'acl',
         after: 'parseToken'
       });
-
       _this4.app.acl.allow('users', 'setDefaultRole', 'loggedIn');
-
       _this4.app.acl.allow('roles', 'check', 'loggedIn');
-
       _this4.app.acl.allow('*', '*', ctx => {
         return ctx.state.currentRole === 'root';
       });
-
       _this4.app.acl.addFixedParams('collections', 'destroy', () => {
         return {
           filter: {
@@ -672,7 +549,6 @@ class PluginACL extends _server().Plugin {
           }
         };
       });
-
       _this4.app.acl.addFixedParams('rolesResourcesScopes', 'destroy', () => {
         return {
           filter: {
@@ -684,7 +560,6 @@ class PluginACL extends _server().Plugin {
           }
         };
       });
-
       _this4.app.acl.addFixedParams('rolesResourcesScopes', 'update', () => {
         return {
           filter: {
@@ -696,7 +571,6 @@ class PluginACL extends _server().Plugin {
           }
         };
       });
-
       _this4.app.acl.addFixedParams('roles', 'destroy', () => {
         return {
           filter: {
@@ -710,17 +584,14 @@ class PluginACL extends _server().Plugin {
           }
         };
       });
-
       _this4.app.resourcer.use( /*#__PURE__*/function () {
         var _ref13 = _asyncToGenerator(function* (ctx, next) {
           const _ctx$action = ctx.action,
-                actionName = _ctx$action.actionName,
-                resourceName = _ctx$action.resourceName,
-                params = _ctx$action.params;
-
+            actionName = _ctx$action.actionName,
+            resourceName = _ctx$action.resourceName,
+            params = _ctx$action.params;
           const _ref14 = params || {},
-                showAnonymous = _ref14.showAnonymous;
-
+            showAnonymous = _ref14.showAnonymous;
           if (actionName === 'list' && resourceName === 'roles') {
             if (!showAnonymous) {
               ctx.action.mergeParams({
@@ -730,96 +601,75 @@ class PluginACL extends _server().Plugin {
               });
             }
           }
-
           if (actionName === 'update' && resourceName === 'roles.resources') {
             ctx.action.mergeParams({
               updateAssociationValues: ['actions']
             });
           }
-
           yield next();
         });
-
         return function (_x23, _x24) {
           return _ref13.apply(this, arguments);
         };
       }());
-
       _this4.app.acl.use( /*#__PURE__*/function () {
         var _ref15 = _asyncToGenerator(function* (ctx, next) {
           const _ctx$action2 = ctx.action,
-                actionName = _ctx$action2.actionName,
-                resourceName = _ctx$action2.resourceName;
-
+            actionName = _ctx$action2.actionName,
+            resourceName = _ctx$action2.resourceName;
           if (actionName === 'get' || actionName === 'list') {
             var _ctx$permission, _ctx$permission$can, _ctx$permission$can$p;
-
             if (!Array.isArray(ctx === null || ctx === void 0 ? void 0 : (_ctx$permission = ctx.permission) === null || _ctx$permission === void 0 ? void 0 : (_ctx$permission$can = _ctx$permission.can) === null || _ctx$permission$can === void 0 ? void 0 : (_ctx$permission$can$p = _ctx$permission$can.params) === null || _ctx$permission$can$p === void 0 ? void 0 : _ctx$permission$can$p.fields)) {
               return next();
             }
-
             let collection;
-
             if (resourceName.includes('.')) {
               var _ctx$db$getCollection, _ctx$db$getCollection2;
-
               const _resourceName$split = resourceName.split('.'),
-                    _resourceName$split2 = _slicedToArray(_resourceName$split, 2),
-                    collectionName = _resourceName$split2[0],
-                    associationName = _resourceName$split2[1];
-
+                _resourceName$split2 = _slicedToArray(_resourceName$split, 2),
+                collectionName = _resourceName$split2[0],
+                associationName = _resourceName$split2[1];
               const field = (_ctx$db$getCollection = ctx.db.getCollection(collectionName)) === null || _ctx$db$getCollection === void 0 ? void 0 : (_ctx$db$getCollection2 = _ctx$db$getCollection.getField) === null || _ctx$db$getCollection2 === void 0 ? void 0 : _ctx$db$getCollection2.call(_ctx$db$getCollection, associationName);
-
               if (field.target) {
                 collection = ctx.db.getCollection(field.target);
               }
             } else {
               collection = ctx.db.getCollection(resourceName);
             }
-
             if (collection && collection.hasField('createdById')) {
               ctx.permission.can.params.fields.push('createdById');
             }
           }
-
           return next();
         });
-
         return function (_x25, _x26) {
           return _ref15.apply(this, arguments);
         };
       }());
-
       const parseJsonTemplate = _this4.app.acl.parseJsonTemplate;
-
       _this4.app.acl.use( /*#__PURE__*/function () {
         var _ref16 = _asyncToGenerator(function* (ctx, next) {
           const _ctx$action3 = ctx.action,
-                actionName = _ctx$action3.actionName,
-                resourceName = _ctx$action3.resourceName,
-                resourceOf = _ctx$action3.resourceOf; // is association request
-
+            actionName = _ctx$action3.actionName,
+            resourceName = _ctx$action3.resourceName,
+            resourceOf = _ctx$action3.resourceOf;
+          // is association request
           if (resourceName.includes('.') && resourceOf) {
             var _ctx$permission2, _ctx$permission2$can, _availableAction$opti;
-
             if (!(ctx === null || ctx === void 0 ? void 0 : (_ctx$permission2 = ctx.permission) === null || _ctx$permission2 === void 0 ? void 0 : (_ctx$permission2$can = _ctx$permission2.can) === null || _ctx$permission2$can === void 0 ? void 0 : _ctx$permission2$can.params)) {
               return next();
-            } // 关联数据去掉 filter
-
-
-            delete ctx.permission.can.params.filter; // 关联数据能不能处理取决于 source 是否有权限
-
+            }
+            // 关联数据去掉 filter
+            delete ctx.permission.can.params.filter;
+            // 关联数据能不能处理取决于 source 是否有权限
             const _resourceName$split3 = resourceName.split('.'),
-                  _resourceName$split4 = _slicedToArray(_resourceName$split3, 1),
-                  collectionName = _resourceName$split4[0];
-
+              _resourceName$split4 = _slicedToArray(_resourceName$split3, 1),
+              collectionName = _resourceName$split4[0];
             const action = ctx.can({
               resource: collectionName,
               action: actionName
             });
-
             const availableAction = _this4.app.acl.getAvailableAction(actionName);
-
             if (availableAction === null || availableAction === void 0 ? void 0 : (_availableAction$opti = availableAction.options) === null || _availableAction$opti === void 0 ? void 0 : _availableAction$opti.onNewRecord) {
               if (action) {
                 ctx.permission.skip = true;
@@ -828,53 +678,42 @@ class PluginACL extends _server().Plugin {
               }
             } else {
               var _action$params;
-
               const filter = parseJsonTemplate((action === null || action === void 0 ? void 0 : (_action$params = action.params) === null || _action$params === void 0 ? void 0 : _action$params.filter) || {}, ctx);
               const sourceInstance = yield ctx.db.getRepository(collectionName).findOne({
                 filterByTk: resourceOf,
                 filter
               });
-
               if (!sourceInstance) {
                 ctx.permission.can = false;
               }
             }
           }
-
           yield next();
         });
-
         return function (_x27, _x28) {
           return _ref16.apply(this, arguments);
         };
       }(), {
         before: 'core'
-      }); // throw error when user has no fixed params permissions
-
-
+      });
+      // throw error when user has no fixed params permissions
       _this4.app.acl.use( /*#__PURE__*/function () {
         var _ref17 = _asyncToGenerator(function* (ctx, next) {
           var _ctx$permission3, _ctx$permission3$can;
-
           const action = (_ctx$permission3 = ctx.permission) === null || _ctx$permission3 === void 0 ? void 0 : (_ctx$permission3$can = _ctx$permission3.can) === null || _ctx$permission3$can === void 0 ? void 0 : _ctx$permission3$can.action;
-
           if (action == 'destroy' && !ctx.action.resourceName.includes('.')) {
-            const repository = _actions2().utils.getRepositoryFromParams(ctx); // params after merge with fixed params
-
-
-            const filteredCount = yield repository.count(ctx.permission.mergedParams); // params user requested
-
+            const repository = _actions().utils.getRepositoryFromParams(ctx);
+            // params after merge with fixed params
+            const filteredCount = yield repository.count(ctx.permission.mergedParams);
+            // params user requested
             const queryCount = yield repository.count(ctx.permission.rawParams);
-
             if (queryCount > filteredCount) {
               ctx.throw(403, 'No permissions');
               return;
             }
           }
-
           yield next();
         });
-
         return function (_x29, _x30) {
           return _ref17.apply(this, arguments);
         };
@@ -882,56 +721,35 @@ class PluginACL extends _server().Plugin {
         after: 'core',
         group: 'after'
       });
-
       const withACLMeta = /*#__PURE__*/function () {
         var _ref18 = _asyncToGenerator(function* (ctx, next) {
           var _ctx$body;
-
           yield next();
-
-          if (!ctx.action) {
+          if (!ctx.action || !ctx.get('X-With-ACL-Meta') || ctx.status !== 200) {
             return;
           }
-
           const _ctx$action4 = ctx.action,
-                resourceName = _ctx$action4.resourceName,
-                actionName = _ctx$action4.actionName;
-
-          if (!ctx.get('X-With-ACL-Meta')) {
-            return;
-          }
-
-          if (ctx.status !== 200) {
-            return;
-          }
-
+            resourceName = _ctx$action4.resourceName,
+            actionName = _ctx$action4.actionName;
           if (!['list', 'get'].includes(actionName)) {
             return;
           }
-
           const collection = ctx.db.getCollection(resourceName);
-
           if (!collection) {
             return;
           }
-
           const Model = collection.model;
           const primaryKeyField = Model.primaryKeyField || Model.primaryKeyAttribute;
           const dataPath = ((_ctx$body = ctx.body) === null || _ctx$body === void 0 ? void 0 : _ctx$body.rows) ? 'body.rows' : 'body';
-
           let listData = _lodash().default.get(ctx, dataPath);
-
           if (actionName == 'get') {
             listData = _lodash().default.castArray(listData);
           }
-
-          const actions = ['view', 'update', 'destroy'];
+          const inspectActions = ['view', 'update', 'destroy'];
           const actionsParams = [];
-
-          for (var _i2 = 0, _actions = actions; _i2 < _actions.length; _i2++) {
+          for (var _i2 = 0, _inspectActions = inspectActions; _i2 < _inspectActions.length; _i2++) {
             var _actionCtx$permission, _actionCtx$permission2;
-
-            const action = _actions[_i2];
+            const action = _inspectActions[_i2];
             const actionCtx = {
               db: ctx.db,
               action: {
@@ -940,9 +758,7 @@ class PluginACL extends _server().Plugin {
                 params: {},
                 resourceName: ctx.action.resourceName,
                 resourceOf: ctx.action.resourceOf,
-
                 mergeParams() {}
-
               },
               state: {
                 currentRole: ctx.state.currentRole,
@@ -950,101 +766,96 @@ class PluginACL extends _server().Plugin {
                   if (!ctx.state.currentUser) {
                     return null;
                   }
-
                   if (ctx.state.currentUser.toJSON) {
                     var _ctx$state$currentUse;
-
                     return (_ctx$state$currentUse = ctx.state.currentUser) === null || _ctx$state$currentUse === void 0 ? void 0 : _ctx$state$currentUse.toJSON();
                   }
-
                   return ctx.state.currentUser;
                 })()
               },
               permission: {},
-
               throw(...args) {
                 throw new (_acl().NoPermissionError)(...args);
               }
-
             };
-
             try {
               yield _this4.app.acl.getActionParams(actionCtx);
             } catch (e) {
               if (e instanceof _acl().NoPermissionError) {
                 continue;
               }
-
               throw e;
             }
-
             actionsParams.push([action, ((_actionCtx$permission = actionCtx.permission) === null || _actionCtx$permission === void 0 ? void 0 : _actionCtx$permission.can) === null && !actionCtx.permission.skip ? null : ((_actionCtx$permission2 = actionCtx.permission) === null || _actionCtx$permission2 === void 0 ? void 0 : _actionCtx$permission2.parsedParams) || {}, actionCtx]);
           }
-
-          const ids = listData.map(item => item[primaryKeyField]);
+          const ids = (() => {
+            if (collection.options.tree) {
+              if (listData.length == 0) return [];
+              const getAllNodeIds = data => [data[primaryKeyField], ...(data.children || []).flatMap(getAllNodeIds)];
+              return listData.map(tree => getAllNodeIds(tree.toJSON())).flat();
+            }
+            return listData.map(item => item[primaryKeyField]);
+          })();
           const conditions = [];
           const allAllowed = [];
-
           for (var _i3 = 0, _actionsParams = actionsParams; _i3 < _actionsParams.length; _i3++) {
             const _actionsParams$_i = _slicedToArray(_actionsParams[_i3], 3),
-                  action = _actionsParams$_i[0],
-                  params = _actionsParams$_i[1],
-                  actionCtx = _actionsParams$_i[2];
-
+              action = _actionsParams$_i[0],
+              params = _actionsParams$_i[1],
+              actionCtx = _actionsParams$_i[2];
             if (!params) {
               continue;
             }
-
             if (_lodash().default.isEmpty(params) || _lodash().default.isEmpty(params.filter)) {
               allAllowed.push(action);
               continue;
             }
-
             const queryParams = collection.repository.buildQueryOptions(_objectSpread(_objectSpread({}, params), {}, {
               context: actionCtx
             }));
             const actionSql = ctx.db.sequelize.queryInterface.queryGenerator.selectQuery(Model.getTableName(), {
               where: (() => {
                 const filterObj = queryParams.where;
-
                 if (!_this4.db.options.underscored) {
                   return filterObj;
                 }
-
+                const isAssociationKey = key => {
+                  return key.startsWith('$') && key.endsWith('$');
+                };
+                // change camelCase to snake_case
                 const iterate = (rootObj, path = []) => {
                   const obj = path.length == 0 ? rootObj : _lodash().default.get(rootObj, path);
-
                   if (Array.isArray(obj)) {
                     for (let i = 0; i < obj.length; i++) {
                       if (obj[i] === null) {
                         continue;
                       }
-
                       if (typeof obj[i] === 'object') {
                         iterate(rootObj, [...path, i]);
                       }
                     }
-
                     return;
                   }
-
                   Reflect.ownKeys(obj).forEach(key => {
                     if (Array.isArray(obj) && key == 'length') {
                       return;
                     }
-
                     if (typeof obj[key] === 'object' && obj[key] !== null || typeof obj[key] === 'symbol') {
                       iterate(rootObj, [...path, key]);
                     }
-
                     if (typeof key === 'string' && key !== (0, _database().snakeCase)(key)) {
-                      _lodash().default.set(rootObj, [...path, (0, _database().snakeCase)(key)], _lodash().default.cloneDeep(obj[key]));
-
+                      const setKey = isAssociationKey(key) ? (() => {
+                        const parts = key.split('.');
+                        parts[parts.length - 1] = _lodash().default.snakeCase(parts[parts.length - 1]);
+                        const result = parts.join('.');
+                        return result.endsWith('$') ? result : `${result}$`;
+                      })() : (0, _database().snakeCase)(key);
+                      const setValue = _lodash().default.cloneDeep(obj[key]);
                       _lodash().default.unset(rootObj, [...path, key]);
+                      _lodash().default.set(rootObj, [...path, setKey], setValue);
                     }
                   });
                 };
-
                 iterate(filterObj);
                 return filterObj;
               })(),
@@ -1058,7 +869,6 @@ class PluginACL extends _server().Plugin {
               include: queryParams.include
             });
           }
-
           const results = yield collection.model.findAll({
             where: {
               [primaryKeyField]: ids
@@ -1068,34 +878,29 @@ class PluginACL extends _server().Plugin {
             })],
             include: conditions.map(condition => condition.include).flat()
           });
-          const allowedActions = actions.map(action => {
+          const allowedActions = inspectActions.map(action => {
             if (allAllowed.includes(action)) {
               return [action, ids];
             }
-
             return [action, results.filter(item => Boolean(item.get(action))).map(item => item.get(primaryKeyField))];
           }).reduce((acc, [action, ids]) => {
             acc[action] = ids;
             return acc;
           }, {});
-
           if (actionName == 'get') {
             ctx.bodyMeta = _objectSpread(_objectSpread({}, ctx.bodyMeta || {}), {}, {
               allowedActions: allowedActions
             });
           }
-
           if (actionName == 'list') {
             ctx.body.allowedActions = allowedActions;
           }
         });
-
         return function withACLMeta(_x31, _x32) {
           return _ref18.apply(this, arguments);
         };
-      }(); // append allowedActions to list & get response
-
-
+      }();
+      // append allowedActions to list & get response
       _this4.app.use( /*#__PURE__*/function () {
         var _ref19 = _asyncToGenerator(function* (ctx, next) {
           try {
@@ -1104,7 +909,6 @@ class PluginACL extends _server().Plugin {
             ctx.logger.error(error);
           }
         });
-
         return function (_x33, _x34) {
           return _ref19.apply(this, arguments);
         };
@@ -1114,35 +918,27 @@ class PluginACL extends _server().Plugin {
       });
     })();
   }
-
   install() {
     var _this5 = this;
-
     return _asyncToGenerator(function* () {
       const repo = _this5.db.getRepository('collections');
-
       if (repo) {
         yield repo.db2cm('roles');
       }
     })();
   }
-
   load() {
     var _this6 = this;
-
     return _asyncToGenerator(function* () {
       yield _this6.importCollections((0, _path().resolve)(__dirname, 'collections'));
-
       _this6.db.extendCollection({
         name: 'rolesUischemas',
-        namespace: 'acl',
+        namespace: 'acl.acl',
         duplicator: 'required'
       });
     })();
   }
-
 }
-
 exports.PluginACL = PluginACL;
 var _default = PluginACL;
 exports.default = _default;