@nocobase/plugin-acl 2.0.0-alpha.9 → 2.0.0-beta.10

package/dist/server/migrations/20251119225252-update-member-default-permission.js

@@ -0,0 +1,59 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var update_member_default_permission_exports = {};
+__export(update_member_default_permission_exports, {
+  default: () => update_member_default_permission_default
+});
+module.exports = __toCommonJS(update_member_default_permission_exports);
+var import_server = require("@nocobase/server");
+class update_member_default_permission_default extends import_server.Migration {
+  on = "afterLoad";
+  // 'beforeLoad' or 'afterLoad'
+  appVersion = "<2.0.0";
+  async up() {
+    const repo = this.db.getRepository("roles");
+    const role = await repo.findOne({
+      filter: {
+        name: "member"
+      }
+    });
+    if (!role) {
+      return;
+    }
+    await repo.update({
+      filter: {
+        name: role.name
+      },
+      values: {
+        strategy: {
+          ...role.strategy,
+          actions: ["view:own"]
+        }
+      }
+    });
+  }
+}

package/dist/server/server.js

@@ -55,6 +55,8 @@ var import_RoleModel = require("./model/RoleModel");
 var import_RoleResourceActionModel = require("./model/RoleResourceActionModel");
 var import_RoleResourceModel = require("./model/RoleResourceModel");
 var import_union_role = require("./actions/union-role");
+var import_check_association_operate = require("./middlewares/check-association-operate");
+var import_check_change_with_association = require("./middlewares/check-change-with-association");
 class PluginACLServer extends import_server.Plugin {
   get acl() {
     return this.app.acl;
@@ -143,6 +145,7 @@ class PluginACLServer extends import_server.Plugin {
         "roles.dataSourcesCollections:*",
         "roles.dataSourceResources:*",
         "dataSourcesRolesResourcesScopes:*",
+        "dataSourcesRolesResourcesActions:*",
         "rolesResourcesScopes:*"
       ]
     });
@@ -387,7 +390,7 @@ class PluginACLServer extends import_server.Plugin {
             name: "member",
             title: '{{t("Member")}}',
             allowNewMenu: true,
-            strategy: { actions: ["view", "update:own", "destroy:own", "create"] },
+            strategy: { actions: ["view:own"] },
             default: true,
             snippets: ["!ui.*", "!pm", "!pm.*"]
           }
@@ -411,6 +414,16 @@ class PluginACLServer extends import_server.Plugin {
         ]
       });
     });
+    this.app.on("afterStart", async (app) => {
+      app.db.on("rolesUsers.beforeSave", async (model) => {
+        if (!model._changed.has("roleName")) {
+          return;
+        }
+        if (model.roleName === "root") {
+          throw new Error("No permissions");
+        }
+      });
+    });
     this.app.on("cache:del:roles", ({ userId }) => {
       this.app.cache.del(`roles:${userId}`);
     });
@@ -485,8 +498,9 @@ class PluginACLServer extends import_server.Plugin {
         } else {
           collection = ctx.db.getCollection(resourceName);
         }
-        if (collection && collection.hasField("createdById")) {
-          ctx.permission.can.params.fields.push("createdById");
+        const fields = ctx.permission.can.params.fields;
+        if (collection && collection.hasField("createdById") && !fields.includes("createdById")) {
+          fields.push("createdById");
         }
       }
       return next();
@@ -559,6 +573,17 @@ class PluginACLServer extends import_server.Plugin {
       },
       { after: "dataSource", group: "with-acl-meta" }
     );
+    this.app.dataSourceManager.afterAddDataSource((dataSource) => {
+      dataSource.acl.use(import_check_association_operate.checkAssociationOperate, {
+        before: "core"
+      });
+      if (dataSource.options.acl !== false && dataSource.options.useACL !== false) {
+        dataSource.resourceManager.registerPreActionHandler("create", import_check_change_with_association.checkChangesWithAssociation);
+        dataSource.resourceManager.registerPreActionHandler("firstOrCreate", import_check_change_with_association.checkChangesWithAssociation);
+        dataSource.resourceManager.registerPreActionHandler("updateOrCreate", import_check_change_with_association.checkChangesWithAssociation);
+        dataSource.resourceManager.registerPreActionHandler("update", import_check_change_with_association.checkChangesWithAssociation);
+      }
+    });
     this.db.on("afterUpdateCollection", async (collection) => {
       if (collection.options.loadedFromCollectionManager || collection.options.asStrategyResource) {
         this.app.acl.appendStrategyResource(collection.name);

package/package.json

@@ -1,17 +1,23 @@
 {
   "name": "@nocobase/plugin-acl",
   "displayName": "Access control",
+  "displayName.ru-RU": "Контроль доступа",
   "displayName.zh-CN": "权限控制",
   "description": "Based on roles, resources, and actions, access control can precisely manage interface configuration permissions, data operation permissions, menu access permissions, and plugin permissions.",
+  "description.ru-RU": "На основе ролей, ресурсов и действий система контроля доступа может точно управлять разрешениями на изменение интерфейса, работу с данными, доступ к меню и разрешениями для подключаемых модулей.",
   "description.zh-CN": "基于角色、资源和操作的权限控制，可以精确控制界面配置权限、数据操作权限、菜单访问权限、插件权限。",
-  "version": "2.0.0-alpha.9",
+  "version": "2.0.0-beta.10",
   "license": "AGPL-3.0",
   "main": "./dist/server/index.js",
   "homepage": "https://docs.nocobase.com/handbook/acl",
+  "homepage.ru-RU": "https://docs-ru.nocobase.com/handbook/acl",
   "homepage.zh-CN": "https://docs-cn.nocobase.com/handbook/acl",
   "keywords": [
     "Users & permissions"
   ],
+  "nocobase": {
+    "defaultEnabled": true
+  },
   "devDependencies": {
     "@types/jsonwebtoken": "^9.0.9",
     "jsonwebtoken": "^9.0.2",
@@ -33,5 +39,5 @@
     "url": "git+https://github.com/nocobase/nocobase.git",
     "directory": "packages/plugins/acl"
   },
-  "gitHead": "4a9acf96f21a3aa35bccbd188b942595b09da0a9"
+  "gitHead": "9943dc4b0fdedcac3f304714b58635ae441e2560"
 }