@nocobase/plugin-acl 2.1.0-alpha.2 → 2.1.0-alpha.20

package/dist/server/index.d.ts

@@ -8,6 +8,7 @@
  */
 export * from './middlewares/setCurrentRole';
 export * from './middlewares/with-acl-meta';
+export * from './query/apply-query-permission';
 export { RoleResourceActionModel } from './model/RoleResourceActionModel';
 export { RoleResourceModel } from './model/RoleResourceModel';
 export * from './constants';

package/dist/server/index.js

@@ -44,6 +44,7 @@ __export(server_exports, {
 module.exports = __toCommonJS(server_exports);
 __reExport(server_exports, require("./middlewares/setCurrentRole"), module.exports);
 __reExport(server_exports, require("./middlewares/with-acl-meta"), module.exports);
+__reExport(server_exports, require("./query/apply-query-permission"), module.exports);
 var import_RoleResourceActionModel = require("./model/RoleResourceActionModel");
 var import_RoleResourceModel = require("./model/RoleResourceModel");
 __reExport(server_exports, require("./constants"), module.exports);
@@ -55,6 +56,7 @@ var import_server = __toESM(require("./server"));
   RoleResourceModel,
   ...require("./middlewares/setCurrentRole"),
   ...require("./middlewares/with-acl-meta"),
+  ...require("./query/apply-query-permission"),
   ...require("./constants"),
   ...require("./enum")
 });

package/dist/server/middlewares/check-association-operate.js

@@ -31,7 +31,7 @@ __export(check_association_operate_exports, {
 module.exports = __toCommonJS(check_association_operate_exports);
 var import_acl = require("@nocobase/acl");
 async function checkAssociationOperate(ctx, next) {
-  var _a;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
   const { actionName, resourceName, sourceId } = ctx.action;
   if (!(resourceName.includes(".") && ["add", "set", "remove", "toggle"].includes(actionName))) {
     return next();
@@ -59,12 +59,21 @@ async function checkAssociationOperate(ctx, next) {
   }
   if (params.filter) {
     try {
-      const filteredParams = ctx.acl.filterParams(ctx, resource, params);
-      const parsedParams = await ctx.acl.parseJsonTemplate(filteredParams, ctx);
-      const repo = ctx.db.getRepository(resource);
+      const timezone = ((_c = (_b = ctx.request) == null ? void 0 : _b.get) == null ? void 0 : _c.call(_b, "x-timezone")) ?? ((_e = (_d = ctx.request) == null ? void 0 : _d.header) == null ? void 0 : _e["x-timezone"]) ?? ((_g = (_f = ctx.req) == null ? void 0 : _f.headers) == null ? void 0 : _g["x-timezone"]);
+      const collection = (_i = (_h = ctx.database) == null ? void 0 : _h.getCollection) == null ? void 0 : _i.call(_h, resource);
+      (0, import_acl.checkFilterParams)(collection, params.filter);
+      const parsedFilter = await (0, import_acl.parseJsonTemplate)(params.filter, {
+        state: ctx.state,
+        timezone,
+        userProvider: (0, import_acl.createUserProvider)({
+          db: ctx.db,
+          currentUser: (_j = ctx.state) == null ? void 0 : _j.currentUser
+        })
+      });
+      const repo = ctx.database.getRepository(resource);
       const record = await repo.findOne({
         filterByTk: sourceId,
-        filter: parsedParams.filter
+        filter: parsedFilter ?? params.filter
       });
       if (!record) {
         ctx.throw(403, "No permissions");

package/dist/server/middlewares/check-change-with-association.d.ts

@@ -6,5 +6,26 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
+import { ACL, UserProvider } from '@nocobase/acl';
 import { Context, Next } from '@nocobase/actions';
+import { Collection } from '@nocobase/database';
+export type SanitizeAssociationValuesOptions = {
+    acl?: ACL;
+    resourceName: string;
+    actionName: string;
+    values: any;
+    updateAssociationValues?: string[];
+    protectedKeys?: string[];
+    aclParams?: any;
+    roles?: string[];
+    currentRole?: string;
+    currentUser?: any;
+    collection?: Collection;
+    db?: any;
+    database?: any;
+    state?: Record<string, any>;
+    timezone?: string;
+    userProvider?: UserProvider;
+};
+export declare function sanitizeAssociationValues(options: SanitizeAssociationValuesOptions): Promise<any>;
 export declare const checkChangesWithAssociation: (ctx: Context, next: Next) => Promise<any>;