@nocobase/plugin-acl 2.2.0-beta.8 → 2.3.0-alpha.1

package/dist/externalVersion.js

@@ -8,7 +8,7 @@
  */
 
 module.exports = {
-  "@nocobase/client": "2.2.0-beta.8",
+  "@nocobase/client": "2.3.0-alpha.1",
   "antd": "5.24.2",
   "react": "18.2.0",
   "react-i18next": "11.18.6",
@@ -17,15 +17,15 @@ module.exports = {
   "@formily/react": "2.3.7",
   "@ant-design/icons": "5.6.1",
   "lodash": "4.18.1",
-  "@nocobase/utils": "2.2.0-beta.8",
-  "@nocobase/flow-engine": "2.2.0-beta.8",
-  "@nocobase/client-v2": "2.2.0-beta.8",
-  "@nocobase/actions": "2.2.0-beta.8",
-  "@nocobase/cache": "2.2.0-beta.8",
-  "@nocobase/database": "2.2.0-beta.8",
-  "@nocobase/server": "2.2.0-beta.8",
-  "@nocobase/acl": "2.2.0-beta.8",
-  "@nocobase/test": "2.2.0-beta.8",
+  "@nocobase/utils": "2.3.0-alpha.1",
+  "@nocobase/flow-engine": "2.3.0-alpha.1",
+  "@nocobase/client-v2": "2.3.0-alpha.1",
+  "@nocobase/actions": "2.3.0-alpha.1",
+  "@nocobase/cache": "2.3.0-alpha.1",
+  "@nocobase/database": "2.3.0-alpha.1",
+  "@nocobase/server": "2.3.0-alpha.1",
+  "@nocobase/acl": "2.3.0-alpha.1",
+  "@nocobase/test": "2.3.0-alpha.1",
   "@formily/core": "2.3.7",
   "@formily/antd-v5": "1.2.3",
   "antd-style": "3.7.1"

package/dist/server/enum.d.ts

@@ -12,3 +12,4 @@ export declare const SystemRoleMode: {
     readonly onlyUseUnion: "only-use-union";
     readonly validate: (value: string) => boolean;
 };
+export type SystemRoleMode = (typeof SystemRoleMode)[Exclude<keyof typeof SystemRoleMode, 'validate'>];

package/dist/server/middlewares/setCurrentRole.js

@@ -39,12 +39,58 @@ __export(setCurrentRole_exports, {
   setCurrentRole: () => setCurrentRole
 });
 module.exports = __toCommonJS(setCurrentRole_exports);
+var import_utils = require("@nocobase/utils");
 var import_constants = require("../constants");
 var import_enum = require("../enum");
 var import_lodash = __toESM(require("lodash"));
+function getCurrentUserId(currentUser) {
+  var _a;
+  return (currentUser == null ? void 0 : currentUser.id) ?? ((_a = currentUser == null ? void 0 : currentUser.get) == null ? void 0 : _a.call(currentUser, "id"));
+}
+async function loadCurrentUserRoles(options) {
+  const { cache, currentUser, mainDb } = options;
+  const userId = getCurrentUserId(currentUser);
+  if (typeof userId !== "string" && typeof userId !== "number") {
+    return [];
+  }
+  return cache.wrap(`roles:${userId}`, async () => {
+    var _a, _b, _c, _d, _e;
+    const repository = (_a = mainDb == null ? void 0 : mainDb.getRepository) == null ? void 0 : _a.call(mainDb, "users.roles", userId);
+    if (repository) {
+      return repository.find({
+        raw: true
+      });
+    }
+    const roleUsers = await ((_c = (_b = mainDb == null ? void 0 : mainDb.getRepository) == null ? void 0 : _b.call(mainDb, "rolesUsers")) == null ? void 0 : _c.find({
+      filter: {
+        userId
+      },
+      raw: true
+    }));
+    if (roleUsers == null ? void 0 : roleUsers.length) {
+      return roleUsers.map((roleUser) => ({ name: roleUser.roleName })).filter((role) => role.name);
+    }
+    if (typeof currentUser.getRoles === "function") {
+      return currentUser.getRoles({ raw: true });
+    }
+    const user = await ((_e = (_d = mainDb == null ? void 0 : mainDb.getRepository) == null ? void 0 : _d.call(mainDb, "users")) == null ? void 0 : _e.findOne({
+      filter: {
+        id: userId
+      }
+    }));
+    if (typeof (user == null ? void 0 : user.getRoles) === "function") {
+      return user.getRoles({ raw: true });
+    }
+    return [];
+  });
+}
 async function setCurrentRole(ctx, next) {
-  var _a, _b;
-  let currentRole = ctx.get("X-Role");
+  var _a, _b, _c, _d, _e, _f, _g;
+  const headerRole = ctx.get("X-Role");
+  const roleCookieName = (0, import_utils.getAuthCookieName)("role", (_a = ctx.app) == null ? void 0 : _a.name);
+  const cookieRole = headerRole ? null : (_b = ctx.cookies) == null ? void 0 : _b.get(roleCookieName);
+  let currentRole = headerRole || cookieRole;
+  const currentRoleFromCookie = !!cookieRole && !headerRole;
   if (currentRole === "anonymous") {
     ctx.state.currentRole = currentRole;
     return next();
@@ -54,13 +100,12 @@ async function setCurrentRole(ctx, next) {
   }
   const attachRoles = ctx.state.attachRoles || [];
   const cache = ctx.cache;
-  const repository = ctx.db.getRepository("users.roles", ctx.state.currentUser.id);
-  const roles = await cache.wrap(
-    `roles:${ctx.state.currentUser.id}`,
-    () => repository.find({
-      raw: true
-    })
-  );
+  const mainDb = ((_c = ctx.app) == null ? void 0 : _c.db) || ctx.db;
+  const roles = await loadCurrentUserRoles({
+    cache,
+    mainDb,
+    currentUser: ctx.state.currentUser
+  });
   if (!roles.length && !attachRoles.length) {
     ctx.state.currentRole = void 0;
     return ctx.throw(401, {
@@ -73,10 +118,11 @@ async function setCurrentRole(ctx, next) {
   roles.forEach((role2) => rolesMap.set(role2.name, role2));
   const userRoles = Array.from(rolesMap.values());
   ctx.state.currentUser.roles = userRoles;
-  const systemSettings = await cache.wrap(
+  const systemSettingsRepository = mainDb == null ? void 0 : mainDb.getRepository("systemSettings");
+  const systemSettings = systemSettingsRepository ? await cache.wrap(
     `app:systemSettings`,
-    () => ctx.db.getRepository("systemSettings").findOne({ raw: true })
-  );
+    () => systemSettingsRepository.findOne({ raw: true })
+  ) : void 0;
   const roleMode = (systemSettings == null ? void 0 : systemSettings.roleMode) || import_enum.SystemRoleMode.default;
   if ([currentRole, ctx.state.currentRole].includes(import_constants.UNION_ROLE_KEY) && roleMode === import_enum.SystemRoleMode.default) {
     currentRole = userRoles[0].name;
@@ -95,26 +141,34 @@ async function setCurrentRole(ctx, next) {
   }
   let role;
   if (currentRole) {
-    role = (_a = userRoles.find((role2) => role2.name === currentRole)) == null ? void 0 : _a.name;
+    role = (_d = userRoles.find((role2) => role2.name === currentRole)) == null ? void 0 : _d.name;
     if (!role) {
-      return ctx.throw(401, {
-        code: "ROLE_NOT_FOUND_FOR_USER",
-        message: ctx.t("The role does not belong to the user", { ns: "acl" })
-      });
+      if (currentRoleFromCookie) {
+        (_e = ctx.cookies) == null ? void 0 : _e.set(roleCookieName, null, (0, import_utils.getAuthCookieOptions)(ctx, false));
+        currentRole = void 0;
+      } else {
+        return ctx.throw(401, {
+          code: "ROLE_NOT_FOUND_FOR_USER",
+          message: ctx.t("The role does not belong to the user", { ns: "acl" })
+        });
+      }
     }
   }
   if (!role) {
     const defaultRoleModel = await cache.wrapWithCondition(
       `roles:${ctx.state.currentUser.id}:defaultRole`,
-      () => ctx.db.getRepository("rolesUsers").findOne({ where: { userId: ctx.state.currentUser.id, default: true } }),
+      () => mainDb.getRepository("rolesUsers").findOne({ where: { userId: ctx.state.currentUser.id, default: true } }),
       {
         isCacheable: (x) => !import_lodash.default.isEmpty(x)
       }
     );
-    role = (defaultRoleModel == null ? void 0 : defaultRoleModel.roleName) || ((_b = userRoles[0]) == null ? void 0 : _b.name);
+    role = (defaultRoleModel == null ? void 0 : defaultRoleModel.roleName) || ((_f = userRoles[0]) == null ? void 0 : _f.name);
   }
   ctx.state.currentRole = role;
   ctx.state.currentRoles = role === import_constants.UNION_ROLE_KEY ? userRoles.map((role2) => role2.name) : [role];
+  if (currentRoleFromCookie && role) {
+    (_g = ctx.cookies) == null ? void 0 : _g.set(roleCookieName, role, (0, import_utils.getAuthCookieOptions)(ctx, false));
+  }
   if (!ctx.state.currentRoles.length) {
     return ctx.throw(401, {
       code: "ROLE_NOT_FOUND_ERR",

package/dist/server/server.js

@@ -450,7 +450,7 @@ class PluginACLServer extends import_server.Plugin {
     this.app.on("cache:del:roles", ({ userId }) => {
       this.app.cache.del(`roles:${userId}`);
     });
-    this.app.resourcer.use(import_setCurrentRole.setCurrentRole, { tag: "setCurrentRole", before: "acl", after: "auth" });
+    this.app.resourceManager.use(import_setCurrentRole.setCurrentRole, { tag: "setCurrentRole", before: "acl", after: "auth" });
     this.app.acl.allow("users", "setDefaultRole", "loggedIn");
     this.app.acl.allow("roles", "check", "loggedIn");
     this.app.acl.allow("*", "*", (ctx) => {

package/package.json

@@ -6,7 +6,7 @@
   "description": "Based on roles, resources, and actions, access control can precisely manage interface configuration permissions, data operation permissions, menu access permissions, and plugin permissions.",
   "description.ru-RU": "На основе ролей, ресурсов и действий система контроля доступа может точно управлять разрешениями на изменение интерфейса, работу с данными, доступ к меню и разрешениями для подключаемых модулей.",
   "description.zh-CN": "基于角色、资源和操作的权限控制，可以精确控制界面配置权限、数据操作权限、菜单访问权限、插件权限。",
-  "version": "2.2.0-beta.8",
+  "version": "2.3.0-alpha.1",
   "license": "Apache-2.0",
   "main": "./dist/server/index.js",
   "homepage": "https://docs.nocobase.com/handbook/acl",
@@ -46,5 +46,5 @@
     "url": "git+https://github.com/nocobase/nocobase.git",
     "directory": "packages/plugins/acl"
   },
-  "gitHead": "fa2502c1e9faf6d74b3f51b42dbc6546638d46af"
+  "gitHead": "2377df8ceb12549149017f7f14a61207bf6e49a2"
 }