@nocobase/portal-template-default 1.0.0 → 1.0.2

package/src/lib/nocobase/acl/action.ts

@@ -0,0 +1,147 @@
+import type {
+  AclActionParams,
+  AclCanParams,
+  AclRoleData,
+  AclSnapshot,
+  ResourceAcl,
+} from "./types";
+import ignore from "ignore";
+import { getRecordActionPermission } from "./record-permissions";
+import { resolveAclDataSourceKey } from "./data-source";
+
+const REFINE_ACTION_MAP: Record<string, string> = {
+  list: "list",
+  show: "get",
+  create: "create",
+  edit: "update",
+  delete: "destroy",
+  clone: "create",
+};
+
+const getResourceAcl = (params?: AclCanParams["params"]) =>
+  params?.resource?.meta?.acl as ResourceAcl | undefined;
+
+export const mapRefineAction = (action: string) =>
+  REFINE_ACTION_MAP[action] ?? action;
+
+export const getAclDataForDataSource = (
+  snapshot: AclSnapshot,
+  dataSourceKey = "main"
+): AclRoleData => {
+  const dataSourceAcl = snapshot.meta.dataSources?.[dataSourceKey];
+  return dataSourceAcl
+    ? {
+        ...snapshot.data,
+        ...dataSourceAcl,
+        snippets: snapshot.data.snippets,
+      }
+    : snapshot.data;
+};
+
+export const resolveActionPermission = ({
+  snapshot,
+  resource,
+  action,
+  dataSourceKey = "main",
+}: {
+  snapshot: AclSnapshot;
+  resource: string;
+  action: string;
+  dataSourceKey?: string;
+}): AclActionParams | null => {
+  const data = getAclDataForDataSource(snapshot, dataSourceKey);
+  if (data.allowAll) return {};
+
+  const canonicalAction = data.actionAlias?.[action] ?? action;
+  if (data.resources?.includes(resource)) {
+    return (
+      data.actions?.[`${resource}:${canonicalAction}`] ??
+      data.actions?.[`${resource}:${action}`] ??
+      null
+    );
+  }
+
+  const strategyAllowed = data.strategy?.actions?.some(
+    (item) => item.split(":")[0] === canonicalAction
+  );
+  return strategyAllowed ? {} : null;
+};
+
+const matchesSnippet = (snippets: string[], target: string) =>
+  !target || target === "*" || ignore().add(snippets).ignores(target);
+
+export const canAccessWithSnapshot = (
+  snapshot: AclSnapshot,
+  { resource, action, params }: AclCanParams
+) => {
+  if (snapshot.status !== "ready") return false;
+
+  const resourceAcl = getResourceAcl(params);
+  if (resourceAcl === false || resourceAcl?.type === "authenticated") {
+    return true;
+  }
+
+  if (resourceAcl?.type === "snippet") {
+    return (
+      snapshot.data.allowAll ||
+      matchesSnippet(snapshot.data.snippets ?? [], resourceAcl.name)
+    );
+  }
+
+  if (resourceAcl?.type === "route") {
+    return (
+      snapshot.data.allowAll ||
+      (snapshot.data.allowMenuItemIds ?? [])
+        .map(String)
+        .includes(String(resourceAcl.routeId))
+    );
+  }
+
+  const targetResource =
+    resourceAcl?.type === "collection" && resourceAcl.resource
+      ? resourceAcl.resource
+      : resource;
+  if (!targetResource) return true;
+
+  const dataSourceKey =
+    resolveAclDataSourceKey(
+      params,
+      params?.meta as { dataSourceKey?: unknown; acl?: ResourceAcl } | undefined,
+      params?.resource?.meta as
+        | { dataSourceKey?: unknown; acl?: ResourceAcl }
+        | undefined
+    ) ?? "main";
+  const mappedAction =
+    (resourceAcl?.type === "collection" && resourceAcl.actionMap?.[action]) ||
+    mapRefineAction(action);
+  const permission = resolveActionPermission({
+    snapshot,
+    resource: targetResource,
+    action: mappedAction,
+    dataSourceKey,
+  });
+  if (!permission) return false;
+
+  if (params?.id !== undefined) {
+    const recordPermission = getRecordActionPermission({
+      dataSourceKey,
+      resource: targetResource,
+      action: mappedAction,
+      id: params.id,
+      actionAlias: getAclDataForDataSource(snapshot, dataSourceKey).actionAlias,
+    });
+    if (recordPermission !== undefined) return recordPermission;
+  }
+
+  if (typeof params?.field === "string") {
+    const fields = [
+      ...(permission.fields ?? []),
+      ...(permission.whitelist ?? []),
+      ...(permission.appends ?? []),
+    ];
+    if (!fields.length) return true;
+    return fields.includes(params.field);
+  }
+
+  return true;
+};

package/src/lib/nocobase/acl/data-source.ts

@@ -0,0 +1,24 @@
+import type { ResourceAcl } from "./types";
+
+type DataSourceMeta = {
+  dataSourceKey?: unknown;
+  acl?: ResourceAcl;
+};
+
+export const resolveAclDataSourceKey = (
+  ...candidates: Array<DataSourceMeta | null | undefined>
+) => {
+  for (const candidate of candidates) {
+    if (typeof candidate?.dataSourceKey === "string") {
+      return candidate.dataSourceKey;
+    }
+    if (
+      candidate?.acl &&
+      candidate.acl.type === "collection" &&
+      candidate.acl.dataSourceKey
+    ) {
+      return candidate.acl.dataSourceKey;
+    }
+  }
+  return undefined;
+};

package/src/lib/nocobase/acl/index.ts

@@ -0,0 +1,6 @@
+export * from "./action";
+export * from "./data-source";
+export * from "./menu";
+export * from "./record-permissions";
+export * from "./store";
+export * from "./types";

package/src/lib/nocobase/acl/menu.ts

@@ -0,0 +1,41 @@
+import type { TreeMenuItem } from "@refinedev/core";
+
+import { canAccessWithSnapshot } from "./action";
+import type { AclSnapshot } from "./types";
+
+export const filterMenuItemsByAcl = (
+  items: TreeMenuItem[],
+  acl: AclSnapshot
+): TreeMenuItem[] =>
+  items.flatMap((item) => {
+    const children = filterMenuItemsByAcl(item.children ?? [], acl);
+    const isContainer = Boolean(item.meta?.group || item.children?.length);
+    const canAccessItem = item.route
+      ? canAccessWithSnapshot(acl, {
+          resource: item.name,
+          action: "list",
+          params: { resource: item },
+        })
+      : true;
+
+    if (isContainer && !children.length && !item.route) return [];
+    if (!canAccessItem && !children.length) return [];
+    return [
+      {
+        ...item,
+        route: canAccessItem ? item.route : undefined,
+        children,
+      },
+    ];
+  });
+
+export const findFirstAccessibleRoute = (
+  items: TreeMenuItem[]
+): string | undefined => {
+  for (const item of items) {
+    if (item.route) return item.route;
+    const childRoute = findFirstAccessibleRoute(item.children ?? []);
+    if (childRoute) return childRoute;
+  }
+  return undefined;
+};

package/src/lib/nocobase/acl/record-permissions.ts

@@ -0,0 +1,111 @@
+import type { BaseKey } from "@refinedev/core";
+
+type RecordPermissionEntry = {
+  allowedIds: Map<string, Set<string>>;
+  knownIds: Map<string, Set<string>>;
+};
+
+const permissions = new Map<string, RecordPermissionEntry>();
+
+const getKey = (dataSourceKey: string, resource: string) =>
+  `${dataSourceKey}:${resource}`;
+
+export const clearRecordPermissions = () => {
+  permissions.clear();
+};
+
+export const updateRecordPermissions = ({
+  dataSourceKey = "main",
+  resource,
+  recordIds,
+  allowedActions,
+}: {
+  dataSourceKey?: string;
+  resource: string;
+  recordIds: BaseKey[];
+  allowedActions?: Record<string, BaseKey[]>;
+}) => {
+  if (!allowedActions) return false;
+
+  const key = getKey(dataSourceKey, resource);
+  const entry = permissions.get(key) ?? {
+    allowedIds: new Map<string, Set<string>>(),
+    knownIds: new Map<string, Set<string>>(),
+  };
+  const normalizedIds = new Set(recordIds.map(String));
+  const normalizedAllowedActions = new Map(
+    Object.entries(allowedActions).map(([action, ids]) => [
+      action,
+      new Set(ids.map(String)),
+    ])
+  );
+  const actionNames = new Set([
+    ...entry.knownIds.keys(),
+    ...normalizedAllowedActions.keys(),
+  ]);
+  let changed = false;
+
+  for (const action of actionNames) {
+    const previousAllowedIds = entry.allowedIds.get(action);
+    const previousKnownIds = entry.knownIds.get(action);
+    const nextAllowedIds = normalizedAllowedActions.get(action);
+    const nextKnown = Boolean(nextAllowedIds);
+    for (const id of normalizedIds) {
+      const previousKnown = Boolean(previousKnownIds?.has(id));
+      if (
+        previousKnown !== nextKnown ||
+        (nextKnown &&
+          Boolean(previousAllowedIds?.has(id)) !==
+            Boolean(nextAllowedIds?.has(id)))
+      ) {
+        changed = true;
+      }
+    }
+  }
+
+  for (const action of actionNames) {
+    const allowedIds = entry.allowedIds.get(action);
+    const knownIds = entry.knownIds.get(action);
+    for (const id of normalizedIds) {
+      allowedIds?.delete(id);
+      knownIds?.delete(id);
+    }
+  }
+
+  for (const [action, ids] of normalizedAllowedActions) {
+    const allowedIds = entry.allowedIds.get(action) ?? new Set<string>();
+    const knownIds = entry.knownIds.get(action) ?? new Set<string>();
+    ids.forEach((id) => allowedIds.add(id));
+    normalizedIds.forEach((id) => knownIds.add(id));
+    entry.allowedIds.set(action, allowedIds);
+    entry.knownIds.set(action, knownIds);
+  }
+
+  permissions.set(key, entry);
+  return changed;
+};
+
+export const getRecordActionPermission = ({
+  dataSourceKey = "main",
+  resource,
+  action,
+  id,
+  actionAlias,
+}: {
+  dataSourceKey?: string;
+  resource: string;
+  action: string;
+  id: BaseKey;
+  actionAlias?: Record<string, string>;
+}): boolean | undefined => {
+  const entry = permissions.get(getKey(dataSourceKey, resource));
+  if (!entry) return undefined;
+
+  const canonicalAction = actionAlias?.[action] ?? action;
+  const targetAction = entry.knownIds.has(canonicalAction)
+    ? canonicalAction
+    : action;
+  const recordId = String(id);
+  if (!entry.knownIds.get(targetAction)?.has(recordId)) return undefined;
+  return Boolean(entry.allowedIds.get(targetAction)?.has(recordId));
+};

package/src/lib/nocobase/acl/store.ts

@@ -0,0 +1,182 @@
+import { useSyncExternalStore } from "react";
+
+import { nocobaseClient } from "@/lib/nocobase/client";
+import { NocoBaseHttpError } from "@/lib/nocobase/error";
+import { clearRecordPermissions } from "./record-permissions";
+import type {
+  AclResponse,
+  AclSnapshot,
+} from "./types";
+
+const listeners = new Set<() => void>();
+let request:
+  | {
+      id: number;
+      identity: string;
+      promise: Promise<AclSnapshot>;
+    }
+  | undefined;
+let requestId = 0;
+let snapshot: AclSnapshot = {
+  status: "idle",
+  data: {},
+  meta: {},
+  version: 0,
+};
+
+const emit = () => listeners.forEach((listener) => listener());
+
+const setSnapshot = (next: Partial<AclSnapshot>) => {
+  snapshot = {
+    ...snapshot,
+    ...next,
+    version: snapshot.version + 1,
+  };
+  emit();
+  return snapshot;
+};
+
+const getIdentity = () => {
+  const token = nocobaseClient.getToken();
+  return token ? `${token}:${nocobaseClient.getRole() ?? ""}` : undefined;
+};
+
+const requestAcl = async (role?: string) =>
+  nocobaseClient.request<AclResponse>("roles:check", {
+    unwrap: "none",
+    withAclMeta: false,
+    role,
+    includeRole: Boolean(role),
+  });
+
+const isStaleRoleError = (error: unknown) => {
+  if (!(error instanceof NocoBaseHttpError)) return false;
+  const payload = error.payload as
+    | {
+        code?: string;
+        error?: { code?: string };
+        errors?: Array<{ code?: string }>;
+      }
+    | undefined;
+  const codes = [
+    payload?.code,
+    payload?.error?.code,
+    ...(payload?.errors?.map((item) => item.code) ?? []),
+  ];
+  return codes.some((code) =>
+    ["ROLE_NOT_FOUND_ERR", "ROLE_NOT_FOUND_FOR_USER"].includes(code ?? "")
+  );
+};
+
+export const getAclSnapshot = () => snapshot;
+
+export const subscribeAcl = (listener: () => void) => {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+};
+
+export const useAclSnapshot = () =>
+  useSyncExternalStore(
+    subscribeAcl,
+    getAclSnapshot,
+    getAclSnapshot
+  );
+
+export const clearAcl = ({ keepRole = false } = {}) => {
+  requestId += 1;
+  request = undefined;
+  clearRecordPermissions();
+  if (!keepRole) nocobaseClient.setRole(null);
+  setSnapshot({
+    status: "idle",
+    identity: undefined,
+    data: {},
+    meta: {},
+    error: undefined,
+  });
+};
+
+export const notifyRecordPermissionsChanged = () => {
+  setSnapshot({});
+};
+
+export const loadAcl = async ({ force = false } = {}) => {
+  const identity = getIdentity();
+  if (!identity) {
+    clearAcl();
+    return snapshot;
+  }
+
+  if (!force && snapshot.status === "ready" && snapshot.identity === identity) {
+    return snapshot;
+  }
+  if (!force && request?.identity === identity) return request.promise;
+
+  setSnapshot({ status: "loading", identity, error: undefined });
+  const currentRequestId = ++requestId;
+  const requestedRole = nocobaseClient.getRole();
+  const promise = (async () => {
+    try {
+      let response: AclResponse;
+      let effectiveRole = requestedRole;
+      try {
+        response = await requestAcl(requestedRole);
+      } catch (error) {
+        if (!requestedRole || !isStaleRoleError(error)) throw error;
+        effectiveRole = undefined;
+        response = await requestAcl();
+      }
+
+      if (currentRequestId !== requestId) return snapshot;
+
+      const data = response.data ?? {};
+      nocobaseClient.setRole(data.role ?? effectiveRole ?? null);
+      clearRecordPermissions();
+      return setSnapshot({
+        status: "ready",
+        identity: getIdentity(),
+        data,
+        meta: response.meta ?? {},
+        error: undefined,
+      });
+    } catch (error) {
+      const normalizedError =
+        error instanceof Error ? error : new Error("Unable to load permissions");
+      if (currentRequestId !== requestId) return snapshot;
+      setSnapshot({ status: "error", error: normalizedError });
+      throw normalizedError;
+    } finally {
+      if (request?.id === currentRequestId) request = undefined;
+    }
+  })();
+  request = { id: currentRequestId, identity, promise };
+
+  return promise;
+};
+
+export const switchRole = async (
+  roleName: string,
+  { reloadAcl = true } = {}
+) => {
+  const previousRole = nocobaseClient.getRole();
+  nocobaseClient.setRole(roleName);
+
+  try {
+    await nocobaseClient.action("users", "setDefaultRole", {
+      method: "POST",
+      body: { roleName },
+      withAclMeta: false,
+    });
+    if (!reloadAcl) {
+      clearRecordPermissions();
+      return snapshot;
+    }
+    return await loadAcl({ force: true });
+  } catch (error) {
+    nocobaseClient.setRole(previousRole);
+    if (reloadAcl) {
+      await loadAcl({ force: true }).catch(() => undefined);
+    }
+    throw error;
+  }
+};

package/src/lib/nocobase/acl/types.ts

@@ -0,0 +1,96 @@
+import type { BaseKey, IResourceItem } from "@refinedev/core";
+
+export type RoleMode =
+  | "default"
+  | "allow-use-union"
+  | "only-use-union";
+
+export type Role = {
+  name: string;
+  title?: string;
+};
+
+export type AclActionParams = Record<string, unknown> & {
+  fields?: string[];
+  whitelist?: string[];
+  appends?: string[];
+};
+
+export type AclRoleData = {
+  snippets?: string[];
+  role?: string;
+  roleMode?: RoleMode;
+  resources?: string[];
+  actions?: Record<string, AclActionParams>;
+  actionAlias?: Record<string, string>;
+  strategy?: {
+    actions?: string[];
+  };
+  allowAll?: boolean;
+  allowConfigure?: boolean;
+  availableActions?: string[];
+  allowMenuItemIds?: Array<string | number>;
+  allowAnonymous?: boolean;
+  uiButtonSchemasBlacklist?: string[];
+};
+
+export type AclMeta = {
+  dataSources?: Record<string, Partial<AclRoleData>>;
+};
+
+export type AclResponse = {
+  data?: AclRoleData;
+  meta?: AclMeta;
+};
+
+export type AclSnapshot = {
+  status: "idle" | "loading" | "ready" | "error";
+  identity?: string;
+  data: AclRoleData;
+  meta: AclMeta;
+  error?: Error;
+  version: number;
+};
+
+export type ResourceAcl =
+  | false
+  | {
+      type: "authenticated";
+    }
+  | {
+      type: "collection";
+      resource?: string;
+      dataSourceKey?: string;
+      actionMap?: Record<string, string>;
+    }
+  | {
+      type: "snippet";
+      name: string;
+    }
+  | {
+      type: "route";
+      routeId: string | number;
+    };
+
+export type AclCanParams = {
+  resource?: string;
+  action: string;
+  params?: {
+    id?: BaseKey;
+    field?: string;
+    dataSourceKey?: string;
+    meta?: Record<string, unknown>;
+    resource?: IResourceItem;
+    [key: string]: unknown;
+  };
+};
+
+export type AclIdentity = {
+  id: number | string;
+  firstName: string;
+  lastName: string;
+  fullName: string;
+  email: string;
+  avatar?: string;
+  roles: Role[];
+};