@nocobase/portal-template-default 1.0.8 → 1.0.10

package/src/lib/nocobase/acl/evaluator.ts

@@ -0,0 +1,186 @@
+import ignore from "ignore";
+
+import { resolveAclDataSourceKey } from "./data-source";
+import { getRecordActionPermission } from "./record-permissions";
+import type {
+  AclAccessRequest,
+  AclActionParams,
+  AclPermissionSet,
+  AclResourcePermissions,
+  ResourceAcl,
+  RoleConstraint,
+} from "./types";
+
+const REFINE_ACTION_MAP: Record<string, string> = {
+  list: "list",
+  show: "get",
+  create: "create",
+  edit: "update",
+  delete: "destroy",
+  clone: "create",
+};
+
+const getResourceAcl = (request: AclAccessRequest) =>
+  request.resourceItem?.meta?.acl as ResourceAcl | undefined;
+
+export const mapRefineAction = (action: string) =>
+  REFINE_ACTION_MAP[action] ?? action;
+
+export const getPermissionsForDataSource = (
+  permissions: AclPermissionSet,
+  dataSourceKey = "main"
+): AclResourcePermissions => {
+  const dataSourcePermissions = permissions.dataSources?.[dataSourceKey];
+  return dataSourcePermissions
+    ? {
+        ...permissions,
+        ...dataSourcePermissions,
+        snippets: permissions.snippets,
+      }
+    : permissions;
+};
+
+export const resolveActionPermission = ({
+  permissions,
+  resource,
+  action,
+  dataSourceKey = "main",
+}: {
+  permissions: AclPermissionSet;
+  resource: string;
+  action: string;
+  dataSourceKey?: string;
+}): AclActionParams | null => {
+  const data = getPermissionsForDataSource(permissions, dataSourceKey);
+  if (data.allowAll) return {};
+
+  const canonicalAction = data.actionAlias?.[action] ?? action;
+  if (data.resources?.includes(resource)) {
+    return (
+      data.actions?.[`${resource}:${canonicalAction}`] ??
+      data.actions?.[`${resource}:${action}`] ??
+      null
+    );
+  }
+
+  const strategyAllowed = data.strategy?.actions?.some(
+    (item) => item.split(":")[0] === canonicalAction
+  );
+  return strategyAllowed ? {} : null;
+};
+
+const matchesSnippet = (snippets: string[], target: string) =>
+  !target || target === "*" || ignore().add(snippets).ignores(target);
+
+export const getEffectiveRoles = (permissions: AclPermissionSet) =>
+  permissions.roles;
+
+export const matchesRoleConstraint = (
+  permissions: AclPermissionSet,
+  constraint?: RoleConstraint
+) => {
+  if (!constraint || permissions.allowAll) return true;
+
+  const roles = new Set(getEffectiveRoles(permissions));
+
+  return (
+    (!constraint.anyOf?.length ||
+      constraint.anyOf.some((role) => roles.has(role))) &&
+    (!constraint.allOf?.length ||
+      constraint.allOf.every((role) => roles.has(role))) &&
+    (!constraint.noneOf?.length ||
+      constraint.noneOf.every((role) => !roles.has(role)))
+  );
+};
+
+export type RecordPermissionResolver = typeof getRecordActionPermission;
+
+export const evaluateAccess = (
+  permissions: AclPermissionSet,
+  request: AclAccessRequest,
+  getRecordPermission: RecordPermissionResolver = getRecordActionPermission
+) => {
+  const resourceAcl = getResourceAcl(request);
+  if (
+    !matchesRoleConstraint(
+      permissions,
+      resourceAcl === false ? undefined : resourceAcl?.roles
+    ) ||
+    !matchesRoleConstraint(permissions, request.roles)
+  ) {
+    return false;
+  }
+
+  if (resourceAcl === false || resourceAcl?.type === "authenticated") {
+    return true;
+  }
+
+  if (resourceAcl?.type === "snippet") {
+    return (
+      permissions.allowAll ||
+      matchesSnippet(permissions.snippets ?? [], resourceAcl.name)
+    );
+  }
+
+  if (resourceAcl?.type === "route") {
+    return (
+      permissions.allowAll ||
+      (permissions.allowMenuItemIds ?? [])
+        .map(String)
+        .includes(String(resourceAcl.routeId))
+    );
+  }
+
+  const targetResource =
+    resourceAcl?.type === "collection" && resourceAcl.resource
+      ? resourceAcl.resource
+      : request.resource;
+  if (!targetResource) return true;
+
+  const dataSourceKey =
+    resolveAclDataSourceKey(
+      request,
+      request.meta as
+        | { dataSourceKey?: unknown; acl?: ResourceAcl }
+        | undefined,
+      request.resourceItem?.meta as
+        | { dataSourceKey?: unknown; acl?: ResourceAcl }
+        | undefined
+    ) ?? "main";
+  const requestedAction = request.action ?? "list";
+  const mappedAction =
+    (resourceAcl?.type === "collection" &&
+      resourceAcl.actionMap?.[requestedAction]) ||
+    mapRefineAction(requestedAction);
+  const permission = resolveActionPermission({
+    permissions,
+    resource: targetResource,
+    action: mappedAction,
+    dataSourceKey,
+  });
+  if (!permission) return false;
+
+  if (request.id !== undefined) {
+    const recordPermission = getRecordPermission({
+      dataSourceKey,
+      resource: targetResource,
+      action: mappedAction,
+      id: request.id,
+      actionAlias: getPermissionsForDataSource(permissions, dataSourceKey)
+        .actionAlias,
+    });
+    if (recordPermission !== undefined) return recordPermission;
+  }
+
+  if (request.field) {
+    const fields = [
+      ...(permission.fields ?? []),
+      ...(permission.whitelist ?? []),
+      ...(permission.appends ?? []),
+    ];
+    if (!fields.length) return true;
+    return fields.includes(request.field);
+  }
+
+  return true;
+};

package/src/lib/nocobase/acl/hooks.ts

@@ -0,0 +1,40 @@
+import { useSyncExternalStore } from "react";
+
+import { useAclState, useAclStore } from "./context";
+import { evaluateAccess } from "./evaluator";
+import type { AclAccessRequest } from "./types";
+
+export const useAclEvaluator = () => {
+  const store = useAclStore();
+  const state = useAclState();
+  useSyncExternalStore(
+    store.recordPermissions.subscribe,
+    store.recordPermissions.getState,
+    store.recordPermissions.getState
+  );
+
+  return (request: AclAccessRequest) =>
+    state.status === "ready" &&
+    evaluateAccess(
+      state.permissions,
+      request,
+      store.recordPermissions.getPermission
+    );
+};
+
+export const useCanAccess = (request: AclAccessRequest) =>
+  useAclEvaluator()(request);
+
+export const useGetRoles = () => {
+  const state = useAclState();
+  const isLoading = state.status === "idle" || state.status === "loading";
+  const isError = state.status === "error";
+
+  return {
+    data: state.status === "ready" ? state.permissions.roles : undefined,
+    error: isError ? state.error : undefined,
+    isError,
+    isLoading,
+    isPending: isLoading,
+  };
+};

package/src/lib/nocobase/acl/index.ts

@@ -1,6 +1,9 @@
-export * from "./action";
+export * from "./context";
 export * from "./data-source";
+export * from "./evaluator";
+export * from "./hooks";
 export * from "./menu";
 export * from "./record-permissions";
 export * from "./store";
+export * from "./store-provider";
 export * from "./types";

package/src/lib/nocobase/acl/menu.ts

@@ -1,20 +1,20 @@
 import type { TreeMenuItem } from "@refinedev/core";
 
-import { canAccessWithSnapshot } from "./action";
-import type { AclSnapshot } from "./types";
+import { evaluateAccess } from "./evaluator";
+import type { AclPermissionSet } from "./types";
 
 export const filterMenuItemsByAcl = (
   items: TreeMenuItem[],
-  acl: AclSnapshot
+  permissions: AclPermissionSet
 ): TreeMenuItem[] =>
   items.flatMap((item) => {
-    const children = filterMenuItemsByAcl(item.children ?? [], acl);
+    const children = filterMenuItemsByAcl(item.children ?? [], permissions);
     const isContainer = Boolean(item.meta?.group || item.children?.length);
     const canAccessItem = item.route
-      ? canAccessWithSnapshot(acl, {
+      ? evaluateAccess(permissions, {
           resource: item.name,
           action: "list",
-          params: { resource: item },
+          resourceItem: item,
         })
       : true;
 

package/src/lib/nocobase/acl/record-permissions.ts

@@ -5,15 +5,25 @@ type RecordPermissionEntry = {
   knownIds: Map<string, Set<string>>;
 };
 
-const permissions = new Map<string, RecordPermissionEntry>();
+let permissions = new Map<string, RecordPermissionEntry>();
+const listeners = new Set<() => void>();
 
 const getKey = (dataSourceKey: string, resource: string) =>
   `${dataSourceKey}:${resource}`;
 
 export const clearRecordPermissions = () => {
-  permissions.clear();
+  if (!permissions.size) return;
+  permissions = new Map();
+  listeners.forEach((listener) => listener());
 };
 
+export const subscribeRecordPermissions = (listener: () => void) => {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+};
+
+export const getRecordPermissions = () => permissions;
+
 export const updateRecordPermissions = ({
   dataSourceKey = "main",
   resource,
@@ -28,10 +38,26 @@ export const updateRecordPermissions = ({
   if (!allowedActions) return false;
 
   const key = getKey(dataSourceKey, resource);
-  const entry = permissions.get(key) ?? {
-    allowedIds: new Map<string, Set<string>>(),
-    knownIds: new Map<string, Set<string>>(),
-  };
+  const existingEntry = permissions.get(key);
+  const entry = existingEntry
+    ? {
+        allowedIds: new Map(
+          Array.from(existingEntry.allowedIds, ([action, ids]) => [
+            action,
+            new Set(ids),
+          ])
+        ),
+        knownIds: new Map(
+          Array.from(existingEntry.knownIds, ([action, ids]) => [
+            action,
+            new Set(ids),
+          ])
+        ),
+      }
+    : {
+        allowedIds: new Map<string, Set<string>>(),
+        knownIds: new Map<string, Set<string>>(),
+      };
   const normalizedIds = new Set(recordIds.map(String));
   const normalizedAllowedActions = new Map(
     Object.entries(allowedActions).map(([action, ids]) => [
@@ -81,7 +107,11 @@ export const updateRecordPermissions = ({
     entry.knownIds.set(action, knownIds);
   }
 
-  permissions.set(key, entry);
+  if (changed) {
+    permissions = new Map(permissions);
+    permissions.set(key, entry);
+    listeners.forEach((listener) => listener());
+  }
   return changed;
 };
 

package/src/lib/nocobase/acl/store-provider.tsx

@@ -0,0 +1,14 @@
+import type { PropsWithChildren } from "react";
+
+import { AclStoreContext, type AclStore } from "./context";
+
+export function AclStoreProvider({
+  children,
+  store,
+}: PropsWithChildren<{ store: AclStore }>) {
+  return (
+    <AclStoreContext.Provider value={store}>
+      {children}
+    </AclStoreContext.Provider>
+  );
+}

package/src/lib/nocobase/acl/store.ts

@@ -1,44 +1,38 @@
-import { useSyncExternalStore } from "react";
-
 import { nocobaseClient } from "@/lib/nocobase/client";
 import { NocoBaseHttpError } from "@/lib/nocobase/error";
-import { clearRecordPermissions } from "./record-permissions";
-import type {
-  AclResponse,
-  AclSnapshot,
-} from "./types";
+import type { AclStore } from "./context";
+import {
+  clearRecordPermissions,
+  getRecordActionPermission,
+  getRecordPermissions,
+  subscribeRecordPermissions,
+} from "./record-permissions";
+import type { AclPermissionSet, AclResponse, AclState } from "./types";
 
 const listeners = new Set<() => void>();
-let request:
+let activeRequest:
   | {
       id: number;
-      identity: string;
-      promise: Promise<AclSnapshot>;
+      sessionKey: string;
+      promise: Promise<AclState>;
     }
   | undefined;
 let requestId = 0;
-let snapshot: AclSnapshot = {
-  status: "idle",
-  data: {},
-  meta: {},
-  version: 0,
-};
+let loadedSessionKey: string | undefined;
+let state: AclState = { status: "idle" };
 
 const emit = () => listeners.forEach((listener) => listener());
 
-const setSnapshot = (next: Partial<AclSnapshot>) => {
-  snapshot = {
-    ...snapshot,
-    ...next,
-    version: snapshot.version + 1,
-  };
+const setState = (next: AclState) => {
+  state = next;
   emit();
-  return snapshot;
+  return state;
 };
 
-const getIdentity = () => {
-  const token = nocobaseClient.getToken();
-  return token ? `${token}:${nocobaseClient.getRole() ?? ""}` : undefined;
+const getSessionKey = () => {
+  return `${nocobaseClient.getToken() ?? "cookie"}:${
+    nocobaseClient.getRole() ?? ""
+  }`;
 };
 
 const requestAcl = async (role?: string) =>
@@ -68,51 +62,45 @@ const isStaleRoleError = (error: unknown) => {
   );
 };
 
-export const getAclSnapshot = () => snapshot;
+const normalizePermissions = (
+  response: AclResponse,
+  fallbackRole?: string
+): AclPermissionSet => {
+  const { role, roles, ...permissions } = response.data ?? {};
+  const currentRole = role ?? fallbackRole;
+  return {
+    ...permissions,
+    currentRole,
+    roles: roles ?? (currentRole ? [currentRole] : []),
+    dataSources: response.meta?.dataSources,
+  };
+};
+
+export const getAclState = () => state;
 
 export const subscribeAcl = (listener: () => void) => {
   listeners.add(listener);
   return () => listeners.delete(listener);
 };
 
-export const useAclSnapshot = () =>
-  useSyncExternalStore(
-    subscribeAcl,
-    getAclSnapshot,
-    getAclSnapshot
-  );
-
-export const clearAcl = ({ keepRole = false } = {}) => {
+export const clearAcl = () => {
   requestId += 1;
-  request = undefined;
+  activeRequest = undefined;
+  loadedSessionKey = undefined;
   clearRecordPermissions();
-  if (!keepRole) nocobaseClient.setRole(null);
-  setSnapshot({
-    status: "idle",
-    identity: undefined,
-    data: {},
-    meta: {},
-    error: undefined,
-  });
-};
-
-export const notifyRecordPermissionsChanged = () => {
-  setSnapshot({});
+  setState({ status: "idle" });
 };
 
-export const loadAcl = async ({ force = false } = {}) => {
-  const identity = getIdentity();
-  if (!identity) {
-    clearAcl();
-    return snapshot;
+const load = async ({ force = false } = {}) => {
+  const sessionKey = getSessionKey();
+  if (!force && state.status === "ready" && loadedSessionKey === sessionKey) {
+    return state;
   }
-
-  if (!force && snapshot.status === "ready" && snapshot.identity === identity) {
-    return snapshot;
+  if (!force && activeRequest?.sessionKey === sessionKey) {
+    return activeRequest.promise;
   }
-  if (!force && request?.identity === identity) return request.promise;
 
-  setSnapshot({ status: "loading", identity, error: undefined });
+  setState({ status: "loading" });
   const currentRequestId = ++requestId;
   const requestedRole = nocobaseClient.getRole();
   const promise = (async () => {
@@ -127,37 +115,34 @@ export const loadAcl = async ({ force = false } = {}) => {
         response = await requestAcl();
       }
 
-      if (currentRequestId !== requestId) return snapshot;
+      if (currentRequestId !== requestId) return state;
 
-      const data = response.data ?? {};
-      nocobaseClient.setRole(data.role ?? effectiveRole ?? null);
+      const permissions = normalizePermissions(response, effectiveRole);
+      nocobaseClient.setRole(permissions.currentRole ?? null);
       clearRecordPermissions();
-      return setSnapshot({
-        status: "ready",
-        identity: getIdentity(),
-        data,
-        meta: response.meta ?? {},
-        error: undefined,
-      });
+      loadedSessionKey = getSessionKey();
+      return setState({ status: "ready", permissions });
     } catch (error) {
       const normalizedError =
-        error instanceof Error ? error : new Error("Unable to load permissions");
-      if (currentRequestId !== requestId) return snapshot;
-      setSnapshot({ status: "error", error: normalizedError });
-      throw normalizedError;
+        error instanceof Error
+          ? error
+          : new Error("Unable to load permissions");
+      if (currentRequestId !== requestId) return state;
+      loadedSessionKey = undefined;
+      return setState({ status: "error", error: normalizedError });
     } finally {
-      if (request?.id === currentRequestId) request = undefined;
+      if (activeRequest?.id === currentRequestId) activeRequest = undefined;
     }
   })();
-  request = { id: currentRequestId, identity, promise };
-
+  activeRequest = { id: currentRequestId, sessionKey, promise };
   return promise;
 };
 
-export const switchRole = async (
-  roleName: string,
-  { reloadAcl = true } = {}
-) => {
+export const loadAcl = () => load();
+
+export const retryAcl = () => load({ force: true });
+
+export const switchRole = async (roleName: string) => {
   const previousRole = nocobaseClient.getRole();
   nocobaseClient.setRole(roleName);
 
@@ -167,16 +152,37 @@ export const switchRole = async (
       body: { roleName },
       withAclMeta: false,
     });
-    if (!reloadAcl) {
-      clearRecordPermissions();
-      return snapshot;
-    }
-    return await loadAcl({ force: true });
+    await nocobaseClient.action("auth", "syncCookies", {
+      method: "POST",
+      withAclMeta: false,
+    });
   } catch (error) {
     nocobaseClient.setRole(previousRole);
-    if (reloadAcl) {
-      await loadAcl({ force: true }).catch(() => undefined);
+    try {
+      await nocobaseClient.action("auth", "syncCookies", {
+        method: "POST",
+        withAclMeta: false,
+      });
+    } catch {
+      // Preserve the original role-switch error. The stored role still rolls
+      // back and will override a stale role cookie on subsequent requests.
     }
     throw error;
   }
+
+  clearAcl();
+  await loadAcl();
+};
+
+export const aclStore: AclStore = {
+  getState: getAclState,
+  subscribe: subscribeAcl,
+  load: loadAcl,
+  retry: retryAcl,
+  clear: clearAcl,
+  recordPermissions: {
+    getState: getRecordPermissions,
+    subscribe: subscribeRecordPermissions,
+    getPermission: getRecordActionPermission,
+  },
 };