@rpcbase/server 0.324.0 → 0.326.0

package/boot/load_models.js

@@ -0,0 +1,23 @@
+/* @flow */
+const glob = require("glob")
+const path = require("path")
+
+
+const is_pascal_case = (str) => /^[A-Z][a-zA-Z0-9]*$/.test(str)
+
+
+const load_models = () => {
+  const wd = process.cwd()
+
+  const models_dir = path.join(wd, "./src/models")
+
+  const files = glob.sync(path.join(models_dir, "./**/*.js"))
+
+  files
+    .filter((f) => !path.dirname(f).endsWith("/helpers"))
+    .filter((f) => is_pascal_case(path.basename(f, ".js")))
+    .forEach((f) => require(f))
+
+}
+
+load_models()

package/boot/shared.js

@@ -6,6 +6,8 @@ require("../extend-expect")
 const mongoose = require("../mongoose")
 require("../src/access-control")(mongoose)
 
+require("./load_models")
+
 const {database, firebase} = require("../")
 
 database()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rpcbase/server",
-  "version": "0.324.0",
+  "version": "0.326.0",
   "license": "SSPL-1.0",
   "main": "./index.js",
   "bin": {

package/src/access-control/check_apply_permissions.js

@@ -49,12 +49,13 @@ const check_apply_permissions = (ac_config, model_name, operation, user_id, item
 
       const conditions = query.getQuery()
 
+      // TMP: warn if user supplied _owners, which is currently overwritten for ACL
       if (conditions._owners) {
-        if (conditions._owners.length !== 1 || conditions._owners[0] !== user_id) {
-          console.log(colors.yellow("Warning!"), model_name, "ACL for read is owner, but client is sending _owners in query, the field will be overwritten")
-          console.log("received conditions._owners:", JSON.stringify(conditions._owners))
+        if (JSON.stringify(conditions._owners) !== `{"$in":["${user_id}"]}`) {
+          console.log(colors.yellow("Warning!"), model_name, "ACL for read is owner, but client is sending _owners in query, the field will be overwritten", "\nreceived conditions._owners:", JSON.stringify(conditions._owners))
         }
       }
+
       // TODO: implement dynamic ACL based on what the application allows the user to read
       query.setQuery({
         ...conditions,