@ruiapp/rapid-core 0.1.60 → 0.1.62

package/dist/index.js

@@ -2295,7 +2295,10 @@ async function convertEntityFiltersToRowFilters(server, model, baseModel, filter
                     ],
                 });
                 const targetEntityIds = lodash.map(targetEntities, (entity) => entity["id"]);
-                const command = `SELECT * FROM ${server.queryBuilder.quoteTable({ schema: relationProperty.linkSchema, tableName: relationProperty.linkTableName })} WHERE ${server.queryBuilder.quoteObject(relationProperty.targetIdColumnName)} = ANY($1::int[])`;
+                const command = `SELECT * FROM ${server.queryBuilder.quoteTable({
+                    schema: relationProperty.linkSchema,
+                    tableName: relationProperty.linkTableName,
+                })} WHERE ${server.queryBuilder.quoteObject(relationProperty.targetIdColumnName)} = ANY($1::int[])`;
                 const params = [targetEntityIds];
                 const links = await server.queryDatabaseObject(command, params);
                 const selfEntityIds = links.map((link) => link[relationProperty.selfIdColumnName]);
@@ -2352,7 +2355,10 @@ async function convertEntityFiltersToRowFilters(server, model, baseModel, filter
     return replacedFilters;
 }
 async function findManyRelationLinksViaLinkTable(server, targetModel, relationProperty, entityIds) {
-    const command = `SELECT * FROM ${server.queryBuilder.quoteTable({ schema: relationProperty.linkSchema, tableName: relationProperty.linkTableName })} WHERE ${server.queryBuilder.quoteObject(relationProperty.selfIdColumnName)} = ANY($1::int[])`;
+    const command = `SELECT * FROM ${server.queryBuilder.quoteTable({
+        schema: relationProperty.linkSchema,
+        tableName: relationProperty.linkTableName,
+    })} WHERE ${server.queryBuilder.quoteObject(relationProperty.selfIdColumnName)} = ANY($1::int[])`;
     const params = [entityIds];
     const links = await server.queryDatabaseObject(command, params);
     const targetEntityIds = links.map((link) => link[relationProperty.targetIdColumnName]);
@@ -2417,7 +2423,7 @@ async function createEntity(server, dataAccessor, options, plugin) {
         throw newEntityOperationError("Create base entity directly is not allowed.");
     }
     const { entity, routeContext } = options;
-    const userId = options.routeContext.state?.userId;
+    const userId = options.routeContext?.state?.userId;
     if (userId) {
         const createdByProperty = getEntityPropertyByCode(server, model, "createdBy");
         if (createdByProperty) {
@@ -2536,7 +2542,10 @@ async function createEntity(server, dataAccessor, options, plugin) {
                         entity: targetEntity,
                     });
                     if (property.linkTableName) {
-                        const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+                        const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+                            schema: property.linkSchema,
+                            tableName: property.linkTableName,
+                        })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
                         const params = [newEntity.id, newTargetEntity.id];
                         await server.queryDatabaseObject(command, params);
                     }
@@ -2549,7 +2558,10 @@ async function createEntity(server, dataAccessor, options, plugin) {
                         throw new Error(`Entity with id '${relatedEntityId}' in field '${property.code}' is not exists.`);
                     }
                     if (property.linkTableName) {
-                        const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+                        const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+                            schema: property.linkSchema,
+                            tableName: property.linkTableName,
+                        })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
                         const params = [newEntity.id, relatedEntityId];
                         await server.queryDatabaseObject(command, params);
                     }
@@ -2568,7 +2580,10 @@ async function createEntity(server, dataAccessor, options, plugin) {
                     throw new Error(`Entity with id '${relatedEntityId}' in field '${property.code}' is not exists.`);
                 }
                 if (property.linkTableName) {
-                    const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+                    const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+                        schema: property.linkSchema,
+                        tableName: property.linkTableName,
+                    })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
                     const params = [newEntity.id, relatedEntityId];
                     await server.queryDatabaseObject(command, params);
                 }
@@ -2612,7 +2627,7 @@ async function updateEntityById(server, dataAccessor, options, plugin) {
         return entity;
     }
     entityToSave = changes || {};
-    const userId = options.routeContext.state?.userId;
+    const userId = options.routeContext?.state?.userId;
     if (userId) {
         const updatedByProperty = getEntityPropertyByCode(server, model, "updatedBy");
         if (updatedByProperty) {
@@ -2724,7 +2739,10 @@ async function updateEntityById(server, dataAccessor, options, plugin) {
         }
         if (property.linkTableName) {
             // TODO: should support removing relation
-            await server.queryDatabaseObject(`DELETE FROM ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} WHERE ${server.queryBuilder.quoteObject(property.selfIdColumnName)} = $1`, [id]);
+            await server.queryDatabaseObject(`DELETE FROM ${server.queryBuilder.quoteTable({
+                schema: property.linkSchema,
+                tableName: property.linkTableName,
+            })} WHERE ${server.queryBuilder.quoteObject(property.selfIdColumnName)} = $1`, [id]);
         }
         for (const relatedEntityToBeSaved of relatedEntitiesToBeSaved) {
             let relatedEntityId;
@@ -2740,7 +2758,10 @@ async function updateEntityById(server, dataAccessor, options, plugin) {
                         entity: targetEntity,
                     });
                     if (property.linkTableName) {
-                        const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+                        const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+                            schema: property.linkSchema,
+                            tableName: property.linkTableName,
+                        })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
                         const params = [id, newTargetEntity.id];
                         await server.queryDatabaseObject(command, params);
                     }
@@ -2753,7 +2774,10 @@ async function updateEntityById(server, dataAccessor, options, plugin) {
                         throw new Error(`Entity with id '${relatedEntityId}' in field '${property.code}' is not exists.`);
                     }
                     if (property.linkTableName) {
-                        const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+                        const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+                            schema: property.linkSchema,
+                            tableName: property.linkTableName,
+                        })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
                         const params = [id, relatedEntityId];
                         await server.queryDatabaseObject(command, params);
                     }
@@ -2772,7 +2796,10 @@ async function updateEntityById(server, dataAccessor, options, plugin) {
                     throw new Error(`Entity with id '${relatedEntityId}' in field '${property.code}' is not exists.`);
                 }
                 if (property.linkTableName) {
-                    const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+                    const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+                        schema: property.linkSchema,
+                        tableName: property.linkTableName,
+                    })} (${server.queryBuilder.quoteObject(property.selfIdColumnName)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
                     const params = [id, relatedEntityId];
                     await server.queryDatabaseObject(command, params);
                 }
@@ -2916,7 +2943,10 @@ class EntityManager {
         const { queryBuilder } = server;
         if (relationProperty.linkTableName) {
             for (const relation of relations) {
-                const command = `INSERT INTO ${queryBuilder.quoteTable({ schema: relationProperty.linkSchema, tableName: relationProperty.linkTableName })} (${queryBuilder.quoteObject(relationProperty.selfIdColumnName)}, ${queryBuilder.quoteObject(relationProperty.targetIdColumnName)})
+                const command = `INSERT INTO ${queryBuilder.quoteTable({
+                    schema: relationProperty.linkSchema,
+                    tableName: relationProperty.linkTableName,
+                })} (${queryBuilder.quoteObject(relationProperty.selfIdColumnName)}, ${queryBuilder.quoteObject(relationProperty.targetIdColumnName)})
     SELECT $1, $2 WHERE NOT EXISTS (
       SELECT ${queryBuilder.quoteObject(relationProperty.selfIdColumnName)}, ${queryBuilder.quoteObject(relationProperty.targetIdColumnName)}
         FROM ${queryBuilder.quoteTable({ schema: relationProperty.linkSchema, tableName: relationProperty.linkTableName })}
@@ -5553,6 +5583,7 @@ class ServerOperationPlugin {
                         code: "runServerOperation",
                         config: {
                             operation: operation.handler,
+                            permissionCheck: operation.permissionCheck,
                         },
                     },
                 ],
@@ -6003,14 +6034,6 @@ class EntityAccessControlPlugin {
     async configureRoutes(server, applicationConfig) {
         const logger = server.getLogger();
         logger.info("Configuring entity access checking policies...");
-        const model = lodash.find(applicationConfig.models, (item) => item.singularCode === "model");
-        if (!model) {
-            return;
-        }
-        const { permissionPolicies } = model;
-        if (!permissionPolicies) {
-            return;
-        }
         const routes = applicationConfig.routes;
         for (const route of routes) {
             const { actions } = route;
@@ -6018,9 +6041,56 @@ class EntityAccessControlPlugin {
                 continue;
             }
             for (const action of route.actions) {
-                if (action.code === "findCollectionEntityById") {
+                if (action.code === "findCollectionEntityById" || action.code === "findCollectionEntities" || action.code === "countCollectionEntities") {
+                    const model = lodash.find(applicationConfig.models, (item) => item.singularCode === action.config.singularCode);
+                    if (!model) {
+                        continue;
+                    }
+                    const { permissionPolicies } = model;
+                    if (!permissionPolicies) {
+                        continue;
+                    }
                     if (permissionPolicies.find) {
-                        lodash.set(action, "config.permissionPolicy", permissionPolicies.find);
+                        lodash.set(action, "config.permissionCheck", permissionPolicies.find);
+                    }
+                }
+                else if (action.code === "createCollectionEntity" || action.code === "createCollectionEntitiesBatch") {
+                    const model = lodash.find(applicationConfig.models, (item) => item.singularCode === action.config.singularCode);
+                    if (!model) {
+                        continue;
+                    }
+                    const { permissionPolicies } = model;
+                    if (!permissionPolicies) {
+                        continue;
+                    }
+                    if (permissionPolicies.create) {
+                        lodash.set(action, "config.permissionCheck", permissionPolicies.create);
+                    }
+                }
+                else if (action.code === "updateCollectionEntityById" || action.code === "addEntityRelations" || action.code === "removeEntityRelations") {
+                    const model = lodash.find(applicationConfig.models, (item) => item.singularCode === action.config.singularCode);
+                    if (!model) {
+                        continue;
+                    }
+                    const { permissionPolicies } = model;
+                    if (!permissionPolicies) {
+                        continue;
+                    }
+                    if (permissionPolicies.update) {
+                        lodash.set(action, "config.permissionCheck", permissionPolicies.update);
+                    }
+                }
+                else if (action.code === "deleteCollectionEntityById") {
+                    const model = lodash.find(applicationConfig.models, (item) => item.singularCode === action.config.singularCode);
+                    if (!model) {
+                        continue;
+                    }
+                    const { permissionPolicies } = model;
+                    if (!permissionPolicies) {
+                        continue;
+                    }
+                    if (permissionPolicies.delete) {
+                        lodash.set(action, "config.permissionCheck", permissionPolicies.delete);
                     }
                 }
             }
@@ -6042,9 +6112,9 @@ class EntityAccessControlPlugin {
         const { routerContext } = handlerContext;
         const { routeConfig } = routerContext;
         for (const actionConfig of routeConfig.actions) {
-            const permissionPolicy = actionConfig.config?.permissionPolicy;
-            if (permissionPolicy) {
-                if (!isAccessAllowed(permissionPolicy, routerContext.state.allowedActions || [])) {
+            const permissionCheck = actionConfig.config?.permissionCheck;
+            if (permissionCheck) {
+                if (!isAccessAllowed(permissionCheck, routerContext.state.allowedActions || [])) {
                     throw new Error(`Your action of '${actionConfig.code}' is not permitted.`);
                 }
             }

package/dist/plugins/serverOperation/ServerOperationPluginTypes.d.ts

@@ -1,9 +1,11 @@
 import { ActionHandlerContext } from "../../core/actionHandler";
 import { RpdHttpMethod } from "../../types";
+import { PermissionCheckPolicy } from "../../utilities/accessControlUtility";
 export interface ServerOperation {
     code: string;
     description?: string;
     method: RpdHttpMethod;
+    permissionCheck?: PermissionCheckPolicy;
     handler: (ctx: ActionHandlerContext) => Promise<void>;
 }
 export interface ServerOperationPluginInitOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ruiapp/rapid-core",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/dataAccess/entityManager.ts

@@ -114,7 +114,9 @@ async function findEntities(server: IRpdServer, dataAccessor: IRpdDataAccessor,
 
   // if `keepNonPropertyFields` is true and `properties` are not specified, then select relation columns automatically.
   if (options.keepNonPropertyFields && (!options.properties || !options.properties.length)) {
-    const oneRelationPropertiesWithNoLinkTable = getEntityPropertiesIncludingBase(server, model).filter((property) => property.relation === "one" && !property.linkTableName);
+    const oneRelationPropertiesWithNoLinkTable = getEntityPropertiesIncludingBase(server, model).filter(
+      (property) => property.relation === "one" && !property.linkTableName,
+    );
     oneRelationPropertiesWithNoLinkTable.forEach((property) => {
       if (property.targetIdColumnName) {
         columnsToSelect.push({
@@ -232,7 +234,12 @@ async function findById(server: IRpdServer, dataAccessor: IRpdDataAccessor, opti
   });
 }
 
-async function convertEntityFiltersToRowFilters(server: IRpdServer, model: RpdDataModel, baseModel: RpdDataModel, filters: EntityFilterOptions[] | undefined): Promise<RowFilterOptions[]> {
+async function convertEntityFiltersToRowFilters(
+  server: IRpdServer,
+  model: RpdDataModel,
+  baseModel: RpdDataModel,
+  filters: EntityFilterOptions[] | undefined,
+): Promise<RowFilterOptions[]> {
   if (!filters || !filters.length) {
     return [];
   }
@@ -251,7 +258,9 @@ async function convertEntityFiltersToRowFilters(server: IRpdServer, model: RpdDa
         throw new Error(`Invalid filters. Property '${filter.field}' was not found in model '${model.namespace}.${model.singularCode}'`);
       }
       if (!isRelationProperty(relationProperty)) {
-        throw new Error(`Invalid filters. Filter with 'existence' operator on property '${filter.field}' is not allowed. You can only use it on an relation property.`);
+        throw new Error(
+          `Invalid filters. Filter with 'existence' operator on property '${filter.field}' is not allowed. You can only use it on an relation property.`,
+        );
       }
 
       const relatedEntityFilters = filter.filters;
@@ -382,7 +391,10 @@ async function convertEntityFiltersToRowFilters(server: IRpdServer, model: RpdDa
         });
         const targetEntityIds = map(targetEntities, (entity: any) => entity["id"]);
 
-        const command = `SELECT * FROM ${server.queryBuilder.quoteTable({ schema: relationProperty.linkSchema, tableName: relationProperty.linkTableName! })} WHERE ${server.queryBuilder.quoteObject(relationProperty.targetIdColumnName!)} = ANY($1::int[])`;
+        const command = `SELECT * FROM ${server.queryBuilder.quoteTable({
+          schema: relationProperty.linkSchema,
+          tableName: relationProperty.linkTableName!,
+        })} WHERE ${server.queryBuilder.quoteObject(relationProperty.targetIdColumnName!)} = ANY($1::int[])`;
         const params = [targetEntityIds];
         const links = await server.queryDatabaseObject(command, params);
         const selfEntityIds = links.map((link) => link[relationProperty.selfIdColumnName!]);
@@ -440,7 +452,10 @@ async function convertEntityFiltersToRowFilters(server: IRpdServer, model: RpdDa
 }
 
 async function findManyRelationLinksViaLinkTable(server: IRpdServer, targetModel: RpdDataModel, relationProperty: RpdDataModelProperty, entityIds: any[]) {
-  const command = `SELECT * FROM ${server.queryBuilder.quoteTable({ schema: relationProperty.linkSchema, tableName: relationProperty.linkTableName! })} WHERE ${server.queryBuilder.quoteObject(relationProperty.selfIdColumnName!)} = ANY($1::int[])`;
+  const command = `SELECT * FROM ${server.queryBuilder.quoteTable({
+    schema: relationProperty.linkSchema,
+    tableName: relationProperty.linkTableName!,
+  })} WHERE ${server.queryBuilder.quoteObject(relationProperty.selfIdColumnName!)} = ANY($1::int[])`;
   const params = [entityIds];
   const links = await server.queryDatabaseObject(command, params);
   const targetEntityIds = links.map((link) => link[relationProperty.targetIdColumnName!]);
@@ -514,7 +529,7 @@ async function createEntity(server: IRpdServer, dataAccessor: IRpdDataAccessor,
 
   const { entity, routeContext } = options;
 
-  const userId = options.routeContext.state?.userId;
+  const userId = options.routeContext?.state?.userId;
   if (userId) {
     const createdByProperty = getEntityPropertyByCode(server, model, "createdBy");
     if (createdByProperty) {
@@ -583,7 +598,9 @@ async function createEntity(server: IRpdServer, dataAccessor: IRpdDataAccessor,
           routeContext,
         });
         if (!targetEntity) {
-          throw newEntityOperationError(`Create ${model.singularCode} entity failed. Property '${property.code}' was invalid. Related ${property.targetSingularCode} entity with id '${targetEntityId}' was not found.`);
+          throw newEntityOperationError(
+            `Create ${model.singularCode} entity failed. Property '${property.code}' was invalid. Related ${property.targetSingularCode} entity with id '${targetEntityId}' was not found.`,
+          );
         }
         newEntityOneRelationProps[property.code] = targetEntity;
         targetRow[property.targetIdColumnName!] = targetEntityId;
@@ -596,7 +613,9 @@ async function createEntity(server: IRpdServer, dataAccessor: IRpdDataAccessor,
         routeContext,
       });
       if (!targetEntity) {
-        throw newEntityOperationError(`Create ${model.singularCode} entity failed. Property '${property.code}' was invalid. Related ${property.targetSingularCode} entity with id '${targetEntityId}' was not found.`);
+        throw newEntityOperationError(
+          `Create ${model.singularCode} entity failed. Property '${property.code}' was invalid. Related ${property.targetSingularCode} entity with id '${targetEntityId}' was not found.`,
+        );
       }
       newEntityOneRelationProps[property.code] = targetEntity;
       targetRow[property.targetIdColumnName!] = targetEntityId;
@@ -643,7 +662,10 @@ async function createEntity(server: IRpdServer, dataAccessor: IRpdDataAccessor,
           });
 
           if (property.linkTableName) {
-            const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+            const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+              schema: property.linkSchema,
+              tableName: property.linkTableName,
+            })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
             const params = [newEntity.id, newTargetEntity.id];
             await server.queryDatabaseObject(command, params);
           }
@@ -657,7 +679,10 @@ async function createEntity(server: IRpdServer, dataAccessor: IRpdDataAccessor,
           }
 
           if (property.linkTableName) {
-            const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+            const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+              schema: property.linkSchema,
+              tableName: property.linkTableName,
+            })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
             const params = [newEntity.id, relatedEntityId];
             await server.queryDatabaseObject(command, params);
           } else {
@@ -675,7 +700,10 @@ async function createEntity(server: IRpdServer, dataAccessor: IRpdDataAccessor,
         }
 
         if (property.linkTableName) {
-          const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+          const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+            schema: property.linkSchema,
+            tableName: property.linkTableName,
+          })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
           const params = [newEntity.id, relatedEntityId];
           await server.queryDatabaseObject(command, params);
         } else {
@@ -726,7 +754,7 @@ async function updateEntityById(server: IRpdServer, dataAccessor: IRpdDataAccess
 
   entityToSave = changes || {};
 
-  const userId = options.routeContext.state?.userId;
+  const userId = options.routeContext?.state?.userId;
   if (userId) {
     const updatedByProperty = getEntityPropertyByCode(server, model, "updatedBy");
     if (updatedByProperty) {
@@ -799,7 +827,9 @@ async function updateEntityById(server: IRpdServer, dataAccessor: IRpdDataAccess
           routeContext,
         });
         if (!targetEntity) {
-          throw newEntityOperationError(`Create ${model.singularCode} entity failed. Property '${property.code}' was invalid. Related ${property.targetSingularCode} entity with id '${targetEntityId}' was not found.`);
+          throw newEntityOperationError(
+            `Create ${model.singularCode} entity failed. Property '${property.code}' was invalid. Related ${property.targetSingularCode} entity with id '${targetEntityId}' was not found.`,
+          );
         }
         updatedEntityOneRelationProps[property.code] = targetEntity;
         targetRow[property.targetIdColumnName!] = targetEntityId;
@@ -812,7 +842,9 @@ async function updateEntityById(server: IRpdServer, dataAccessor: IRpdDataAccess
         routeContext,
       });
       if (!targetEntity) {
-        throw newEntityOperationError(`Create ${model.singularCode} entity failed. Property '${property.code}' was invalid. Related ${property.targetSingularCode} entity with id '${targetEntityId}' was not found.`);
+        throw newEntityOperationError(
+          `Create ${model.singularCode} entity failed. Property '${property.code}' was invalid. Related ${property.targetSingularCode} entity with id '${targetEntityId}' was not found.`,
+        );
       }
       updatedEntityOneRelationProps[property.code] = targetEntity;
       targetRow[property.targetIdColumnName!] = targetEntityId;
@@ -848,7 +880,13 @@ async function updateEntityById(server: IRpdServer, dataAccessor: IRpdDataAccess
 
     if (property.linkTableName) {
       // TODO: should support removing relation
-      await server.queryDatabaseObject(`DELETE FROM ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} WHERE ${server.queryBuilder.quoteObject(property.selfIdColumnName!)} = $1`, [id]);
+      await server.queryDatabaseObject(
+        `DELETE FROM ${server.queryBuilder.quoteTable({
+          schema: property.linkSchema,
+          tableName: property.linkTableName,
+        })} WHERE ${server.queryBuilder.quoteObject(property.selfIdColumnName!)} = $1`,
+        [id],
+      );
     }
 
     for (const relatedEntityToBeSaved of relatedEntitiesToBeSaved) {
@@ -866,7 +904,10 @@ async function updateEntityById(server: IRpdServer, dataAccessor: IRpdDataAccess
           });
 
           if (property.linkTableName) {
-            const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+            const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+              schema: property.linkSchema,
+              tableName: property.linkTableName,
+            })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
             const params = [id, newTargetEntity.id];
             await server.queryDatabaseObject(command, params);
           }
@@ -880,7 +921,10 @@ async function updateEntityById(server: IRpdServer, dataAccessor: IRpdDataAccess
           }
 
           if (property.linkTableName) {
-            const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+            const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+              schema: property.linkSchema,
+              tableName: property.linkTableName,
+            })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
             const params = [id, relatedEntityId];
             await server.queryDatabaseObject(command, params);
           } else {
@@ -898,7 +942,10 @@ async function updateEntityById(server: IRpdServer, dataAccessor: IRpdDataAccess
         }
 
         if (property.linkTableName) {
-          const command = `INSERT INTO ${server.queryBuilder.quoteTable({ schema: property.linkSchema, tableName: property.linkTableName })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
+          const command = `INSERT INTO ${server.queryBuilder.quoteTable({
+            schema: property.linkSchema,
+            tableName: property.linkTableName,
+          })} (${server.queryBuilder.quoteObject(property.selfIdColumnName!)}, ${property.targetIdColumnName}) VALUES ($1, $2) ON CONFLICT DO NOTHING;`;
           const params = [id, relatedEntityId];
           await server.queryDatabaseObject(command, params);
         } else {
@@ -1065,7 +1112,10 @@ export default class EntityManager<TEntity = any> {
     const { queryBuilder } = server;
     if (relationProperty.linkTableName) {
       for (const relation of relations) {
-        const command = `INSERT INTO ${queryBuilder.quoteTable({ schema: relationProperty.linkSchema, tableName: relationProperty.linkTableName })} (${queryBuilder.quoteObject(relationProperty.selfIdColumnName!)}, ${queryBuilder.quoteObject(relationProperty.targetIdColumnName!)})
+        const command = `INSERT INTO ${queryBuilder.quoteTable({
+          schema: relationProperty.linkSchema,
+          tableName: relationProperty.linkTableName,
+        })} (${queryBuilder.quoteObject(relationProperty.selfIdColumnName!)}, ${queryBuilder.quoteObject(relationProperty.targetIdColumnName!)})
     SELECT $1, $2 WHERE NOT EXISTS (
       SELECT ${queryBuilder.quoteObject(relationProperty.selfIdColumnName!)}, ${queryBuilder.quoteObject(relationProperty.targetIdColumnName!)}
         FROM ${queryBuilder.quoteTable({ schema: relationProperty.linkSchema, tableName: relationProperty.linkTableName })}

package/src/plugins/entityAccessControl/EntityAccessControlPlugin.ts

@@ -1,6 +1,12 @@
 import type { RpdApplicationConfig, RpdDataModelProperty } from "~/types";
 
-import { IRpdServer, RapidPlugin, RpdConfigurationItemOptions, RpdServerPluginConfigurableTargetOptions, RpdServerPluginExtendingAbilities } from "~/core/server";
+import {
+  IRpdServer,
+  RapidPlugin,
+  RpdConfigurationItemOptions,
+  RpdServerPluginConfigurableTargetOptions,
+  RpdServerPluginExtendingAbilities,
+} from "~/core/server";
 import { find, set } from "lodash";
 import { ActionHandlerContext } from "~/core/actionHandler";
 import { isAccessAllowed } from "~/utilities/accessControlUtility";
@@ -45,16 +51,6 @@ class EntityAccessControlPlugin implements RapidPlugin {
     const logger = server.getLogger();
     logger.info("Configuring entity access checking policies...");
 
-    const model = find(applicationConfig.models, (item) => item.singularCode === "model");
-    if (!model) {
-      return;
-    }
-
-    const { permissionPolicies } = model;
-    if (!permissionPolicies) {
-      return;
-    }
-
     const routes = applicationConfig.routes;
     for (const route of routes) {
       const { actions } = route;
@@ -63,9 +59,53 @@ class EntityAccessControlPlugin implements RapidPlugin {
       }
 
       for (const action of route.actions) {
-        if (action.code === "findCollectionEntityById") {
+        if (action.code === "findCollectionEntityById" || action.code === "findCollectionEntities" || action.code === "countCollectionEntities") {
+          const model = find(applicationConfig.models, (item) => item.singularCode === action.config.singularCode);
+          if (!model) {
+            continue;
+          }
+          const { permissionPolicies } = model;
+          if (!permissionPolicies) {
+            continue;
+          }
           if (permissionPolicies.find) {
-            set(action, "config.permissionPolicy", permissionPolicies.find);
+            set(action, "config.permissionCheck", permissionPolicies.find);
+          }
+        } else if (action.code === "createCollectionEntity" || action.code === "createCollectionEntitiesBatch") {
+          const model = find(applicationConfig.models, (item) => item.singularCode === action.config.singularCode);
+          if (!model) {
+            continue;
+          }
+          const { permissionPolicies } = model;
+          if (!permissionPolicies) {
+            continue;
+          }
+          if (permissionPolicies.create) {
+            set(action, "config.permissionCheck", permissionPolicies.create);
+          }
+        } else if (action.code === "updateCollectionEntityById" || action.code === "addEntityRelations" || action.code === "removeEntityRelations") {
+          const model = find(applicationConfig.models, (item) => item.singularCode === action.config.singularCode);
+          if (!model) {
+            continue;
+          }
+          const { permissionPolicies } = model;
+          if (!permissionPolicies) {
+            continue;
+          }
+          if (permissionPolicies.update) {
+            set(action, "config.permissionCheck", permissionPolicies.update);
+          }
+        } else if (action.code === "deleteCollectionEntityById") {
+          const model = find(applicationConfig.models, (item) => item.singularCode === action.config.singularCode);
+          if (!model) {
+            continue;
+          }
+          const { permissionPolicies } = model;
+          if (!permissionPolicies) {
+            continue;
+          }
+          if (permissionPolicies.delete) {
+            set(action, "config.permissionCheck", permissionPolicies.delete);
           }
         }
       }
@@ -93,9 +133,9 @@ class EntityAccessControlPlugin implements RapidPlugin {
     const { routerContext } = handlerContext;
     const { routeConfig } = routerContext;
     for (const actionConfig of routeConfig.actions) {
-      const permissionPolicy = actionConfig.config?.permissionPolicy;
-      if (permissionPolicy) {
-        if (!isAccessAllowed(permissionPolicy, routerContext.state.allowedActions || [])) {
+      const permissionCheck = actionConfig.config?.permissionCheck;
+      if (permissionCheck) {
+        if (!isAccessAllowed(permissionCheck, routerContext.state.allowedActions || [])) {
           throw new Error(`Your action of '${actionConfig.code}' is not permitted.`);
         }
       }

package/src/plugins/serverOperation/ServerOperationPlugin.ts

@@ -2,7 +2,13 @@ import type { RpdApplicationConfig, RpdRoute } from "~/types";
 
 import pluginActionHandlers from "./actionHandlers";
 import { ServerOperation, ServerOperationPluginInitOptions } from "./ServerOperationPluginTypes";
-import { IRpdServer, RapidPlugin, RpdConfigurationItemOptions, RpdServerPluginConfigurableTargetOptions, RpdServerPluginExtendingAbilities } from "~/core/server";
+import {
+  IRpdServer,
+  RapidPlugin,
+  RpdConfigurationItemOptions,
+  RpdServerPluginConfigurableTargetOptions,
+  RpdServerPluginExtendingAbilities,
+} from "~/core/server";
 
 class ServerOperationPlugin implements RapidPlugin {
   #operations: ServerOperation[];
@@ -68,6 +74,7 @@ class ServerOperationPlugin implements RapidPlugin {
             code: "runServerOperation",
             config: {
               operation: operation.handler,
+              permissionCheck: operation.permissionCheck,
             },
           },
         ],

package/src/plugins/serverOperation/ServerOperationPluginTypes.ts

@@ -1,10 +1,12 @@
 import { ActionHandlerContext } from "~/core/actionHandler";
 import { RpdHttpMethod } from "~/types";
+import { PermissionCheckPolicy } from "~/utilities/accessControlUtility";
 
 export interface ServerOperation {
   code: string;
   description?: string;
   method: RpdHttpMethod;
+  permissionCheck?: PermissionCheckPolicy;
   handler: (ctx: ActionHandlerContext) => Promise<void>;
 }