@ruiapp/rapid-core 0.9.10 → 0.9.12

package/dist/index.js

@@ -2879,6 +2879,7 @@ async function findManyRelationLinksViaLinkTable(options) {
         singularCode: relationModel.singularCode,
     });
     const findEntityOptions = {
+        routeContext,
         filters: [
             {
                 field: "id",
@@ -2917,11 +2918,12 @@ async function findManyRelationLinksViaLinkTable(options) {
     return { relationLinks, targetEntities };
 }
 async function findManyRelatedEntitiesViaIdPropertyCode(options) {
-    const { server, relationProperty, mainEntityIds, selectRelationOptions } = options;
+    const { server, routeContext, relationProperty, mainEntityIds, selectRelationOptions } = options;
     const dataAccessor = server.getDataAccessor({
         singularCode: relationProperty.targetSingularCode,
     });
     const findEntityOptions = {
+        routeContext,
         filters: [
             {
                 field: relationProperty.selfIdColumnName,
@@ -2962,11 +2964,12 @@ async function findManyRelatedEntitiesViaIdPropertyCode(options) {
     return await findEntities(server, dataAccessor, findEntityOptions);
 }
 async function findOneRelatedEntitiesViaIdPropertyCode(options) {
-    const { server, relationProperty, relationEntityIds, selectRelationOptions } = options;
+    const { server, routeContext, relationProperty, relationEntityIds, selectRelationOptions } = options;
     const dataAccessor = server.getDataAccessor({
         singularCode: relationProperty.targetSingularCode,
     });
     const findEntityOptions = {
+        routeContext,
         filters: [
             {
                 field: "id",
@@ -9773,11 +9776,19 @@ class EntityAccessControlPlugin {
         // Check permission
         const { routerContext } = handlerContext;
         const { routeConfig } = routerContext;
-        for (const actionConfig of routeConfig.actions) {
-            const permissionCheck = actionConfig.config?.permissionCheck;
-            if (permissionCheck) {
-                if (!isAccessAllowed(permissionCheck, routerContext.state.allowedActions || [])) {
-                    throw new Error(`Your action of '${actionConfig.code}' is not permitted.`);
+        if (routeConfig.permissionCheck) {
+            if (!isAccessAllowed(routeConfig.permissionCheck, routerContext.state.allowedActions || [])) {
+                throw new Error(`Your request to route '${routeConfig.code}' is not permitted.`);
+            }
+        }
+        const actions = routeConfig.actions;
+        if (actions) {
+            for (const actionConfig of routeConfig.actions) {
+                const permissionCheck = actionConfig.config?.permissionCheck;
+                if (permissionCheck) {
+                    if (!isAccessAllowed(permissionCheck, routerContext.state.allowedActions || [])) {
+                        throw new Error(`Your action of '${actionConfig.code}' is not permitted.`);
+                    }
                 }
             }
         }

package/dist/types.d.ts

@@ -483,6 +483,7 @@ export interface RpdRoute {
     type: "RESTful";
     method: RpdHttpMethod;
     endpoint: string;
+    permissionCheck?: PermissionPolicy;
     actions?: RpdRouteActionConfig[];
     handler?: string | ((ctx: ActionHandlerContext) => Promise<void>);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ruiapp/rapid-core",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/dataAccess/entityManager.ts

@@ -649,6 +649,7 @@ async function findManyRelationLinksViaLinkTable(options: FindManyRelationEntiti
   });
 
   const findEntityOptions: FindEntityOptions = {
+    routeContext,
     filters: [
       {
         field: "id",
@@ -692,12 +693,13 @@ async function findManyRelationLinksViaLinkTable(options: FindManyRelationEntiti
 }
 
 async function findManyRelatedEntitiesViaIdPropertyCode(options: FindManyRelationEntitiesOptions) {
-  const { server, relationProperty, mainEntityIds, selectRelationOptions } = options;
+  const { server, routeContext, relationProperty, mainEntityIds, selectRelationOptions } = options;
   const dataAccessor = server.getDataAccessor({
     singularCode: relationProperty.targetSingularCode as string,
   });
 
   const findEntityOptions: FindEntityOptions = {
+    routeContext,
     filters: [
       {
         field: relationProperty.selfIdColumnName,
@@ -741,13 +743,14 @@ async function findManyRelatedEntitiesViaIdPropertyCode(options: FindManyRelatio
 }
 
 async function findOneRelatedEntitiesViaIdPropertyCode(options: FindOneRelationEntitiesOptions) {
-  const { server, relationProperty, relationEntityIds, selectRelationOptions } = options;
+  const { server, routeContext, relationProperty, relationEntityIds, selectRelationOptions } = options;
 
   const dataAccessor = server.getDataAccessor({
     singularCode: relationProperty.targetSingularCode as string,
   });
 
   const findEntityOptions: FindEntityOptions = {
+    routeContext,
     filters: [
       {
         field: "id",

package/src/plugins/entityAccessControl/EntityAccessControlPlugin.ts

@@ -132,11 +132,20 @@ class EntityAccessControlPlugin implements RapidPlugin {
     // Check permission
     const { routerContext } = handlerContext;
     const { routeConfig } = routerContext;
-    for (const actionConfig of routeConfig.actions) {
-      const permissionCheck = actionConfig.config?.permissionCheck;
-      if (permissionCheck) {
-        if (!isAccessAllowed(permissionCheck, routerContext.state.allowedActions || [])) {
-          throw new Error(`Your action of '${actionConfig.code}' is not permitted.`);
+    if (routeConfig.permissionCheck) {
+      if (!isAccessAllowed(routeConfig.permissionCheck, routerContext.state.allowedActions || [])) {
+        throw new Error(`Your request to route '${routeConfig.code}' is not permitted.`);
+      }
+    }
+
+    const actions = routeConfig.actions;
+    if (actions) {
+      for (const actionConfig of routeConfig.actions) {
+        const permissionCheck = actionConfig.config?.permissionCheck;
+        if (permissionCheck) {
+          if (!isAccessAllowed(permissionCheck, routerContext.state.allowedActions || [])) {
+            throw new Error(`Your action of '${actionConfig.code}' is not permitted.`);
+          }
         }
       }
     }

package/src/types.ts

@@ -586,6 +586,7 @@ export interface RpdRoute {
   type: "RESTful";
   method: RpdHttpMethod;
   endpoint: string;
+  permissionCheck?: PermissionPolicy;
   actions?: RpdRouteActionConfig[];
   handler?: string | ((ctx: ActionHandlerContext) => Promise<void>);
 }