@ruiapp/rapid-core 0.9.9 → 0.9.11

package/dist/index.js

@@ -4881,7 +4881,7 @@ class RapidRequest {
         else if (contentType.startsWith("multipart/form-data")) {
             this.#body = {
                 type: "form-data",
-                value: await parseFormDataBody(req),
+                value: await parseFormDataBody(req, { all: true }),
             };
         }
         this.#bodyParsed = true;
@@ -9773,11 +9773,19 @@ class EntityAccessControlPlugin {
         // Check permission
         const { routerContext } = handlerContext;
         const { routeConfig } = routerContext;
-        for (const actionConfig of routeConfig.actions) {
-            const permissionCheck = actionConfig.config?.permissionCheck;
-            if (permissionCheck) {
-                if (!isAccessAllowed(permissionCheck, routerContext.state.allowedActions || [])) {
-                    throw new Error(`Your action of '${actionConfig.code}' is not permitted.`);
+        if (routeConfig.permissionCheck) {
+            if (!isAccessAllowed(routeConfig.permissionCheck, routerContext.state.allowedActions || [])) {
+                throw new Error(`Your request to route '${routeConfig.code}' is not permitted.`);
+            }
+        }
+        const actions = routeConfig.actions;
+        if (actions) {
+            for (const actionConfig of routeConfig.actions) {
+                const permissionCheck = actionConfig.config?.permissionCheck;
+                if (permissionCheck) {
+                    if (!isAccessAllowed(permissionCheck, routerContext.state.allowedActions || [])) {
+                        throw new Error(`Your action of '${actionConfig.code}' is not permitted.`);
+                    }
                 }
             }
         }

package/dist/types.d.ts

@@ -483,6 +483,7 @@ export interface RpdRoute {
     type: "RESTful";
     method: RpdHttpMethod;
     endpoint: string;
+    permissionCheck?: PermissionPolicy;
     actions?: RpdRouteActionConfig[];
     handler?: string | ((ctx: ActionHandlerContext) => Promise<void>);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ruiapp/rapid-core",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/core/http/formDataParser.ts

@@ -1,5 +1,3 @@
-import type { RapidRequest } from "../request";
-
 export type BodyData = Record<string, string | File | (string | File)[]>;
 export type ParseBodyOptions = {
   /**

package/src/core/request.ts

@@ -66,7 +66,7 @@ export class RapidRequest {
     } else if (contentType.startsWith("multipart/form-data")) {
       this.#body = {
         type: "form-data",
-        value: await parseFormDataBody(req),
+        value: await parseFormDataBody(req, { all: true }),
       };
     }
     this.#bodyParsed = true;

package/src/plugins/entityAccessControl/EntityAccessControlPlugin.ts

@@ -132,11 +132,20 @@ class EntityAccessControlPlugin implements RapidPlugin {
     // Check permission
     const { routerContext } = handlerContext;
     const { routeConfig } = routerContext;
-    for (const actionConfig of routeConfig.actions) {
-      const permissionCheck = actionConfig.config?.permissionCheck;
-      if (permissionCheck) {
-        if (!isAccessAllowed(permissionCheck, routerContext.state.allowedActions || [])) {
-          throw new Error(`Your action of '${actionConfig.code}' is not permitted.`);
+    if (routeConfig.permissionCheck) {
+      if (!isAccessAllowed(routeConfig.permissionCheck, routerContext.state.allowedActions || [])) {
+        throw new Error(`Your request to route '${routeConfig.code}' is not permitted.`);
+      }
+    }
+
+    const actions = routeConfig.actions;
+    if (actions) {
+      for (const actionConfig of routeConfig.actions) {
+        const permissionCheck = actionConfig.config?.permissionCheck;
+        if (permissionCheck) {
+          if (!isAccessAllowed(permissionCheck, routerContext.state.allowedActions || [])) {
+            throw new Error(`Your action of '${actionConfig.code}' is not permitted.`);
+          }
         }
       }
     }

package/src/types.ts

@@ -586,6 +586,7 @@ export interface RpdRoute {
   type: "RESTful";
   method: RpdHttpMethod;
   endpoint: string;
+  permissionCheck?: PermissionPolicy;
   actions?: RpdRouteActionConfig[];
   handler?: string | ((ctx: ActionHandlerContext) => Promise<void>);
 }