@servicenow/sdk-build-plugins 3.0.3 → 4.0.1

package/src/aclAndRole/AclPlugin.ts

@@ -1,420 +0,0 @@
-import {
-    Acl,
-    TableAcl,
-    NamedAcl,
-    AclAttributes,
-    AclBase,
-    AclOperations,
-    AclTypes,
-    AclSchema,
-} from '@servicenow/sdk-core/runtime/app'
-import {
-    Plugin,
-    extractCallExpression,
-    generateCallExpressionExportForDocument,
-    getOrCreateEntitySourceFile,
-    getSysUpdateName,
-    linkDocument,
-    removeNode,
-    transformFunctionArguments,
-    FluentDiagnostic,
-    findObjectPropertyValue,
-    EntityData,
-    ObjectData,
-    ArrayData,
-    Data,
-    getCallExpressionName,
-} from '@servicenow/sdk-build-core'
-import { addObjectToArrayById, removeObjectFromArrayById } from './Util'
-import { additionalProperties } from '@servicenow/sdk-core/runtime/util'
-import { Record as DBRecord, TableName } from '@servicenow/sdk-core/runtime/db'
-import { except } from '../scripts/scriptUtils'
-import { ts } from '@servicenow/sdk-project'
-import { AclNamedTypes } from '@servicenow/sdk-core/runtime/app'
-import { processScript } from '../ScriptTemplatePlugin'
-import { Diagnostic } from '@servicenow/sdk-project'
-import { ModuleFunctionData } from '../ServerModulePlugin'
-import { RecordPlugin } from '../db'
-
-type AclDoc = {
-    table: string
-    data: {
-        sys_id: string
-    }
-}
-
-type AclRole = {
-    table: string
-    data: {
-        sys_security_acl: string
-        sys_user_role: string
-    }
-}
-
-type AclData = AclBase & {
-    name: string
-    type: keyof typeof AclTypes
-}
-
-const ExecuteOnlyTypes = new Set([
-    'client_callable_flow_object',
-    'client_callable_script_include',
-    'graphql',
-    'processor',
-    'rest_endpoint',
-])
-
-function aclAsRecord<T extends TableName>(config: Acl<T>) {
-    const tableConfig = config as TableAcl<T>
-    const namedConfig = config as NamedAcl
-
-    const field = String(tableConfig.field || '')
-    const name = namedConfig.name || (field ? `${tableConfig.table}.${field}` : tableConfig.table)
-    if (!name) {
-        throw new Error(`ACL of type ${config.type} and $id '${config.$id}' has no name or associated table`)
-    }
-
-    if (config.operation !== 'execute' && ExecuteOnlyTypes.has(config.type)) {
-        throw new Error(`ACL ${name} must use operation 'execute', because it is of type '${config.type}'`)
-    }
-    if (config.script && config.type === 'graphql') {
-        throw new Error(`ACL ${name} does not support scripts, because it is of type ${config.type}`)
-    }
-    if (tableConfig.applies_to && tableConfig.type !== 'record') {
-        throw new Error(`ACL ${name} cannot set applies_to unless its type is 'record'`)
-    }
-    if (tableConfig.operation === 'add_to_list' && (config.script || config.condition)) {
-        throw new Error(`ACL ${name} cannot have a script or condition due to its 'add_to_list' operation`)
-    }
-
-    return DBRecord({
-        table: 'sys_security_acl',
-        $id: config.$id,
-        data: {
-            name,
-            active: config.active ?? true,
-            type: AclTypes[config.type ?? 'record'],
-            operation: AclOperations[config.operation as keyof typeof AclOperations] || config.operation || '',
-            decision_type: config.decision_type ?? 'allow',
-            description: config.description || '',
-            local_or_existing: config.local_or_existing || 'Local',
-            admin_overrides: config.admin_overrides ?? true,
-            advanced: !!config.script,
-            condition: config.condition ?? '',
-            applies_to: tableConfig.applies_to ?? '',
-            script: config.script as any,
-            security_attribute:
-                (config.security_attribute && AclAttributes[config.security_attribute as keyof typeof AclAttributes]) ||
-                config.security_attribute ||
-                '',
-            ...additionalProperties(config, AclSchema),
-        },
-    })
-}
-
-export default Plugin({
-    name: 'Acl',
-    ownedTables: {
-        sys_security_acl: { diagnosticLevel: Diagnostic.Level.Warn },
-    },
-    extractors: {
-        entity: {
-            fluent: {
-                CallExpression(node, context) {
-                    const result = extractCallExpression(Acl, 'record', node, context, (acl) =>
-                        context.registerExplicitId('sys_security_acl', acl.$id)
-                    )
-
-                    if (!result.handled || !result.data) {
-                        return result
-                    }
-
-                    const acl = result.data
-                    const aclRecord = aclAsRecord(acl.getValue())
-                    const scriptVal = ModuleFunctionData.getGlueCode(
-                        acl.getProperty('script'),
-                        (n) => `answer = ${n}(current)`
-                    )
-
-                    const m2mRoleToAcl =
-                        acl
-                            .getProperty('roles')
-                            ?.getValue(true)
-                            ?.map((role) => {
-                                const roleId = typeof role === 'string' ? role : role.$id
-
-                                const roleSysId =
-                                    typeof role === 'string'
-                                        ? role
-                                        : context.registerExplicitId('sys_user_role', role.$id)
-                                const guid = context.keys.registerCompositeId('sys_security_acl_role', {
-                                    sys_security_acl: aclRecord.$id,
-                                    sys_user_role: roleId,
-                                })
-
-                                return new EntityData(
-                                    'record',
-                                    guid,
-                                    ObjectData.fromObjectValue(
-                                        DBRecord({
-                                            table: 'sys_security_acl_role',
-                                            $id: guid,
-                                            data: {
-                                                sys_security_acl: acl.getGuid(),
-                                                sys_user_role: roleSysId,
-                                            },
-                                        }),
-                                        node
-                                    ),
-                                    node,
-                                    acl.getInstallMethod()
-                                )
-                            }) || []
-
-                    const diagnostics = performDiagnosticChecksOnSecurityAttribute(
-                        node,
-                        acl.getValue(true),
-                        m2mRoleToAcl
-                    )
-
-                    const aclWithScript = { ...aclRecord, data: { ...aclRecord.data, script: scriptVal || '' } }
-                    const aclEntityData = new EntityData(
-                        'record',
-                        acl.getGuid(),
-                        ObjectData.fromObjectValue(aclWithScript, node),
-                        node,
-                        acl.getInstallMethod()
-                    )
-
-                    const wrapperEntity = new EntityData(
-                        'acl',
-                        acl.getGuid(),
-                        new ObjectData(
-                            {
-                                records: new ArrayData([aclEntityData, ...m2mRoleToAcl], node),
-                            },
-                            node
-                        ),
-                        node,
-                        acl.getInstallMethod(),
-                        acl.getExplicitIds()
-                    )
-
-                    return {
-                        handled: true,
-                        diagnostics: [...result.diagnostics, ...diagnostics],
-                        data: wrapperEntity,
-                    }
-                },
-            },
-        },
-    },
-    composers: {
-        entity: {
-            acl(entity, context) {
-                return Promise.all(
-                    entity
-                        .getPropertyOrThrow('records', 'array')
-                        .getElements()
-                        .map((record) => {
-                            if (!Data.isEntity(record)) {
-                                throw new Error('Expected entity')
-                            }
-
-                            return RecordPlugin.composers.entity.record(record, context)
-                        })
-                        .flat()
-                )
-            },
-        },
-    },
-    arrangers: {
-        record(document, context) {
-            if ((document.data as any).table !== 'sys_security_acl_role') {
-                return { handled: false }
-            }
-
-            const aclId = (document.data as any).data.sys_security_acl
-            const aclDoc = context.getDocument(aclId, 'record')
-            const aclDeleted = aclDoc && aclDoc.action === 'DELETE'
-            if (aclDeleted && document.action === 'INSERT_OR_UPDATE') {
-                throw new Error(
-                    `Existing sys_security_acl_role with id ${document.guid} is referencing deleted ACL ${aclId}. This can be fixed by either deleting the sys_security_acl_role record or updating its sys_security_acl reference.`
-                )
-            }
-
-            return {
-                handled: true,
-                result: aclId ? { kind: 'record', guid: aclId } : undefined,
-            }
-        },
-    },
-    generators: {
-        record(document, context, linkedDocuments) {
-            const documentType = (document.data as any)?.table
-            if (documentType === 'sys_security_acl_role') {
-                if (!document.parent) {
-                    return undefined
-                }
-                const acl = linkedDocuments.find(
-                    (doc) =>
-                        (doc.data as AclDoc).table === 'sys_security_acl' &&
-                        doc.guid === (document.data as AclRole).data.sys_security_acl
-                )
-
-                return acl && acl.node ? { ...document, node: acl.node } : undefined
-            }
-
-            if (documentType !== 'sys_security_acl') {
-                return undefined
-            }
-
-            return linkDocument(
-                document,
-                generateCallExpressionExportForDocument(
-                    context,
-                    {
-                        sourceFile: getOrCreateEntitySourceFile(
-                            context,
-                            getSysUpdateName(document, 'sys_security_acl')
-                        ),
-                        moduleSpecifier: '@servicenow/sdk/core',
-                    },
-                    Acl,
-                    { $id: document.guid }
-                ).getExpressionIfKindOrThrow(ts.SyntaxKind.CallExpression)
-            )
-        },
-    },
-    transformers: {
-        record: {
-            CallExpression(document, context) {
-                const documentType = (document.data as any)?.table
-
-                const [args] = document.node.getArguments()
-                if (!ts.Node.isObjectLiteralExpression(args)) {
-                    return false
-                }
-
-                if (documentType === 'sys_security_acl_role') {
-                    if (!document.parent || getCallExpressionName(document.node) !== Acl.name) {
-                        // Record plugin can handle this as its own entity
-                        return false
-                    }
-                    const acl2Role = (document.data as AclRole).data
-                    if (document.action === 'DELETE') {
-                        const roleId = acl2Role.sys_user_role
-                        if (roleId) {
-                            removeObjectFromArrayById(document, 'roles', context)
-                        }
-                        return true
-                    }
-
-                    addObjectToArrayById(document, 'roles', acl2Role.sys_user_role, context)
-                    return true
-                }
-
-                if (document.action === 'DELETE') {
-                    removeNode(document.node)
-                    return true
-                }
-
-                if (documentType !== 'sys_security_acl' || !document.changedData) {
-                    return false
-                }
-
-                const modifiedAclData = (document.changedData as any).data as AclBase
-                const unmodifiedAclData = (document.data as any).data as AclData
-                const type = reverseLookup(AclTypes, unmodifiedAclData.type)
-
-                const aclData = {
-                    ...except(
-                        modifiedAclData,
-                        (key) =>
-                            key.startsWith('sys_') ||
-                            key === 'advanced' ||
-                            key === 'name' ||
-                            key === 'operation' ||
-                            key === 'script'
-                    ),
-                    ...getTableOrName(type, unmodifiedAclData.name),
-                    security_attribute:
-                        reverseLookup(AclAttributes, unmodifiedAclData.security_attribute) ||
-                        unmodifiedAclData.security_attribute,
-                    operation: reverseLookup(AclOperations, unmodifiedAclData.operation) || unmodifiedAclData.operation,
-                    type,
-                } as any
-
-                const { script } = modifiedAclData as { script?: string }
-                if (script !== undefined) {
-                    processScript(args, 'script', script)
-                }
-                transformFunctionArguments(document.node, Acl, aclData)
-                context.argTypesToFix.push(document.node)
-                return true
-            },
-        },
-    },
-})
-
-// security_attribute.is_localizsed ? 'Local' : 'Existing'
-function performDiagnosticChecksOnSecurityAttribute<T>(
-    callExpression: ts.CallExpression,
-    aclData: AclBase,
-    roles: Array<T>
-) {
-    const diagnostics: FluentDiagnostic[] = []
-
-    if (roles.length < 1) {
-        const attributeRecord = aclData.security_attribute as DBRecord<'sys_security_attribute'>
-        if (!aclData.security_attribute && !aclData.script && !aclData.condition) {
-            diagnostics.push(
-                new FluentDiagnostic(
-                    callExpression,
-                    'ACLs must have at least one of the following: roles, security_attribute, condition, or script',
-                    { level: Diagnostic.Level.Warn }
-                )
-            )
-        } else if (attributeRecord && attributeRecord.data) {
-            if (
-                aclData.local_or_existing === 'Existing' &&
-                (attributeRecord.data.type !== 'compound' || attributeRecord.data.is_localized)
-            ) {
-                diagnostics.push(
-                    new FluentDiagnostic(
-                        findObjectPropertyValue(callExpression, 'security_attribute'),
-                        `Invalid ACL with 'Existing' sys_security_attribute: Must have a security_attribute with a type of 'compound' and is_localized set to false.`
-                    )
-                )
-            } else if (
-                (!aclData.local_or_existing || aclData.local_or_existing === 'Local') &&
-                !attributeRecord.data.is_localized
-            ) {
-                diagnostics.push(
-                    new FluentDiagnostic(
-                        findObjectPropertyValue(callExpression, 'security_attribute'),
-                        `Invalid ACL with 'Local' security_attribute: security_attribute must have is_localized set to true`
-                    )
-                )
-            }
-        }
-    }
-    return diagnostics
-}
-
-function getTableOrName(type: keyof typeof AclTypes, name: string) {
-    if (AclNamedTypes[type]) {
-        return { name }
-    }
-    const tablePathParts = name.split('.')
-    const table = tablePathParts[0] || ''
-    const field = tablePathParts[1] || ''
-
-    return { table, field }
-}
-
-function reverseLookup<T extends object>(obj: T, sysId): keyof T {
-    return (Object.entries(obj)
-        .filter(([_, id]) => id === sysId)
-        .map(([key]) => key)[0] || '') as keyof T
-}

package/src/aclAndRole/RolePlugin.ts

@@ -1,254 +0,0 @@
-import { Role, RoleConfig, roleSchema } from '@servicenow/sdk-core/runtime/app'
-import {
-    Context,
-    Plugin,
-    linkDocument,
-    extractCallExpression,
-    FluentDiagnostic,
-    findObjectPropertyValue,
-    Data,
-    isSNScope,
-    LinkedDocument,
-    ArrayData,
-} from '@servicenow/sdk-build-core'
-import {
-    generateCallExpressionExportForDocument,
-    getOrCreateEntitySourceFile,
-    transformFunctionArguments,
-    getSysUpdateName,
-    removeNode,
-} from '@servicenow/sdk-build-core'
-import { addObjectToArrayById, removeObjectFromArrayById } from './Util'
-import { except } from '../scripts/scriptUtils'
-import { Diagnostic, SupportedNode, ts } from '@servicenow/sdk-project'
-
-export function getRolesString(roles: ArrayData<unknown[]>): string {
-    const uniqueRoles = [
-        ...new Set(
-            roles.getElements().map((role) => {
-                return Data.isEntity(role) ? role.getPropertyOrThrow('name', 'string').getValue() : role.getValue()
-            })
-        ),
-    ]
-
-    return uniqueRoles.join(',')
-}
-
-function mapRoleToRole(context: Context, roleId: string, containedRoleId: string, node: SupportedNode): LinkedDocument {
-    const mappingId = context.keys.registerCompositeId('sys_user_role_contains', {
-        role: roleId,
-        contains: containedRoleId,
-    })
-
-    return {
-        kind: 'record',
-        guid: mappingId,
-        node,
-        data: {
-            $id: mappingId,
-            table: 'sys_user_role_contains',
-            data: {
-                contains: containedRoleId,
-                role: roleId,
-            },
-        },
-    }
-}
-
-type RoleDoc = {
-    table: string
-    data: {
-        sys_id: string
-    }
-}
-
-type RoleContainsDoc = {
-    table: string
-    data: {
-        role: string
-        contains: string
-    }
-}
-
-export default Plugin({
-    name: 'Role',
-    ownedTables: {
-        sys_user_role: { diagnosticLevel: Diagnostic.Level.Error },
-    },
-    extractors: {
-        entity: {
-            fluent: {
-                CallExpression: (node, context) => {
-                    const result = extractCallExpression(
-                        Role as (role: RoleConfig) => RoleConfig,
-                        'role',
-                        node,
-                        context,
-                        ({ $id }) => context.registerExplicitId('sys_user_role', $id as string)
-                    )
-
-                    if (!result.handled || !result.data) {
-                        return result
-                    }
-
-                    const role = result.data
-                    const diagnostics = result.diagnostics
-                    const scope = context.app?.config?.scope
-                    const name = role.getProperty('name').getValue()
-                    if (!isSNScope(scope) && !name.startsWith(`${scope}.`)) {
-                        const nameValue = findObjectPropertyValue(node, 'name')
-                        diagnostics.push(new FluentDiagnostic(nameValue, `Role name must begin with '${scope}.'`))
-                    }
-
-                    return {
-                        handled: true,
-                        diagnostics,
-                        data: role,
-                    }
-                },
-            },
-        },
-    },
-    composers: {
-        entity: {
-            role(entity, context) {
-                const scope = context.app?.config?.scope
-                const guid = entity.getGuid()
-
-                const role = roleSchema.safeParse(entity.getValue())
-                if (!role.success) {
-                    return Promise.resolve(undefined)
-                }
-
-                const { $id: _, name, contains_roles, ...rest } = role.data
-
-                const roleMappingDocuments: LinkedDocument[] = []
-                const containsRoles = entity.getProperty('contains_roles')
-                if (Data.isArray(containsRoles)) {
-                    for (const containedRole of containsRoles.getElements()) {
-                        const containedRoleSysId = Data.isEntity(containedRole)
-                            ? containedRole.getGuid()
-                            : Data.isString(containedRole)
-                              ? containedRole.getValue()
-                              : undefined
-
-                        if (!containedRoleSysId) {
-                            throw new Error(`Invalid contained role value: ${containedRole.getValue()}`)
-                        }
-
-                        roleMappingDocuments.push(
-                            mapRoleToRole(context, guid, containedRoleSysId, containedRole.getNode())
-                        )
-                    }
-                }
-
-                const suffix = name.replace(new RegExp(`^${scope}\\.`), '')
-                const roleDocument = {
-                    kind: 'record',
-                    guid,
-                    node: entity.getNode(),
-                    data: {
-                        $id: guid,
-                        table: 'sys_user_role',
-                        data: {
-                            name,
-                            suffix,
-                            ...rest,
-                        },
-                    },
-                }
-
-                return Promise.resolve([roleDocument, ...roleMappingDocuments])
-            },
-        },
-    },
-    arrangers: {
-        record(document) {
-            if ((document.data as any).table !== 'sys_user_role_contains') {
-                return { handled: false }
-            }
-
-            const roleId = (document.data as any).data.role
-            return {
-                handled: true,
-                result: roleId ? { kind: 'record', guid: roleId } : undefined,
-            }
-        },
-    },
-    generators: {
-        record(document, context: Context, linkedDocuments) {
-            const documentType = (document.data as any)?.table
-            if (documentType === 'sys_user_role_contains') {
-                const role = linkedDocuments.find(
-                    (doc) =>
-                        (doc.data as RoleDoc).table === 'sys_user_role' &&
-                        doc.guid === (document.data as RoleContainsDoc).data.role
-                )
-                return role && role.node ? { ...document, node: role.node } : undefined
-            }
-
-            if (documentType !== 'sys_user_role') {
-                return undefined
-            }
-
-            return linkDocument(
-                document,
-                generateCallExpressionExportForDocument(
-                    context,
-                    {
-                        sourceFile: getOrCreateEntitySourceFile(context, getSysUpdateName(document, 'sys_user_role')),
-                        moduleSpecifier: '@servicenow/sdk/core',
-                    },
-                    Role,
-                    { $id: document.guid }
-                ).getExpressionIfKindOrThrow(ts.SyntaxKind.CallExpression)
-            )
-        },
-    },
-    transformers: {
-        record: {
-            CallExpression(document, context) {
-                const documentType = (document.data as any)?.table
-                if (documentType === 'sys_user_role_contains') {
-                    const [args] = document.node.getArguments()
-                    if (!ts.Node.isObjectLiteralExpression(args) || !document.parent) {
-                        return false
-                    }
-                    if (document.action === 'DELETE') {
-                        removeObjectFromArrayById(document, 'contains_roles', context)
-                        return true
-                    }
-                    const m2mData = (document.data as RoleContainsDoc).data
-                    addObjectToArrayById(document, 'contains_roles', m2mData.contains, context)
-                    return true
-                }
-
-                if (documentType !== 'sys_user_role') {
-                    return false
-                }
-
-                if (document.action === 'DELETE') {
-                    removeNode(document.node)
-                    return true
-                }
-
-                if (!document.changedData) {
-                    return true
-                }
-
-                const rawRoleData = (document.changedData as any).data
-                const roleData = except(
-                    rawRoleData,
-                    (key) =>
-                        key.startsWith('sys_') ||
-                        key === 'requires_subscription' ||
-                        key === 'suffix' ||
-                        key === 'includes_roles'
-                )
-                transformFunctionArguments(document.node, Role, roleData)
-                context.argTypesToFix.push(document.node)
-                return true
-            },
-        },
-    },
-})