@steedos/objectql 2.1.54 → 2.1.58

package/lib/types/object.js

@@ -16,6 +16,9 @@ var object_events_1 = require("./object_events");
 var i18n_1 = require("@steedos/i18n");
 var object_layouts_1 = require("./object_layouts");
 var lodash_1 = require("lodash");
+var shareRule_1 = require("./shareRule");
+var restrictionRule_1 = require("./restrictionRule");
+var field_permission_1 = require("./field_permission");
 var clone = require('clone');
 // 主子表有层级限制，超过3层就报错，该函数判断当前对象作为主表对象往下的层级最多不越过3层，
 // 其3层指的是A-B-C-D，它们都有父子关系，A作为最顶层，该对象上不可以再创建主表子表关系字段，但是B、C、D上可以；
@@ -356,7 +359,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
     };
     SteedosObjectType.prototype.runTriggerActions = function (when, context) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var triggers, triggers_1, triggers_1_1, trigger, params, error_1, e_2_1;
+            var triggers, triggers_1, triggers_1_1, trigger, params, e_2_1;
             var e_2, _a;
             return tslib_1.__generator(this, function (_b) {
                 switch (_b.label) {
@@ -368,39 +371,40 @@ var SteedosObjectType = /** @class */ (function (_super) {
                         }
                         _b.label = 2;
                     case 2:
-                        _b.trys.push([2, 9, 10, 11]);
+                        _b.trys.push([2, 7, 8, 9]);
                         triggers_1 = tslib_1.__values(triggers), triggers_1_1 = triggers_1.next();
                         _b.label = 3;
                     case 3:
-                        if (!!triggers_1_1.done) return [3 /*break*/, 8];
+                        if (!!triggers_1_1.done) return [3 /*break*/, 6];
                         trigger = triggers_1_1.value;
                         params = util_1.generateActionParams(when, context);
-                        _b.label = 4;
+                        return [4 /*yield*/, this._schema.metadataBroker.call(trigger.service.name + "." + trigger.metadata.action, params).catch(function (error) {
+                                //如果action trigger 下线，则只打印error
+                                if (error && _.isObject(error) && error.type === 'SERVICE_NOT_AVAILABLE') {
+                                    console.error("runTriggerActions error", error);
+                                }
+                                else {
+                                    throw error;
+                                }
+                            })];
                     case 4:
-                        _b.trys.push([4, 6, , 7]);
-                        return [4 /*yield*/, this._schema.metadataBroker.call(trigger.service.name + "." + trigger.metadata.action, params)];
-                    case 5:
                         _b.sent();
-                        return [3 /*break*/, 7];
-                    case 6:
-                        error_1 = _b.sent();
-                        console.error(error_1);
-                        return [3 /*break*/, 7];
-                    case 7:
+                        _b.label = 5;
+                    case 5:
                         triggers_1_1 = triggers_1.next();
                         return [3 /*break*/, 3];
-                    case 8: return [3 /*break*/, 11];
-                    case 9:
+                    case 6: return [3 /*break*/, 9];
+                    case 7:
                         e_2_1 = _b.sent();
                         e_2 = { error: e_2_1 };
-                        return [3 /*break*/, 11];
-                    case 10:
+                        return [3 /*break*/, 9];
+                    case 8:
                         try {
                             if (triggers_1_1 && !triggers_1_1.done && (_a = triggers_1.return)) _a.call(triggers_1);
                         }
                         finally { if (e_2) throw e_2.error; }
                         return [7 /*endfinally*/];
-                    case 11: return [2 /*return*/];
+                    case 9: return [2 /*return*/];
                 }
             });
         });
@@ -555,7 +559,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
     SteedosObjectType.prototype.refreshIndexes = function () {
         var e_3, _a, e_4, _b;
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var adapter, collection, indexesInfo, dropIndexNames, key, field, info, indexesInfo_1, indexesInfo_1_1, indexInfo, key, error_2, e_3_1, error_3, dropIndexNames_1, dropIndexNames_1_1, indexName, error_4, e_4_1, error_5;
+            var adapter, collection, indexesInfo, dropIndexNames, key, field, info, indexesInfo_1, indexesInfo_1_1, indexInfo, key, error_1, e_3_1, error_2, dropIndexNames_1, dropIndexNames_1_1, indexName, error_3, e_4_1, error_4;
             return tslib_1.__generator(this, function (_c) {
                 switch (_c.label) {
                     case 0:
@@ -600,8 +604,8 @@ var SteedosObjectType = /** @class */ (function (_super) {
                         _c.sent();
                         return [3 /*break*/, 9];
                     case 8:
-                        error_2 = _c.sent();
-                        console.error(error_2);
+                        error_1 = _c.sent();
+                        console.error(error_1);
                         return [3 /*break*/, 9];
                     case 9: return [3 /*break*/, 4];
                     case 10: return [3 /*break*/, 17];
@@ -623,8 +627,8 @@ var SteedosObjectType = /** @class */ (function (_super) {
                     case 16: return [7 /*endfinally*/];
                     case 17: return [3 /*break*/, 19];
                     case 18:
-                        error_3 = _c.sent();
-                        console.error(error_3);
+                        error_2 = _c.sent();
+                        console.error(error_2);
                         return [3 /*break*/, 19];
                     case 19:
                         if (!(dropIndexNames && dropIndexNames.length > 0)) return [3 /*break*/, 37];
@@ -648,7 +652,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
                         _c.sent();
                         return [3 /*break*/, 27];
                     case 26:
-                        error_4 = _c.sent();
+                        error_3 = _c.sent();
                         return [3 /*break*/, 27];
                     case 27: return [3 /*break*/, 22];
                     case 28: return [3 /*break*/, 35];
@@ -670,8 +674,8 @@ var SteedosObjectType = /** @class */ (function (_super) {
                     case 34: return [7 /*endfinally*/];
                     case 35: return [3 /*break*/, 37];
                     case 36:
-                        error_5 = _c.sent();
-                        console.error(error_5);
+                        error_4 = _c.sent();
+                        console.error(error_4);
                         return [3 /*break*/, 37];
                     case 37: return [2 /*return*/];
                 }
@@ -712,77 +716,125 @@ var SteedosObjectType = /** @class */ (function (_super) {
     };
     SteedosObjectType.prototype.getUserObjectPermission = function (userSession) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var roles, objectRolesPermission, userObjectPermission, spaceId;
+            var roles, objectRolesPermission, userObjectPermission, rolesFieldsPermission, field_permissions, spaceId;
             return tslib_1.__generator(this, function (_a) {
-                if (!userSession) {
-                    throw new Error('userSession is required');
-                }
-                roles = userSession.roles;
-                objectRolesPermission = this.getObjectRolesPermission(userSession.spaceId);
-                userObjectPermission = {
-                    allowRead: false,
-                    allowCreate: false,
-                    allowEdit: false,
-                    allowDelete: false,
-                    viewAllRecords: false,
-                    modifyAllRecords: false,
-                    viewCompanyRecords: false,
-                    modifyCompanyRecords: false,
-                    allowReadFiles: null,
-                    viewAllFiles: null,
-                    allowCreateFiles: null,
-                    allowEditFiles: null,
-                    allowDeleteFiles: null,
-                    modifyAllFiles: null,
-                    disabled_list_views: null,
-                    disabled_actions: null,
-                    unreadable_fields: null,
-                    uneditable_fields: null,
-                    unrelated_objects: null
-                };
-                if (_.isEmpty(roles)) {
-                    throw new Error('not find user permission');
-                }
-                roles.forEach(function (role) {
-                    var rolePermission = objectRolesPermission[role];
-                    if (rolePermission) {
-                        _.each(userObjectPermission, function (v, k) {
-                            var _v = rolePermission[k];
-                            if (_.isBoolean(v)) {
-                                if (v === false && _v === true) {
-                                    userObjectPermission[k] = _v;
-                                }
-                            }
-                            else if (['allowReadFiles', 'viewAllFiles', 'allowCreateFiles', 'allowEditFiles', 'allowDeleteFiles', 'modifyAllFiles'].indexOf(k) > -1) {
-                                if (_.isBoolean(_v)) {
-                                    userObjectPermission[k] = _v;
-                                }
+                switch (_a.label) {
+                    case 0:
+                        if (!userSession) {
+                            throw new Error('userSession is required');
+                        }
+                        roles = userSession.roles;
+                        objectRolesPermission = this.getObjectRolesPermission(userSession.spaceId);
+                        userObjectPermission = {
+                            allowRead: false,
+                            allowCreate: false,
+                            allowEdit: false,
+                            allowDelete: false,
+                            viewAllRecords: false,
+                            modifyAllRecords: false,
+                            viewCompanyRecords: false,
+                            modifyCompanyRecords: false,
+                            allowReadFiles: null,
+                            viewAllFiles: null,
+                            allowCreateFiles: null,
+                            allowEditFiles: null,
+                            allowDeleteFiles: null,
+                            modifyAllFiles: null,
+                            disabled_list_views: null,
+                            disabled_actions: null,
+                            unreadable_fields: null,
+                            uneditable_fields: null,
+                            unrelated_objects: null,
+                            field_permissions: null,
+                        };
+                        if (_.isEmpty(roles)) {
+                            throw new Error('not find user permission');
+                        }
+                        return [4 /*yield*/, field_permission_1.FieldPermission.getObjectFieldsPermissionGroupRole(this.name)];
+                    case 1:
+                        rolesFieldsPermission = _a.sent();
+                        roles.forEach(function (role) {
+                            var rolePermission = objectRolesPermission[role];
+                            if (rolePermission) {
+                                var roleFieldsPermission_1 = rolesFieldsPermission[role];
+                                _.each(userObjectPermission, function (v, k) {
+                                    var _v = rolePermission[k];
+                                    if (k === 'field_permissions') {
+                                        _v = roleFieldsPermission_1;
+                                    }
+                                    if (_.isBoolean(v)) {
+                                        if (v === false && _v === true) {
+                                            userObjectPermission[k] = _v;
+                                        }
+                                    }
+                                    else if (['allowReadFiles', 'viewAllFiles', 'allowCreateFiles', 'allowEditFiles', 'allowDeleteFiles', 'modifyAllFiles'].indexOf(k) > -1) {
+                                        if (_.isBoolean(_v)) {
+                                            userObjectPermission[k] = _v;
+                                        }
+                                    }
+                                    else if (['read_filters', 'edit_filters'].indexOf(k) > -1) {
+                                        if ('edit_filters' === k) {
+                                            if (!_.isEmpty(_v)) {
+                                                userObjectPermission['read_filters'].push(_v);
+                                            }
+                                        }
+                                        if (!_.isEmpty(_v)) {
+                                            userObjectPermission[k].push(_v);
+                                        }
+                                    }
+                                    else if ((_.isArray(v) || _.isNull(v))) {
+                                        if (!_.isArray(_v)) {
+                                            _v = [];
+                                        }
+                                        if (_.isNull(v)) {
+                                            userObjectPermission[k] = _v;
+                                        }
+                                        else {
+                                            if (k === 'field_permissions') {
+                                                userObjectPermission[k] = _.union(v, _v);
+                                            }
+                                            else {
+                                                userObjectPermission[k] = _.intersection(v, _v);
+                                            }
+                                        }
+                                    }
+                                });
                             }
-                            else if ((_.isArray(v) || _.isNull(v))) {
-                                if (!_.isArray(_v)) {
-                                    _v = [];
-                                }
-                                if (_.isNull(v)) {
-                                    userObjectPermission[k] = _v;
+                        });
+                        field_permissions = {};
+                        if (userObjectPermission.field_permissions) {
+                            _.each(userObjectPermission.field_permissions, function (field_permission) {
+                                var field = field_permission.field, read = field_permission.read, edit = field_permission.edit;
+                                if (field_permissions[field]) {
+                                    field_permissions[field].edit = field_permissions[field].edit || edit;
+                                    if (field_permissions[field].edit) {
+                                        field_permissions[field].read = true;
+                                    }
+                                    else {
+                                        field_permissions[field].read = field_permissions[field].read || read;
+                                    }
                                 }
                                 else {
-                                    userObjectPermission[k] = _.intersection(v, _v);
+                                    field_permissions[field] = {
+                                        field: field,
+                                        read: edit || read,
+                                        edit: edit
+                                    };
                                 }
-                            }
-                        });
-                    }
-                });
-                userObjectPermission.disabled_list_views = userObjectPermission.disabled_list_views || [];
-                userObjectPermission.disabled_actions = userObjectPermission.disabled_actions || [];
-                userObjectPermission.unreadable_fields = userObjectPermission.unreadable_fields || [];
-                userObjectPermission.uneditable_fields = userObjectPermission.uneditable_fields || [];
-                userObjectPermission.unrelated_objects = userObjectPermission.unrelated_objects || [];
-                spaceId = userSession.spaceId;
-                if (util_1.isTemplateSpace(spaceId)) {
-                    return [2 /*return*/, Object.assign({}, userObjectPermission, { allowRead: true, viewAllRecords: true, viewCompanyRecords: true })];
+                            });
+                        }
+                        userObjectPermission.field_permissions = field_permissions;
+                        userObjectPermission.disabled_list_views = userObjectPermission.disabled_list_views || [];
+                        userObjectPermission.disabled_actions = userObjectPermission.disabled_actions || [];
+                        userObjectPermission.unreadable_fields = userObjectPermission.unreadable_fields || [];
+                        userObjectPermission.uneditable_fields = userObjectPermission.uneditable_fields || [];
+                        userObjectPermission.unrelated_objects = userObjectPermission.unrelated_objects || [];
+                        spaceId = userSession.spaceId;
+                        if (util_1.isTemplateSpace(spaceId)) {
+                            return [2 /*return*/, Object.assign({}, userObjectPermission, { allowRead: true, viewAllRecords: true, viewCompanyRecords: true })];
+                        }
+                        return [2 /*return*/, userObjectPermission];
                 }
-                Creator.processPermissions(userObjectPermission);
-                return [2 /*return*/, userObjectPermission];
             });
         });
     };
@@ -1283,7 +1335,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
     };
     SteedosObjectType.prototype.getRecordView = function (userSession) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var lng, objectMetadataConfig, objectConfig, _a, _b, _c, _d, layouts, layout, _fields_1, sort_no_1, layoutFieldKeys, objectFieldKeys, difference, layoutButtonsName_1, spaceProcessDefinition, dbListViews;
+            var lng, objectMetadataConfig, objectConfig, _a, _b, _c, _d, layouts, layout, _fields_1, sort_no_1, layoutFieldKeys, objectFieldKeys, difference, layoutButtonsName_1, userObjectFields, spaceProcessDefinition, dbListViews;
             return tslib_1.__generator(this, function (_e) {
                 switch (_e.label) {
                     case 0:
@@ -1383,6 +1435,23 @@ var SteedosObjectType = /** @class */ (function (_super) {
                                 }
                             });
                         }
+                        userObjectFields = objectConfig.fields;
+                        _.each(objectConfig.permissions.field_permissions, function (field_permission, field) {
+                            var read = field_permission.read, edit = field_permission.edit;
+                            if (read) {
+                                userObjectFields[field].omit = true;
+                            }
+                            if (edit) {
+                                userObjectFields[field].omit = false;
+                                userObjectFields[field].hidden = false;
+                                userObjectFields[field].readonly = false;
+                                userObjectFields[field].disabled = false;
+                            }
+                            if (!read && !edit) {
+                                delete userObjectFields[field];
+                            }
+                        });
+                        objectConfig.fields = userObjectFields;
                         return [4 /*yield*/, getObject("process_definition").directFind({ filters: [['space', '=', userSession.spaceId], ['object_name', '=', this.name], ['active', '=', true]] })];
                     case 7:
                         spaceProcessDefinition = _e.sent();
@@ -1551,7 +1620,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
     };
     SteedosObjectType.prototype.createDefaulRecordView = function (userSession) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var name, label, profiles, defaultRecordView, error_6;
+            var name, label, profiles, defaultRecordView, error_5;
             return tslib_1.__generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -1567,8 +1636,8 @@ var SteedosObjectType = /** @class */ (function (_super) {
                         return [4 /*yield*/, getObject('object_layouts').insert(Object.assign({}, defaultRecordView, { name: name, label: label, profiles: profiles }), userSession)];
                     case 3: return [2 /*return*/, _a.sent()];
                     case 4:
-                        error_6 = _a.sent();
-                        return [2 /*return*/, { error: error_6.message }];
+                        error_5 = _a.sent();
+                        return [2 /*return*/, { error: error_5.message }];
                     case 5: return [2 /*return*/];
                 }
             });
@@ -1737,6 +1806,29 @@ var SteedosObjectType = /** @class */ (function (_super) {
             });
         });
     };
+    // private async appendRecordPermission(records, userSession) {
+    //     const _ids = _.pluck(records, '_id');
+    //     const objPm = await this.getUserObjectPermission(userSession);
+    //     const permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
+    //     if (_.isEmpty(permissionFilters)) {
+    //         return;
+    //     }
+    //     const filters = formatFiltersToODataQuery(['_id', 'in', _ids])
+    //     const results = await this.directFind({
+    //         fields: ['_id'],
+    //         filters: `(${filters}) and (${permissionFilters.join(' or ')})`
+    //     });
+    //     const allowEditIds = _.pluck(results, '_id');
+    //     _.each(records, (record) => {
+    //         if (_.include(allowEditIds, record._id)) {
+    //             record.record_permissions = {
+    //                 allowRead: true,
+    //                 allowEdit: true,
+    //                 allowDelete: true,
+    //             }
+    //         }
+    //     })
+    // }
     SteedosObjectType.prototype.getTriggerContext = function (when, method, args, recordId) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var userSession, context, _a;
@@ -1744,7 +1836,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
                 switch (_b.label) {
                     case 0:
                         userSession = args[args.length - 1];
-                        context = { userId: userSession ? userSession.userId : undefined, spaceId: userSession ? userSession.spaceId : undefined };
+                        context = { objectName: this.name, userId: userSession ? userSession.userId : undefined, spaceId: userSession ? userSession.spaceId : undefined };
                         if (method === 'find' || method === 'findOne' || method === 'count') {
                             context.query = args[args.length - 2];
                         }
@@ -1900,6 +1992,15 @@ var SteedosObjectType = /** @class */ (function (_super) {
                             if (method === 'count') {
                                 values = returnValue || 0;
                             }
+                            // else{
+                            //     if (userSession) {
+                            //         let _records = returnValue
+                            //         if (method == 'findOne' && returnValue) {
+                            //             _records = [_records]
+                            //         }
+                            //         await this.appendRecordPermission(_records, userSession);
+                            //     }
+                            // }
                             Object.assign(afterTriggerContext, { data: { values: values } });
                         }
                         // console.log("==returnValue==", returnValue);
@@ -2011,6 +2112,28 @@ var SteedosObjectType = /** @class */ (function (_super) {
             });
         });
     };
+    // private getObjectPermissionFilters(objectPermission, userSession, isEdit) {
+    //     const objectPermissionFilters = [];
+    //     let permissionFiltersKey = 'read_filters';
+    //     if (isEdit) {
+    //         permissionFiltersKey = 'edit_filters';
+    //     }
+    //     const globalData = Object.assign({}, userSession, { now: new Date() });
+    //     let permissionFilters = objectPermission[permissionFiltersKey];
+    //     _.each(permissionFilters, (permissionFilter) => {
+    //         if (_.isString(permissionFilter) && isExpression(permissionFilter.trim())) {
+    //             try {
+    //                 const filters = parseSingleExpression(permissionFilter, {}, "#", globalData);
+    //                 if (filters && !_.isString(filters)) {
+    //                     objectPermissionFilters.push(`(${formatFiltersToODataQuery(filters, userSession)})`)
+    //                 }
+    //             } catch (error) {
+    //                 console.error(`getObjectPermissionFilters error`, permissionFilter, error.message);
+    //             }
+    //         }
+    //     })
+    //     return objectPermissionFilters;
+    // }
     /**
      * 把query.filters用formatFiltersToODataQuery转为odata query
      * 主要是为了把userSession中的utcOffset逻辑传入formatFiltersToODataQuery函数处理
@@ -2031,82 +2154,102 @@ var SteedosObjectType = /** @class */ (function (_super) {
     };
     SteedosObjectType.prototype.dealWithMethodPermission = function (method, args) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var userSession, spaceId, userId, objPm, query, spaceFilter, companyFilter, ownerFilter, sharesFilter, clientFilter, filters, permissionFilters, userFilters, id, companyFilters, queryFilters, companyFilters, id, companyFilters;
+            var userSession, spaceId, userId, objPm, query, spaceFilter, companyFilter, ownerFilter, sharesFilter, shareRuleFilters, restrictionRuleFilters, clientFilter, filters, permissionFilters, userFilters, permissionFilters, objectPermissionEditFilters, id, companyFilters, queryFilters, companyFilters, permissionFilters, objectPermissionEditFilters, id, companyFilters;
             return tslib_1.__generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         userSession = args[args.length - 1];
-                        if (!userSession) return [3 /*break*/, 2];
+                        if (!userSession) return [3 /*break*/, 5];
                         spaceId = userSession.spaceId;
                         userId = userSession.userId;
                         return [4 /*yield*/, this.getUserObjectPermission(userSession)];
                     case 1:
                         objPm = _a.sent();
-                        if (method === 'find' || method === 'count' || method === 'findOne' || method === 'aggregate' || method === 'aggregatePrefixalPipeline') {
-                            query = args[args.length - 2];
-                            if (method === 'aggregate' || method === 'aggregatePrefixalPipeline') {
-                                query = args[args.length - 3];
-                            }
-                            if (query.filters && !_.isString(query.filters)) {
-                                query.filters = filters_1.formatFiltersToODataQuery(query.filters);
-                            }
-                            if (this.table_name == 'cfs.files.filerecord' || this.table_name == 'cfs.instances.filerecord') {
-                                return [2 /*return*/];
-                            }
-                            if (util_1.isCloudAdminSpace(spaceId)) {
-                                return [2 /*return*/];
-                            }
-                            spaceFilter = void 0, companyFilter = void 0, ownerFilter = void 0, sharesFilter = void 0, clientFilter = query.filters, filters = void 0, permissionFilters = [], userFilters = [];
-                            if (spaceId) {
-                                spaceFilter = "(space eq '" + spaceId + "')";
-                            }
-                            if (spaceId && !objPm.viewAllRecords && objPm.viewCompanyRecords) { // 公司级
-                                if (_.isEmpty(userSession.companies)) {
-                                    console.log('objPm', objPm);
-                                    throw new Error("user not belong any company!");
-                                }
-                                companyFilter = _.map(userSession.companies, function (comp) {
-                                    return "(company_id eq '" + comp._id + "') or (company_ids eq '" + comp._id + "')";
-                                });
-                            }
-                            if (!objPm.viewAllRecords && !objPm.viewCompanyRecords && objPm.allowRead) { // owner
-                                ownerFilter = "(owner eq '" + userId + "')";
-                            }
-                            if (!objPm.viewAllRecords) {
-                                sharesFilter = util_1.getUserObjectSharesFilters(this.name, userSession);
-                            }
-                            if (!_.isEmpty(companyFilter)) {
-                                permissionFilters.push("(" + companyFilter.join(' or ') + ")");
-                            }
-                            if (ownerFilter) {
-                                permissionFilters.push(ownerFilter);
-                            }
-                            if (!_.isEmpty(sharesFilter)) {
-                                permissionFilters.push("(" + sharesFilter.join(' or ') + ")");
-                            }
-                            if (clientFilter) {
-                                userFilters.push(clientFilter);
-                            }
-                            if (spaceFilter) {
-                                userFilters.push(spaceFilter);
-                            }
-                            if (!userSession.is_space_admin && !_.isEmpty(permissionFilters)) {
-                                filters = permissionFilters.join(' or ');
-                            }
-                            if (!_.isEmpty(userFilters)) {
-                                filters = filters ? "(" + filters + ") and (" + userFilters.join(' and ') + ")" : userFilters.join(' and ');
+                        if (!(method === 'find' || method === 'count' || method === 'findOne' || method === 'aggregate' || method === 'aggregatePrefixalPipeline')) return [3 /*break*/, 4];
+                        query = args[args.length - 2];
+                        if (method === 'aggregate' || method === 'aggregatePrefixalPipeline') {
+                            query = args[args.length - 3];
+                        }
+                        if (query.filters && !_.isString(query.filters)) {
+                            query.filters = filters_1.formatFiltersToODataQuery(query.filters);
+                        }
+                        if (this.table_name == 'cfs.files.filerecord' || this.table_name == 'cfs.instances.filerecord') {
+                            return [2 /*return*/];
+                        }
+                        if (util_1.isCloudAdminSpace(spaceId)) {
+                            return [2 /*return*/];
+                        }
+                        spaceFilter = void 0, companyFilter = void 0, ownerFilter = void 0, sharesFilter = void 0, shareRuleFilters = void 0, restrictionRuleFilters = void 0, clientFilter = query.filters, filters = void 0, permissionFilters = [], userFilters = [];
+                        if (spaceId) {
+                            spaceFilter = "(space eq '" + spaceId + "')";
+                        }
+                        if (spaceId && !objPm.viewAllRecords && objPm.viewCompanyRecords) { // 公司级
+                            if (_.isEmpty(userSession.companies)) {
+                                console.log('objPm', objPm);
+                                throw new Error("user not belong any company!");
                             }
-                            query.filters = filters;
+                            companyFilter = _.map(userSession.companies, function (comp) {
+                                return "(company_id eq '" + comp._id + "') or (company_ids eq '" + comp._id + "')";
+                            });
+                        }
+                        if (!objPm.viewAllRecords && !objPm.viewCompanyRecords && objPm.allowRead) { // owner
+                            ownerFilter = "(owner eq '" + userId + "')";
+                        }
+                        return [4 /*yield*/, shareRule_1.ShareRules.getUserObjectFilters(this.name, userSession)];
+                    case 2:
+                        shareRuleFilters = _a.sent();
+                        if (!_.isEmpty(shareRuleFilters)) {
+                            permissionFilters.push("(" + shareRuleFilters.join(' or ') + ")");
                         }
-                        else if (method === 'insert') {
+                        return [4 /*yield*/, restrictionRule_1.RestrictionRule.getUserObjectFilters(this.name, userSession)];
+                    case 3:
+                        restrictionRuleFilters = _a.sent();
+                        if (!_.isEmpty(restrictionRuleFilters)) {
+                            userFilters.push("(" + restrictionRuleFilters.join(' or ') + ")");
+                        }
+                        // objectPermissionFilters = this.getObjectPermissionFilters(objPm, userSession, false);
+                        // if (!_.isEmpty(objectPermissionFilters)) {
+                        //     permissionFilters.push(`(${objectPermissionFilters.join(' or ')})`);
+                        // }
+                        sharesFilter = util_1.getUserObjectSharesFilters(this.name, userSession);
+                        if (!_.isEmpty(companyFilter)) {
+                            permissionFilters.push("(" + companyFilter.join(' and ') + ")");
+                        }
+                        if (ownerFilter) {
+                            permissionFilters.push(ownerFilter);
+                        }
+                        if (!_.isEmpty(sharesFilter)) {
+                            permissionFilters.push("(" + sharesFilter.join(' or ') + ")");
+                        }
+                        if (clientFilter) {
+                            userFilters.push(clientFilter);
+                        }
+                        if (spaceFilter) {
+                            userFilters.push(spaceFilter);
+                        }
+                        if (!userSession.is_space_admin && !_.isEmpty(permissionFilters)) {
+                            filters = permissionFilters.join(' or ');
+                        }
+                        if (!_.isEmpty(userFilters)) {
+                            filters = filters ? "(" + filters + ") and (" + userFilters.join(' and ') + ")" : userFilters.join(' and ');
+                        }
+                        query.filters = filters;
+                        return [3 /*break*/, 5];
+                    case 4:
+                        if (method === 'insert') {
                             if (!objPm.allowCreate) {
                                 throw new Error("no " + method + " permission!");
                             }
                         }
                         else if (method === 'update' || method === 'updateOne') {
-                            if (!objPm.allowEdit) {
+                            permissionFilters = null;
+                            if (!objPm.allowEdit && _.isEmpty(permissionFilters)) {
                                 throw new Error("no " + method + " permission!");
                             }
+                            objectPermissionEditFilters = '';
+                            if (!_.isEmpty(permissionFilters)) {
+                                objectPermissionEditFilters = " or (" + permissionFilters.join(' or ') + ")";
+                            }
                             id = args[args.length - 3];
                             if (!objPm.modifyAllRecords && objPm.modifyCompanyRecords) {
                                 companyFilters = _.map(userSession.companies, function (comp) {
@@ -2114,25 +2257,36 @@ var SteedosObjectType = /** @class */ (function (_super) {
                                 }).join(' or ');
                                 if (companyFilters) {
                                     if (_.isString(id)) {
-                                        id = { filters: "(_id eq '" + id + "') and (" + companyFilters + ")" };
+                                        id = { filters: "(_id eq '" + id + "') and (" + companyFilters + objectPermissionEditFilters + ")" };
                                     }
                                     else if (_.isObject(id)) {
                                         if (id.filters && !_.isString(id.filters)) {
                                             id.filters = filters_1.formatFiltersToODataQuery(id.filters);
                                         }
-                                        id.filters = id.filters ? "(" + id.filters + ") and (" + companyFilters + ")" : "(" + companyFilters + ")";
+                                        id.filters = id.filters ? "(" + id.filters + ") and (" + companyFilters + objectPermissionEditFilters + ")" : "(" + companyFilters + objectPermissionEditFilters + ")";
                                     }
                                 }
                             }
                             else if (!objPm.modifyAllRecords && !objPm.modifyCompanyRecords && objPm.allowEdit) {
                                 if (_.isString(id)) {
-                                    id = { filters: "(_id eq '" + id + "') and (owner eq '" + userId + "')" };
+                                    id = { filters: "(_id eq '" + id + "') and (owner eq '" + userId + "' " + objectPermissionEditFilters + ")" };
                                 }
                                 else if (_.isObject(id)) {
                                     if (id.filters && !_.isString(id.filters)) {
                                         id.filters = filters_1.formatFiltersToODataQuery(id.filters);
                                     }
-                                    id.filters = id.filters ? "(" + id.filters + ") and (owner eq '" + userId + "')" : "(owner eq '" + userId + "')";
+                                    id.filters = id.filters ? "(" + id.filters + ") and (owner eq '" + userId + "' " + objectPermissionEditFilters + ")" : "(owner eq '" + userId + "' " + objectPermissionEditFilters + ")";
+                                }
+                            }
+                            else if (objectPermissionEditFilters) {
+                                if (_.isString(id)) {
+                                    id = { filters: "(_id eq '" + id + "') and (" + objectPermissionEditFilters + ")" };
+                                }
+                                else if (_.isObject(id)) {
+                                    if (id.filters && !_.isString(id.filters)) {
+                                        id.filters = filters_1.formatFiltersToODataQuery(id.filters);
+                                    }
+                                    id.filters = id.filters ? "(" + id.filters + ") and (" + objectPermissionEditFilters + ")" : "(" + objectPermissionEditFilters + ")";
                                 }
                             }
                             args[args.length - 3] = id;
@@ -2156,25 +2310,41 @@ var SteedosObjectType = /** @class */ (function (_super) {
                             }
                         }
                         else if (method === 'delete') {
-                            if (!objPm.allowDelete) {
+                            permissionFilters = null;
+                            if (!objPm.allowDelete && _.isEmpty(permissionFilters)) {
                                 throw new Error("no " + method + " permission!");
                             }
+                            objectPermissionEditFilters = '';
+                            if (!_.isEmpty(permissionFilters)) {
+                                objectPermissionEditFilters = " or (" + permissionFilters.join(' or ') + ")";
+                            }
                             id = args[args.length - 2];
                             if (!objPm.modifyAllRecords && objPm.modifyCompanyRecords) {
                                 companyFilters = _.map(userSession.companies, function (comp) {
                                     return "(company_id eq '" + comp._id + "') or (company_ids eq '" + comp._id + "')";
                                 }).join(' or ');
                                 if (companyFilters) {
-                                    id = { filters: "(_id eq '" + id + "') and (" + companyFilters + ")" };
+                                    id = { filters: "(_id eq '" + id + "') and (" + companyFilters + objectPermissionEditFilters + ")" };
                                 }
                             }
                             else if (!objPm.modifyAllRecords && !objPm.modifyCompanyRecords) {
-                                id = { filters: "(_id eq '" + id + "') and (owner eq '" + userId + "')" };
+                                id = { filters: "(_id eq '" + id + "') and (owner eq '" + userId + "'" + objectPermissionEditFilters + ")" };
+                            }
+                            else if (objectPermissionEditFilters) {
+                                if (_.isString(id)) {
+                                    id = { filters: "(_id eq '" + id + "') and (" + objectPermissionEditFilters + ")" };
+                                }
+                                else if (_.isObject(id)) {
+                                    if (id.filters && !_.isString(id.filters)) {
+                                        id.filters = filters_1.formatFiltersToODataQuery(id.filters);
+                                    }
+                                    id.filters = id.filters ? "(" + id.filters + ") and (" + objectPermissionEditFilters + ")" : "(" + objectPermissionEditFilters + ")";
+                                }
                             }
                             args[args.length - 2] = id;
                         }
-                        _a.label = 2;
-                    case 2: return [2 /*return*/];
+                        _a.label = 5;
+                    case 5: return [2 /*return*/];
                 }
             });
         });