@steedos/objectql 2.1.56 → 2.1.57

package/lib/types/object.d.ts

@@ -155,6 +155,9 @@ export declare class SteedosObjectType extends SteedosObjectProperties {
         unreadable_fields: any;
         uneditable_fields: any;
         unrelated_objects: any;
+        field_permissions: any;
+        read_filters: any[];
+        edit_filters: any[];
     }>;
     private allowFind;
     private allowInsert;
@@ -203,12 +206,14 @@ export declare class SteedosObjectType extends SteedosObjectProperties {
     private allow;
     private runBeforeTriggers;
     private runAfterTriggers;
+    private appendRecordPermission;
     private getTriggerContext;
     private processUnreadableField;
     private processUneditableFields;
     private callAdapter;
     private runRecordFormula;
     private runRecordSummaries;
+    private getObjectPermissionFilters;
     /**
      * 把query.filters用formatFiltersToODataQuery转为odata query
      * 主要是为了把userSession中的utcOffset逻辑传入formatFiltersToODataQuery函数处理

package/lib/types/object.js

@@ -713,7 +713,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
     };
     SteedosObjectType.prototype.getUserObjectPermission = function (userSession) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var roles, objectRolesPermission, userObjectPermission, spaceId;
+            var roles, objectRolesPermission, userObjectPermission, field_permissions, spaceId;
             return tslib_1.__generator(this, function (_a) {
                 if (!userSession) {
                     throw new Error('userSession is required');
@@ -739,7 +739,10 @@ var SteedosObjectType = /** @class */ (function (_super) {
                     disabled_actions: null,
                     unreadable_fields: null,
                     uneditable_fields: null,
-                    unrelated_objects: null
+                    unrelated_objects: null,
+                    field_permissions: null,
+                    read_filters: [],
+                    edit_filters: []
                 };
                 if (_.isEmpty(roles)) {
                     throw new Error('not find user permission');
@@ -759,6 +762,16 @@ var SteedosObjectType = /** @class */ (function (_super) {
                                     userObjectPermission[k] = _v;
                                 }
                             }
+                            else if (['read_filters', 'edit_filters'].indexOf(k) > -1) {
+                                if ('edit_filters' === k) {
+                                    if (!_.isEmpty(_v)) {
+                                        userObjectPermission['read_filters'].push(_v);
+                                    }
+                                }
+                                if (!_.isEmpty(_v)) {
+                                    userObjectPermission[k].push(_v);
+                                }
+                            }
                             else if ((_.isArray(v) || _.isNull(v))) {
                                 if (!_.isArray(_v)) {
                                     _v = [];
@@ -767,12 +780,40 @@ var SteedosObjectType = /** @class */ (function (_super) {
                                     userObjectPermission[k] = _v;
                                 }
                                 else {
-                                    userObjectPermission[k] = _.intersection(v, _v);
+                                    if (k === 'field_permissions') {
+                                        userObjectPermission[k] = _.union(v, _v);
+                                    }
+                                    else {
+                                        userObjectPermission[k] = _.intersection(v, _v);
+                                    }
                                 }
                             }
                         });
                     }
                 });
+                field_permissions = {};
+                if (userObjectPermission.field_permissions) {
+                    _.each(userObjectPermission.field_permissions, function (field_permission) {
+                        var field = field_permission.field, read = field_permission.read, edit = field_permission.edit;
+                        if (field_permissions[field]) {
+                            field_permissions[field].edit = field_permissions[field].edit || edit;
+                            if (field_permissions[field].edit) {
+                                field_permissions[field].read = true;
+                            }
+                            else {
+                                field_permissions[field].read = field_permissions[field].read || read;
+                            }
+                        }
+                        else {
+                            field_permissions[field] = {
+                                field: field,
+                                read: edit || read,
+                                edit: edit
+                            };
+                        }
+                    });
+                }
+                userObjectPermission.field_permissions = field_permissions;
                 userObjectPermission.disabled_list_views = userObjectPermission.disabled_list_views || [];
                 userObjectPermission.disabled_actions = userObjectPermission.disabled_actions || [];
                 userObjectPermission.unreadable_fields = userObjectPermission.unreadable_fields || [];
@@ -782,7 +823,6 @@ var SteedosObjectType = /** @class */ (function (_super) {
                 if (util_1.isTemplateSpace(spaceId)) {
                     return [2 /*return*/, Object.assign({}, userObjectPermission, { allowRead: true, viewAllRecords: true, viewCompanyRecords: true })];
                 }
-                Creator.processPermissions(userObjectPermission);
                 return [2 /*return*/, userObjectPermission];
             });
         });
@@ -1284,7 +1324,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
     };
     SteedosObjectType.prototype.getRecordView = function (userSession) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var lng, objectMetadataConfig, objectConfig, _a, _b, _c, _d, layouts, layout, _fields_1, sort_no_1, layoutFieldKeys, objectFieldKeys, difference, layoutButtonsName_1, spaceProcessDefinition, dbListViews;
+            var lng, objectMetadataConfig, objectConfig, _a, _b, _c, _d, layouts, layout, _fields_1, sort_no_1, layoutFieldKeys, objectFieldKeys, difference, layoutButtonsName_1, userObjectFields, spaceProcessDefinition, dbListViews;
             return tslib_1.__generator(this, function (_e) {
                 switch (_e.label) {
                     case 0:
@@ -1384,6 +1424,23 @@ var SteedosObjectType = /** @class */ (function (_super) {
                                 }
                             });
                         }
+                        userObjectFields = objectConfig.fields;
+                        _.each(objectConfig.permissions.field_permissions, function (field_permission, field) {
+                            var read = field_permission.read, edit = field_permission.edit;
+                            if (read) {
+                                userObjectFields[field].omit = true;
+                            }
+                            if (edit) {
+                                userObjectFields[field].omit = false;
+                                userObjectFields[field].hidden = false;
+                                userObjectFields[field].readonly = false;
+                                userObjectFields[field].disabled = false;
+                            }
+                            if (!read && !edit) {
+                                delete userObjectFields[field];
+                            }
+                        });
+                        objectConfig.fields = userObjectFields;
                         return [4 /*yield*/, getObject("process_definition").directFind({ filters: [['space', '=', userSession.spaceId], ['object_name', '=', this.name], ['active', '=', true]] })];
                     case 7:
                         spaceProcessDefinition = _e.sent();
@@ -1738,6 +1795,42 @@ var SteedosObjectType = /** @class */ (function (_super) {
             });
         });
     };
+    SteedosObjectType.prototype.appendRecordPermission = function (records, userSession) {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            var _ids, objPm, permissionFilters, filters, results, allowEditIds;
+            return tslib_1.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        _ids = _.pluck(records, '_id');
+                        return [4 /*yield*/, this.getUserObjectPermission(userSession)];
+                    case 1:
+                        objPm = _a.sent();
+                        permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
+                        if (_.isEmpty(permissionFilters)) {
+                            return [2 /*return*/];
+                        }
+                        filters = filters_1.formatFiltersToODataQuery(['_id', 'in', _ids]);
+                        return [4 /*yield*/, this.directFind({
+                                fields: ['_id'],
+                                filters: "(" + filters + ") and (" + permissionFilters.join(' or ') + ")"
+                            })];
+                    case 2:
+                        results = _a.sent();
+                        allowEditIds = _.pluck(results, '_id');
+                        _.each(records, function (record) {
+                            if (_.include(allowEditIds, record._id)) {
+                                record.record_permissions = {
+                                    allowRead: true,
+                                    allowEdit: true,
+                                    allowDelete: true,
+                                };
+                            }
+                        });
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
     SteedosObjectType.prototype.getTriggerContext = function (when, method, args, recordId) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var userSession, context, _a;
@@ -1827,7 +1920,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
             args[_i - 1] = arguments[_i];
         }
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var adapterMethod, allow, objectName, recordId, doc, paramRecordId, returnValue, userSession, beforeTriggerContext, afterTriggerContext, previousDoc, values;
+            var adapterMethod, allow, objectName, recordId, doc, paramRecordId, returnValue, userSession, beforeTriggerContext, afterTriggerContext, previousDoc, values, _records;
             return tslib_1.__generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -1870,7 +1963,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
                         return [4 /*yield*/, adapterMethod.apply(this._datasource, args)];
                     case 4:
                         returnValue = _a.sent();
-                        return [3 /*break*/, 21];
+                        return [3 /*break*/, 25];
                     case 5:
                         userSession = args[args.length - 1];
                         return [4 /*yield*/, this.getTriggerContext('before', method, args)];
@@ -1896,31 +1989,43 @@ var SteedosObjectType = /** @class */ (function (_super) {
                         return [4 /*yield*/, adapterMethod.apply(this._datasource, args)];
                     case 10:
                         returnValue = _a.sent();
-                        if (method === 'find' || method == 'findOne' || method == 'count' || method == 'aggregate' || method == 'aggregatePrefixalPipeline') {
-                            values = returnValue || {};
-                            if (method === 'count') {
-                                values = returnValue || 0;
-                            }
-                            Object.assign(afterTriggerContext, { data: { values: values } });
+                        if (!(method === 'find' || method == 'findOne' || method == 'count' || method == 'aggregate' || method == 'aggregatePrefixalPipeline')) return [3 /*break*/, 14];
+                        values = returnValue || {};
+                        if (!(method === 'count')) return [3 /*break*/, 11];
+                        values = returnValue || 0;
+                        return [3 /*break*/, 13];
+                    case 11:
+                        if (!userSession) return [3 /*break*/, 13];
+                        _records = returnValue;
+                        if (method == 'findOne' && returnValue) {
+                            _records = [_records];
                         }
+                        return [4 /*yield*/, this.appendRecordPermission(_records, userSession)];
+                    case 12:
+                        _a.sent();
+                        _a.label = 13;
+                    case 13:
+                        Object.assign(afterTriggerContext, { data: { values: values } });
+                        _a.label = 14;
+                    case 14:
                         // console.log("==returnValue==", returnValue);
                         if (method == 'insert' && _.has(returnValue, '_id')) {
                             afterTriggerContext.doc = returnValue;
                             afterTriggerContext = Object.assign({}, afterTriggerContext, { id: returnValue._id });
                         }
-                        if (!(method == "update")) return [3 /*break*/, 13];
-                        if (!returnValue) return [3 /*break*/, 12];
+                        if (!(method == "update")) return [3 /*break*/, 17];
+                        if (!returnValue) return [3 /*break*/, 16];
                         afterTriggerContext.doc = returnValue;
                         return [4 /*yield*/, this.runAfterTriggers(method, afterTriggerContext)];
-                    case 11:
+                    case 15:
                         _a.sent();
-                        _a.label = 12;
-                    case 12: return [3 /*break*/, 15];
-                    case 13: return [4 /*yield*/, this.runAfterTriggers(method, afterTriggerContext)];
-                    case 14:
+                        _a.label = 16;
+                    case 16: return [3 /*break*/, 19];
+                    case 17: return [4 /*yield*/, this.runAfterTriggers(method, afterTriggerContext)];
+                    case 18:
                         _a.sent();
-                        _a.label = 15;
-                    case 15:
+                        _a.label = 19;
+                    case 19:
                         if (method === 'find' || method == 'findOne' || method == 'count' || method == 'aggregate' || method == 'aggregatePrefixalPipeline') {
                             if (_.isEmpty(afterTriggerContext.data) || (_.isEmpty(afterTriggerContext.data.values) && !_.isNumber(afterTriggerContext.data.values))) {
                                 return [2 /*return*/, returnValue];
@@ -1936,9 +2041,9 @@ var SteedosObjectType = /** @class */ (function (_super) {
                                 user_session: userSession,
                                 previous_record: afterTriggerContext.previousDoc
                             }).run()];
-                    case 16:
+                    case 20:
                         _a.sent();
-                        if (!returnValue) return [3 /*break*/, 19];
+                        if (!returnValue) return [3 /*break*/, 23];
                         if (method === "insert") {
                             // 当为insert时，上面代码执行后的doc不带_id，只能从returnValue中取
                             doc = returnValue;
@@ -1946,18 +2051,18 @@ var SteedosObjectType = /** @class */ (function (_super) {
                         }
                         // 一定要先运行公式再运行汇总，以下两个函数顺序不能反
                         return [4 /*yield*/, this.runRecordFormula(method, objectName, recordId, doc, userSession)];
-                    case 17:
+                    case 21:
                         // 一定要先运行公式再运行汇总，以下两个函数顺序不能反
                         _a.sent();
                         return [4 /*yield*/, this.runRecordSummaries(method, objectName, recordId, doc, previousDoc, userSession)];
-                    case 18:
+                    case 22:
                         _a.sent();
-                        _a.label = 19;
-                    case 19: return [4 /*yield*/, object_events_1.brokeEmitEvents(objectName, method, afterTriggerContext)];
-                    case 20:
+                        _a.label = 23;
+                    case 23: return [4 /*yield*/, object_events_1.brokeEmitEvents(objectName, method, afterTriggerContext)];
+                    case 24:
                         _a.sent();
-                        _a.label = 21;
-                    case 21: return [2 /*return*/, returnValue];
+                        _a.label = 25;
+                    case 25: return [2 /*return*/, returnValue];
                 }
             });
         });
@@ -2012,6 +2117,29 @@ var SteedosObjectType = /** @class */ (function (_super) {
             });
         });
     };
+    SteedosObjectType.prototype.getObjectPermissionFilters = function (objectPermission, userSession, isEdit) {
+        var objectPermissionFilters = [];
+        var permissionFiltersKey = 'read_filters';
+        if (isEdit) {
+            permissionFiltersKey = 'edit_filters';
+        }
+        var globalData = Object.assign({}, userSession, { now: new Date() });
+        var permissionFilters = objectPermission[permissionFiltersKey];
+        _.each(permissionFilters, function (permissionFilter) {
+            if (_.isString(permissionFilter) && util_1.isExpression(permissionFilter.trim())) {
+                try {
+                    var filters = util_1.parseSingleExpression(permissionFilter, {}, "#", globalData);
+                    if (filters && !_.isString(filters)) {
+                        objectPermissionFilters.push("(" + filters_1.formatFiltersToODataQuery(filters, userSession) + ")");
+                    }
+                }
+                catch (error) {
+                    console.error("getObjectPermissionFilters error", permissionFilter, error.message);
+                }
+            }
+        });
+        return objectPermissionFilters;
+    };
     /**
      * 把query.filters用formatFiltersToODataQuery转为odata query
      * 主要是为了把userSession中的utcOffset逻辑传入formatFiltersToODataQuery函数处理
@@ -2032,7 +2160,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
     };
     SteedosObjectType.prototype.dealWithMethodPermission = function (method, args) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var userSession, spaceId, userId, objPm, query, spaceFilter, companyFilter, ownerFilter, sharesFilter, clientFilter, filters, permissionFilters, userFilters, id, companyFilters, queryFilters, companyFilters, id, companyFilters;
+            var userSession, spaceId, userId, objPm, query, spaceFilter, companyFilter, ownerFilter, sharesFilter, objectPermissionFilters, clientFilter, filters, permissionFilters, userFilters, permissionFilters, objectPermissionEditFilters, id, companyFilters, queryFilters, companyFilters, permissionFilters, objectPermissionEditFilters, id, companyFilters;
             return tslib_1.__generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -2057,7 +2185,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
                             if (util_1.isCloudAdminSpace(spaceId)) {
                                 return [2 /*return*/];
                             }
-                            spaceFilter = void 0, companyFilter = void 0, ownerFilter = void 0, sharesFilter = void 0, clientFilter = query.filters, filters = void 0, permissionFilters = [], userFilters = [];
+                            spaceFilter = void 0, companyFilter = void 0, ownerFilter = void 0, sharesFilter = void 0, objectPermissionFilters = void 0, clientFilter = query.filters, filters = void 0, permissionFilters = [], userFilters = [];
                             if (spaceId) {
                                 spaceFilter = "(space eq '" + spaceId + "')";
                             }
@@ -2073,9 +2201,11 @@ var SteedosObjectType = /** @class */ (function (_super) {
                             if (!objPm.viewAllRecords && !objPm.viewCompanyRecords && objPm.allowRead) { // owner
                                 ownerFilter = "(owner eq '" + userId + "')";
                             }
-                            if (!objPm.viewAllRecords) {
-                                sharesFilter = util_1.getUserObjectSharesFilters(this.name, userSession);
+                            objectPermissionFilters = this.getObjectPermissionFilters(objPm, userSession, false);
+                            if (!_.isEmpty(objectPermissionFilters)) {
+                                permissionFilters.push("(" + objectPermissionFilters.join(' or ') + ")");
                             }
+                            sharesFilter = util_1.getUserObjectSharesFilters(this.name, userSession);
                             if (!_.isEmpty(companyFilter)) {
                                 permissionFilters.push("(" + companyFilter.join(' or ') + ")");
                             }
@@ -2105,9 +2235,14 @@ var SteedosObjectType = /** @class */ (function (_super) {
                             }
                         }
                         else if (method === 'update' || method === 'updateOne') {
-                            if (!objPm.allowEdit) {
+                            permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
+                            if (!objPm.allowEdit && _.isEmpty(permissionFilters)) {
                                 throw new Error("no " + method + " permission!");
                             }
+                            objectPermissionEditFilters = '';
+                            if (!_.isEmpty(permissionFilters)) {
+                                objectPermissionEditFilters = " or (" + permissionFilters.join(' or ') + ")";
+                            }
                             id = args[args.length - 3];
                             if (!objPm.modifyAllRecords && objPm.modifyCompanyRecords) {
                                 companyFilters = _.map(userSession.companies, function (comp) {
@@ -2115,25 +2250,36 @@ var SteedosObjectType = /** @class */ (function (_super) {
                                 }).join(' or ');
                                 if (companyFilters) {
                                     if (_.isString(id)) {
-                                        id = { filters: "(_id eq '" + id + "') and (" + companyFilters + ")" };
+                                        id = { filters: "(_id eq '" + id + "') and (" + companyFilters + objectPermissionEditFilters + ")" };
                                     }
                                     else if (_.isObject(id)) {
                                         if (id.filters && !_.isString(id.filters)) {
                                             id.filters = filters_1.formatFiltersToODataQuery(id.filters);
                                         }
-                                        id.filters = id.filters ? "(" + id.filters + ") and (" + companyFilters + ")" : "(" + companyFilters + ")";
+                                        id.filters = id.filters ? "(" + id.filters + ") and (" + companyFilters + objectPermissionEditFilters + ")" : "(" + companyFilters + objectPermissionEditFilters + ")";
                                     }
                                 }
                             }
                             else if (!objPm.modifyAllRecords && !objPm.modifyCompanyRecords && objPm.allowEdit) {
                                 if (_.isString(id)) {
-                                    id = { filters: "(_id eq '" + id + "') and (owner eq '" + userId + "')" };
+                                    id = { filters: "(_id eq '" + id + "') and (owner eq '" + userId + "' " + objectPermissionEditFilters + ")" };
+                                }
+                                else if (_.isObject(id)) {
+                                    if (id.filters && !_.isString(id.filters)) {
+                                        id.filters = filters_1.formatFiltersToODataQuery(id.filters);
+                                    }
+                                    id.filters = id.filters ? "(" + id.filters + ") and (owner eq '" + userId + "' " + objectPermissionEditFilters + ")" : "(owner eq '" + userId + "' " + objectPermissionEditFilters + ")";
+                                }
+                            }
+                            else if (objectPermissionEditFilters) {
+                                if (_.isString(id)) {
+                                    id = { filters: "(_id eq '" + id + "') and (" + objectPermissionEditFilters + ")" };
                                 }
                                 else if (_.isObject(id)) {
                                     if (id.filters && !_.isString(id.filters)) {
                                         id.filters = filters_1.formatFiltersToODataQuery(id.filters);
                                     }
-                                    id.filters = id.filters ? "(" + id.filters + ") and (owner eq '" + userId + "')" : "(owner eq '" + userId + "')";
+                                    id.filters = id.filters ? "(" + id.filters + ") and (" + objectPermissionEditFilters + ")" : "(" + objectPermissionEditFilters + ")";
                                 }
                             }
                             args[args.length - 3] = id;
@@ -2157,20 +2303,36 @@ var SteedosObjectType = /** @class */ (function (_super) {
                             }
                         }
                         else if (method === 'delete') {
-                            if (!objPm.allowDelete) {
+                            permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
+                            if (!objPm.allowDelete && _.isEmpty(permissionFilters)) {
                                 throw new Error("no " + method + " permission!");
                             }
+                            objectPermissionEditFilters = '';
+                            if (!_.isEmpty(permissionFilters)) {
+                                objectPermissionEditFilters = " or (" + permissionFilters.join(' or ') + ")";
+                            }
                             id = args[args.length - 2];
                             if (!objPm.modifyAllRecords && objPm.modifyCompanyRecords) {
                                 companyFilters = _.map(userSession.companies, function (comp) {
                                     return "(company_id eq '" + comp._id + "') or (company_ids eq '" + comp._id + "')";
                                 }).join(' or ');
                                 if (companyFilters) {
-                                    id = { filters: "(_id eq '" + id + "') and (" + companyFilters + ")" };
+                                    id = { filters: "(_id eq '" + id + "') and (" + companyFilters + objectPermissionEditFilters + ")" };
                                 }
                             }
                             else if (!objPm.modifyAllRecords && !objPm.modifyCompanyRecords) {
-                                id = { filters: "(_id eq '" + id + "') and (owner eq '" + userId + "')" };
+                                id = { filters: "(_id eq '" + id + "') and (owner eq '" + userId + "'" + objectPermissionEditFilters + ")" };
+                            }
+                            else if (objectPermissionEditFilters) {
+                                if (_.isString(id)) {
+                                    id = { filters: "(_id eq '" + id + "') and (" + objectPermissionEditFilters + ")" };
+                                }
+                                else if (_.isObject(id)) {
+                                    if (id.filters && !_.isString(id.filters)) {
+                                        id.filters = filters_1.formatFiltersToODataQuery(id.filters);
+                                    }
+                                    id.filters = id.filters ? "(" + id.filters + ") and (" + objectPermissionEditFilters + ")" : "(" + objectPermissionEditFilters + ")";
+                                }
                             }
                             args[args.length - 2] = id;
                         }