@steedos/objectql 2.1.56 → 2.1.57

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@steedos/objectql",
   "private": false,
-  "version": "2.1.56",
+  "version": "2.1.57",
   "description": "",
   "main": "lib/index.js",
   "scripts": {
@@ -18,12 +18,12 @@
     "@salesforce/dev-config": "^1.4.4",
     "@salesforce/kit": "^1.0.4",
     "@salesforce/ts-types": "^1.1.1",
-    "@steedos/filters": "2.1.56",
-    "@steedos/formula": "2.1.56",
-    "@steedos/metadata-core": "2.1.56",
+    "@steedos/filters": "2.1.57",
+    "@steedos/formula": "2.1.57",
+    "@steedos/metadata-core": "2.1.57",
     "@steedos/odata-v4-typeorm": "^1.20.1",
-    "@steedos/schemas": "2.1.56",
-    "@steedos/standard-objects": "2.1.56",
+    "@steedos/schemas": "2.1.57",
+    "@steedos/standard-objects": "2.1.57",
     "@types/express": "^4.16.1",
     "@types/mongodb": "^3.1.22",
     "@types/node": "^11.10.4",
@@ -57,7 +57,7 @@
   },
   "devDependencies": {
     "@salesforce/dev-scripts": "0.3.12",
-    "@steedos/meteor-bundle-runner": "2.1.56",
+    "@steedos/meteor-bundle-runner": "2.1.57",
     "@types/chai": "^4.1.7",
     "@types/chai-as-promised": "7.1.0",
     "@types/mocha": "^5.2.6",
@@ -77,5 +77,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "a8eed2e9927d67c38df80be1474cb6b7f5b0159c"
+  "gitHead": "ded65c3ad95afec8827dd81d505684459a3ba019"
 }

package/src/types/object.ts

@@ -1,6 +1,6 @@
 import { Dictionary, JsonMap } from "@salesforce/ts-types";
 import { SteedosTriggerType, SteedosFieldType, SteedosFieldTypeConfig, SteedosSchema, SteedosListenerConfig, SteedosObjectListViewTypeConfig, SteedosObjectListViewType, SteedosIDType, SteedosObjectPermissionTypeConfig, SteedosActionType, SteedosActionTypeConfig, SteedosUserSession, getSteedosSchema } from ".";
-import { getUserObjectSharesFilters, isTemplateSpace, isCloudAdminSpace, generateActionParams, absoluteUrl } from '../util'
+import { getUserObjectSharesFilters, isTemplateSpace, isCloudAdminSpace, generateActionParams, absoluteUrl, isExpression, parseSingleExpression } from '../util'
 import _ = require("underscore");
 import { SteedosTriggerTypeConfig, SteedosTriggerContextConfig } from "./trigger";
 import { SteedosQueryOptions, SteedosQueryFilters } from "./query";
@@ -15,7 +15,7 @@ import { brokeEmitEvents } from "./object_events";
 import { translationObject } from "@steedos/i18n";
 import { getObjectLayouts } from "./object_layouts";
 import { sortBy, forEach } from 'lodash';
-declare var Creator: any;
+
 const clone = require('clone')
 
 // 主子表有层级限制，超过3层就报错，该函数判断当前对象作为主表对象往下的层级最多不越过3层，
@@ -634,7 +634,10 @@ export class SteedosObjectType extends SteedosObjectProperties {
             disabled_actions: null,
             unreadable_fields: null,
             uneditable_fields: null,
-            unrelated_objects: null
+            unrelated_objects: null,
+            field_permissions: null,
+            read_filters: [],
+            edit_filters: []
         }
 
         if (_.isEmpty(roles)) {
@@ -654,20 +657,56 @@ export class SteedosObjectType extends SteedosObjectProperties {
                         if(_.isBoolean(_v)){
                             userObjectPermission[k] = _v
                         }
-                    } else if ((_.isArray(v) || _.isNull(v))) {
+                    } else if (['read_filters', 'edit_filters'].indexOf(k) > -1) {
+                        if ('edit_filters' === k) {
+                            if (!_.isEmpty(_v)) {
+                                userObjectPermission['read_filters'].push(_v);
+                            }
+                        }
+                        if (!_.isEmpty(_v)) {
+                            userObjectPermission[k].push(_v);
+                        }
+                    }
+                    else if ((_.isArray(v) || _.isNull(v))) {
                         if (!_.isArray(_v)) {
                             _v = []
                         }
                         if (_.isNull(v)) {
                             userObjectPermission[k] = _v
                         } else {
-                            userObjectPermission[k] = _.intersection(v, _v)
+                            if (k === 'field_permissions') {
+                                userObjectPermission[k] = _.union(v, _v)
+                            } else {
+                                userObjectPermission[k] = _.intersection(v, _v)
+                            }
                         }
                     }
                 })
             }
-        })
+        });
 
+        const field_permissions = {};
+        if (userObjectPermission.field_permissions) {
+            _.each(userObjectPermission.field_permissions, (field_permission) => {
+                const { field, read, edit } = field_permission;
+                if (field_permissions[field]) {
+                    field_permissions[field].edit = field_permissions[field].edit || edit;
+                    if (field_permissions[field].edit) {
+                        field_permissions[field].read = true
+                    } else {
+                        field_permissions[field].read = field_permissions[field].read || read;
+                    }
+                } else {
+                    field_permissions[field] = {
+                        field: field,
+                        read: edit || read,
+                        edit: edit
+                    }
+                }
+            })
+        }
+
+        userObjectPermission.field_permissions = field_permissions;
 
         userObjectPermission.disabled_list_views = userObjectPermission.disabled_list_views || []
         userObjectPermission.disabled_actions = userObjectPermission.disabled_actions || []
@@ -680,7 +719,6 @@ export class SteedosObjectType extends SteedosObjectProperties {
             return Object.assign({}, userObjectPermission, { allowRead: true, viewAllRecords: true, viewCompanyRecords: true })
         }
 
-        Creator.processPermissions(userObjectPermission)
         return userObjectPermission;
     }
 
@@ -1021,6 +1059,27 @@ export class SteedosObjectType extends SteedosObjectProperties {
             })
         }
 
+        // 使用字段级安全性作为限制用户对字段的访问权限的手段；然后使用页面布局主要在选项卡中组织详细信息和编辑页面。这可以减少需要维护的页面布局数量。
+        // 例如，如果字段在页面布局中是必需的，并且在字段级安全性设置中是只读的，则字段级安全性将覆盖页面布局，并且该字段将对用户是只读的。
+        const userObjectFields = objectConfig.fields;
+        _.each(objectConfig.permissions.field_permissions, (field_permission, field) => {
+            const { read, edit } = field_permission;
+            if (read) {
+                userObjectFields[field].omit = true;
+            }
+            if (edit) {
+                userObjectFields[field].omit = false;
+                userObjectFields[field].hidden = false;
+                userObjectFields[field].readonly = false;
+                userObjectFields[field].disabled = false;
+            }
+            if (!read && !edit) {
+                delete userObjectFields[field]
+            }
+        })
+
+        objectConfig.fields = userObjectFields
+
         // TODO object layout 是否需要控制审批记录显示？
         let spaceProcessDefinition = await getObject("process_definition").directFind({ filters: [['space', '=', userSession.spaceId], ['object_name', '=', this.name], ['active', '=', true]] })
         if (spaceProcessDefinition.length > 0) {
@@ -1256,6 +1315,32 @@ export class SteedosObjectType extends SteedosObjectProperties {
         return await this.runTriggerActions(when, context)
     }
 
+    private async appendRecordPermission(records, userSession) {
+        const _ids = _.pluck(records, '_id');
+        const objPm = await this.getUserObjectPermission(userSession);
+        const permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
+        if (_.isEmpty(permissionFilters)) {
+            return;
+        }
+        const filters = formatFiltersToODataQuery(['_id', 'in', _ids])
+
+        const results = await this.directFind({
+            fields: ['_id'],
+            filters: `(${filters}) and (${permissionFilters.join(' or ')})`
+        });
+        const allowEditIds = _.pluck(results, '_id');
+        _.each(records, (record) => {
+            if (_.include(allowEditIds, record._id)) {
+                record.record_permissions = {
+                    allowRead: true,
+                    allowEdit: true,
+                    allowDelete: true,
+                }
+            }
+        })
+
+    }
+
     private async getTriggerContext(when: string, method: string, args: any[], recordId?: string) {
 
         let userSession = args[args.length - 1]
@@ -1406,6 +1491,14 @@ export class SteedosObjectType extends SteedosObjectProperties {
                 let values = returnValue || {}
                 if (method === 'count') {
                     values = returnValue || 0
+                } else {
+                    if (userSession) {
+                        let _records = returnValue
+                        if (method == 'findOne' && returnValue) {
+                            _records = [_records]
+                        }
+                        await this.appendRecordPermission(_records, userSession);
+                    }
                 }
                 Object.assign(afterTriggerContext, { data: { values: values } })
             }
@@ -1484,6 +1577,33 @@ export class SteedosObjectType extends SteedosObjectProperties {
         }
     }
 
+    private getObjectPermissionFilters(objectPermission, userSession, isEdit) {
+        const objectPermissionFilters = [];
+
+        let permissionFiltersKey = 'read_filters';
+        if (isEdit) {
+            permissionFiltersKey = 'edit_filters';
+        }
+
+        const globalData = Object.assign({}, userSession, { now: new Date() });
+
+        let permissionFilters = objectPermission[permissionFiltersKey];
+
+        _.each(permissionFilters, (permissionFilter) => {
+            if (_.isString(permissionFilter) && isExpression(permissionFilter.trim())) {
+                try {
+                    const filters = parseSingleExpression(permissionFilter, {}, "#", globalData);
+                    if (filters && !_.isString(filters)) {
+                        objectPermissionFilters.push(`(${formatFiltersToODataQuery(filters, userSession)})`)
+                    }
+                } catch (error) {
+                    console.error(`getObjectPermissionFilters error`, permissionFilter, error.message);
+                }
+            }
+        })
+        return objectPermissionFilters;
+    }
+
     /**
      * 把query.filters用formatFiltersToODataQuery转为odata query
      * 主要是为了把userSession中的utcOffset逻辑传入formatFiltersToODataQuery函数处理
@@ -1514,7 +1634,6 @@ export class SteedosObjectType extends SteedosObjectProperties {
                 if (method === 'aggregate' || method === 'aggregatePrefixalPipeline') {
                     query = args[args.length - 3];
                 }
-
                 if (query.filters && !_.isString(query.filters)) {
                     query.filters = formatFiltersToODataQuery(query.filters);
                 }
@@ -1527,7 +1646,7 @@ export class SteedosObjectType extends SteedosObjectProperties {
                     return
                 }
 
-                let spaceFilter, companyFilter, ownerFilter, sharesFilter, clientFilter = query.filters, filters, permissionFilters = [], userFilters = [];
+                let spaceFilter, companyFilter, ownerFilter, sharesFilter, objectPermissionFilters, clientFilter = query.filters, filters, permissionFilters = [], userFilters = [];
 
                 if (spaceId) {
                     spaceFilter = `(space eq '${spaceId}')`;
@@ -1547,10 +1666,14 @@ export class SteedosObjectType extends SteedosObjectProperties {
                     ownerFilter = `(owner eq '${userId}')`;
                 }
 
-                if (!objPm.viewAllRecords) {
-                    sharesFilter = getUserObjectSharesFilters(this.name, userSession);
+                objectPermissionFilters = this.getObjectPermissionFilters(objPm, userSession, false);
+
+                if (!_.isEmpty(objectPermissionFilters)) {
+                    permissionFilters.push(`(${objectPermissionFilters.join(' or ')})`);
                 }
 
+                sharesFilter = getUserObjectSharesFilters(this.name, userSession);
+
                 if (!_.isEmpty(companyFilter)) {
                     permissionFilters.push(`(${companyFilter.join(' or ')})`);
                 }
@@ -1587,9 +1710,14 @@ export class SteedosObjectType extends SteedosObjectProperties {
                 }
             }
             else if (method === 'update' || method === 'updateOne') {
-                if (!objPm.allowEdit) {
+                const permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
+                if (!objPm.allowEdit && _.isEmpty(permissionFilters)) {
                     throw new Error(`no ${method} permission!`);
                 }
+                let objectPermissionEditFilters = '';
+                if (!_.isEmpty(permissionFilters)) {
+                    objectPermissionEditFilters = ` or (${permissionFilters.join(' or ')})`
+                }
                 let id = args[args.length - 3];
                 if (!objPm.modifyAllRecords && objPm.modifyCompanyRecords) {
                     let companyFilters = _.map(userSession.companies, function (comp: any) {
@@ -1597,25 +1725,35 @@ export class SteedosObjectType extends SteedosObjectProperties {
                     }).join(' or ')
                     if (companyFilters) {
                         if (_.isString(id)) {
-                            id = { filters: `(_id eq \'${id}\') and (${companyFilters})` }
+                            id = { filters: `(_id eq \'${id}\') and (${companyFilters}${objectPermissionEditFilters})` }
                         }
                         else if (_.isObject(id)) {
                             if (id.filters && !_.isString(id.filters)) {
                                 id.filters = formatFiltersToODataQuery(id.filters);
                             }
-                            id.filters = id.filters ? `(${id.filters}) and (${companyFilters})` : `(${companyFilters})`;
+                            id.filters = id.filters ? `(${id.filters}) and (${companyFilters}${objectPermissionEditFilters})` : `(${companyFilters}${objectPermissionEditFilters})`;
                         }
                     }
                 }
                 else if (!objPm.modifyAllRecords && !objPm.modifyCompanyRecords && objPm.allowEdit) {
                     if (_.isString(id)) {
-                        id = { filters: `(_id eq \'${id}\') and (owner eq \'${userId}\')` }
+                        id = { filters: `(_id eq \'${id}\') and (owner eq \'${userId}\' ${objectPermissionEditFilters})` }
                     }
                     else if (_.isObject(id)) {
                         if (id.filters && !_.isString(id.filters)) {
                             id.filters = formatFiltersToODataQuery(id.filters);
                         }
-                        id.filters = id.filters ? `(${id.filters}) and (owner eq \'${userId}\')` : `(owner eq \'${userId}\')`;
+                        id.filters = id.filters ? `(${id.filters}) and (owner eq \'${userId}\' ${objectPermissionEditFilters})` : `(owner eq \'${userId}\' ${objectPermissionEditFilters})`;
+                    }
+                } else if (objectPermissionEditFilters) {
+                    if (_.isString(id)) {
+                        id = { filters: `(_id eq \'${id}\') and (${objectPermissionEditFilters})` }
+                    }
+                    else if (_.isObject(id)) {
+                        if (id.filters && !_.isString(id.filters)) {
+                            id.filters = formatFiltersToODataQuery(id.filters);
+                        }
+                        id.filters = id.filters ? `(${id.filters}) and (${objectPermissionEditFilters})` : `(${objectPermissionEditFilters})`;
                     }
                 }
                 args[args.length - 3] = id;
@@ -1639,20 +1777,37 @@ export class SteedosObjectType extends SteedosObjectProperties {
                 }
             }
             else if (method === 'delete') {
-                if (!objPm.allowDelete) {
+                const permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
+                if (!objPm.allowDelete && _.isEmpty(permissionFilters)) {
                     throw new Error(`no ${method} permission!`);
                 }
+
+                let objectPermissionEditFilters = '';
+                if (!_.isEmpty(permissionFilters)) {
+                    objectPermissionEditFilters = ` or (${permissionFilters.join(' or ')})`
+                }
+
                 let id = args[args.length - 2];
                 if (!objPm.modifyAllRecords && objPm.modifyCompanyRecords) {
                     let companyFilters = _.map(userSession.companies, function (comp: any) {
                         return `(company_id eq '${comp._id}') or (company_ids eq '${comp._id}')`
                     }).join(' or ')
                     if (companyFilters) {
-                        id = { filters: `(_id eq \'${id}\') and (${companyFilters})` };
+                        id = { filters: `(_id eq \'${id}\') and (${companyFilters}${objectPermissionEditFilters})` };
                     }
                 }
                 else if (!objPm.modifyAllRecords && !objPm.modifyCompanyRecords) {
-                    id = { filters: `(_id eq \'${id}\') and (owner eq \'${userId}\')` };
+                    id = { filters: `(_id eq \'${id}\') and (owner eq \'${userId}\'${objectPermissionEditFilters})` };
+                } else if (objectPermissionEditFilters) {
+                    if (_.isString(id)) {
+                        id = { filters: `(_id eq \'${id}\') and (${objectPermissionEditFilters})` }
+                    }
+                    else if (_.isObject(id)) {
+                        if (id.filters && !_.isString(id.filters)) {
+                            id.filters = formatFiltersToODataQuery(id.filters);
+                        }
+                        id.filters = id.filters ? `(${id.filters}) and (${objectPermissionEditFilters})` : `(${objectPermissionEditFilters})`;
+                    }
                 }
                 args[args.length - 2] = id;
             }

package/src/types/object_permission.ts

@@ -22,6 +22,7 @@ abstract class SteedosObjectPermissionTypeProperties {
     unreadable_fields?: string[]
     uneditable_fields?: string[]
     unrelated_objects?: string[]
+    field_permissions?: any
 }
 
 export interface SteedosObjectPermissionTypeConfig extends SteedosObjectPermissionTypeProperties { }
@@ -71,6 +72,37 @@ export class SteedosObjectPermissionType extends SteedosObjectPermissionTypeProp
             this.allowRead = true;
         }
 
+        if (this.allowRead) {
+            typeof this.allowReadFiles !== "boolean" && (this.allowReadFiles = true);
+            typeof this.viewAllFiles !== "boolean" && (this.viewAllFiles = true);
+        }
+        if (this.allowEdit) {
+            typeof this.allowCreateFiles !== "boolean" && (this.allowCreateFiles = true);
+            typeof this.allowEditFiles !== "boolean" && (this.allowEditFiles = true);
+            typeof this.allowDeleteFiles !== "boolean" && (this.allowDeleteFiles = true);
+        }
+        if (this.modifyAllRecords) {
+            typeof this.modifyAllFiles !== "boolean" && (this.modifyAllFiles = true);
+        }
+        if (this.allowCreateFiles) {
+            this.allowReadFiles = true;
+        }
+        if (this.allowEditFiles) {
+            this.allowReadFiles = true;
+        }
+        if (this.allowDeleteFiles) {
+            this.allowEditFiles = true;
+            this.allowReadFiles = true;
+        }
+        if (this.viewAllFiles) {
+            this.allowReadFiles = true;
+        }
+        if (this.modifyAllFiles) {
+            this.allowReadFiles = true;
+            this.allowEditFiles = true;
+            this.allowDeleteFiles = true;
+            this.viewAllFiles = true;
+        }
         this.object_name = object_name
     }
 

package/src/util/function_expression.ts

@@ -0,0 +1,63 @@
+import * as _ from 'lodash'
+
+const globalTag = '__G_L_O_B_A_L__';
+
+const getParentPath = function (path) {
+    var pathArr;
+    if (typeof path === 'string') {
+        pathArr = path.split('.');
+        if (pathArr.length === 1) {
+            return '#';
+        }
+        pathArr.pop();
+        return pathArr.join('.');
+    }
+    return '#';
+}
+
+const getValueByPath = function (formData, path) {
+    if (path === '#' || !path) {
+        return formData || {};
+    } else if (typeof path === 'string') {
+        return _.get(formData, path);
+    } else {
+        console.error('path has to be a string');
+    }
+};
+
+export const isExpression = function (func) {
+    var pattern, reg1, reg2;
+    if (typeof func !== 'string') {
+        return false;
+    }
+    pattern = /^{{(.+)}}$/;
+    reg1 = /^{{(function.+)}}$/;
+    reg2 = /^{{(.+=>.+)}}$/;
+    if (typeof func === 'string' && func.match(pattern) && !func.match(reg1) && !func.match(reg2)) {
+        return true;
+    }
+    return false;
+};
+
+export const parseSingleExpression = function (func, formData, dataPath, global) {
+    var error, funcBody, parent, parentPath, str;
+
+    if (formData === void 0) {
+        formData = {};
+    }
+    parentPath = getParentPath(dataPath);
+    parent = getValueByPath(formData, parentPath) || {};
+    if (typeof func === 'string') {
+        funcBody = func.substring(2, func.length - 2);
+        str = '\n    return ' + funcBody.replace(/\bformData\b/g, JSON.stringify(formData).replace(/\bglobal\b/g, globalTag)).replace(/\bglobal\b/g, JSON.stringify(global)).replace(new RegExp('\\b' + globalTag + '\\b', 'g'), 'global').replace(/rootValue/g, JSON.stringify(parent));
+        try {
+            return Function(str)();
+        } catch (_error) {
+            error = _error;
+            console.log(error, func, dataPath);
+            return func;
+        }
+    } else {
+        return func;
+    }
+};

package/src/util/index.ts

@@ -27,6 +27,7 @@ export * from './permission_shares'
 export * from './suffix'
 export * from './locale'
 export * from './field'
+export * from './function_expression'
 
 exports.loadJSONFile = (filePath: string)=>{
     return JSON.parse(fs.readFileSync(filePath, 'utf8').normalize('NFC'));