@steedos/standard-permission 2.2.55-beta.16

package/main/default/objects/permission_set/permission_set.object.yml

@@ -0,0 +1,268 @@
+name: permission_set
+label: Permission Set
+icon: groups
+hidden: false
+enable_inline_edit: false
+version: 2
+paging:
+  enabled: false
+fields:
+  name:
+    label: Name
+    type: text
+    searchable: true
+    index: true
+    required: true
+  label:
+    label: Label
+    type: text
+    searchable: true
+    index: true
+    is_name: true
+    required: true
+  type:
+    label: Type
+    type: select
+    firstOption: false
+    options: Profile:profile,Permission set:permission_set
+    defaultValue: permission_set
+  license:
+    label: License
+    type: lookup
+    optionsFunction: !!js/function 
+      function(){
+        return Steedos.getLicenseOptions();
+      }
+    showIcon: false
+    # required: "{{ 'profile' === formData.type }}"
+  assigned_apps:
+    label: Assigned Apps
+    type: lookup
+    multiple: true
+    optionsFunction: !<tag:yaml.org,2002:js/function> |-
+      function () {
+              var _options;
+
+              _options = [];
+
+              _.forEach(Creator.Apps, function (o, k) {
+                return _options.push({
+                  label: o.label || o.name,
+                  value: k,
+                  icon: o.icon_slds
+                });
+              });
+
+              return _options;
+            }
+    name: assigned_apps
+    filterable: true
+  users:
+    label: Users
+    type: lookup
+    reference_to: users
+    multiple: true
+    is_wide: true
+    filterable: true
+    depend_on:
+      - type
+    inlineHelpText: When the type is a profile, no user needs to be selected
+    visible_on: "{{'permission_set' === formData.type}}"
+  is_system:
+    type: boolean
+    label: System
+    # omit: true
+    readonly: true
+    visible_on: "{{global.mode ==='read' ? true : false}}"
+    disabled: true
+  password_history:
+    type: lookup
+    group: profile password policy
+    showIcon: false
+    label: 强制密码历史
+    optionsFunction: !!js/function |
+      function(){
+        var options = [];
+        //TODO 支持value = 0
+        for(var i= 1; i < 25; i++){
+          options.push({label: TAPi18n.__('permission_set_field_password_history_options', i), value: `${i}`})
+        }
+        return options;
+      }
+    defaultValue: '3'
+    visible_on: "{{'profile' === formData.type ? true: false}}"
+  max_login_attempts:
+    type: select
+    label: 最大无效登录尝试次数
+    group: profile password policy
+    firstOption: false
+    required: true
+    options:
+      - label: '3'
+        value: '3'
+      - label: '5'
+        value: '5'
+      - label: '10'
+        value: '10'
+      - label: '无限制'
+        value: '0'
+    defaultValue: '10'
+    visible_on: "{{'profile' === formData.type ? true: false}}"
+  lockout_interval:
+    type: select
+    group: profile password policy
+    label: 锁定有效期间
+    firstOption: false
+    required: true
+    options:
+      - label: '15 分钟'
+        value: '15'
+      - label: '30 分钟'
+        value: '30'
+      - label: '60 分钟'
+        value: '60'
+      - label: '始终(必须由管理员重置)'
+        value: '0'
+    defaultValue: '15'
+    visible_on: "{{'profile' === formData.type ? true: false}}"
+  enable_MFA:
+    type: boolean
+    label: 多重身份验证(需要开启短信服务)
+    inlineHelpText: 密码登陆的基础上增加短信验证的两种组合的鉴别技术进行系统登陆.
+    sort_no: 1200
+    group: 登录策略
+    visible_on: "{{'profile' === formData.type ? true: false}}"
+  logout_other_clients: 
+    type: boolean
+    label: 单例登录
+    inlineHelpText: 注销以当前用户身份登录的其他客户端。
+    sort_no: 1100
+    group: 登录策略
+    visible_on: "{{'profile' === formData.type ? true: false}}"
+  login_expiration_in_days:
+    type: number
+    scale: 4
+    label: 登录到期时间(天)
+    sort_no: 1000
+    defaultValue: 90
+    group: 登录策略
+    visible_on: "{{'profile' === formData.type ? true: false}}"
+  phone_logout_other_clients: 
+    type: boolean
+    label: 手机App单例登录
+    inlineHelpText: 注销以当前用户身份登录的其他客户端。
+    sort_no: 1100
+    group: 登录策略
+    visible_on: "{{'profile' === formData.type ? true: false}}"
+  phone_login_expiration_in_days:
+    type: number
+    scale: 4
+    label: 手机App登录到期时间(天)
+    sort_no: 1000
+    defaultValue: 90
+    group: 登录策略
+    visible_on: "{{'profile' === formData.type ? true: false}}"
+list_views:
+  all:
+    label: All
+    filter_scope: space
+    columns:
+      - label
+      - name
+      - users
+      - type
+      - license
+      - is_system
+  permission_set:
+    label: Permission Set
+    filter_scope: space
+    filters:
+      - [["type", "=", "permission_set"]]
+    columns:
+      - label
+      - name
+      - users
+      - type
+      - license
+      - is_system
+  profile:
+    label: Profile
+    filter_scope: space
+    filters:
+      - [["type", "=", "profile"]]
+    columns:
+      - label
+      - name
+      - type
+      - license
+      - is_system
+actions:
+  customize:
+    label: Customize
+    on: record_only
+# relatedList:
+#   - objectName: permission_objects
+#     filters: !!js/function | 
+#       function(parentRecord) {
+#         return [["is_system","=",true], ["permission_set_id","=",parentRecord._id]]
+#       }
+#   - objectName: permission_objects
+#     filters: !!js/function | 
+#       function(parentRecord) {
+#         return [["is_system","<>",true], ["permission_set_id","=",parentRecord._id]]
+#       }
+permission_set:
+  user:
+    allowCreate: false
+    allowDelete: false
+    allowEdit: false
+    allowRead: false
+    modifyAllRecords: false
+    viewAllRecords: false
+  admin:
+    allowCreate: true
+    allowDelete: true
+    allowEdit: true
+    allowRead: true
+    modifyAllRecords: true
+    viewAllRecords: true
+  customer:
+    allowCreate: false
+    allowDelete: false
+    allowEdit: false
+    allowRead: false
+    modifyAllRecords: false
+    viewAllRecords: false
+form:
+  initialValues: !!js/function |
+    function(){
+      var listView = Creator.getListView();
+      if(listView && listView.name === 'profile'){
+        return {type: 'profile'}
+      }
+      return {}
+    }
+  beforeEdit: !!js/function |
+    function(){
+      Steedos.PermissionSetManager.changeSchema(this.doc, this.schema);
+    }
+  afterEdit: !!js/function |
+    function(){
+      Steedos.PermissionSetManager.changeSchema(this.doc, this.schema);
+    }
+  beforeView: !!js/function |
+    function(){
+      Steedos.PermissionSetManager.changeSchema(this.doc, this.schema);
+    }
+  beforeInsert: !!js/function |
+    function(){
+      if(this.doc && _.isString(this.doc.users)){
+        this.doc.users = this.doc.users.split(',');
+      }
+    }
+  beforeUpdate: !!js/function |
+    function(){
+      if(this.doc && _.isString(this.doc.users)){
+        this.doc.users = this.doc.users.split(',');
+      }
+    }

package/main/default/objects/permission_shares.object.js

@@ -0,0 +1,57 @@
+const objectql = require('@steedos/objectql');
+
+Creator.Objects['permission_shares'].triggers = Object.assign({}, Creator.Objects['permission_shares'].triggers, {
+  "before.insert.server.sharing": {
+    on: "server",
+    when: "before.insert",
+    todo: function (userId, doc) {
+      if (_.isEmpty(doc.organizations) && _.isEmpty(doc.users)) {
+        throw new Meteor.Error(500, "请在授权组织或授权用户中至少填写一个值");
+      }
+    }
+  },
+  "before.update.server.sharing": {
+    on: "server",
+    when: "before.update",
+    todo: function (userId, doc, fieldNames, modifier, options) {
+      var errMsg;
+      errMsg = t("creator_permission_share_miss");
+      if (fieldNames.length === 1) {
+        if (fieldNames.indexOf("organizations") > -1) {
+          if (_.isEmpty(modifier.$set.organizations) && _.isEmpty(doc.users)) {
+            throw new Meteor.Error(500, errMsg);
+          }
+        } else if (fieldNames.indexOf("users") > -1) {
+          if (_.isEmpty(doc.organizations) && _.isEmpty(modifier.$set.users)) {
+            throw new Meteor.Error(500, errMsg);
+          }
+        }
+      } else if (_.isEmpty(modifier.$set.organizations) && _.isEmpty(modifier.$set.users)) {
+        throw new Meteor.Error(500, errMsg);
+      }
+    }
+  }
+})
+
+if(Meteor.isServer){
+  Meteor.startup(function() {
+    let objectName = 'permission_shares';
+    Creator.getCollection(objectName).find({}, {
+      fields: {
+        _id: 1,
+        object_name: 1,
+        filters: 1
+      }
+    }).observe({
+      added: function(doc){
+        objectql.addConfig(objectName, doc)
+      },
+      changed: function(doc){
+        objectql.addConfig(objectName, doc)
+      },
+      removed: function(doc){
+        objectql.removeConfig(objectName, doc)
+      }
+    })
+  });
+}

package/main/default/objects/permission_shares.object.yml

@@ -0,0 +1,63 @@
+name: permission_shares
+label: Permission Share
+icon: assigned_resource
+hidden: true
+fields:
+  name:
+    label: Name
+    type: text
+    required: true
+    searchable: true
+    index: true
+  object_name:
+    label: Object
+    type: lookup
+    multiple: true
+    optionsFunction: !<tag:yaml.org,2002:js/function> |- 
+      function () {
+        return Steedos.getObjectsOptions(function(o){
+          return o.enable_share
+        })
+      }
+    required: true
+    filterable: true
+  filters:
+    label: Filters
+    type: textarea
+    inlineHelpText: Format of OData Filters Required.
+    is_wide: true
+  organizations:
+    label: Departments
+    type: lookup
+    reference_to: organizations
+    multiple: true
+    defaultValue: []
+    filterable: true
+  users:
+    label: Users
+    type: lookup
+    reference_to: users
+    multiple: true
+    defaultValue: []
+    filterable: true
+list_views:
+  all:
+    label: All
+    filter_scope: space
+    columns:
+      - name
+permission_set:
+  user:
+    allowCreate: true
+    allowDelete: true
+    allowEdit: true
+    allowRead: true
+    modifyAllRecords: false
+    viewAllRecords: false
+  admin:
+    allowCreate: true
+    allowDelete: true
+    allowEdit: true
+    allowRead: true
+    modifyAllRecords: true
+    viewAllRecords: true

package/main/default/objects/restriction_rules.action.js

@@ -0,0 +1,25 @@
+const _ = require("underscore");
+module.exports = {
+    customize: function (object_name, record_id, fields) {
+        var doc = Creator.odata.get(object_name, record_id);
+        var newDoc = {}
+        _.each(Creator.getObject(object_name).fields, function (v, k) {
+            if (_.has(doc, k)) {
+                newDoc[k] = doc[k]
+            }
+        })
+        delete newDoc.is_system;
+
+        Creator.odata.insert(object_name, Object.assign(newDoc), function (result, error) {
+            if (result) {
+                FlowRouter.go(`/app/-/${object_name}/view/${result._id}`)
+            }
+        });
+    },
+    customizeVisible: function (object_name, record_id, record_permissions, record) {
+        if (!record) {
+            record = {}
+        }
+        return Creator.baseObject.actions.standard_new.visible() && record.is_system;
+    }
+}

package/main/default/objects/restriction_rules.object.yml

@@ -0,0 +1,82 @@
+name: restriction_rules
+label: 限制规则
+icon: filter_criteria
+version: 2
+fields:
+  name:
+    label: Api 名称
+    type: text
+    sort_no: 110
+    required: true
+  object_name:
+    type: lookup
+    label: 对象
+    reference_to: objects
+    write_requires_master_read: true
+    reference_to_field: name
+    required: true
+    optionsFunction: !<tag:yaml.org,2002:js/function> |-
+      function () {
+        return Steedos.getObjectsOptions();
+      }
+    sort_no: 120
+  active:
+    label: 启用
+    type: boolean
+    sort_no: 130
+  entry_criteria:
+    label: 指定条目条件
+    inlineHelpText: "满足此条件的时，使用该记录过滤器。语法为函数表达式, 例如: {{$user.profile !='user'}}"
+    type: textarea
+    is_wide: true
+    sort_no: 140
+    required: true
+  record_filter:
+    label: 记录过滤器
+    type: textarea
+    is_wide: true
+    sort_no: 150
+    required: true
+  description:
+    label: 描述
+    type: textarea
+    is_wide: true
+    sort_no: 160
+  is_system:
+    type: boolean
+    label: 系统
+    # omit: true
+    readonly: true
+    disabled: true
+    visible_on: "{{global.mode ==='read' ? true : false}}"
+actions:
+  customize:
+    label: 自定义
+    on: record
+list_views:
+  all:
+    label: All Roles
+    filter_scope: space
+    columns:
+      - name
+      - object_name
+      - active
+      - entry_criteria
+      - record_filter
+      - description
+      - is_system
+permission_set:
+  user:
+    allowCreate: false
+    allowDelete: false
+    allowEdit: false
+    allowRead: false
+    modifyAllRecords: false
+    viewAllRecords: false
+  admin:
+    allowCreate: true
+    allowDelete: true
+    allowEdit: true
+    allowRead: true
+    modifyAllRecords: true
+    viewAllRecords: true

package/main/default/objects/share_rules.action.js

@@ -0,0 +1,25 @@
+const _ = require("underscore");
+module.exports = {
+    customize: function (object_name, record_id, fields) {
+        var doc = Creator.odata.get(object_name, record_id);
+        var newDoc = {}
+        _.each(Creator.getObject(object_name).fields, function (v, k) {
+            if (_.has(doc, k)) {
+                newDoc[k] = doc[k]
+            }
+        })
+        delete newDoc.is_system;
+
+        Creator.odata.insert(object_name, Object.assign(newDoc), function (result, error) {
+            if (result) {
+                FlowRouter.go(`/app/-/${object_name}/view/${result._id}`)
+            }
+        });
+    },
+    customizeVisible: function (object_name, record_id, record_permissions, record) {
+        if (!record) {
+            record = {}
+        }
+        return Creator.baseObject.actions.standard_new.visible() && record.is_system;
+    }
+}

package/main/default/objects/share_rules.object.yml

@@ -0,0 +1,82 @@
+name: share_rules
+label: 共享规则
+icon: assigned_resource
+version: 2
+fields:
+  name:
+    label: Api 名称
+    type: text
+    sort_no: 110
+    required: true
+  object_name:
+    type: lookup
+    label: 对象
+    reference_to: objects
+    write_requires_master_read: true
+    reference_to_field: name
+    required: true
+    optionsFunction: !<tag:yaml.org,2002:js/function> |-
+      function () {
+        return Steedos.getObjectsOptions();
+      }
+    sort_no: 120
+  active:
+    label: 启用
+    type: boolean
+    sort_no: 130
+  entry_criteria:
+    label: 指定条目条件
+    inlineHelpText: "满足此条件的时，使用该记录过滤器。语法为函数表达式, 例如: {{$user.profile !='user'}}"
+    type: textarea
+    is_wide: true
+    sort_no: 140
+    required: true
+  record_filter:
+    label: 记录过滤器
+    type: textarea
+    is_wide: true
+    sort_no: 150
+    required: true
+  description:
+    label: 描述
+    type: textarea
+    is_wide: true
+    sort_no: 160
+  is_system:
+    type: boolean
+    label: 系统
+    # omit: true
+    readonly: true
+    disabled: true
+    visible_on: "{{global.mode ==='read' ? true : false}}"
+actions:
+  customize:
+    label: 自定义
+    on: record
+list_views:
+  all:
+    label: All Roles
+    filter_scope: space
+    columns:
+      - name
+      - object_name
+      - active
+      - entry_criteria
+      - record_filter
+      - description
+      - is_system
+permission_set:
+  user:
+    allowCreate: false
+    allowDelete: false
+    allowEdit: false
+    allowRead: false
+    modifyAllRecords: false
+    viewAllRecords: false
+  admin:
+    allowCreate: true
+    allowDelete: true
+    allowEdit: true
+    allowRead: true
+    modifyAllRecords: true
+    viewAllRecords: true