@steedos/standard-permission 2.2.55-beta.16

package/main/default/routes/copyProfile.router.js

@@ -0,0 +1,113 @@
+/*
+ * @Author: sunhaolin@hotoa.com
+ * @Date: 2022-05-26 16:56:54
+ * @LastEditors: sunhaolin@hotoa.com
+ * @LastEditTime: 2022-05-26 19:28:09
+ * @Description: 复制已有简档来创建新简档
+ */
+'use strict';
+// @ts-check
+
+const express = require("express");
+const router = express.Router();
+const core = require('@steedos/core');
+const objectql = require('@steedos/objectql');
+
+/**
+ * body {
+ *  originalPermissionSetId: "", // 已有简档的id
+ *  name: "", // 新简档的名称
+ *  label: "", // 新简档的标签
+ * }
+ */
+router.post('/api/permission/permission_set/copy', core.requireAuthentication, async function (req, res) {
+    try {
+        const userSession = req.user;
+        const { userId, spaceId, company_id } = userSession;
+
+        const { originalPermissionSetId, name, label } = req.body;
+        if (!originalPermissionSetId) {
+            throw new Error("originalPermissionSetId is required");
+        }
+        if (!name) {
+            throw new Error("name is required");
+        }
+        if (!label) {
+            throw new Error("label is required");
+        }
+
+        const psObj = objectql.getObject('permission_set');
+        const poObj = objectql.getObject('permission_objects');
+        const pfObj = objectql.getObject('permission_fields');
+
+        const originalPermissionSet = await psObj.findOne(originalPermissionSetId, {}, userSession);
+        if (!originalPermissionSet) {
+            throw new Error("permission_set not found");
+        }
+        // 校验简档是否是简档profile类型
+        if (originalPermissionSet.type !== 'profile') {
+            throw new Error("permission_set is not profile type");
+        }
+
+        // 基础信息
+        const baseInfo = {
+            created: new Date(),
+            created_by: userId,
+            modified: new Date(),
+            modified_by: userId,
+            space: spaceId,
+            company_id: company_id
+        };
+
+        // 创建新简档
+        delete originalPermissionSet._id;
+        const newPermissionSet = await psObj.insert({
+            ...originalPermissionSet,
+            ...baseInfo,
+            name,
+            label
+        });
+
+        // 创建对象权限
+        if (newPermissionSet) {
+            const orininalPermissionSetName = originalPermissionSet.name;
+            const { _id: newPermissionSetId, name: newPermissionSetName } = newPermissionSet;
+            const originalPermissionObjects = await poObj.find({ filters: [['space', '=', spaceId], ['permission_set_id', '=', originalPermissionSetId]] }, userSession);
+            // 遍历原有的对象权限
+            for (const poDoc of originalPermissionObjects) {
+                // 创建新的对象权限
+                delete poDoc._id;
+                const newPermissionObject = await poObj.insert({
+                    ...poDoc,
+                    ...baseInfo,
+                    permission_set_id: newPermissionSetId,
+                });
+                // 创建新的字段权限
+                // 由于 15.permission_objects.observe.object.js 中的 _change 函数中，调用了 permission_fields.resetFieldPermissions 方法，会自动创建新的字段权限，为防止重复创建故这里不手动创建
+                // if (newPermissionObject) {
+                //     const newPermissionObjectName = newPermissionObject.name;
+                //     const originalPermissionFields = await pfObj.find({ filters: [['space', '=', spaceId], ['permission_set_id', '=', orininalPermissionSetName], ['permission_object', '=', poDoc.name]] }, userSession);
+                //     // 遍历原有的字段权限
+                //     for (const pfDoc of originalPermissionFields) {
+                //         // 创建新的字段权限
+                //         delete pfDoc._id;
+                //         const newPermissionField = await pfObj.insert({
+                //             ...pfDoc,
+                //             ...baseInfo,
+                //             permission_set_id: newPermissionSetName,
+                //             permission_object_id: newPermissionObjectName
+                //         });
+                //     }
+                // }
+            }
+
+        }
+
+        res.status(200).send({ message: 'success' });
+    } catch (error) {
+        console.error(error);
+        res.status(500).send({ error: error.message });
+    }
+
+});
+exports.default = router;

package/main/default/server/permission_set.object.js

@@ -0,0 +1,130 @@
+var _ = require("underscore");
+function checkType(name, type){
+    if(_.include(['admin','user','supplier','customer'], name) && type != 'profile'){
+        throw new Meteor.Error(500, "API名称为admin,user,supplier,customer时，类别必须为简档");
+    }
+}
+
+Creator.Objects['permission_set'].triggers = Object.assign({}, Creator.Objects['permission_set'].triggers,{
+    "before.insert.server.check": {
+        on: "server",
+        when: "before.insert",
+        todo: function (userId, doc) {
+            var newName;
+            // console.log "before.insert.server.check,doc:", doc
+            newName = doc != null ? doc.name : void 0;
+            if (newName && Creator.getCollection("permission_set").findOne({
+                space: doc.space,
+                name: newName
+            }, {
+                    fields: {
+                        name: 1
+                    }
+                })) {
+                throw new Meteor.Error(500, "API名称不能重复");
+            }
+            checkType(doc.name, doc.type);
+            if(doc.type === 'profile'){
+                if(!doc.license){
+                    // throw new Meteor.Error(500, "请指定许可证");
+                }else{
+                    if(_.indexOf(_.pluck(Steedos.getLicenseOptionsSync(doc.space), 'value'), doc.license) < 0){
+                        throw new Meteor.Error(500, "无效的许可证");
+                    }
+                }
+            }
+
+            if(doc.license){
+                if(_.indexOf(_.pluck(Steedos.getLicenseOptionsSync(doc.space), 'value'), doc.license) < 0){
+                    throw new Meteor.Error(500, "无效的许可证");
+                }
+            }
+
+            if(doc.type === 'profile'){
+                delete doc.users
+            }
+        }
+    },
+    "before.update.server.check": {
+        on: "server",
+        when: "before.update",
+        todo: function (userId, doc, fieldNames, modifier, options) {
+            var newName, ref;
+            newName = (ref = modifier.$set) != null ? ref.name : void 0;
+            if (newName && Creator.getCollection("permission_set").findOne({
+                space: doc.space,
+                name: newName,
+                _id: {
+                    $ne: doc._id
+                }
+            }, {
+                    fields: {
+                        name: 1
+                    }
+                })) {
+                throw new Meteor.Error(500, "API名称不能重复");
+            }
+
+            var set = modifier.$set || {}
+            if(_.has(set, 'name') || _.has(set, 'type')){
+                checkType(set.name || doc.name, set.type || doc.type);
+            }
+
+            if(_.has(set, 'type') || _.has(set, 'users')){
+                var type = set.type || doc.type;
+                var users = set.users || doc.users
+                if(type === 'profile'){
+                    if(_.has(set, 'users')){
+                        modifier.$set.users = []
+                    }else{
+                        if(!modifier.$unset){
+                            modifier.$unset = {}  
+                        }
+                        modifier.$unset.users = 1
+                    }
+                }
+            }
+            var unset = modifier.$unset || {}
+            if((_.has(set, 'license') && set.license != doc.license)){
+                throw new Meteor.Error(500, '禁止修改许可证');
+                // let _type = set.type || doc.type;
+                // if(_type === 'profile'){
+                //     if(!set.license){
+                //         throw new Meteor.Error(500, "请指定许可证");
+                //     }else{
+                        
+                //         if(_.indexOf(_.pluck(Steedos.getLicenseOptionsSync(doc.space), 'value'), set.license) < 0){
+                //             throw new Meteor.Error(500, "无效的许可证");
+                //         }
+                //     }
+                // }
+            }
+        }
+    },
+    "after.update.server.syncSpaceUserProfile": {
+        on: "server",
+        when: "after.update",
+        todo: function(userId, doc, fieldNames, modifier, options){
+            modifier.$set = modifier.$set || {}
+            if(doc.type === 'profile' && _.has(modifier.$set, 'name') && modifier.$set.name != this.previous.name){
+                if(doc.space){
+                    db.space_users.update({space: doc.space, profile: this.previous.name}, {$set: {profile: doc.name}}, {
+                        multi: true
+                    });
+                }
+            }
+        }
+    },
+    "before.remove.server.check": {
+        on: "server",
+        when: "before.remove",
+        todo: function (userId, doc) {
+            var documents, object_collections;
+            console.log('permission_objects', {permission_set_id: doc._id, space: doc.space});
+            var pero= Creator.getCollection("permission_objects").find({permission_set_id: doc._id, space: doc.space}, {fields:{_id:1}});
+            if (pero.count() > 0) {
+                throw new Meteor.Error(500, `此记录已在对象权限中引用`);
+            }
+        }
+    }
+})

package/main/default/triggers/permission_fields.trigger.js

@@ -0,0 +1,94 @@
+const objectql = require('@steedos/objectql');
+const auth = require('@steedos/auth');
+const clone = require('clone');
+const _ = require('underscore');
+const readonlyFields = ['created', 'created_by', 'modified', 'modified_by'];
+
+async function getAll() {
+    const schema = objectql.getSteedosSchema();
+    const configs = await objectql.registerPermissionFields.getAll(schema.broker)
+    const dataList = _.pluck(configs, 'metadata');
+
+    _.each(dataList, function (item) {
+        if (!item._id) {
+            item._id = `${item.name}`
+        }
+    })
+    return dataList;
+}
+
+async function get(apiName) {
+    const schema = objectql.getSteedosSchema();
+    const config = await objectql.registerPermissionFields.get(schema.broker, apiName)
+    return config ? config.metadata : null;
+}
+
+module.exports = {
+    listenTo: 'permission_fields',
+    beforeInsert: async function(){
+        const { doc } = this;
+        if(_.include(readonlyFields, doc.field)){
+            doc.editable = false;
+        }
+        if(doc.editable){
+            doc.readable = true;
+        }
+    },
+    beforeUpdate: async function(){
+        const { doc } = this;
+        if(_.include(readonlyFields, doc.field)){
+            doc.editable = false;
+        }
+        if(doc.editable){
+            doc.readable = true;
+        }
+    },
+    beforeFind: async function () {
+        delete this.query.fields;
+    },
+
+    beforeAggregate: async function () {
+        delete this.query.fields;
+    },
+    afterFind: async function () {
+        let spaceId = this.spaceId;
+        let dataList = await getAll();
+        const values = clone(this.data.values);
+        _.each(dataList, (item) => {
+            if (!_.find(this.data.values, (value) => {
+                return value._id === item._id || item.name === value.name
+            })) {
+                values.push(item)
+            }
+        })
+        this.data.values = objectql.getSteedosSchema().metadataDriver.find(values, this.query, spaceId);
+
+    },
+    afterAggregate: async function () {
+        let spaceId = this.spaceId;
+        let dataList = await getAll();
+        const values = clone(this.data.values);
+        _.each(dataList, (item) => {
+            if (!_.find(this.data.values, (value) => {
+                return value._id === item._id || item.name === value.name
+            })) {
+                values.push(item)
+            }
+        })
+        this.data.values = objectql.getSteedosSchema().metadataDriver.find(values, this.query, spaceId);
+
+    },
+    afterCount: async function () {
+        let result = await objectql.getObject(this.object_name).find(this.query, await auth.getSessionByUserId(this.userId, this.spaceId))
+        this.data.values = result.length;
+    },
+    afterFindOne: async function () {
+        if (_.isEmpty(this.data.values)) {
+            let id = this.id
+            let data = await get(id);
+            if (data) {
+                this.data.values = data;
+            }
+        }
+    }
+}

package/main/default/triggers/permission_objects.trigger.js

@@ -0,0 +1,159 @@
+const _ = require('underscore');
+const objectql = require("@steedos/objectql");
+const InternalData = require('@steedos/standard-objects').internalData;
+const auth = require("@steedos/auth");
+
+const permissions = {
+    allowEdit: false,
+    allowDelete: false,
+    allowRead: true,
+}
+
+const baseRecord = {
+    is_system:true,
+    record_permissions:permissions
+}
+
+const getInternalPermissionObjects = async function(){
+    let objectsPermissions = [];
+    const datasources = objectql.getSteedosSchema().getDataSources();
+    for (const datasourceName in datasources) {
+        let datasource = datasources[datasourceName];
+        let datasourceObjects = await datasource.getObjects();
+        _.each(datasourceObjects, function(object) {
+          const objectJSON  = object.metadata;
+          const objectName = objectJSON.name;
+          if(!objectJSON._id && !objectJSON.hidden && !_.include(InternalData.hiddenObjects, objectName)){
+            let permission_set = objectJSON.permission_set
+            _.each(permission_set, function(v, code){
+                objectsPermissions.push(Object.assign({}, v, {_id: `${code}_${objectName}`, name: `${code}_${objectName}`, permission_set_id: code, object_name: objectName}, baseRecord))
+            })
+          }
+        });
+    }
+    return objectsPermissions;
+}
+
+
+const initPermissionSet = async function(doc, userId, spaceId){
+    const userSession = await auth.getSessionByUserId(userId, spaceId);
+    if(!doc.permission_set_id){
+        throw new Error('权限集不能为空')
+    }
+    
+    const permissionSet = await objectql.getObject('permission_set').findOne(doc.permission_set_id)
+    
+    if(!permissionSet){
+        throw new Error('无效的权限集')
+    }
+    
+    if(permissionSet._id === permissionSet.name){
+        const now = new Date();
+        const dbPermissionSet = await objectql.getObject('permission_set').insert({
+            name: permissionSet.name, 
+            label: permissionSet.label, 
+            type: permissionSet.type, 
+            license: permissionSet.license,
+            space: spaceId,
+            owner: userId,
+            created_by: userId,
+            created: now,
+            modified_by: userId,
+            modified: now,
+            company_id: userSession.company_id,
+            company_ids: userSession.company_ids
+        })
+        doc.permission_set_id = dbPermissionSet._id;
+    }
+} 
+
+module.exports = {
+    beforeFind: async function () {
+        delete this.query.fields;
+    },
+
+    beforeAggregate: async function () {
+        delete this.query.fields;
+    },
+
+    afterFind: async function(){
+        const { spaceId } = this;
+        let dataList = await getInternalPermissionObjects();
+        if (!_.isEmpty(dataList)) {
+            dataList.forEach((doc) => {
+                if (!_.find(this.data.values, (value) => {
+                    return value.name === doc.name
+                })) {
+                    this.data.values.push(doc);
+                }
+            })
+            const records = objectql.getSteedosSchema().metadataDriver.find(this.data.values, this.query, spaceId);
+            if (records.length > 0) {
+                this.data.values = records;
+            } else {
+                this.data.values.length = 0;
+            }
+        }
+
+    },
+    afterAggregate: async function(){
+        const { spaceId } = this;
+        let dataList = await getInternalPermissionObjects();
+        if (!_.isEmpty(dataList)) {
+            dataList.forEach((doc) => {
+                if (!_.find(this.data.values, (value) => {
+                    return value.name === doc.name
+                })) {
+                    this.data.values.push(doc);
+                }
+            })
+            const records = objectql.getSteedosSchema().metadataDriver.find(this.data.values, this.query, spaceId);
+            if (records.length > 0) {
+                this.data.values = records;
+            } else {
+                this.data.values.length = 0;
+            }
+        }
+    },
+    afterCount: async function(){
+        delete this.query.fields;
+        let result = await objectql.getObject(this.object_name).find(this.query, await auth.getSessionByUserId(this.userId, this.spaceId))
+        this.data.values = result.length;
+    },
+    afterFindOne: async function(){
+        if(_.isEmpty(this.data.values)){
+            const all = await getInternalPermissionObjects();
+            const id = this.id;
+            this.data.values = _.find(all, function(item){
+                return item._id === id
+            });
+        }
+    },
+    beforeInsert: async function(){
+        let doc = this.doc;
+        let existedCount = Creator.getCollection("permission_objects").direct.find({permission_set_id: doc.permission_set_id, object_name: doc.object_name, space: doc.space}).count()
+        if(existedCount > 0){
+            throw new Error("此对象已有权限对象记录")
+        }
+
+        await initPermissionSet(doc, this.userId, this.spaceId);
+
+        const permissionSet = await objectql.getObject('permission_set').findOne(doc.permission_set_id)
+        if(_.isEmpty(doc.name)){
+            doc.name = `${doc.object_name}.${permissionSet.name}`
+        }
+    },
+    beforeUpdate: async function () {
+        let oldDoc = Creator.getCollection("permission_objects").direct.findOne({_id: this.id})
+        let doc = this.doc;
+        let permission_set_id = doc.permission_set_id || oldDoc.permission_set_id
+        let object_name = doc.object_name || oldDoc.object_name
+        let space = oldDoc.space
+        let existedCount = Creator.getCollection("permission_objects").direct.find({permission_set_id: permission_set_id, object_name: object_name, space: space, _id: {$ne: this.id}}).count()
+        if(existedCount > 0){
+            throw new Error("此对象已有权限对象记录")
+        }
+
+        await initPermissionSet(Object.assign({permission_set_id: permission_set_id}, doc), this.userId, this.spaceId);
+    }
+}

package/main/default/triggers/permission_set.trigger.js

@@ -0,0 +1,89 @@
+const _ = require('underscore');
+const objectql = require('@steedos/objectql');
+const auth = require("@steedos/auth");
+
+
+const getSourcePermissionSets = async function(type){
+    switch (type) {
+        case 'permission_set':
+            return await objectql.getSourcePermissionsets();
+        case 'profile':
+            return await objectql.getSourceProfiles();
+        default:
+            return (await objectql.getSourceProfiles()).concat((await objectql.getSourcePermissionsets()));
+    }
+    
+}
+
+module.exports = {
+    beforeFind: async function () {
+        delete this.query.fields;
+    },
+
+    beforeAggregate: async function () {
+        delete this.query.fields;
+    },
+
+    afterFind: async function(){
+        let { spaceId } = this;
+        if(!spaceId){
+            spaceId = process.env.STEEDOS_CLOUD_SPACE_ID;
+        }
+        if(!spaceId){
+            const spaces = await objectql.getObject('spaces').find({});
+            if(spaces.length > 0 ){
+                spaceId = spaces[0]._id;
+            }
+        }
+        let dataList = await getSourcePermissionSets();
+        if (!_.isEmpty(dataList)) {
+            dataList.forEach((doc) => {
+                if (!_.find(this.data.values, (value) => {
+                    return value.name === doc.name
+                })) {
+                    this.data.values.push(doc);
+                }
+            })
+            const records = objectql.getSteedosSchema().metadataDriver.find(this.data.values, this.query, spaceId);
+            if (records.length > 0) {
+                this.data.values = records;
+            } else {
+                this.data.values.length = 0;
+            }
+        }
+
+    },
+    afterAggregate: async function(){
+        const { spaceId } = this;
+        let dataList = await getSourcePermissionSets();
+        if (!_.isEmpty(dataList)) {
+            dataList.forEach((doc) => {
+                if (!_.find(this.data.values, (value) => {
+                    return value.name === doc.name
+                })) {
+                    this.data.values.push(doc);
+                }
+            })
+            const records = objectql.getSteedosSchema().metadataDriver.find(this.data.values, this.query, spaceId);
+            if (records.length > 0) {
+                this.data.values = records;
+            } else {
+                this.data.values.length = 0;
+            }
+        }
+    },
+    afterCount: async function(){
+        delete this.query.fields;
+        let result = await objectql.getObject(this.object_name).find(this.query, await auth.getSessionByUserId(this.userId, this.spaceId))
+        this.data.values = result.length;
+    },
+    afterFindOne: async function(){
+        if(_.isEmpty(this.data.values)){
+            const all = await getSourcePermissionSets();
+            const id = this.id;
+            this.data.values = _.find(all, function(item){
+                return item._id === id
+            });
+        }
+    }
+}

package/main/default/triggers/restriction_rules.trigger.js

@@ -0,0 +1,67 @@
+const objectql = require('@steedos/objectql');
+const auth = require('@steedos/auth');
+const _ = require('underscore');
+const clone = require('clone');
+async function getAll() {
+    const schema = objectql.getSteedosSchema();
+    const configs = await objectql.registerRestrictionRules.getAll(schema.broker)
+    const dataList = _.pluck(configs, 'metadata');
+
+    _.each(dataList, function (item) {
+        if (!item._id) {
+            item._id = `${item.object_name}.${item.name}`
+        }
+    })
+    return dataList;
+}
+
+async function get(apiName) {
+    const schema = objectql.getSteedosSchema();
+    const config = await objectql.registerRestrictionRules.get(schema.broker, apiName)
+    return config ? Object.assign(config.metadata, { _id: config.metadata._id || `${config.metadata.object_name}.${config.metadata.name}` }) : null;
+}
+
+module.exports = {
+    listenTo: 'restriction_rules',
+
+    afterFind: async function () {
+        let spaceId = this.spaceId;
+        let dataList = await getAll();
+        const values = clone(this.data.values);
+        _.each(dataList, (item) => {
+            if (!_.find(this.data.values, (value) => {
+                return value._id === item._id
+            })) {
+                values.push(item)
+            }
+        })
+        this.data.values = objectql.getSteedosSchema().metadataDriver.find(values, this.query, spaceId);
+    },
+    afterAggregate: async function () {
+        let spaceId = this.spaceId;
+        let dataList = await getAll();
+        const values = clone(this.data.values);
+        _.each(dataList, (item) => {
+            if (!_.find(this.data.values, (value) => {
+                return value._id === item._id
+            })) {
+                values.push(item)
+            }
+        })
+        this.data.values = objectql.getSteedosSchema().metadataDriver.find(values, this.query, spaceId);
+
+    },
+    afterCount: async function () {
+        let result = await objectql.getObject(this.object_name).find(this.query, await auth.getSessionByUserId(this.userId, this.spaceId))
+        this.data.values = result.length;
+    },
+    afterFindOne: async function () {
+        if (_.isEmpty(this.data.values)) {
+            let id = this.id
+            let data = await get(id);
+            if (data) {
+                this.data.values = data;
+            }
+        }
+    }
+}

package/main/default/triggers/restriction_rules_api_name.trigger.js

@@ -0,0 +1,30 @@
+/*
+ * @Author: sunhaolin@hotoa.com
+ * @Date: 2021-12-27 10:49:33
+ * @LastEditors: sunhaolin@hotoa.com
+ * @LastEditTime: 2022-07-30 13:22:03
+ * @Description: 
+ */
+const util = require('@steedos/standard-objects').util;
+const _ = require('lodash');
+const objectql = require('@steedos/objectql');
+module.exports = {
+    listenTo: 'restriction_rules',
+
+    beforeInsert: async function () {
+        const { object_name, doc } = this;
+        await util.checkAPIName(object_name, 'name', doc.name, undefined, [['is_system', '!=', true], ['object_name', '=', doc.object_name]]);
+    },
+
+    beforeUpdate: async function () {
+        const oldDoc = await objectql.getObject(this.object_name).findOne(this.id)
+        let name = oldDoc.name, object_name = oldDoc.object_name;
+        if (_.has(this.doc, 'name')) {
+            name = this.doc.name
+        }
+        if (_.has(this.doc, 'object_name')) {
+            object_name = this.doc.object_name
+        }
+        await util.checkAPIName(this.object_name, 'name', name, this.id, [['is_system', '!=', true], ['object_name', '=', object_name]]);
+    }
+}