@stoker-platform/cli 0.5.138 → 0.5.139

package/lib/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stoker-platform/cli",
-    "version": "0.5.137",
+    "version": "0.5.138",
     "type": "module",
     "license": "SEE LICENSE IN LICENSE.md",
     "main": "./lib/src/main.js",
@@ -24,9 +24,9 @@
         "@google-cloud/secret-manager": "^6.1.2",
         "@google-cloud/storage": "^7.19.0",
         "@inquirer/prompts": "^8.5.2",
-        "@stoker-platform/node-client": "0.5.86",
-        "@stoker-platform/types": "0.5.64",
-        "@stoker-platform/utils": "0.5.77",
+        "@stoker-platform/node-client": "0.5.87",
+        "@stoker-platform/types": "0.5.65",
+        "@stoker-platform/utils": "0.5.78",
         "algoliasearch": "^5.53.0",
         "commander": "^15.0.0",
         "cross-spawn": "^7.0.6",

package/lib/src/lint/lintSchema.js

@@ -204,11 +204,8 @@ export const lintSchema = async (noLog = false) => {
                 if (!groupKeyRegex.test(groupKey)) {
                     errors.push(`Collection ${collectionName} has a field access group key ${groupKey} that is invalid. Keys must start with a letter and contain only letters, digits and hyphens.`);
                 }
-                if (fieldNames.includes(groupKey)) {
-                    errors.push(`Collection ${collectionName} has a field access group key ${groupKey} that collides with a field name`);
-                }
-                if (roles.includes(groupKey)) {
-                    errors.push(`Collection ${collectionName} has a field access group key ${groupKey} that collides with a role name`);
+                if (/-\d+$/.test(groupKey)) {
+                    errors.push(`Collection ${collectionName} has a field access group key ${groupKey} that ends with a hyphen followed by digits.`);
                 }
                 // eslint-disable-next-line security/detect-object-injection
                 if (!groupFields[groupKey]?.length) {

package/lib/src/lint/securityReport.js

@@ -1,5 +1,5 @@
 import { generateSchema } from "../deploy/schema/generateSchema.js";
-import { getAccessFields, getField, getDependencyIndexFields, getFieldAccessGroupFields, getFieldAccessGroupIndexFields, getRoleFields, isDependencyField, isRelationField, getRoleGroups, getFieldCustomization, roleHasOperationAccess, } from "@stoker-platform/utils";
+import { getAccessFields, getField, getDependencyIndexFields, getFieldAccessGroupFields, getFieldAccessGroupIndexFields, isDependencyField, isRelationField, getRoleGroups, getFieldCustomization, roleHasOperationAccess, } from "@stoker-platform/utils";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 /* eslint-disable security/detect-object-injection */
@@ -27,15 +27,20 @@ export const securityReport = async () => {
         writeRuleReads[collectionName].batch.add("User Document Lookup");
         writeRuleReads[collectionName].batch.add("Latest Deploy Document");
         writeRuleReads[collectionName].batch.add("Maintenance Mode Document");
-        const roleGroups = getRoleGroups(collectionSchema, schema);
+        const roleGroups = Array.from(getRoleGroups(collectionSchema, schema));
         roleGroups.forEach(() => {
             writeRuleReads[collectionName].batch.add("Main Document");
         });
         const fieldAccessGroups = getFieldAccessGroupFields(collectionSchema);
-        Object.values(fieldAccessGroups).forEach((groupFields) => {
+        Object.entries(fieldAccessGroups).forEach(([groupKey, groupFields]) => {
             if (groupFields.length === 0)
                 return;
-            writeRuleReads[collectionName].batch.add(`Main Document`);
+            for (const roleGroup of roleGroups) {
+                const overlayFields = getFieldAccessGroupIndexFields(groupKey, collectionSchema, roleGroup);
+                if (overlayFields.length === 0)
+                    continue;
+                writeRuleReads[collectionName].batch.add("Main Document");
+            }
         });
         if (auth) {
             writeRuleReads[collectionName].main.add("Document Lock Lookup");
@@ -154,34 +159,6 @@ export const securityReport = async () => {
                     }
                 }
             }
-            if (roleHasOperationAccess(collectionSchema, role, "read")) {
-                const fieldAccessGroups = getFieldAccessGroupFields(collectionSchema);
-                const roleFields = getRoleFields(collectionSchema, role);
-                const roleFieldNames = new Set(roleFields.map((field) => field.name));
-                for (const [groupKey, groupFields] of Object.entries(fieldAccessGroups)) {
-                    if (groupFields.length === 0)
-                        continue;
-                    // eslint-disable-next-line security/detect-object-injection
-                    if (!collectionSchema.fieldAccessGroups?.[groupKey]?.applicableRoles.includes(role))
-                        continue;
-                    const groupFieldNames = new Set(groupFields.map((field) => field.name));
-                    const overlayFields = getFieldAccessGroupIndexFields(groupKey, collectionSchema);
-                    for (const overlayField of overlayFields) {
-                        if (overlayField.name === "id" || overlayField.name === "Collection_Path") {
-                            continue;
-                        }
-                        if (groupFieldNames.has(overlayField.name))
-                            continue;
-                        if (roleFieldNames.has(overlayField.name))
-                            continue;
-                        roles[role][collectionName] ||= {};
-                        if (!roles[role][collectionName][overlayField.name]) {
-                            roles[role][collectionName][overlayField.name] = new Set();
-                        }
-                        roles[role][collectionName][overlayField.name].add(`Field Access Group ${groupKey}- Index`);
-                    }
-                }
-            }
         }
     }
     console.log("Security Rule Write Reads:\n");
@@ -212,7 +189,6 @@ export const securityReport = async () => {
         console.log("\n");
     }
     console.log("\n\nPossible Excess Permissions:\n");
-    console.log("(Includes fields on field access group overlays that are not on the role's mirror, after filtering overlay metadata to the roles declared on each field access group.)\n");
     for (const [role, collections] of Object.entries(roles)) {
         console.log(`${role.toUpperCase()}\n`);
         for (const [collection, fields] of Object.entries(collections)) {

package/lib/src/ops/auditDenormalized.js

@@ -1,5 +1,5 @@
 import { fetchCurrentSchema, initializeStoker, getStokerFirestore } from "@stoker-platform/node-client";
-import { getDependencyIndexFields, getFieldAccessGroupFields, getFieldAccessGroupIndexFields, getLowercaseFields, getRoleGroups, getSingleFieldRelations, isDependencyField, isRelationField, } from "@stoker-platform/utils";
+import { getDependencyIndexFields, getFieldAccessGroupFields, getFieldAccessGroupIndexFields, getFieldAccessGroupKey, getLowercaseFields, getRoleGroups, getSingleFieldRelations, isDependencyField, isRelationField, } from "@stoker-platform/utils";
 import { join } from "node:path";
 import isEqual from "lodash/isEqual.js";
 import isEmpty from "lodash/isEmpty.js";
@@ -121,57 +121,62 @@ export const auditDenormalized = async (options) => {
         for (const [groupKey, groupFields] of Object.entries(fieldAccessGroups)) {
             if (groupFields.length === 0)
                 continue;
-            const overlayIndexFields = getFieldAccessGroupIndexFields(groupKey, collectionSchema);
-            const overlaySnapshot = await db
-                .collection("tenants")
-                .doc(options.tenant)
-                .collection("system_fields")
-                .doc(collectionName)
-                .collection(`${collectionName}-${groupKey}`)
-                .get();
-            const overlayIds = new Set();
-            const lowercaseFields = getLowercaseFields(collectionSchema, overlayIndexFields);
-            const lowercaseFieldNames = Array.from(lowercaseFields).map((field) => field.name);
-            overlaySnapshot.forEach((overlay) => {
-                overlayIds.add(overlay.id);
-                const overlayData = overlay.data();
-                for (const indexField of overlayIndexFields) {
-                    if (indexField.name === "Collection_Path_String")
-                        continue;
-                    if (isRelationField(indexField)) {
-                        const overlayValue = {
-                            [indexField.name]: overlayData[indexField.name],
-                            [`${indexField.name}_Array`]: overlayData[`${indexField.name}_Array`],
-                        };
-                        const collectionValue = {
-                            [indexField.name]: collectionData[overlay.id]?.[indexField.name],
-                            [`${indexField.name}_Array`]: collectionData[overlay.id]?.[`${indexField.name}_Array`],
-                        };
-                        if (singleFieldRelationNames.includes(indexField.name)) {
-                            overlayValue[`${indexField.name}_Single`] = overlayData[`${indexField.name}_Single`];
-                            collectionValue[`${indexField.name}_Single`] =
-                                collectionData[overlay.id]?.[`${indexField.name}_Single`];
-                        }
-                        if (!isEqual(overlayValue, collectionValue)) {
-                            console.log(`${collectionName} ${overlay.id} Field Access Group ${groupKey}: ${indexField.name} - ${JSON.stringify(overlayValue)} !== ${JSON.stringify(collectionValue)}`);
+            for (const roleGroup of roleGroups) {
+                const overlayIndexFields = getFieldAccessGroupIndexFields(groupKey, collectionSchema, roleGroup);
+                if (overlayIndexFields.length === 0)
+                    continue;
+                const overlayKey = getFieldAccessGroupKey(groupKey, roleGroup.key);
+                const overlaySnapshot = await db
+                    .collection("tenants")
+                    .doc(options.tenant)
+                    .collection("system_fields")
+                    .doc(collectionName)
+                    .collection(`${collectionName}-${overlayKey}`)
+                    .get();
+                const overlayIds = new Set();
+                const lowercaseFields = getLowercaseFields(collectionSchema, overlayIndexFields);
+                const lowercaseFieldNames = Array.from(lowercaseFields).map((field) => field.name);
+                overlaySnapshot.forEach((overlay) => {
+                    overlayIds.add(overlay.id);
+                    const overlayData = overlay.data();
+                    for (const indexField of overlayIndexFields) {
+                        if (indexField.name === "Collection_Path_String")
+                            continue;
+                        if (isRelationField(indexField)) {
+                            const overlayValue = {
+                                [indexField.name]: overlayData[indexField.name],
+                                [`${indexField.name}_Array`]: overlayData[`${indexField.name}_Array`],
+                            };
+                            const collectionValue = {
+                                [indexField.name]: collectionData[overlay.id]?.[indexField.name],
+                                [`${indexField.name}_Array`]: collectionData[overlay.id]?.[`${indexField.name}_Array`],
+                            };
+                            if (singleFieldRelationNames.includes(indexField.name)) {
+                                overlayValue[`${indexField.name}_Single`] = overlayData[`${indexField.name}_Single`];
+                                collectionValue[`${indexField.name}_Single`] =
+                                    collectionData[overlay.id]?.[`${indexField.name}_Single`];
+                            }
+                            if (!isEqual(overlayValue, collectionValue)) {
+                                console.log(`${collectionName} ${overlay.id} Field Access Group ${overlayKey}: ${indexField.name} - ${JSON.stringify(overlayValue)} !== ${JSON.stringify(collectionValue)}`);
+                            }
                         }
-                    }
-                    else {
-                        const overlayValue = overlayData[indexField.name];
-                        const collectionValue = collectionData[overlay.id]?.[indexField.name];
-                        if (!isEqual(overlayValue, collectionValue)) {
-                            console.log(`${collectionName} ${overlay.id} Field Access Group ${groupKey}: ${indexField.name} - ${JSON.stringify(overlayValue)} !== ${JSON.stringify(collectionValue)}`);
+                        else {
+                            const overlayValue = overlayData[indexField.name];
+                            const collectionValue = collectionData[overlay.id]?.[indexField.name];
+                            if (!isEqual(overlayValue, collectionValue)) {
+                                console.log(`${collectionName} ${overlay.id} Field Access Group ${overlayKey}: ${indexField.name} - ${JSON.stringify(overlayValue)} !== ${JSON.stringify(collectionValue)}`);
+                            }
                         }
-                    }
-                    if (lowercaseFieldNames.includes(indexField.name)) {
-                        const overlayValue = overlayData[`${indexField.name}_Lowercase`];
-                        const collectionValue = collectionData[overlay.id]?.[`${indexField.name}_Lowercase`];
-                        if (!isEqual(overlayValue, collectionValue)) {
-                            console.log(`${collectionName} ${overlay.id} Field Access Group ${groupKey}: ${indexField.name}_Lowercase - ${JSON.stringify(overlayValue)} !== ${JSON.stringify(collectionValue)}`);
+                        if (lowercaseFieldNames.includes(indexField.name)) {
+                            const overlayValue = overlayData[`${indexField.name}_Lowercase`];
+                            const collectionValue = collectionData[overlay.id]?.[`${indexField.name}_Lowercase`];
+                            if (!isEqual(overlayValue, collectionValue)) {
+                                console.log(`${collectionName} ${overlay.id} Field Access Group ${overlayKey}: ${indexField.name}_Lowercase - ${JSON.stringify(overlayValue)} !== ${JSON.stringify(collectionValue)}`);
+                            }
                         }
                     }
-                }
-            });
+                });
+            }
         }
         console.log(`${collectionName} audited.\n`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stoker-platform/cli",
-    "version": "0.5.138",
+    "version": "0.5.139",
     "type": "module",
     "license": "SEE LICENSE IN LICENSE.md",
     "main": "./lib/src/main.js",
@@ -24,9 +24,9 @@
         "@google-cloud/secret-manager": "^6.1.2",
         "@google-cloud/storage": "^7.19.0",
         "@inquirer/prompts": "^8.5.2",
-        "@stoker-platform/node-client": "0.5.87",
+        "@stoker-platform/node-client": "0.5.88",
         "@stoker-platform/types": "0.5.65",
-        "@stoker-platform/utils": "0.5.78",
+        "@stoker-platform/utils": "0.5.79",
         "algoliasearch": "^5.53.0",
         "commander": "^15.0.0",
         "cross-spawn": "^7.0.6",