@stoker-platform/utils 0.5.77 → 0.5.78

package/lib/src/access/collection.d.ts

@@ -3,7 +3,7 @@ export declare const collectionAuthAccess: (permissions: CollectionPermissions)
 export declare const collectionAccess: (operation: "Read" | "Create" | "Update" | "Delete", permissions: CollectionPermissions) => boolean | undefined;
 export declare const collectionSomeWriteAccess: (permissions: CollectionPermissions) => boolean | undefined;
 export declare const collectionAllWriteAccess: (permissions: CollectionPermissions) => boolean | undefined;
-export declare const privateFieldAccess: (field: CollectionField, permissions?: StokerPermissions) => boolean | undefined;
-export declare const restrictCreateAccess: (field: CollectionField, permissions?: StokerPermissions) => boolean;
-export declare const restrictUpdateAccess: (field: CollectionField, permissions?: StokerPermissions) => boolean;
-export declare const canUpdateField: (collection: CollectionSchema, field: CollectionField, permissions: StokerPermissions) => boolean | undefined;
+export declare const privateFieldAccess: (field: CollectionField, permissions?: StokerPermissions, collection?: CollectionSchema, claims?: Record<string, unknown>) => boolean | undefined;
+export declare const restrictCreateAccess: (field: CollectionField, permissions?: StokerPermissions, collectionName?: string, claims?: Record<string, unknown>) => boolean;
+export declare const restrictUpdateAccess: (field: CollectionField, permissions?: StokerPermissions, collectionName?: string, claims?: Record<string, unknown>) => boolean;
+export declare const canUpdateField: (collection: CollectionSchema, field: CollectionField, permissions: StokerPermissions, claims: Record<string, unknown>) => boolean | undefined;

package/lib/src/access/collection.js

@@ -1,3 +1,4 @@
+import { evaluateFieldAccessCondition, fieldAccessGroupAccess, isFieldAccessGroupReference } from "./fieldAccess.js";
 export const collectionAuthAccess = (permissions) => {
     return !!permissions.auth;
 };
@@ -19,44 +20,53 @@ export const collectionAllWriteAccess = (permissions) => {
     }
     return;
 };
-export const privateFieldAccess = (field, permissions) => {
+export const privateFieldAccess = (field, permissions, collection, claims) => {
     if (!permissions)
         return true;
     if (!permissions.Role)
         return false;
+    if (isFieldAccessGroupReference(field.access)) {
+        if (!collection || !claims)
+            return false;
+        return fieldAccessGroupAccess(field, collection, permissions, claims);
+    }
     return field.access?.includes(permissions.Role);
 };
-export const restrictCreateAccess = (field, permissions) => {
-    if (!permissions)
-        return true;
-    if (!permissions.Role)
-        return false;
-    if (field.restrictCreate === true)
+const restrictWriteAccess = (restriction, permissions, collectionName, claims) => {
+    if (restriction === true)
         return false;
-    else if (typeof field.restrictCreate === "object") {
-        return field.restrictCreate?.includes(permissions.Role);
+    if (Array.isArray(restriction)) {
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        return restriction.includes(permissions.Role);
+    }
+    if (typeof restriction === "object" && restriction !== null) {
+        if (!collectionName || !claims)
+            return false;
+        return evaluateFieldAccessCondition(restriction, collectionName, permissions, claims);
     }
     return true;
 };
-export const restrictUpdateAccess = (field, permissions) => {
+export const restrictCreateAccess = (field, permissions, collectionName, claims) => {
     if (!permissions)
         return true;
     if (!permissions.Role)
         return false;
-    if (field.restrictUpdate === true)
+    return restrictWriteAccess(field.restrictCreate, permissions, collectionName, claims);
+};
+export const restrictUpdateAccess = (field, permissions, collectionName, claims) => {
+    if (!permissions)
+        return true;
+    if (!permissions.Role)
         return false;
-    else if (typeof field.restrictUpdate === "object") {
-        return field.restrictUpdate?.includes(permissions.Role);
-    }
-    return true;
+    return restrictWriteAccess(field.restrictUpdate, permissions, collectionName, claims);
 };
-export const canUpdateField = (collection, field, permissions) => {
+export const canUpdateField = (collection, field, permissions, claims) => {
     const { labels } = collection;
     return (permissions.collections &&
         // eslint-disable-next-line security/detect-object-injection
         collectionAccess("Update", permissions.collections[labels.collection]) &&
-        (!field.access || privateFieldAccess(field, permissions)) &&
-        restrictUpdateAccess(field, permissions) &&
+        (!field.access || privateFieldAccess(field, permissions, collection, claims)) &&
+        restrictUpdateAccess(field, permissions, labels.collection, claims) &&
         !(collection.auth &&
             !permissions.collections?.[labels.collection].auth &&
             ["Enabled", "Role", "Name", "Email", "Photo_URL"].includes(field.name)));

package/lib/src/access/document.d.ts

@@ -1,3 +1,3 @@
 import { CollectionSchema, CollectionsSchema, StokerPermissions, StokerRecord } from "@stoker-platform/types";
 export declare const documentAccess: (operation: "Read" | "Create" | "Update" | "Delete", collectionSchema: CollectionSchema, schema: CollectionsSchema, userId: string, permissions: StokerPermissions, record: StokerRecord) => boolean;
-export declare const dependencyAccess: (collectionSchema: CollectionSchema, schema: CollectionsSchema, userId: string, permissions: StokerPermissions, record: StokerRecord) => boolean;
+export declare const dependencyAccess: (collectionSchema: CollectionSchema, schema: CollectionsSchema, userId: string, permissions: StokerPermissions, record: StokerRecord, claims: Record<string, unknown>) => boolean;

package/lib/src/access/document.js

@@ -177,13 +177,13 @@ export const documentAccess = (operation, collectionSchema, schema, userId, perm
         granted = false;
     return granted;
 };
-export const dependencyAccess = (collectionSchema, schema, userId, permissions, record) => {
+export const dependencyAccess = (collectionSchema, schema, userId, permissions, record, claims) => {
     let granted = true;
     if (!permissions.Role) {
         granted = false;
         return granted;
     }
-    if (hasDependencyAccess(collectionSchema, schema, permissions).length === 0)
+    if (hasDependencyAccess(collectionSchema, schema, permissions, claims).length === 0)
         granted = false;
     if (!filterAccess("Read", collectionSchema, schema, userId, permissions, record, true))
         granted = false;

package/lib/src/access/fieldAccess.d.ts

@@ -0,0 +1,8 @@
+import { CollectionField, CollectionSchema, FieldAccessCondition, FieldAccessGroupReference, StokerPermissions, StokerRole } from "@stoker-platform/types";
+export declare const isFieldAccessGroupReference: (access?: StokerRole[] | FieldAccessGroupReference) => access is FieldAccessGroupReference;
+export declare const getFieldAccessRoles: (access?: StokerRole[] | FieldAccessGroupReference) => StokerRole[] | undefined;
+export declare const fieldRoleProjectionAccess: (field: CollectionField, role: StokerRole) => boolean;
+export declare const getFieldAccessGroupCondition: (field: CollectionField, collection: CollectionSchema) => FieldAccessCondition | undefined;
+export declare const getFieldAccessGroupFields: (collection: CollectionSchema) => Record<string, CollectionField[]>;
+export declare const evaluateFieldAccessCondition: (condition: FieldAccessCondition, collectionName: string, permissions?: StokerPermissions, claims?: Record<string, unknown>) => boolean;
+export declare const fieldAccessGroupAccess: (field: CollectionField, collection: CollectionSchema, permissions: StokerPermissions, claims: Record<string, unknown>) => boolean;

package/lib/src/access/fieldAccess.js

@@ -0,0 +1,76 @@
+export const isFieldAccessGroupReference = (access) => {
+    return !!access && !Array.isArray(access);
+};
+export const getFieldAccessRoles = (access) => {
+    return Array.isArray(access) ? access : undefined;
+};
+export const fieldRoleProjectionAccess = (field, role) => {
+    if (!field.access)
+        return true;
+    if (isFieldAccessGroupReference(field.access))
+        return false;
+    return field.access.includes(role);
+};
+export const getFieldAccessGroupCondition = (field, collection) => {
+    if (!isFieldAccessGroupReference(field.access))
+        return;
+    return collection.fieldAccessGroups?.[field.access.group];
+};
+export const getFieldAccessGroupFields = (collection) => {
+    const groups = {};
+    Object.keys(collection.fieldAccessGroups || {}).forEach((key) => {
+        // eslint-disable-next-line security/detect-object-injection
+        groups[key] = [];
+    });
+    collection.fields.forEach((field) => {
+        if (isFieldAccessGroupReference(field.access)) {
+            const { group } = field.access;
+            // eslint-disable-next-line security/detect-object-injection
+            if (groups[group])
+                groups[group].push(field);
+        }
+    });
+    return groups;
+};
+export const evaluateFieldAccessCondition = (condition, collectionName, permissions, claims) => {
+    if (!permissions)
+        return true;
+    // eslint-disable-next-line security/detect-object-injection
+    const collectionPermissions = permissions.collections?.[collectionName];
+    const checks = [];
+    if (condition.collectionAuth !== undefined) {
+        checks.push(!!collectionPermissions?.auth === condition.collectionAuth);
+    }
+    if (condition.roles) {
+        checks.push(!!permissions.Role && condition.roles.includes(permissions.Role));
+    }
+    if (condition.claims) {
+        checks.push(Object.entries(condition.claims).every(([claim, expected]) => {
+            // eslint-disable-next-line security/detect-object-injection
+            let value = claims?.[claim];
+            if (value === undefined && claim === "role")
+                value = permissions.Role;
+            if (Array.isArray(expected))
+                return expected.some((item) => item === value);
+            return value === expected;
+        }));
+    }
+    if (condition.restrictions) {
+        const { recordOwner, recordUser, recordProperty, restrictEntities } = condition.restrictions;
+        checks.push((recordOwner === undefined || !!collectionPermissions?.recordOwner?.active === recordOwner) &&
+            (recordUser === undefined || !!collectionPermissions?.recordUser?.active === recordUser) &&
+            (recordProperty === undefined || !!collectionPermissions?.recordProperty?.active === recordProperty) &&
+            (restrictEntities === undefined || !!collectionPermissions?.restrictEntities === restrictEntities));
+    }
+    if (checks.length === 0)
+        return false;
+    if (condition.match === "all")
+        return checks.every(Boolean);
+    return checks.some(Boolean);
+};
+export const fieldAccessGroupAccess = (field, collection, permissions, claims) => {
+    const condition = getFieldAccessGroupCondition(field, collection);
+    if (!condition)
+        return false;
+    return evaluateFieldAccessCondition(condition, collection.labels.collection, permissions, claims);
+};

package/lib/src/access/getRelatedCollections.d.ts

@@ -1,2 +1,2 @@
 import { CollectionSchema, CollectionsSchema, StokerPermissions } from "@stoker-platform/types";
-export declare const getRelatedCollections: (collectionSchema: CollectionSchema, schema: CollectionsSchema, permissions?: StokerPermissions) => string[];
+export declare const getRelatedCollections: (collectionSchema: CollectionSchema, schema: CollectionsSchema, permissions?: StokerPermissions, claims?: Record<string, unknown>) => string[];

package/lib/src/access/getRelatedCollections.js

@@ -1,11 +1,11 @@
 import { isRelationField } from "../schema/isRelationField.js";
 import { collectionAccess, privateFieldAccess } from "../access/collection.js";
 import { hasDependencyAccess } from "./hasDependencyAccess.js";
-export const getRelatedCollections = (collectionSchema, schema, permissions) => {
+export const getRelatedCollections = (collectionSchema, schema, permissions, claims) => {
     const relatedCollections = [];
     for (const field of collectionSchema.fields) {
         if (isRelationField(field)) {
-            if (field.access && (!permissions || !privateFieldAccess(field, permissions)))
+            if (field.access && (!permissions || !privateFieldAccess(field, permissions, collectionSchema, claims)))
                 continue;
             const relatedCollection = schema.collections[field.collection];
             if (!relatedCollection)
@@ -15,7 +15,7 @@ export const getRelatedCollections = (collectionSchema, schema, permissions) =>
                 continue;
             if (!permissions ||
                 collectionAccess("Read", relatedCollectionPermissions) ||
-                hasDependencyAccess(collectionSchema, schema, permissions)) {
+                hasDependencyAccess(collectionSchema, schema, permissions, claims ?? {})) {
                 relatedCollections.push(field.collection);
             }
         }

package/lib/src/access/hasDependencyAccess.d.ts

@@ -1,2 +1,2 @@
 import { CollectionSchema, CollectionsSchema, DependencyField, StokerPermissions } from "@stoker-platform/types";
-export declare const hasDependencyAccess: (collection: CollectionSchema, schema: CollectionsSchema, permissions: StokerPermissions) => DependencyField[];
+export declare const hasDependencyAccess: (collection: CollectionSchema, schema: CollectionsSchema, permissions: StokerPermissions, claims: Record<string, unknown>) => DependencyField[];

package/lib/src/access/hasDependencyAccess.js

@@ -1,13 +1,13 @@
 import { privateFieldAccess } from "./collection.js";
 import { isRelationField } from "../schema/isRelationField.js";
-export const hasDependencyAccess = (collection, schema, permissions) => {
+export const hasDependencyAccess = (collection, schema, permissions, claims) => {
     const collections = Object.values(schema.collections);
     const { labels } = collection;
     const hasDependencyAccess = [];
     for (const collectionSchema of collections) {
         const { fields: dependencyFields } = collectionSchema;
         for (const field of dependencyFields) {
-            if (field.access && !privateFieldAccess(field, permissions))
+            if (field.access && !privateFieldAccess(field, permissions, collectionSchema, claims))
                 continue;
             if (!permissions.Role)
                 continue;

package/lib/src/access/write/addRecord.d.ts

@@ -1,2 +1,2 @@
 import { CollectionSchema, CollectionsSchema, StokerPermissions, StokerRecord } from "@stoker-platform/types";
-export declare const addRecordAccessControl: (record: StokerRecord, docId: string, collectionSchema: CollectionSchema, schema: CollectionsSchema, currentUserId?: string, currentUserPermissions?: StokerPermissions, permissions?: StokerPermissions) => void;
+export declare const addRecordAccessControl: (record: StokerRecord, docId: string, collectionSchema: CollectionSchema, schema: CollectionsSchema, currentUserId?: string, currentUserPermissions?: StokerPermissions, permissions?: StokerPermissions, claims?: Record<string, unknown>) => void;

package/lib/src/access/write/addRecord.js

@@ -1,7 +1,7 @@
 import { collectionAccess, collectionAuthAccess, privateFieldAccess, restrictCreateAccess } from "../collection.js";
 import { documentAccess } from "../document.js";
 import { permissionsWriteAccess } from "../permissions.js";
-export const addRecordAccessControl = (record, docId, collectionSchema, schema, currentUserId, currentUserPermissions, permissions) => {
+export const addRecordAccessControl = (record, docId, collectionSchema, schema, currentUserId, currentUserPermissions, permissions, claims) => {
     const { labels, fields } = collectionSchema;
     // eslint-disable-next-line security/detect-object-injection
     const collectionPermissions = currentUserPermissions?.collections?.[labels.collection];
@@ -27,11 +27,11 @@ export const addRecordAccessControl = (record, docId, collectionSchema, schema,
     for (const field of fields) {
         const value = record[field.name];
         if (field.access) {
-            if (!privateFieldAccess(field, currentUserPermissions) && value !== undefined) {
+            if (!privateFieldAccess(field, currentUserPermissions, collectionSchema, claims) && value !== undefined) {
                 granted = false;
             }
         }
-        if (value !== undefined && !restrictCreateAccess(field, currentUserPermissions))
+        if (value !== undefined && !restrictCreateAccess(field, currentUserPermissions, labels.collection, claims))
             granted = false;
     }
     if (!granted)

package/lib/src/access/write/updateRecord.d.ts

@@ -1,2 +1,2 @@
 import { CollectionSchema, CollectionsSchema, StokerPermissions, StokerRecord } from "@stoker-platform/types";
-export declare const updateRecordAccessControl: (partial: StokerRecord, originalRecord: StokerRecord, docId: string, collectionSchema: CollectionSchema, schema: CollectionsSchema, currentUserId?: string, currentUserPermissions?: StokerPermissions, userOperation?: string, permissions?: StokerPermissions, originalPermissions?: StokerPermissions | undefined) => void;
+export declare const updateRecordAccessControl: (partial: StokerRecord, originalRecord: StokerRecord, docId: string, collectionSchema: CollectionSchema, schema: CollectionsSchema, currentUserId?: string, currentUserPermissions?: StokerPermissions, userOperation?: string, permissions?: StokerPermissions, originalPermissions?: StokerPermissions | undefined, claims?: Record<string, unknown>) => void;

package/lib/src/access/write/updateRecord.js

@@ -2,7 +2,7 @@ import { collectionAccess, collectionAuthAccess, privateFieldAccess, restrictUpd
 import { documentAccess } from "../document.js";
 import { permissionsWriteAccess } from "../permissions.js";
 import { removeDeleteSentinels } from "../../operations/removeDeleteSentinels.js";
-export const updateRecordAccessControl = (partial, originalRecord, docId, collectionSchema, schema, currentUserId, currentUserPermissions, userOperation, permissions, originalPermissions) => {
+export const updateRecordAccessControl = (partial, originalRecord, docId, collectionSchema, schema, currentUserId, currentUserPermissions, userOperation, permissions, originalPermissions, claims) => {
     const { labels, fields } = collectionSchema;
     // eslint-disable-next-line security/detect-object-injection
     const collectionPermissions = currentUserPermissions?.collections?.[labels.collection];
@@ -50,12 +50,12 @@ export const updateRecordAccessControl = (partial, originalRecord, docId, collec
     for (const field of fields) {
         const value = partial[field.name];
         if (field.access) {
-            if (!privateFieldAccess(field, currentUserPermissions) && value !== undefined) {
+            if (!privateFieldAccess(field, currentUserPermissions, collectionSchema, claims) && value !== undefined) {
                 errorDetails = `Authenticated user does not have access to field ${field.name}`;
                 granted = false;
             }
         }
-        if (value !== undefined && !restrictUpdateAccess(field, currentUserPermissions)) {
+        if (value !== undefined && !restrictUpdateAccess(field, currentUserPermissions, labels.collection, claims)) {
             errorDetails = `Authenticated user does not have Update access to field ${field.name}`;
             granted = false;
         }

package/lib/src/main.d.ts

@@ -20,7 +20,8 @@ export { getCollection } from "./schema/getCollection.js";
 export { getDependencyFields } from "./schema/getDependencyFields.js";
 export { getField } from "./schema/getField.js";
 export { getFieldNames } from "./schema/getFieldNames.js";
-export { getRoleFields, getDependencyAccessFields, getDependencyIndexFields, getRoleGroups, getRoleGroup, getRoleExcludedFields, getUserRoleGroups, getAllRoleGroups, } from "./schema/getIndexFields.js";
+export { getRoleFields, getDependencyAccessFields, getDependencyIndexFields, getFieldAccessGroupIndexFields, getRoleGroups, getRoleGroup, getRoleExcludedFields, getUserRoleGroups, getAllRoleGroups, } from "./schema/getIndexFields.js";
+export { isFieldAccessGroupReference, getFieldAccessRoles, fieldRoleProjectionAccess, getFieldAccessGroupCondition, getFieldAccessGroupFields, evaluateFieldAccessCondition, fieldAccessGroupAccess, } from "./access/fieldAccess.js";
 export { getAccessFields } from "./schema/getAccessFields.js";
 export { getSystemFieldsSchema } from "./schema/getSystemFieldsSchema.js";
 export { isRelationField } from "./schema/isRelationField.js";

package/lib/src/main.js

@@ -20,7 +20,8 @@ export { getCollection } from "./schema/getCollection.js";
 export { getDependencyFields } from "./schema/getDependencyFields.js";
 export { getField } from "./schema/getField.js";
 export { getFieldNames } from "./schema/getFieldNames.js";
-export { getRoleFields, getDependencyAccessFields, getDependencyIndexFields, getRoleGroups, getRoleGroup, getRoleExcludedFields, getUserRoleGroups, getAllRoleGroups, } from "./schema/getIndexFields.js";
+export { getRoleFields, getDependencyAccessFields, getDependencyIndexFields, getFieldAccessGroupIndexFields, getRoleGroups, getRoleGroup, getRoleExcludedFields, getUserRoleGroups, getAllRoleGroups, } from "./schema/getIndexFields.js";
+export { isFieldAccessGroupReference, getFieldAccessRoles, fieldRoleProjectionAccess, getFieldAccessGroupCondition, getFieldAccessGroupFields, evaluateFieldAccessCondition, fieldAccessGroupAccess, } from "./access/fieldAccess.js";
 export { getAccessFields } from "./schema/getAccessFields.js";
 export { getSystemFieldsSchema } from "./schema/getSystemFieldsSchema.js";
 export { isRelationField } from "./schema/isRelationField.js";

package/lib/src/operations/addInitialValues.d.ts

@@ -1,2 +1,2 @@
-import { CollectionSchema, CollectionCustomization, StokerRecord, StokerRole } from "@stoker-platform/types";
-export declare const addInitialValues: (data: StokerRecord, collectionSchema: CollectionSchema, customization: CollectionCustomization, role?: StokerRole) => Promise<void>;
+import { CollectionSchema, CollectionCustomization, StokerPermissions, StokerRecord } from "@stoker-platform/types";
+export declare const addInitialValues: (data: StokerRecord, collectionSchema: CollectionSchema, customization: CollectionCustomization, permissions?: StokerPermissions, claims?: Record<string, unknown>) => Promise<void>;

package/lib/src/operations/addInitialValues.js

@@ -1,13 +1,14 @@
+import { privateFieldAccess } from "../access/collection.js";
 import { tryPromise } from "../getConfigValue.js";
 import { getField } from "../schema/getField.js";
 import { isRelationField } from "../schema/isRelationField.js";
 import { getLowercaseFields } from "./getLowercaseFields.js";
-export const addInitialValues = async (data, collectionSchema, customization, role) => {
+export const addInitialValues = async (data, collectionSchema, customization, permissions, claims) => {
     const { fields } = collectionSchema;
     for (const field of customization.fields) {
         const fieldSchema = getField(fields, field.name);
         if (field.custom?.initialValue !== undefined &&
-            !(role && fieldSchema.access && !fieldSchema.access.includes(role))) {
+            (!fieldSchema.access || privateFieldAccess(fieldSchema, permissions, collectionSchema, claims || {}))) {
             data[field.name] = await tryPromise(field.custom.initialValue, [data]);
             const lowercaseFields = getLowercaseFields(collectionSchema, [fieldSchema]);
             if (lowercaseFields.size === 1) {
@@ -16,7 +17,7 @@ export const addInitialValues = async (data, collectionSchema, customization, ro
         }
     }
     for (const field of fields) {
-        if (!(role && field.access && !field.access.includes(role))) {
+        if (!field.access || privateFieldAccess(field, permissions, collectionSchema, claims || {})) {
             if ("autoIncrement" in field && field.autoIncrement && !data[field.name]) {
                 data[field.name] = "Pending";
             }

package/lib/src/operations/prepareDenormalized.js

@@ -1,5 +1,6 @@
 import { isRelationField } from "../schema/isRelationField.js";
-import { getDependencyIndexFields, getRoleExcludedFields } from "../schema/getIndexFields.js";
+import { getDependencyIndexFields, getFieldAccessGroupIndexFields, getRoleExcludedFields, } from "../schema/getIndexFields.js";
+import { getFieldAccessGroupFields } from "../access/fieldAccess.js";
 import { isDependencyField } from "../schema/isDependencyField.js";
 import { getFieldNames } from "../schema/getFieldNames.js";
 import { getField } from "../schema/getField.js";
@@ -64,6 +65,43 @@ options, allRoleGroups, arrayUnion, arrayRemove, deleteField, dependencyRef, uni
             }
         }
     });
+    const fieldAccessGroups = getFieldAccessGroupFields(collectionSchema);
+    Object.entries(fieldAccessGroups).forEach(([groupKey, groupFields]) => {
+        if (groupFields.length === 0)
+            return;
+        const overlayFieldsSchema = getFieldAccessGroupIndexFields(groupKey, collectionSchema);
+        const overlayRecord = {};
+        overlayFieldsSchema.forEach((overlayField) => {
+            const names = [
+                overlayField.name,
+                `${overlayField.name}_Array`,
+                `${overlayField.name}_Single`,
+                `${overlayField.name}_Lowercase`,
+            ];
+            names.forEach((name) => {
+                // eslint-disable-next-line security/detect-object-injection
+                if (record[name] !== undefined)
+                    overlayRecord[name] = record[name];
+            });
+        });
+        if (operation === "create") {
+            overlayRecord.Collection_Path ||= path;
+            overlayRecord.Collection_Path_String = path.join("/");
+            batch.set(privateRef(groupKey), overlayRecord);
+            if (batchSize)
+                batchSize.size++;
+        }
+        if (operation === "update" && Object.keys(overlayRecord).length > 0) {
+            batch.update(privateRef(groupKey), overlayRecord);
+            if (batchSize)
+                batchSize.size++;
+        }
+        if (operation === "delete") {
+            batch.delete(privateRef(groupKey));
+            if (batchSize)
+                batchSize.size++;
+        }
+    });
     const roleGroups = allRoleGroups[collectionSchema.labels.collection];
     for (const group of roleGroups) {
         const excludedFields = getRoleExcludedFields(group, collectionSchema);
@@ -110,6 +148,16 @@ options, allRoleGroups, arrayUnion, arrayRemove, deleteField, dependencyRef, uni
                 batchSize++;
             }
         }
+        const fieldAccessGroups = getFieldAccessGroupFields(targetSchema);
+        for (const [groupKey, groupFields] of Object.entries(fieldAccessGroups)) {
+            if (groupFields.length === 0)
+                continue;
+            const overlayIndexFields = getFieldAccessGroupIndexFields(groupKey, targetSchema);
+            if (overlayIndexFields.some((overlayField) => overlayField.name === targetField.name) &&
+                isRelationField(targetField)) {
+                batchSize++;
+            }
+        }
         return batchSize;
     };
     const deleteFields = (field, targetSchema, targetField, id, relationPath) => {
@@ -142,6 +190,16 @@ options, allRoleGroups, arrayUnion, arrayRemove, deleteField, dependencyRef, uni
                 batch.update(twoWayPrivateRef(field, group.key, id), fieldUpdate);
             }
         }
+        const fieldAccessGroups = getFieldAccessGroupFields(targetSchema);
+        for (const [groupKey, groupFields] of Object.entries(fieldAccessGroups)) {
+            if (groupFields.length === 0)
+                continue;
+            const overlayIndexFields = getFieldAccessGroupIndexFields(groupKey, targetSchema);
+            if (overlayIndexFields.some((overlayField) => overlayField.name === targetField.name) &&
+                isRelationField(targetField)) {
+                batch.update(twoWayPrivateRef(field, groupKey, id), fieldUpdate);
+            }
+        }
     };
     if (operation === "delete")
         return;
@@ -246,6 +304,25 @@ options, allRoleGroups, arrayUnion, arrayRemove, deleteField, dependencyRef, uni
                             }
                         }
                     }
+                    const fieldAccessGroups = getFieldAccessGroupFields(targetSchema);
+                    for (const [groupKey, groupFields] of Object.entries(fieldAccessGroups)) {
+                        if (groupFields.length === 0)
+                            continue;
+                        const overlayIndexFields = getFieldAccessGroupIndexFields(groupKey, targetSchema);
+                        if (overlayIndexFields.some((overlayField) => overlayField.name === targetField.name)) {
+                            const overlayFieldUpdate = { ...fieldUpdate };
+                            Object.keys(systemFields).forEach((systemField) => {
+                                if (overlayIndexFields.some((overlayField) => overlayField.name === systemField)) {
+                                    // eslint-disable-next-line security/detect-object-injection
+                                    overlayFieldUpdate[systemField] = systemFields[systemField];
+                                }
+                            });
+                            if (Object.keys(overlayFieldUpdate).length > 0) {
+                                batch.update(twoWayPrivateRef(field, groupKey, id), overlayFieldUpdate);
+                                batchSize.size++;
+                            }
+                        }
+                    }
                 }
             }
         }

package/lib/src/schema/getIndexFields.d.ts

@@ -2,6 +2,7 @@ import type { CollectionField, CollectionSchema, CollectionsSchema, StokerPermis
 export declare const getRoleFields: (collection: CollectionSchema, role: StokerRole) => CollectionField[];
 export declare const getDependencyAccessFields: (field: CollectionField, collection: CollectionSchema, schema: CollectionsSchema) => CollectionField[];
 export declare const getDependencyIndexFields: (field: CollectionField, collection: CollectionSchema, schema: CollectionsSchema) => CollectionField[];
+export declare const getFieldAccessGroupIndexFields: (groupKey: string, collection: CollectionSchema) => CollectionField[];
 export declare const getRoleGroups: (collection: CollectionSchema, schema: CollectionsSchema) => Set<RoleGroup>;
 export declare const getRoleGroup: (role: StokerRole, collection: CollectionSchema, schema: CollectionsSchema) => RoleGroup | undefined;
 export declare const getRoleExcludedFields: (roleGroup: RoleGroup, collection: CollectionSchema) => CollectionField[];

package/lib/src/schema/getIndexFields.js

@@ -5,6 +5,7 @@ import { getAccessFields } from "./getAccessFields.js";
 import { getDependencyFields } from "./getDependencyFields.js";
 import { roleHasOperationAccess } from "../access/roleHasOperationAccess.js";
 import { isRelationField } from "./isRelationField.js";
+import { fieldRoleProjectionAccess, getFieldAccessGroupFields } from "../access/fieldAccess.js";
 export const getRoleFields = (collection, role) => {
     const indexFields = [];
     const { fields, roleSystemFields, preloadCache, queries } = collection;
@@ -15,7 +16,7 @@ export const getRoleFields = (collection, role) => {
         required: true,
     });
     fields.forEach((field) => {
-        if (!field.access || field.access.includes(role)) {
+        if (fieldRoleProjectionAccess(field, role)) {
             indexFields.push(field);
         }
     });
@@ -35,7 +36,7 @@ export const getRoleFields = (collection, role) => {
         const queryField = getField(fields.concat(systemFieldsSchema), query.field);
         if ((!query.roles || query.roles.includes(role)) &&
             queryField &&
-            (!queryField.access || queryField.access?.includes(role)) &&
+            fieldRoleProjectionAccess(queryField, role) &&
             systemFields.includes(query.field)) {
             indexFields.push(getField(systemFieldsSchema, query.field));
         }
@@ -52,16 +53,6 @@ export const getDependencyAccessFields = (field, collection, schema) => {
     const indexFields = [];
     const { fields, preloadCache } = collection;
     const systemFieldsSchema = getSystemFieldsSchema();
-    if (preloadCache?.range) {
-        preloadCache.range.fields.forEach((field) => {
-            if (systemFields.includes(field)) {
-                indexFields.push(getField(systemFieldsSchema, field));
-            }
-            else {
-                indexFields.push(getField(fields, field));
-            }
-        });
-    }
     const dependentRoles = new Set();
     const dependentFields = getDependencyFields(collection, schema);
     Object.entries(dependentFields).map(([fieldName, collectionValues]) => {
@@ -76,6 +67,16 @@ export const getDependencyAccessFields = (field, collection, schema) => {
     dependentRoles.forEach((role) => {
         indexFields.push(...getAccessFields(collection, role));
     });
+    if (preloadCache?.range) {
+        preloadCache.range.fields.forEach((field) => {
+            if (systemFields.includes(field)) {
+                indexFields.push(getField(systemFieldsSchema, field));
+            }
+            else if (Array.from(dependentRoles).some((role) => fieldRoleProjectionAccess(getField(fields, field), role))) {
+                indexFields.push(getField(fields, field));
+            }
+        });
+    }
     return [...new Set(indexFields)];
 };
 export const getDependencyIndexFields = (field, collection, schema) => {
@@ -121,6 +122,62 @@ export const getDependencyIndexFields = (field, collection, schema) => {
     indexFields.push(...getDependencyAccessFields(field, collection, schema));
     return [...new Set(indexFields)];
 };
+export const getFieldAccessGroupIndexFields = (groupKey, collection) => {
+    // eslint-disable-next-line security/detect-object-injection
+    if (!collection.fieldAccessGroups?.[groupKey])
+        return [];
+    const indexFields = [];
+    const { fields, softDelete, preloadCache, roleSystemFields, queries } = collection;
+    const systemFieldsSchema = getSystemFieldsSchema();
+    indexFields.push({
+        name: "Collection_Path",
+        type: "Array",
+        required: true,
+    });
+    indexFields.push({
+        name: "id",
+        type: "String",
+        required: true,
+    });
+    // eslint-disable-next-line security/detect-object-injection
+    const groupFields = getFieldAccessGroupFields(collection)[groupKey] || [];
+    indexFields.push(...groupFields);
+    // eslint-disable-next-line security/detect-object-injection
+    const applicableRoles = collection.fieldAccessGroups[groupKey].applicableRoles;
+    if (softDelete) {
+        const softDeleteField = getField(fields, softDelete.archivedField);
+        if (softDeleteField && !groupFields.includes(softDeleteField)) {
+            indexFields.push(softDeleteField);
+        }
+    }
+    if (preloadCache?.range) {
+        preloadCache.range.fields.forEach((field) => {
+            if (systemFields.includes(field)) {
+                indexFields.push(getField(systemFieldsSchema, field));
+            }
+            else if (applicableRoles.some((role) => fieldRoleProjectionAccess(getField(fields, field), role))) {
+                indexFields.push(getField(fields, field));
+            }
+        });
+    }
+    roleSystemFields
+        ?.filter((systemField) => systemField.field !== "Collection_Path" &&
+        applicableRoles.some((role) => !systemField.roles || systemField.roles.includes(role)))
+        .forEach((systemField) => {
+        indexFields.push(getField(systemFieldsSchema, systemField.field));
+    });
+    queries?.forEach((query) => {
+        const queryField = getField(fields.concat(systemFieldsSchema), query.field);
+        if (queryField &&
+            applicableRoles.some((role) => (!query.roles || query.roles.includes(role)) && fieldRoleProjectionAccess(queryField, role))) {
+            indexFields.push(queryField);
+        }
+    });
+    for (const role of applicableRoles) {
+        indexFields.push(...getAccessFields(collection, role));
+    }
+    return [...new Set(indexFields)];
+};
 export const getRoleGroups = (collection, schema) => {
     const { preloadCache } = collection;
     const roleGroups = new Set();
@@ -194,7 +251,7 @@ export const getAllRoleGroups = (schema, permissions, collections) => {
         roleGroupsArray.map((roleGroup) => {
             roleGroup.fields.forEach((field) => {
                 // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                if (permissions && field.access && !field.access?.includes(permissions.Role)) {
+                if (permissions && field.access && !fieldRoleProjectionAccess(field, permissions.Role)) {
                     roleGroup.fields = roleGroup.fields.filter((groupField) => groupField.name !== field.name);
                 }
             });