@strapi/permissions 0.0.0-next.fc231041206e6f3999b094160cfa05db2892ad54 → 0.0.0-next.fc9d26d995624dc886b29f563e1de655d47e6609

package/LICENSE

@@ -2,7 +2,21 @@ Copyright (c) 2015-present Strapi Solutions SAS
 
 Portions of the Strapi software are licensed as follows:
 
-* All software that resides under an "ee/" directory (the “EE Software”), if that directory exists, is licensed under the license defined in "ee/LICENSE".
+* All software that resides under an "ee/" directory (the “EE Software”), if that directory exists, is licensed under the license defined below.
+
+Enterprise License
+
+If you or the company you represent has entered into a written agreement referencing the Enterprise Edition of the Strapi source code available at
+https://github.com/strapi/strapi, then such agreement applies to your use of the Enterprise Edition of the Strapi Software. If you or the company you
+represent is using the Enterprise Edition of the Strapi Software in connection with a subscription to our cloud offering, then the agreement you have
+agreed to with respect to our cloud offering and the licenses included in such agreement apply to your use of the Enterprise Edition of the Strapi Software.
+Otherwise, the Strapi Enterprise Software License Agreement (found here https://strapi.io/enterprise-terms) applies to your use of the Enterprise Edition of the Strapi Software.
+
+BY ACCESSING OR USING THE ENTERPRISE EDITION OF THE STRAPI SOFTWARE, YOU ARE AGREEING TO BE BOUND BY THE RELEVANT REFERENCED AGREEMENT.
+IF YOU ARE NOT AUTHORIZED TO ACCEPT THESE TERMS ON BEHALF OF THE COMPANY YOU REPRESENT OR IF YOU DO NOT AGREE TO ALL OF THE RELEVANT TERMS AND CONDITIONS REFERENCED AND YOU
+HAVE NOT OTHERWISE EXECUTED A WRITTEN AGREEMENT WITH STRAPI, YOU ARE NOT AUTHORIZED TO ACCESS OR USE OR ALLOW ANY USER TO ACCESS OR USE ANY PART OF
+THE ENTERPRISE EDITION OF THE STRAPI SOFTWARE.  YOUR ACCESS RIGHTS ARE CONDITIONAL ON YOUR CONSENT TO THE RELEVANT REFERENCED TERMS TO THE EXCLUSION OF ALL OTHER TERMS;
+IF THE RELEVANT REFERENCED TERMS ARE CONSIDERED AN OFFER BY YOU, ACCEPTANCE IS EXPRESSLY LIMITED TO THE RELEVANT REFERENCED TERMS.
 
 * All software outside of the above-mentioned directories or restrictions above is available under the "MIT Expat" license as set forth below.
 
@@ -18,5 +32,6 @@ furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/dist/index.js

@@ -1,297 +1,345 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const _ = require("lodash/fp");
-const qs = require("qs");
-const utils = require("@strapi/utils");
-const sift = require("sift");
-const ability = require("@casl/ability");
-const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
-function _interopNamespace(e) {
-  if (e && e.__esModule)
-    return e;
-  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+'use strict';
+
+var _ = require('lodash/fp');
+var qs = require('qs');
+var utils = require('@strapi/utils');
+var sift = require('sift');
+var ability = require('@casl/ability');
+
+function _interopNamespaceDefault(e) {
+  var n = Object.create(null);
   if (e) {
-    for (const k in e) {
-      if (k !== "default") {
-        const d = Object.getOwnPropertyDescriptor(e, k);
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
         Object.defineProperty(n, k, d.get ? d : {
           enumerable: true,
-          get: () => e[k]
+          get: function () { return e[k]; }
         });
       }
-    }
+    });
   }
   n.default = e;
   return Object.freeze(n);
 }
-const ___default = /* @__PURE__ */ _interopDefault(_);
-const qs__default = /* @__PURE__ */ _interopDefault(qs);
-const sift__namespace = /* @__PURE__ */ _interopNamespace(sift);
-const PERMISSION_FIELDS = ["action", "subject", "properties", "conditions"];
-const sanitizePermissionFields = ___default.default.pick(PERMISSION_FIELDS);
-const getDefaultPermission = () => ({
-  conditions: [],
-  properties: {},
-  subject: null
-});
-const create = ___default.default.pipe(___default.default.pick(PERMISSION_FIELDS), ___default.default.merge(getDefaultPermission()));
-const addCondition = ___default.default.curry((condition, permission) => {
-  const { conditions } = permission;
-  const newConditions = Array.isArray(conditions) ? ___default.default.uniq(conditions.concat(condition)) : [condition];
-  return ___default.default.set("conditions", newConditions, permission);
+
+var sift__namespace = /*#__PURE__*/_interopNamespaceDefault(sift);
+
+const PERMISSION_FIELDS = [
+    'action',
+    'subject',
+    'properties',
+    'conditions'
+];
+const sanitizePermissionFields = _.pick(PERMISSION_FIELDS);
+/**
+ * Creates a permission with default values for optional properties
+ */ const getDefaultPermission = ()=>({
+        conditions: [],
+        properties: {},
+        subject: null
+    });
+/**
+ * Create a new permission based on given attributes
+ *
+ * @param {object} attributes
+ */ const create = _.pipe(_.pick(PERMISSION_FIELDS), _.merge(getDefaultPermission()));
+/**
+ * Add a condition to a permission
+ */ const addCondition = _.curry((condition, permission)=>{
+    const { conditions } = permission;
+    const newConditions = Array.isArray(conditions) ? _.uniq(conditions.concat(condition)) : [
+        condition
+    ];
+    return _.set('conditions', newConditions, permission);
 });
-const getProperty = ___default.default.curry(
-  (property, permission) => ___default.default.get(`properties.${property}`, permission)
-);
-const index$3 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+/**
+ * Gets a property or a part of a property from a permission.
+ */ const getProperty = _.curry((property, permission)=>_.get(`properties.${property}`, permission));
+
+var index$3 = /*#__PURE__*/Object.freeze({
   __proto__: null,
-  addCondition,
-  create,
-  getProperty,
-  sanitizePermissionFields
-}, Symbol.toStringTag, { value: "Module" }));
-const index$2 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  addCondition: addCondition,
+  create: create,
+  getProperty: getProperty,
+  sanitizePermissionFields: sanitizePermissionFields
+});
+
+var index$2 = /*#__PURE__*/Object.freeze({
   __proto__: null,
   permission: index$3
-}, Symbol.toStringTag, { value: "Module" }));
-const createEngineHooks = () => ({
-  "before-format::validate.permission": utils.hooks.createAsyncBailHook(),
-  "format.permission": utils.hooks.createAsyncSeriesWaterfallHook(),
-  "after-format::validate.permission": utils.hooks.createAsyncBailHook(),
-  "before-evaluate.permission": utils.hooks.createAsyncSeriesHook(),
-  "before-register.permission": utils.hooks.createAsyncSeriesHook()
-});
-const createValidateContext = (permission) => ({
-  get permission() {
-    return _.cloneDeep(permission);
-  }
-});
-const createBeforeEvaluateContext = (permission) => ({
-  get permission() {
-    return _.cloneDeep(permission);
-  },
-  addCondition(condition) {
-    Object.assign(permission, addCondition(condition, permission));
-    return this;
-  }
 });
-const createWillRegisterContext = ({ permission, options }) => ({
-  ...options,
-  get permission() {
-    return _.cloneDeep(permission);
-  },
-  condition: {
-    and(rawConditionObject) {
-      if (!permission.condition) {
-        permission.condition = { $and: [] };
-      }
-      if (_.isArray(permission.condition.$and)) {
-        permission.condition.$and.push(rawConditionObject);
-      }
-      return this;
-    },
-    or(rawConditionObject) {
-      if (!permission.condition) {
-        permission.condition = { $and: [] };
-      }
-      if (_.isArray(permission.condition.$and)) {
-        const orClause = permission.condition.$and.find(_.has("$or"));
-        if (orClause) {
-          orClause.$or.push(rawConditionObject);
-        } else {
-          permission.condition.$and.push({ $or: [rawConditionObject] });
+
+/**
+ * Create a hook map used by the permission Engine
+ */ const createEngineHooks = ()=>({
+        'before-format::validate.permission': utils.hooks.createAsyncBailHook(),
+        'format.permission': utils.hooks.createAsyncSeriesWaterfallHook(),
+        'after-format::validate.permission': utils.hooks.createAsyncBailHook(),
+        'before-evaluate.permission': utils.hooks.createAsyncSeriesHook(),
+        'before-register.permission': utils.hooks.createAsyncSeriesHook()
+    });
+/**
+ * Create a context from a domain {@link Permission} used by the validate hooks
+ */ const createValidateContext = (permission)=>({
+        get permission () {
+            return _.cloneDeep(permission);
         }
-      }
-      return this;
-    }
-  }
-});
+    });
+/**
+ * Create a context from a domain {@link Permission} used by the before valuate hook
+ */ const createBeforeEvaluateContext = (permission)=>({
+        get permission () {
+            return _.cloneDeep(permission);
+        },
+        addCondition (condition) {
+            Object.assign(permission, addCondition(condition, permission));
+            return this;
+        }
+    });
+/**
+ * Create a context from a casl Permission & some options
+ * @param caslPermission
+ */ const createWillRegisterContext = ({ permission, options })=>({
+        ...options,
+        get permission () {
+            return _.cloneDeep(permission);
+        },
+        condition: {
+            and (rawConditionObject) {
+                if (!permission.condition) {
+                    permission.condition = {
+                        $and: []
+                    };
+                }
+                if (_.isArray(permission.condition.$and)) {
+                    permission.condition.$and.push(rawConditionObject);
+                }
+                return this;
+            },
+            or (rawConditionObject) {
+                if (!permission.condition) {
+                    permission.condition = {
+                        $and: []
+                    };
+                }
+                if (_.isArray(permission.condition.$and)) {
+                    const orClause = permission.condition.$and.find(_.has('$or'));
+                    if (orClause) {
+                        orClause.$or.push(rawConditionObject);
+                    } else {
+                        permission.condition.$and.push({
+                            $or: [
+                                rawConditionObject
+                            ]
+                        });
+                    }
+                }
+                return this;
+            }
+        }
+    });
+
 const allowedOperations = [
-  "$or",
-  "$and",
-  "$eq",
-  "$ne",
-  "$in",
-  "$nin",
-  "$lt",
-  "$lte",
-  "$gt",
-  "$gte",
-  "$exists",
-  "$elemMatch"
+    '$or',
+    '$and',
+    '$eq',
+    '$ne',
+    '$in',
+    '$nin',
+    '$lt',
+    '$lte',
+    '$gt',
+    '$gte',
+    '$exists',
+    '$elemMatch'
 ];
 const operations = _.pick(allowedOperations, sift__namespace);
-const conditionsMatcher = (conditions) => {
-  return sift__namespace.createQueryTester(conditions, { operations });
+const conditionsMatcher = (conditions)=>{
+    return sift__namespace.createQueryTester(conditions, {
+        operations
+    });
 };
-const buildParametrizedAction = ({ name, params }) => {
-  return `${name}?${qs__default.default.stringify(params)}`;
+const buildParametrizedAction = ({ name, params })=>{
+    return `${name}?${qs.stringify(params)}`;
 };
-const caslAbilityBuilder = () => {
-  const { can, build, ...rest } = new ability.AbilityBuilder(ability.Ability);
-  return {
-    can(permission) {
-      const { action, subject, properties = {}, condition } = permission;
-      const { fields } = properties;
-      const caslAction = typeof action === "string" ? action : buildParametrizedAction(action);
-      return can(
-        caslAction,
-        _.isNil(subject) ? "all" : subject,
-        fields,
-        _.isObject(condition) ? condition : void 0
-      );
-    },
-    buildParametrizedAction({ name, params }) {
-      return `${name}?${qs__default.default.stringify(params)}`;
-    },
-    build() {
-      const ability2 = build({ conditionsMatcher });
-      function decorateCan(originalCan) {
-        return function(...args) {
-          const [action, ...rest2] = args;
-          const caslAction = typeof action === "string" ? action : buildParametrizedAction(action);
-          return originalCan.apply(ability2, [caslAction, ...rest2]);
-        };
-      }
-      ability2.can = decorateCan(ability2.can);
-      return ability2;
-    },
-    ...rest
-  };
+/**
+ * Casl Ability Builder.
+ */ const caslAbilityBuilder = ()=>{
+    const { can, build, ...rest } = new ability.AbilityBuilder(ability.Ability);
+    return {
+        can (permission) {
+            const { action, subject, properties = {}, condition } = permission;
+            const { fields } = properties;
+            const caslAction = typeof action === 'string' ? action : buildParametrizedAction(action);
+            return can(caslAction, _.isNil(subject) ? 'all' : subject, fields, _.isObject(condition) ? condition : undefined);
+        },
+        buildParametrizedAction ({ name, params }) {
+            return `${name}?${qs.stringify(params)}`;
+        },
+        build () {
+            const ability = build({
+                conditionsMatcher
+            });
+            function decorateCan(originalCan) {
+                return function(...args) {
+                    const [action, ...rest] = args;
+                    const caslAction = typeof action === 'string' ? action : buildParametrizedAction(action);
+                    // Call the original `can` method
+                    return originalCan.apply(ability, [
+                        caslAction,
+                        ...rest
+                    ]);
+                };
+            }
+            ability.can = decorateCan(ability.can);
+            return ability;
+        },
+        ...rest
+    };
 };
-const index$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+
+var index$1 = /*#__PURE__*/Object.freeze({
   __proto__: null,
-  caslAbilityBuilder
-}, Symbol.toStringTag, { value: "Module" }));
-const createEngineState = () => {
-  const hooks = createEngineHooks();
-  return { hooks };
-};
-const newEngine = (params) => {
-  const { providers, abilityBuilderFactory = caslAbilityBuilder } = params;
-  const state = createEngineState();
-  const runValidationHook = async (hook, context) => state.hooks[hook].call(context);
-  const evaluate = async (params2) => {
-    const { options, register } = params2;
-    const preFormatValidation = await runValidationHook(
-      "before-format::validate.permission",
-      createBeforeEvaluateContext(params2.permission)
-    );
-    if (preFormatValidation === false) {
-      return;
-    }
-    const permission = await state.hooks["format.permission"].call(
-      params2.permission
-    );
-    const afterFormatValidation = await runValidationHook(
-      "after-format::validate.permission",
-      createValidateContext(permission)
-    );
-    if (afterFormatValidation === false) {
-      return;
-    }
-    await state.hooks["before-evaluate.permission"].call(createBeforeEvaluateContext(permission));
-    const {
-      action: actionName,
-      subject,
-      properties,
-      conditions = [],
-      actionParameters = {}
-    } = permission;
-    let action = actionName;
-    if (actionParameters && Object.keys(actionParameters).length > 0) {
-      action = `${actionName}?${qs__default.default.stringify(actionParameters)}`;
-    }
-    if (conditions.length === 0) {
-      return register({ action, subject, properties });
-    }
-    const resolveConditions = ___default.default.map(providers.condition.get);
-    const removeInvalidConditions = ___default.default.filter(
-      (condition) => ___default.default.isFunction(condition.handler)
-    );
-    const evaluateConditions = (conditions2) => {
-      return Promise.all(
-        conditions2.map(async (condition) => ({
-          condition,
-          result: await condition.handler(
-            ___default.default.merge(options, { permission: ___default.default.cloneDeep(permission) })
-          )
-        }))
-      );
+  caslAbilityBuilder: caslAbilityBuilder
+});
+
+/**
+ * Create a default state object for the engine
+ */ const createEngineState = ()=>{
+    const hooks = createEngineHooks();
+    return {
+        hooks
     };
-    const removeInvalidResults = ___default.default.filter(
-      ({ result }) => ___default.default.isBoolean(result) || ___default.default.isObject(result)
-    );
-    const evaluatedConditions = await Promise.resolve(conditions).then(resolveConditions).then(removeInvalidConditions).then(evaluateConditions).then(removeInvalidResults);
-    const resultPropEq = ___default.default.propEq("result");
-    const pickResults = ___default.default.map(___default.default.prop("result"));
-    if (evaluatedConditions.every(resultPropEq(false))) {
-      return;
-    }
-    if (___default.default.isEmpty(evaluatedConditions) || evaluatedConditions.some(resultPropEq(true))) {
-      return register({ action, subject, properties });
-    }
-    const results = pickResults(evaluatedConditions).filter(___default.default.isObject);
-    if (___default.default.isEmpty(results)) {
-      return register({ action, subject, properties });
-    }
-    return register({
-      action,
-      subject,
-      properties,
-      condition: { $and: [{ $or: results }] }
-    });
-  };
-  return {
-    get hooks() {
-      return state.hooks;
-    },
+};
+const newEngine = (params)=>{
+    const { providers, abilityBuilderFactory = caslAbilityBuilder } = params;
+    const state = createEngineState();
+    const runValidationHook = async (hook, context)=>state.hooks[hook].call(context);
     /**
+   * Evaluate a permission using local and registered behaviors (using hooks).
+   * Validate, format (add condition, etc...), evaluate (evaluate conditions) and register a permission
+   */ const evaluate = async (params)=>{
+        const { options, register } = params;
+        const preFormatValidation = await runValidationHook('before-format::validate.permission', createBeforeEvaluateContext(params.permission));
+        if (preFormatValidation === false) {
+            return;
+        }
+        const permission = await state.hooks['format.permission'].call(params.permission);
+        const afterFormatValidation = await runValidationHook('after-format::validate.permission', createValidateContext(permission));
+        if (afterFormatValidation === false) {
+            return;
+        }
+        await state.hooks['before-evaluate.permission'].call(createBeforeEvaluateContext(permission));
+        const { action: actionName, subject, properties, conditions = [], actionParameters = {} } = permission;
+        let action = actionName;
+        if (actionParameters && Object.keys(actionParameters).length > 0) {
+            action = `${actionName}?${qs.stringify(actionParameters)}`;
+        }
+        if (conditions.length === 0) {
+            return register({
+                action,
+                subject,
+                properties
+            });
+        }
+        const resolveConditions = _.map(providers.condition.get);
+        const removeInvalidConditions = _.filter((condition)=>_.isFunction(condition.handler));
+        const evaluateConditions = (conditions)=>{
+            return Promise.all(conditions.map(async (condition)=>({
+                    condition,
+                    result: await condition.handler(_.merge(options, {
+                        permission: _.cloneDeep(permission)
+                    }))
+                })));
+        };
+        const removeInvalidResults = _.filter(({ result })=>_.isBoolean(result) || _.isObject(result));
+        const evaluatedConditions = await Promise.resolve(conditions).then(resolveConditions).then(removeInvalidConditions).then(evaluateConditions).then(removeInvalidResults);
+        const resultPropEq = _.propEq('result');
+        const pickResults = _.map(_.prop('result'));
+        if (evaluatedConditions.every(resultPropEq(false))) {
+            return;
+        }
+        if (_.isEmpty(evaluatedConditions) || evaluatedConditions.some(resultPropEq(true))) {
+            return register({
+                action,
+                subject,
+                properties
+            });
+        }
+        const results = pickResults(evaluatedConditions).filter(_.isObject);
+        if (_.isEmpty(results)) {
+            return register({
+                action,
+                subject,
+                properties
+            });
+        }
+        return register({
+            action,
+            subject,
+            properties,
+            condition: {
+                $and: [
+                    {
+                        $or: results
+                    }
+                ]
+            }
+        });
+    };
+    return {
+        get hooks () {
+            return state.hooks;
+        },
+        /**
      * Create a register function that wraps a `can` function
      * used to register a permission in the ability builder
-     */
-    createRegisterFunction(can, options) {
-      return async (permission) => {
-        const hookContext = createWillRegisterContext({ options, permission });
-        await state.hooks["before-register.permission"].call(hookContext);
-        return can(permission);
-      };
-    },
-    /**
+     */ createRegisterFunction (can, options) {
+            return async (permission)=>{
+                const hookContext = createWillRegisterContext({
+                    options,
+                    permission
+                });
+                await state.hooks['before-register.permission'].call(hookContext);
+                return can(permission);
+            };
+        },
+        /**
      * Register a new handler for a given hook
-     */
-    on(hook, handler) {
-      const validHooks = Object.keys(state.hooks);
-      const isValidHook = validHooks.includes(hook);
-      if (!isValidHook) {
-        throw new Error(
-          `Invalid hook supplied when trying to register an handler to the permission engine. Got "${hook}" but expected one of ${validHooks.join(
-            ", "
-          )}`
-        );
-      }
-      state.hooks[hook].register(handler);
-      return this;
-    },
-    /**
+     */ on (hook, handler) {
+            const validHooks = Object.keys(state.hooks);
+            const isValidHook = validHooks.includes(hook);
+            if (!isValidHook) {
+                throw new Error(`Invalid hook supplied when trying to register an handler to the permission engine. Got "${hook}" but expected one of ${validHooks.join(', ')}`);
+            }
+            state.hooks[hook].register(handler);
+            return this;
+        },
+        /**
      * Generate an ability based on the instance's
      * ability builder and the given permissions
-     */
-    async generateAbility(permissions, options = {}) {
-      const { can, build } = abilityBuilderFactory();
-      for (const permission of permissions) {
-        const register = this.createRegisterFunction(can, options);
-        await evaluate({ permission, options, register });
-      }
-      return build();
-    }
-  };
+     */ async generateAbility (permissions, options = {}) {
+            const { can, build } = abilityBuilderFactory();
+            for (const permission of permissions){
+                const register = this.createRegisterFunction(can, options);
+                await evaluate({
+                    permission,
+                    options,
+                    register
+                });
+            }
+            return build();
+        }
+    };
 };
-const index = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+
+var index = /*#__PURE__*/Object.freeze({
   __proto__: null,
   abilities: index$1,
   new: newEngine
-}, Symbol.toStringTag, { value: "Module" }));
+});
+
 exports.domain = index$2;
 exports.engine = index;
 //# sourceMappingURL=index.js.map