@strapi/permissions 5.52.0 → 5.52.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1 +1 @@
1
- {"version":3,"file":"casl-ability.d.ts","sourceRoot":"","sources":["../../../src/engine/abilities/casl-ability.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEtE,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,UAAU,EAAE,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,uBAAuB,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC5E,KAAK,IAAI,OAAO,CAAC;CAClB;AA2BD;;GAEG;AACH,eAAO,MAAM,kBAAkB,QAAO,oBAyCrC,CAAC"}
1
+ {"version":3,"file":"casl-ability.d.ts","sourceRoot":"","sources":["../../../src/engine/abilities/casl-ability.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEtE,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,UAAU,EAAE,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,uBAAuB,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC5E,KAAK,IAAI,OAAO,CAAC;CAClB;AA8CD;;GAEG;AACH,eAAO,MAAM,kBAAkB,QAAO,oBAyCrC,CAAC"}
@@ -43,10 +43,22 @@ const allowedOperations = [
43
43
  '$elemMatch'
44
44
  ];
45
45
  const operations = _.pick(allowedOperations, sift__namespace);
46
- const conditionsMatcher = (conditions)=>{
47
- return sift__namespace.createQueryTester(conditions, {
48
- operations
49
- });
46
+ /**
47
+ * Match an RBAC condition query against an entity in memory with sift.
48
+ */ const conditionsMatcher = (conditions)=>{
49
+ try {
50
+ return sift__namespace.createQueryTester(conditions, {
51
+ operations
52
+ });
53
+ } catch (error) {
54
+ if (error instanceof Error) {
55
+ const [, operator] = error.message.match(/^Unsupported operation: (.+)$/) ?? [];
56
+ if (operator) {
57
+ throw new Error(`RBAC condition uses unsupported operator "${operator}". Conditions are matched in memory and support only: ${allowedOperations.join(', ')}.`);
58
+ }
59
+ }
60
+ throw error;
61
+ }
50
62
  };
51
63
  const buildParametrizedAction = ({ name, params })=>{
52
64
  return `${name}?${qs__default.default.stringify(params)}`;
@@ -1 +1 @@
1
- {"version":3,"file":"casl-ability.js","sources":["../../../src/engine/abilities/casl-ability.ts"],"sourcesContent":["import * as sift from 'sift';\nimport qs from 'qs';\nimport { AbilityBuilder, Ability } from '@casl/ability';\nimport { pick, isNil, isObject } from 'lodash/fp';\nimport type { ParametrizedAction, PermissionRule } from '../../types';\n\nexport interface CustomAbilityBuilder {\n can(permission: PermissionRule): ReturnType<AbilityBuilder<Ability>['can']>;\n buildParametrizedAction: (parametrizedAction: ParametrizedAction) => string;\n build(): Ability;\n}\n\nconst allowedOperations = [\n '$or',\n '$and',\n '$eq',\n '$ne',\n '$in',\n '$nin',\n '$lt',\n '$lte',\n '$gt',\n '$gte',\n '$exists',\n '$elemMatch',\n] as const;\n\nconst operations = pick(allowedOperations, sift);\n\nconst conditionsMatcher = (conditions: unknown) => {\n return sift.createQueryTester(conditions, { operations });\n};\n\nconst buildParametrizedAction = ({ name, params }: ParametrizedAction) => {\n return `${name}?${qs.stringify(params)}`;\n};\n\n/**\n * Casl Ability Builder.\n */\nexport const caslAbilityBuilder = (): CustomAbilityBuilder => {\n const { can, build, ...rest } = new AbilityBuilder(Ability);\n\n return {\n can(permission: PermissionRule) {\n const { action, subject, properties = {}, condition } = permission;\n const { fields } = properties;\n\n const caslAction = typeof action === 'string' ? action : buildParametrizedAction(action);\n\n return can(\n caslAction,\n isNil(subject) ? 'all' : subject,\n fields,\n isObject(condition) ? condition : undefined\n );\n },\n\n buildParametrizedAction({ name, params }: ParametrizedAction) {\n return `${name}?${qs.stringify(params)}`;\n },\n\n build() {\n const ability = build({ conditionsMatcher });\n\n function decorateCan(originalCan: Ability['can']) {\n return function canWithParametrizedAction(...args: Parameters<Ability['can']>) {\n const [action, ...rest] = args;\n const caslAction = typeof action === 'string' ? action : buildParametrizedAction(action);\n\n // Call the original `can` method\n return originalCan.apply(ability, [caslAction, ...rest]);\n };\n }\n\n ability.can = decorateCan(ability.can);\n return ability;\n },\n\n ...rest,\n };\n};\n"],"names":["allowedOperations","operations","pick","sift","conditionsMatcher","conditions","createQueryTester","buildParametrizedAction","name","params","qs","stringify","caslAbilityBuilder","can","build","rest","AbilityBuilder","Ability","permission","action","subject","properties","condition","fields","caslAction","isNil","isObject","undefined","ability","decorateCan","originalCan","canWithParametrizedAction","args","apply"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,MAAMA,iBAAAA,GAAoB;AACxB,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,KAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,SAAA;AACA,IAAA;AACD,CAAA;AAED,MAAMC,UAAAA,GAAaC,OAAKF,iBAAAA,EAAmBG,eAAAA,CAAAA;AAE3C,MAAMC,oBAAoB,CAACC,UAAAA,GAAAA;IACzB,OAAOF,eAAAA,CAAKG,iBAAiB,CAACD,UAAAA,EAAY;AAAEJ,QAAAA;AAAW,KAAA,CAAA;AACzD,CAAA;AAEA,MAAMM,0BAA0B,CAAC,EAAEC,IAAI,EAAEC,MAAM,EAAsB,GAAA;AACnE,IAAA,OAAO,GAAGD,IAAAA,CAAK,CAAC,EAAEE,mBAAAA,CAAGC,SAAS,CAACF,MAAAA,CAAAA,CAAAA,CAAS;AAC1C,CAAA;AAEA;;UAGaG,kBAAAA,GAAqB,IAAA;IAChC,MAAM,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGC,IAAAA,EAAM,GAAG,IAAIC,sBAAAA,CAAeC,eAAAA,CAAAA;IAEnD,OAAO;AACLJ,QAAAA,GAAAA,CAAAA,CAAIK,UAA0B,EAAA;YAC5B,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,UAAAA,GAAa,EAAE,EAAEC,SAAS,EAAE,GAAGJ,UAAAA;YACxD,MAAM,EAAEK,MAAM,EAAE,GAAGF,UAAAA;AAEnB,YAAA,MAAMG,UAAAA,GAAa,OAAOL,MAAAA,KAAW,QAAA,GAAWA,SAASZ,uBAAAA,CAAwBY,MAAAA,CAAAA;YAEjF,OAAON,GAAAA,CACLW,YACAC,OAAAA,CAAML,OAAAA,CAAAA,GAAW,QAAQA,OAAAA,EACzBG,MAAAA,EACAG,UAAAA,CAASJ,SAAAA,CAAAA,GAAaA,SAAAA,GAAYK,SAAAA,CAAAA;AAEtC,QAAA,CAAA;AAEApB,QAAAA,uBAAAA,CAAAA,CAAwB,EAAEC,IAAI,EAAEC,MAAM,EAAsB,EAAA;AAC1D,YAAA,OAAO,GAAGD,IAAAA,CAAK,CAAC,EAAEE,mBAAAA,CAAGC,SAAS,CAACF,MAAAA,CAAAA,CAAAA,CAAS;AAC1C,QAAA,CAAA;AAEAK,QAAAA,KAAAA,CAAAA,GAAAA;AACE,YAAA,MAAMc,UAAUd,KAAAA,CAAM;AAAEV,gBAAAA;AAAkB,aAAA,CAAA;AAE1C,YAAA,SAASyB,YAAYC,WAA2B,EAAA;gBAC9C,OAAO,SAASC,yBAAAA,CAA0B,GAAGC,IAAgC,EAAA;AAC3E,oBAAA,MAAM,CAACb,MAAAA,EAAQ,GAAGJ,IAAAA,CAAK,GAAGiB,IAAAA;AAC1B,oBAAA,MAAMR,UAAAA,GAAa,OAAOL,MAAAA,KAAW,QAAA,GAAWA,SAASZ,uBAAAA,CAAwBY,MAAAA,CAAAA;;oBAGjF,OAAOW,WAAAA,CAAYG,KAAK,CAACL,OAAAA,EAAS;AAACJ,wBAAAA,UAAAA;AAAeT,wBAAAA,GAAAA;AAAK,qBAAA,CAAA;AACzD,gBAAA,CAAA;AACF,YAAA;AAEAa,YAAAA,OAAAA,CAAQf,GAAG,GAAGgB,WAAAA,CAAYD,OAAAA,CAAQf,GAAG,CAAA;YACrC,OAAOe,OAAAA;AACT,QAAA,CAAA;AAEA,QAAA,GAAGb;AACL,KAAA;AACF;;;;"}
1
+ {"version":3,"file":"casl-ability.js","sources":["../../../src/engine/abilities/casl-ability.ts"],"sourcesContent":["import * as sift from 'sift';\nimport qs from 'qs';\nimport { AbilityBuilder, Ability } from '@casl/ability';\nimport { pick, isNil, isObject } from 'lodash/fp';\nimport type { ParametrizedAction, PermissionRule } from '../../types';\n\nexport interface CustomAbilityBuilder {\n can(permission: PermissionRule): ReturnType<AbilityBuilder<Ability>['can']>;\n buildParametrizedAction: (parametrizedAction: ParametrizedAction) => string;\n build(): Ability;\n}\n\nconst allowedOperations = [\n '$or',\n '$and',\n '$eq',\n '$ne',\n '$in',\n '$nin',\n '$lt',\n '$lte',\n '$gt',\n '$gte',\n '$exists',\n '$elemMatch',\n] as const;\n\nconst operations = pick(allowedOperations, sift);\n\n/**\n * Match an RBAC condition query against an entity in memory with sift.\n */\nconst conditionsMatcher = (conditions: unknown) => {\n try {\n return sift.createQueryTester(conditions, { operations });\n } catch (error) {\n if (error instanceof Error) {\n const [, operator] = error.message.match(/^Unsupported operation: (.+)$/) ?? [];\n\n if (operator) {\n throw new Error(\n `RBAC condition uses unsupported operator \"${operator}\". Conditions are matched in memory and support only: ${allowedOperations.join(\n ', '\n )}.`\n );\n }\n }\n\n throw error;\n }\n};\n\nconst buildParametrizedAction = ({ name, params }: ParametrizedAction) => {\n return `${name}?${qs.stringify(params)}`;\n};\n\n/**\n * Casl Ability Builder.\n */\nexport const caslAbilityBuilder = (): CustomAbilityBuilder => {\n const { can, build, ...rest } = new AbilityBuilder(Ability);\n\n return {\n can(permission: PermissionRule) {\n const { action, subject, properties = {}, condition } = permission;\n const { fields } = properties;\n\n const caslAction = typeof action === 'string' ? action : buildParametrizedAction(action);\n\n return can(\n caslAction,\n isNil(subject) ? 'all' : subject,\n fields,\n isObject(condition) ? condition : undefined\n );\n },\n\n buildParametrizedAction({ name, params }: ParametrizedAction) {\n return `${name}?${qs.stringify(params)}`;\n },\n\n build() {\n const ability = build({ conditionsMatcher });\n\n function decorateCan(originalCan: Ability['can']) {\n return function canWithParametrizedAction(...args: Parameters<Ability['can']>) {\n const [action, ...rest] = args;\n const caslAction = typeof action === 'string' ? action : buildParametrizedAction(action);\n\n // Call the original `can` method\n return originalCan.apply(ability, [caslAction, ...rest]);\n };\n }\n\n ability.can = decorateCan(ability.can);\n return ability;\n },\n\n ...rest,\n };\n};\n"],"names":["allowedOperations","operations","pick","sift","conditionsMatcher","conditions","createQueryTester","error","Error","operator","message","match","join","buildParametrizedAction","name","params","qs","stringify","caslAbilityBuilder","can","build","rest","AbilityBuilder","Ability","permission","action","subject","properties","condition","fields","caslAction","isNil","isObject","undefined","ability","decorateCan","originalCan","canWithParametrizedAction","args","apply"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,MAAMA,iBAAAA,GAAoB;AACxB,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,KAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,SAAA;AACA,IAAA;AACD,CAAA;AAED,MAAMC,UAAAA,GAAaC,OAAKF,iBAAAA,EAAmBG,eAAAA,CAAAA;AAE3C;;IAGA,MAAMC,oBAAoB,CAACC,UAAAA,GAAAA;IACzB,IAAI;QACF,OAAOF,eAAAA,CAAKG,iBAAiB,CAACD,UAAAA,EAAY;AAAEJ,YAAAA;AAAW,SAAA,CAAA;AACzD,IAAA,CAAA,CAAE,OAAOM,KAAAA,EAAO;AACd,QAAA,IAAIA,iBAAiBC,KAAAA,EAAO;YAC1B,MAAM,GAAGC,SAAS,GAAGF,KAAAA,CAAMG,OAAO,CAACC,KAAK,CAAC,+BAAA,CAAA,IAAoC,EAAE;AAE/E,YAAA,IAAIF,QAAAA,EAAU;AACZ,gBAAA,MAAM,IAAID,KAAAA,CACR,CAAC,0CAA0C,EAAEC,QAAAA,CAAS,sDAAsD,EAAET,iBAAAA,CAAkBY,IAAI,CAClI,IAAA,CAAA,CACA,CAAC,CAAC,CAAA;AAER,YAAA;AACF,QAAA;QAEA,MAAML,KAAAA;AACR,IAAA;AACF,CAAA;AAEA,MAAMM,0BAA0B,CAAC,EAAEC,IAAI,EAAEC,MAAM,EAAsB,GAAA;AACnE,IAAA,OAAO,GAAGD,IAAAA,CAAK,CAAC,EAAEE,mBAAAA,CAAGC,SAAS,CAACF,MAAAA,CAAAA,CAAAA,CAAS;AAC1C,CAAA;AAEA;;UAGaG,kBAAAA,GAAqB,IAAA;IAChC,MAAM,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGC,IAAAA,EAAM,GAAG,IAAIC,sBAAAA,CAAeC,eAAAA,CAAAA;IAEnD,OAAO;AACLJ,QAAAA,GAAAA,CAAAA,CAAIK,UAA0B,EAAA;YAC5B,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,UAAAA,GAAa,EAAE,EAAEC,SAAS,EAAE,GAAGJ,UAAAA;YACxD,MAAM,EAAEK,MAAM,EAAE,GAAGF,UAAAA;AAEnB,YAAA,MAAMG,UAAAA,GAAa,OAAOL,MAAAA,KAAW,QAAA,GAAWA,SAASZ,uBAAAA,CAAwBY,MAAAA,CAAAA;YAEjF,OAAON,GAAAA,CACLW,YACAC,OAAAA,CAAML,OAAAA,CAAAA,GAAW,QAAQA,OAAAA,EACzBG,MAAAA,EACAG,UAAAA,CAASJ,SAAAA,CAAAA,GAAaA,SAAAA,GAAYK,SAAAA,CAAAA;AAEtC,QAAA,CAAA;AAEApB,QAAAA,uBAAAA,CAAAA,CAAwB,EAAEC,IAAI,EAAEC,MAAM,EAAsB,EAAA;AAC1D,YAAA,OAAO,GAAGD,IAAAA,CAAK,CAAC,EAAEE,mBAAAA,CAAGC,SAAS,CAACF,MAAAA,CAAAA,CAAAA,CAAS;AAC1C,QAAA,CAAA;AAEAK,QAAAA,KAAAA,CAAAA,GAAAA;AACE,YAAA,MAAMc,UAAUd,KAAAA,CAAM;AAAEhB,gBAAAA;AAAkB,aAAA,CAAA;AAE1C,YAAA,SAAS+B,YAAYC,WAA2B,EAAA;gBAC9C,OAAO,SAASC,yBAAAA,CAA0B,GAAGC,IAAgC,EAAA;AAC3E,oBAAA,MAAM,CAACb,MAAAA,EAAQ,GAAGJ,IAAAA,CAAK,GAAGiB,IAAAA;AAC1B,oBAAA,MAAMR,UAAAA,GAAa,OAAOL,MAAAA,KAAW,QAAA,GAAWA,SAASZ,uBAAAA,CAAwBY,MAAAA,CAAAA;;oBAGjF,OAAOW,WAAAA,CAAYG,KAAK,CAACL,OAAAA,EAAS;AAACJ,wBAAAA,UAAAA;AAAeT,wBAAAA,GAAAA;AAAK,qBAAA,CAAA;AACzD,gBAAA,CAAA;AACF,YAAA;AAEAa,YAAAA,OAAAA,CAAQf,GAAG,GAAGgB,WAAAA,CAAYD,OAAAA,CAAQf,GAAG,CAAA;YACrC,OAAOe,OAAAA;AACT,QAAA,CAAA;AAEA,QAAA,GAAGb;AACL,KAAA;AACF;;;;"}
@@ -18,10 +18,22 @@ const allowedOperations = [
18
18
  '$elemMatch'
19
19
  ];
20
20
  const operations = pick(allowedOperations, sift);
21
- const conditionsMatcher = (conditions)=>{
22
- return sift.createQueryTester(conditions, {
23
- operations
24
- });
21
+ /**
22
+ * Match an RBAC condition query against an entity in memory with sift.
23
+ */ const conditionsMatcher = (conditions)=>{
24
+ try {
25
+ return sift.createQueryTester(conditions, {
26
+ operations
27
+ });
28
+ } catch (error) {
29
+ if (error instanceof Error) {
30
+ const [, operator] = error.message.match(/^Unsupported operation: (.+)$/) ?? [];
31
+ if (operator) {
32
+ throw new Error(`RBAC condition uses unsupported operator "${operator}". Conditions are matched in memory and support only: ${allowedOperations.join(', ')}.`);
33
+ }
34
+ }
35
+ throw error;
36
+ }
25
37
  };
26
38
  const buildParametrizedAction = ({ name, params })=>{
27
39
  return `${name}?${qs.stringify(params)}`;
@@ -1 +1 @@
1
- {"version":3,"file":"casl-ability.mjs","sources":["../../../src/engine/abilities/casl-ability.ts"],"sourcesContent":["import * as sift from 'sift';\nimport qs from 'qs';\nimport { AbilityBuilder, Ability } from '@casl/ability';\nimport { pick, isNil, isObject } from 'lodash/fp';\nimport type { ParametrizedAction, PermissionRule } from '../../types';\n\nexport interface CustomAbilityBuilder {\n can(permission: PermissionRule): ReturnType<AbilityBuilder<Ability>['can']>;\n buildParametrizedAction: (parametrizedAction: ParametrizedAction) => string;\n build(): Ability;\n}\n\nconst allowedOperations = [\n '$or',\n '$and',\n '$eq',\n '$ne',\n '$in',\n '$nin',\n '$lt',\n '$lte',\n '$gt',\n '$gte',\n '$exists',\n '$elemMatch',\n] as const;\n\nconst operations = pick(allowedOperations, sift);\n\nconst conditionsMatcher = (conditions: unknown) => {\n return sift.createQueryTester(conditions, { operations });\n};\n\nconst buildParametrizedAction = ({ name, params }: ParametrizedAction) => {\n return `${name}?${qs.stringify(params)}`;\n};\n\n/**\n * Casl Ability Builder.\n */\nexport const caslAbilityBuilder = (): CustomAbilityBuilder => {\n const { can, build, ...rest } = new AbilityBuilder(Ability);\n\n return {\n can(permission: PermissionRule) {\n const { action, subject, properties = {}, condition } = permission;\n const { fields } = properties;\n\n const caslAction = typeof action === 'string' ? action : buildParametrizedAction(action);\n\n return can(\n caslAction,\n isNil(subject) ? 'all' : subject,\n fields,\n isObject(condition) ? condition : undefined\n );\n },\n\n buildParametrizedAction({ name, params }: ParametrizedAction) {\n return `${name}?${qs.stringify(params)}`;\n },\n\n build() {\n const ability = build({ conditionsMatcher });\n\n function decorateCan(originalCan: Ability['can']) {\n return function canWithParametrizedAction(...args: Parameters<Ability['can']>) {\n const [action, ...rest] = args;\n const caslAction = typeof action === 'string' ? action : buildParametrizedAction(action);\n\n // Call the original `can` method\n return originalCan.apply(ability, [caslAction, ...rest]);\n };\n }\n\n ability.can = decorateCan(ability.can);\n return ability;\n },\n\n ...rest,\n };\n};\n"],"names":["allowedOperations","operations","pick","sift","conditionsMatcher","conditions","createQueryTester","buildParametrizedAction","name","params","qs","stringify","caslAbilityBuilder","can","build","rest","AbilityBuilder","Ability","permission","action","subject","properties","condition","fields","caslAction","isNil","isObject","undefined","ability","decorateCan","originalCan","canWithParametrizedAction","args","apply"],"mappings":";;;;;AAYA,MAAMA,iBAAAA,GAAoB;AACxB,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,KAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,SAAA;AACA,IAAA;AACD,CAAA;AAED,MAAMC,UAAAA,GAAaC,KAAKF,iBAAAA,EAAmBG,IAAAA,CAAAA;AAE3C,MAAMC,oBAAoB,CAACC,UAAAA,GAAAA;IACzB,OAAOF,IAAAA,CAAKG,iBAAiB,CAACD,UAAAA,EAAY;AAAEJ,QAAAA;AAAW,KAAA,CAAA;AACzD,CAAA;AAEA,MAAMM,0BAA0B,CAAC,EAAEC,IAAI,EAAEC,MAAM,EAAsB,GAAA;AACnE,IAAA,OAAO,GAAGD,IAAAA,CAAK,CAAC,EAAEE,EAAAA,CAAGC,SAAS,CAACF,MAAAA,CAAAA,CAAAA,CAAS;AAC1C,CAAA;AAEA;;UAGaG,kBAAAA,GAAqB,IAAA;IAChC,MAAM,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGC,IAAAA,EAAM,GAAG,IAAIC,cAAAA,CAAeC,OAAAA,CAAAA;IAEnD,OAAO;AACLJ,QAAAA,GAAAA,CAAAA,CAAIK,UAA0B,EAAA;YAC5B,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,UAAAA,GAAa,EAAE,EAAEC,SAAS,EAAE,GAAGJ,UAAAA;YACxD,MAAM,EAAEK,MAAM,EAAE,GAAGF,UAAAA;AAEnB,YAAA,MAAMG,UAAAA,GAAa,OAAOL,MAAAA,KAAW,QAAA,GAAWA,SAASZ,uBAAAA,CAAwBY,MAAAA,CAAAA;YAEjF,OAAON,GAAAA,CACLW,YACAC,KAAAA,CAAML,OAAAA,CAAAA,GAAW,QAAQA,OAAAA,EACzBG,MAAAA,EACAG,QAAAA,CAASJ,SAAAA,CAAAA,GAAaA,SAAAA,GAAYK,SAAAA,CAAAA;AAEtC,QAAA,CAAA;AAEApB,QAAAA,uBAAAA,CAAAA,CAAwB,EAAEC,IAAI,EAAEC,MAAM,EAAsB,EAAA;AAC1D,YAAA,OAAO,GAAGD,IAAAA,CAAK,CAAC,EAAEE,EAAAA,CAAGC,SAAS,CAACF,MAAAA,CAAAA,CAAAA,CAAS;AAC1C,QAAA,CAAA;AAEAK,QAAAA,KAAAA,CAAAA,GAAAA;AACE,YAAA,MAAMc,UAAUd,KAAAA,CAAM;AAAEV,gBAAAA;AAAkB,aAAA,CAAA;AAE1C,YAAA,SAASyB,YAAYC,WAA2B,EAAA;gBAC9C,OAAO,SAASC,yBAAAA,CAA0B,GAAGC,IAAgC,EAAA;AAC3E,oBAAA,MAAM,CAACb,MAAAA,EAAQ,GAAGJ,IAAAA,CAAK,GAAGiB,IAAAA;AAC1B,oBAAA,MAAMR,UAAAA,GAAa,OAAOL,MAAAA,KAAW,QAAA,GAAWA,SAASZ,uBAAAA,CAAwBY,MAAAA,CAAAA;;oBAGjF,OAAOW,WAAAA,CAAYG,KAAK,CAACL,OAAAA,EAAS;AAACJ,wBAAAA,UAAAA;AAAeT,wBAAAA,GAAAA;AAAK,qBAAA,CAAA;AACzD,gBAAA,CAAA;AACF,YAAA;AAEAa,YAAAA,OAAAA,CAAQf,GAAG,GAAGgB,WAAAA,CAAYD,OAAAA,CAAQf,GAAG,CAAA;YACrC,OAAOe,OAAAA;AACT,QAAA,CAAA;AAEA,QAAA,GAAGb;AACL,KAAA;AACF;;;;"}
1
+ {"version":3,"file":"casl-ability.mjs","sources":["../../../src/engine/abilities/casl-ability.ts"],"sourcesContent":["import * as sift from 'sift';\nimport qs from 'qs';\nimport { AbilityBuilder, Ability } from '@casl/ability';\nimport { pick, isNil, isObject } from 'lodash/fp';\nimport type { ParametrizedAction, PermissionRule } from '../../types';\n\nexport interface CustomAbilityBuilder {\n can(permission: PermissionRule): ReturnType<AbilityBuilder<Ability>['can']>;\n buildParametrizedAction: (parametrizedAction: ParametrizedAction) => string;\n build(): Ability;\n}\n\nconst allowedOperations = [\n '$or',\n '$and',\n '$eq',\n '$ne',\n '$in',\n '$nin',\n '$lt',\n '$lte',\n '$gt',\n '$gte',\n '$exists',\n '$elemMatch',\n] as const;\n\nconst operations = pick(allowedOperations, sift);\n\n/**\n * Match an RBAC condition query against an entity in memory with sift.\n */\nconst conditionsMatcher = (conditions: unknown) => {\n try {\n return sift.createQueryTester(conditions, { operations });\n } catch (error) {\n if (error instanceof Error) {\n const [, operator] = error.message.match(/^Unsupported operation: (.+)$/) ?? [];\n\n if (operator) {\n throw new Error(\n `RBAC condition uses unsupported operator \"${operator}\". Conditions are matched in memory and support only: ${allowedOperations.join(\n ', '\n )}.`\n );\n }\n }\n\n throw error;\n }\n};\n\nconst buildParametrizedAction = ({ name, params }: ParametrizedAction) => {\n return `${name}?${qs.stringify(params)}`;\n};\n\n/**\n * Casl Ability Builder.\n */\nexport const caslAbilityBuilder = (): CustomAbilityBuilder => {\n const { can, build, ...rest } = new AbilityBuilder(Ability);\n\n return {\n can(permission: PermissionRule) {\n const { action, subject, properties = {}, condition } = permission;\n const { fields } = properties;\n\n const caslAction = typeof action === 'string' ? action : buildParametrizedAction(action);\n\n return can(\n caslAction,\n isNil(subject) ? 'all' : subject,\n fields,\n isObject(condition) ? condition : undefined\n );\n },\n\n buildParametrizedAction({ name, params }: ParametrizedAction) {\n return `${name}?${qs.stringify(params)}`;\n },\n\n build() {\n const ability = build({ conditionsMatcher });\n\n function decorateCan(originalCan: Ability['can']) {\n return function canWithParametrizedAction(...args: Parameters<Ability['can']>) {\n const [action, ...rest] = args;\n const caslAction = typeof action === 'string' ? action : buildParametrizedAction(action);\n\n // Call the original `can` method\n return originalCan.apply(ability, [caslAction, ...rest]);\n };\n }\n\n ability.can = decorateCan(ability.can);\n return ability;\n },\n\n ...rest,\n };\n};\n"],"names":["allowedOperations","operations","pick","sift","conditionsMatcher","conditions","createQueryTester","error","Error","operator","message","match","join","buildParametrizedAction","name","params","qs","stringify","caslAbilityBuilder","can","build","rest","AbilityBuilder","Ability","permission","action","subject","properties","condition","fields","caslAction","isNil","isObject","undefined","ability","decorateCan","originalCan","canWithParametrizedAction","args","apply"],"mappings":";;;;;AAYA,MAAMA,iBAAAA,GAAoB;AACxB,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,KAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,KAAA;AACA,IAAA,MAAA;AACA,IAAA,SAAA;AACA,IAAA;AACD,CAAA;AAED,MAAMC,UAAAA,GAAaC,KAAKF,iBAAAA,EAAmBG,IAAAA,CAAAA;AAE3C;;IAGA,MAAMC,oBAAoB,CAACC,UAAAA,GAAAA;IACzB,IAAI;QACF,OAAOF,IAAAA,CAAKG,iBAAiB,CAACD,UAAAA,EAAY;AAAEJ,YAAAA;AAAW,SAAA,CAAA;AACzD,IAAA,CAAA,CAAE,OAAOM,KAAAA,EAAO;AACd,QAAA,IAAIA,iBAAiBC,KAAAA,EAAO;YAC1B,MAAM,GAAGC,SAAS,GAAGF,KAAAA,CAAMG,OAAO,CAACC,KAAK,CAAC,+BAAA,CAAA,IAAoC,EAAE;AAE/E,YAAA,IAAIF,QAAAA,EAAU;AACZ,gBAAA,MAAM,IAAID,KAAAA,CACR,CAAC,0CAA0C,EAAEC,QAAAA,CAAS,sDAAsD,EAAET,iBAAAA,CAAkBY,IAAI,CAClI,IAAA,CAAA,CACA,CAAC,CAAC,CAAA;AAER,YAAA;AACF,QAAA;QAEA,MAAML,KAAAA;AACR,IAAA;AACF,CAAA;AAEA,MAAMM,0BAA0B,CAAC,EAAEC,IAAI,EAAEC,MAAM,EAAsB,GAAA;AACnE,IAAA,OAAO,GAAGD,IAAAA,CAAK,CAAC,EAAEE,EAAAA,CAAGC,SAAS,CAACF,MAAAA,CAAAA,CAAAA,CAAS;AAC1C,CAAA;AAEA;;UAGaG,kBAAAA,GAAqB,IAAA;IAChC,MAAM,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGC,IAAAA,EAAM,GAAG,IAAIC,cAAAA,CAAeC,OAAAA,CAAAA;IAEnD,OAAO;AACLJ,QAAAA,GAAAA,CAAAA,CAAIK,UAA0B,EAAA;YAC5B,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,UAAAA,GAAa,EAAE,EAAEC,SAAS,EAAE,GAAGJ,UAAAA;YACxD,MAAM,EAAEK,MAAM,EAAE,GAAGF,UAAAA;AAEnB,YAAA,MAAMG,UAAAA,GAAa,OAAOL,MAAAA,KAAW,QAAA,GAAWA,SAASZ,uBAAAA,CAAwBY,MAAAA,CAAAA;YAEjF,OAAON,GAAAA,CACLW,YACAC,KAAAA,CAAML,OAAAA,CAAAA,GAAW,QAAQA,OAAAA,EACzBG,MAAAA,EACAG,QAAAA,CAASJ,SAAAA,CAAAA,GAAaA,SAAAA,GAAYK,SAAAA,CAAAA;AAEtC,QAAA,CAAA;AAEApB,QAAAA,uBAAAA,CAAAA,CAAwB,EAAEC,IAAI,EAAEC,MAAM,EAAsB,EAAA;AAC1D,YAAA,OAAO,GAAGD,IAAAA,CAAK,CAAC,EAAEE,EAAAA,CAAGC,SAAS,CAACF,MAAAA,CAAAA,CAAAA,CAAS;AAC1C,QAAA,CAAA;AAEAK,QAAAA,KAAAA,CAAAA,GAAAA;AACE,YAAA,MAAMc,UAAUd,KAAAA,CAAM;AAAEhB,gBAAAA;AAAkB,aAAA,CAAA;AAE1C,YAAA,SAAS+B,YAAYC,WAA2B,EAAA;gBAC9C,OAAO,SAASC,yBAAAA,CAA0B,GAAGC,IAAgC,EAAA;AAC3E,oBAAA,MAAM,CAACb,MAAAA,EAAQ,GAAGJ,IAAAA,CAAK,GAAGiB,IAAAA;AAC1B,oBAAA,MAAMR,UAAAA,GAAa,OAAOL,MAAAA,KAAW,QAAA,GAAWA,SAASZ,uBAAAA,CAAwBY,MAAAA,CAAAA;;oBAGjF,OAAOW,WAAAA,CAAYG,KAAK,CAACL,OAAAA,EAAS;AAACJ,wBAAAA,UAAAA;AAAeT,wBAAAA,GAAAA;AAAK,qBAAA,CAAA;AACzD,gBAAA,CAAA;AACF,YAAA;AAEAa,YAAAA,OAAAA,CAAQf,GAAG,GAAGgB,WAAAA,CAAYD,OAAAA,CAAQf,GAAG,CAAA;YACrC,OAAOe,OAAAA;AACT,QAAA,CAAA;AAEA,QAAA,GAAGb;AACL,KAAA;AACF;;;;"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@strapi/permissions",
3
- "version": "5.52.0",
3
+ "version": "5.52.2",
4
4
  "description": "Strapi's permission layer.",
5
5
  "homepage": "https://strapi.io",
6
6
  "bugs": {
@@ -44,17 +44,17 @@
44
44
  },
45
45
  "dependencies": {
46
46
  "@casl/ability": "6.7.5",
47
- "@strapi/utils": "5.52.0",
47
+ "@strapi/utils": "5.52.2",
48
48
  "lodash": "4.18.1",
49
49
  "qs": "6.15.3",
50
50
  "sift": "16.0.1"
51
51
  },
52
52
  "devDependencies": {
53
53
  "@types/node": "20.19.41",
54
- "eslint-config-custom": "5.52.0",
55
- "tsconfig": "5.52.0",
54
+ "eslint-config-custom": "5.52.2",
55
+ "tsconfig": "5.52.2",
56
56
  "vitest": "catalog:",
57
- "vitest-config": "5.52.0"
57
+ "vitest-config": "5.52.2"
58
58
  },
59
59
  "engines": {
60
60
  "node": ">=20.0.0 <=26.x.x",