@svadmin/core 0.17.1 → 0.18.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/core",
-  "version": "0.17.1",
+  "version": "0.18.1",
   "author": "zuohuadong",
   "repository": {
     "type": "git",

package/src/adapters/casbin.ts

@@ -48,13 +48,20 @@ export function createCasbinAccessControl(
   options: CasbinAdapterOptions,
 ): AccessControlProvider {
   return {
-    can: async ({ resource, action }: CanParams): Promise<CanResult> => {
-      const user = options.getUser();
-      const allowed = await enforcer.enforce(user, resource, action);
-      return {
-        can: allowed,
-        reason: allowed ? undefined : `User "${user}" cannot "${action}" on "${resource}"`,
+    can: async (params: CanParams | CanParams[]): Promise<CanResult | CanResult[]> => {
+      const executeCheck = async ({ resource, action }: CanParams) => {
+        const user = options.getUser();
+        const allowed = await enforcer.enforce(user, resource, action);
+        return {
+          can: allowed,
+          reason: allowed ? undefined : `User "${user}" cannot "${action}" on "${resource}"`,
+        };
       };
+
+      if (Array.isArray(params)) {
+        return Promise.all(params.map(p => executeCheck(p)));
+      }
+      return executeCheck(params);
     },
     options: options.providerOptions,
   };

package/src/adapters/casl.ts

@@ -38,13 +38,22 @@ export function createCaslAccessControl(
   options?: AccessControlProvider['options'],
 ): AccessControlProvider {
   return {
-    can: async ({ resource, action, params }: CanParams): Promise<CanResult> => {
-      const field = params?.field as string | undefined;
-      const allowed = ability.can(action, resource, field);
-      return {
-        can: allowed,
-        reason: allowed ? undefined : `Cannot "${action}" on "${resource}"${field ? ` (field: ${field})` : ''}`,
+    can: async (params: CanParams | CanParams[]): Promise<CanResult | CanResult[]> => {
+      const executeCheck = async ({ resource, action, params: actionParams }: CanParams) => {
+        const field = actionParams?.field as string | undefined;
+        // CaslAbility's can only accepts string for subject based on its internal definition in this file
+        // To support object subjects when CanParams might pass them, cast it to any here to satisfy the local interface
+        const allowed = ability.can(action as string, resource as any, field);
+        return {
+          can: allowed,
+          reason: allowed ? undefined : `Cannot "${action}" on "${resource}"${field ? ` (field: ${field})` : ''}`,
+        };
       };
+
+      if (Array.isArray(params)) {
+        return Promise.all(params.map(p => executeCheck(p)));
+      }
+      return executeCheck(params);
     },
     options,
   };

package/src/auth-hooks.svelte.ts

@@ -266,17 +266,28 @@ export function useOnError() {
 
 /**
  * Fetches permissions from authProvider.getPermissions().
- * Returns a reactive object with data, isLoading, and error.
+ * Returns a reactive integrated object.
+ * 
+ * @example
+ * ```svelte
+ * <script>
+ *   import { usePermissions } from '@svadmin/core';
+ *   const perms = usePermissions();
+ *   const canAdmin = $derived(perms.has('admin'));
+ * </script>
+ * ```
  */
 export function usePermissions<T = unknown>() {
   const provider = getAuthProvider();
-  let data = $state<T | null>(null);
+  let permissions = $state<T | null>(null);
   let isLoading = $state(true);
   let error = $state<Error | null>(null);
+  let version = $state(0); // Force reactive invalidation
 
   if (provider?.getPermissions) {
-    provider.getPermissions().then(permissions => {
-      data = permissions as T;
+    provider.getPermissions().then(p => {
+      permissions = p as T;
+      version++;
       isLoading = false;
     }).catch(err => {
       error = err instanceof Error ? err : new Error(String(err));
@@ -288,66 +299,28 @@ export function usePermissions<T = unknown>() {
   }
 
   return {
-    get data() { return data; },
     get isLoading() { return isLoading; },
     get error() { return error; },
+    get version() { return version; },
+    
+    /** Get the raw permissions data */
+    get raw() { return permissions; },
+
+    /** Convenience: check if a specific permission exists */
+    has(perm: string): boolean {
+      if (!permissions) return false;
+      if (Array.isArray(permissions)) return permissions.includes(perm);
+      if (permissions instanceof Set) return (permissions as Set<string>).has(perm);
+      if (typeof permissions === 'object') return !!(permissions as Record<string, boolean>)[perm];
+      return false;
+    },
+
+    /** Convenience: check resource action (Casbin style representation if applicable) */
+    can(resource: string, action: string): boolean {
+      // Tries to map to a standard permission string format like "resource:action" 
+      // Replace with your own logic if your permissions are structured differently.
+      return this.has(`${resource}:${action}`);
+    }
   };
 }
 
-// ─── useHasPermission ────────────────────────────────────────
-
-/**
- * Reactive permission checker — returns a closure that re-evaluates
- * when the underlying permissions data changes.
- *
- * Works with Casbin-style permission arrays, Sets, or permission objects.
- * The returned function is safe to use inside `$derived()` for reactive UI updates.
- *
- * @example
- * ```svelte
- * <script>
- *   import { useHasPermission } from '@svadmin/core';
- *
- *   const hasPermission = useHasPermission();
- *   // ✅ Reactive — UI updates when permissions finish loading
- *   const canDelete = $derived(hasPermission('admin'));
- *   const canExport = $derived(hasPermission('data:export'));
- * </script>
- *
- * {#if canDelete}
- *   <Button variant="destructive">Delete</Button>
- * {/if}
- * ```
- */
-export function useHasPermission() {
-  const provider = getAuthProvider();
-  let permissions = $state<unknown>(null);
-  let loaded = $state(false);
-
-  if (provider?.getPermissions) {
-    provider.getPermissions().then(p => {
-      permissions = p;
-      loaded = true;
-    }).catch(err => {
-      console.warn('[svadmin] useHasPermission: getPermissions failed', err);
-      loaded = true;
-    });
-  } else {
-    loaded = true;
-  }
-
-  /**
-   * Check if the current user has a specific permission.
-   * Supports: `string[]`, `Set<string>`, `Record<string, boolean>`, or any object with `.includes` / `.has`.
-   */
-  function hasPermission(perm: string): boolean {
-    if (!loaded || permissions == null) return false;
-    if (Array.isArray(permissions)) return permissions.includes(perm);
-    if (permissions instanceof Set) return (permissions as Set<string>).has(perm);
-    if (typeof permissions === 'object') return !!(permissions as Record<string, boolean>)[perm];
-    return false;
-  }
-
-  return hasPermission;
-}
-

package/src/index.ts

@@ -78,7 +78,7 @@ export {
   useLogin, useLogout,
   useRegister, useForgotPassword, useUpdatePassword,
   useGetIdentity, useIsAuthenticated,
-  useOnError, usePermissions, useHasPermission,
+  useOnError, usePermissions,
 } from './auth-hooks.svelte';
 export { useParsed } from './useParsed.svelte';
 export * from './useStepsForm.svelte';

package/src/permissions.test.ts

@@ -27,7 +27,7 @@ describe('permissions', () => {
       can: async () => ({ can: true }),
     });
     const result = await canAccessAsync('posts', 'edit');
-    expect(result.can).toBe(true);
+    expect((result as any).can).toBe(true);
   });
 
   test('canAccessAsync resolves with denied status', async () => {
@@ -35,8 +35,8 @@ describe('permissions', () => {
       can: async () => ({ can: false, reason: 'No permission' }),
     });
     const result = await canAccessAsync('users', 'delete');
-    expect(result.can).toBe(false);
-    expect(result.reason).toBe('No permission');
+    expect((result as any).can).toBe(false);
+    expect((result as any).reason).toBe('No permission');
   });
 
   test('resource-specific rules', async () => {
@@ -89,8 +89,8 @@ describe('AccessControlProvider', () => {
       },
     });
     const result = await canAccessAsync('posts', 'edit', { id: 42 });
-    expect(result.can).toBe(false);
-    expect(result.reason).toBe('Record locked');
+    expect((result as any).can).toBe(false);
+    expect((result as any).reason).toBe('Record locked');
   });
 
   test('extended action types work', async () => {

package/src/permissions.ts

@@ -38,7 +38,7 @@ export interface CanResult {
  * ```
  */
 export interface AccessControlProvider {
-  can: (params: CanParams) => Promise<CanResult>;
+  can: (params: CanParams | CanParams[]) => Promise<CanResult | CanResult[]>;
   options?: {
     buttons?: {
       /** Enable access control checks on CRUD buttons globally. Default: false */
@@ -73,9 +73,21 @@ export function getAccessControlOptions() {
 }
 
 /**
- * Async access check. Returns `{ can: true }` if no provider is registered.
+ * Async access check. 
+ * Supports both single capability requests or an array of batched checks.
  */
-export async function canAccessAsync(resource: string, action: Action, params?: Record<string, unknown>): Promise<CanResult> {
-  if (!provider) return { can: true };
-  return provider.can({ resource, action, params });
+export async function canAccessAsync(params: CanParams[]): Promise<CanResult[]>;
+export async function canAccessAsync(resource: string, action: Action, params?: Record<string, unknown>): Promise<CanResult>;
+export async function canAccessAsync(resourceOrBatch: string | CanParams[], action?: Action, params?: Record<string, unknown>): Promise<CanResult | CanResult[]> {
+  if (!provider) {
+    return Array.isArray(resourceOrBatch)
+      ? resourceOrBatch.map(() => ({ can: true }))
+      : { can: true };
+  }
+  
+  if (Array.isArray(resourceOrBatch)) {
+    return provider.can(resourceOrBatch);
+  }
+  
+  return provider.can({ resource: resourceOrBatch, action: action!, params }) as Promise<CanResult>;
 }