@teamkeel/functions-runtime 0.298.0 → 0.300.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teamkeel/functions-runtime",
-  "version": "0.298.0",
+  "version": "0.300.0",
   "description": "Internal package used by @teamkeel/sdk",
   "main": "src/index.js",
   "scripts": {

package/src/handleRequest.js

@@ -47,6 +47,7 @@ async function handleRequest(request, config) {
     const result = await db.transaction().execute(async (transaction) => {
       const ctx = createContextAPI(request.meta);
       const api = createFunctionAPI({
+        meta: request.meta,
         headers,
         db: transaction,
       });
@@ -56,7 +57,7 @@ async function handleRequest(request, config) {
       // Call the user's custom function!
       const fnResult = await customFunction(request.params, api, ctx);
 
-      // api.permissions maintains an internal state of whether the current operation has been *explicitly* permitted/denied by the user in the course of their custom function.
+      // api.permissions maintains an internal state of whether the current operation has been *explicitly* permitted/denied by the user in the course of their custom function, or if execution has already been permitted by a role based permission (evaluated in the main runtime).
       // we need to check that the final state is permitted or unpermitted. if it's not, then it means that the user has taken no explicit action to permit/deny
       // and therefore we default to checking the permissions defined in the schema automatically.
       switch (api.permissions.getState()) {

package/src/handleRequest.test.js

@@ -140,6 +140,40 @@ test("when there is an unexpected error in the custom function", async () => {
   });
 });
 
+test("when a role based permission has already been granted by the main runtime", async () => {
+  const config = {
+    functions: {
+      createPost: async (inputs, api, ctx) => {
+        return {
+          title: inputs.title,
+        };
+      },
+    },
+    actionTypes: {
+      createPost: PROTO_ACTION_TYPES.CREATE,
+    },
+    createFunctionAPI: ({ headers, db }) => {
+      return {
+        permissions: new Permissions({ status: "granted", reason: "role" }),
+      };
+    },
+    createContextAPI: () => {},
+  };
+
+  const rpcReq = createJSONRPCRequest("123", "createPost", { title: "a post" });
+
+  expect(await handleRequest(rpcReq, config)).toEqual({
+    id: "123",
+    jsonrpc: "2.0",
+    result: {
+      title: "a post",
+    },
+    meta: {
+      headers: {},
+    },
+  });
+});
+
 test("when there is an unexpected object thrown in the custom function", async () => {
   const config = {
     functions: {

package/src/permissions.js

@@ -6,12 +6,23 @@ const PERMISSION_STATE = {
   UNPERMITTED: "unpermitted",
 };
 
+const defaultState = {
+  status: "unknown",
+};
+
 class Permissions {
-  constructor() {
+  // The permissionState here is the prior state passed in from the Go runtime
+  // The Go runtime performs role based permission rule checks prior to calling the functions
+  // runtime, so the status could already be granted. If already granted, then we need to inherit that permission state as the state is later used to decide whether to run in process permission checks
+  // TLDR if a role based permission is relevant and it is granted, then it is effectively the same as the end user calling api.permissions.allow() explicitly in terms of behaviour.
+  constructor(permissionState = defaultState) {
     this.state = {
       // permitted starts off as null to indicate that the end user
       // hasn't explicitly marked a function execution as permitted yet
-      permitted: null,
+      permitted:
+        permissionState !== null && permissionState.status === "granted"
+          ? true
+          : null,
     };
   }
 

package/src/permissions.test.js

@@ -14,10 +14,13 @@ process.env.KEEL_DB_CONN = `postgresql://postgres:postgres@localhost:5432/functi
 let permissions;
 let ctx = {};
 let db = getDatabase();
+let permissionState = {
+  status: "unknown",
+};
 
 describe("explicit", () => {
   beforeEach(() => {
-    permissions = new Permissions();
+    permissions = new Permissions(permissionState);
   });
 
   test("explicitly allowing execution", () => {
@@ -37,6 +40,25 @@ describe("explicit", () => {
   });
 });
 
+describe("prior state", () => {
+  test("when the prior state is unknown", () => {
+    permissions = new Permissions({
+      status: "unknown",
+    });
+
+    expect(permissions.getState()).toEqual(PERMISSION_STATE.UNKNOWN);
+  });
+
+  test("when the prior state is granted", () => {
+    permissions = new Permissions({
+      status: "granted",
+      reason: "role",
+    });
+
+    expect(permissions.getState()).toEqual(PERMISSION_STATE.PERMITTED);
+  });
+});
+
 describe("check", () => {
   const functionName = "createPerson";