@teamkeel/functions-runtime 0.362.0 → 0.363.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teamkeel/functions-runtime",
-  "version": "0.362.0",
+  "version": "0.363.0",
   "description": "Internal package used by @teamkeel/sdk",
   "main": "src/index.js",
   "scripts": {

package/src/handleJob.js

@@ -9,6 +9,7 @@ const { errorToJSONRPCResponse, RuntimeErrors } = require("./errors");
 const opentelemetry = require("@opentelemetry/api");
 const { withSpan } = require("./tracing");
 const { PROTO_ACTION_TYPES } = require("./consts");
+const { tryExecuteJob } = require("./tryExecuteJob");
 
 // Generic handler function that is agnostic to runtime environment (local or lambda)
 // to execute a job function based on the contents of a jsonrpc-2.0 payload object.
@@ -58,7 +59,7 @@ async function handleJob(request, config) {
         // Jobs will have no permission functions yet.
         permissionFns[request.method] = [];
 
-        const result = await tryExecuteFunction(
+        await tryExecuteJob(
           { request, ctx, permissionFns, permitted, db, actionType },
           async () => {
             // Return the job function to the containing tryExecuteFunction block

package/src/tryExecuteJob.js

@@ -0,0 +1,25 @@
+const { withDatabase } = require("./database");
+const {
+  withPermissions,
+  PERMISSION_STATE,
+  PermissionError,
+} = require("./permissions");
+
+// tryExecuteJob will create a new database transaction around a function call
+// and handle any permissions checks. If a permission check fails, then an Error will be thrown and the catch block will be hit.
+function tryExecuteJob({ db, permitted, actionType, request }, cb) {
+  return withPermissions(permitted, async ({ getPermissionState }) => {
+    return withDatabase(db, actionType, async ({ transaction }) => {
+      await cb();
+
+      // api.permissions maintains an internal state of whether the current operation has been *explicitly* permitted/denied by the user in the course of their custom function, or if execution has already been permitted by a role based permission (evaluated in the main runtime).
+      // we need to check that the final state is permitted or unpermitted. if it's not, then it means that the user has taken no explicit action to permit/deny
+      // and therefore we default to checking the permissions defined in the schema automatically.
+      if (getPermissionState() === PERMISSION_STATE.UNPERMITTED) {
+        throw new PermissionError(`Not permitted to access ${request.method}`);
+      }
+    });
+  });
+}
+
+module.exports.tryExecuteJob = tryExecuteJob;