@things-factory/auth-base 6.0.49 → 6.0.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "6.0.49",
+  "version": "6.0.53",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -41,5 +41,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "e107d6f692d008add950e000d2653bcbbd711a24"
+  "gitHead": "1b60f52b7e043286423881b8fb41f1fa08f9ba6d"
 }

package/server/index.ts

@@ -1,3 +1,6 @@
+import { getRepository } from '@things-factory/shell'
+import { Privilege } from './service/privilege/privilege'
+
 import './routes'
 
 export * from './service'
@@ -15,3 +18,16 @@ export * from './utils/access-token-cookie'
 export * from './errors'
 
 export * from './types'
+
+process.on('bootstrap-module-start' as any, async ({ app, config, client }: any) => {
+  const privileges = process['PRIVILEGES']
+  const privilegeRepository = getRepository(Privilege)
+
+  for (const [category, name] of Object.values(privileges as [string, string])) {
+    if (0 == (await privilegeRepository.count({ where: { category, name } }))) {
+      await privilegeRepository.save({ category, name })
+    }
+  }
+
+  console.log('[auth-base:bootstrap] Synchronization for privilege master has just done.')
+})

package/server/service/privilege/privilege-directive.ts

@@ -2,8 +2,6 @@ import { defaultFieldResolver, GraphQLSchema } from 'graphql'
 import gql from 'graphql-tag'
 
 import { getDirective, MapperKind, mapSchema } from '@graphql-tools/utils'
-import { getRepository } from '@things-factory/shell'
-
 import { User } from '../user/user'
 
 process['PRIVILEGES'] = {}
@@ -47,40 +45,7 @@ export const privilegeDirectiveResolver = (schema: GraphQLSchema) =>
 
           if (!category || !privilege) throw new Error(`Unauthorized!`)
 
-          const result = await getRepository(User).query(
-            `
-                  SELECT 
-                    COUNT(1) AS has_privilege
-                  FROM
-                    privileges
-                  WHERE
-                    category = '${category}'
-                  AND
-                    name = '${privilege}'
-                  AND
-                    id
-                  IN (
-                    SELECT
-                      RP.privileges_id
-                    FROM
-                      users_roles UR
-                    INNER JOIN
-                      roles_privileges RP
-                    ON
-                      UR.roles_id = RP.roles_id
-                    LEFT JOIN
-                      roles R
-                    ON
-                      R.id = UR.roles_id
-                    WHERE
-                      UR.users_id = '${user?.id}'
-                    AND
-                      R.domain_id = '${domain?.id}'
-                  )
-                `
-          )
-
-          if (result[0].has_privilege > 0) {
+          if (await User.hasPrivilege(privilege, category, domain, user)) {
             return await resolve.call(this, source, args, context, info)
           } else {
             throw new Error(`Unauthorized!`)

package/server/service/privilege/privilege-mutation.ts

@@ -1,4 +1,4 @@
-import { Arg, Ctx, Mutation, Resolver } from 'type-graphql'
+import { Arg, Ctx, Mutation, Resolver, Directive } from 'type-graphql'
 import { In } from 'typeorm'
 
 import { getRepository } from '@things-factory/shell'
@@ -9,14 +9,35 @@ import { NewPrivilege, PrivilegePatch } from './privilege-types'
 
 @Resolver(Privilege)
 export class PrivilegeMutation {
+  @Directive('@privilege(superUserGranted:true)')
+  @Mutation(returns => Boolean, {
+    description: 'To synchronize privilege master from API schema.'
+  })
+  async synchronizePrivilegeMaster(
+    @Arg('privilege') privilege: NewPrivilege,
+    @Ctx() context: ResolverContext
+  ): Promise<Boolean> {
+    const privileges = process['PRIVILEGES']
+    const privilegeRepository = getRepository(Privilege)
+
+    for (const [category, name] of Object.values(privileges as [string, string])) {
+      if (0 == (await privilegeRepository.count({ where: { category, name } }))) {
+        await privilegeRepository.save({ category, name })
+      }
+    }
+
+    return true
+  }
+
+  @Directive('@privilege(superUserGranted:true)')
   @Mutation(returns => Privilege, { description: 'To create new privilege' })
   async createPrivilege(
     @Arg('privilege') privilege: NewPrivilege,
     @Ctx() context: ResolverContext
   ): Promise<Privilege> {
     if (privilege.roles && privilege.roles.length) {
-      privilege.roles = await getRepository(Role).findBy({ 
-        id: In(privilege.roles.map((role: Partial<Role>) => role.id)) 
+      privilege.roles = await getRepository(Role).findBy({
+        id: In(privilege.roles.map((role: Partial<Role>) => role.id))
       })
     }
 
@@ -27,6 +48,7 @@ export class PrivilegeMutation {
     })
   }
 
+  @Directive('@privilege(superUserGranted:true)')
   @Mutation(returns => Privilege, { description: 'To modify privilege information' })
   async updatePrivilege(
     @Arg('name') name: string,
@@ -57,6 +79,7 @@ export class PrivilegeMutation {
     })
   }
 
+  @Directive('@privilege(superUserGranted:true)')
   @Mutation(returns => Boolean, { description: 'To delete privilege' })
   async deletePrivilege(
     @Arg('name') name: string,

package/server/service/privilege/privilege-query.ts

@@ -1,6 +1,5 @@
-import { Arg, Args, Ctx, FieldResolver, Query, Resolver, Root } from 'type-graphql'
-
-import { buildQuery, getRepository, ListParam } from '@things-factory/shell'
+import { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'
+import { getQueryBuilderFromListParams, getRepository, ListParam } from '@things-factory/shell'
 
 import { Role } from '../role/role'
 import { User } from '../user/user'
@@ -9,6 +8,7 @@ import { PrivilegeList } from './privilege-types'
 
 @Resolver(Privilege)
 export class PrivilegeQuery {
+  @Directive('@privilege(category: "privilege", privilege: "query", domainOwnerGranted: true, superUserGranted: true)')
   @Query(returns => Privilege, { description: 'To fetch privilege' })
   async privilege(@Arg('name') name: string, @Arg('category') category: string): Promise<Privilege> {
     return await getRepository(Privilege).findOne({
@@ -16,16 +16,28 @@ export class PrivilegeQuery {
     })
   }
 
+  @Directive('@privilege(category: "privilege", privilege: "query", domainOwnerGranted: true, superUserGranted: true)')
   @Query(returns => PrivilegeList, { description: 'To fetch multiple privileges' })
   async privileges(@Args() params: ListParam, @Ctx() context: ResolverContext): Promise<PrivilegeList> {
-    const queryBuilder = getRepository(Privilege).createQueryBuilder()
-    buildQuery(queryBuilder, params, context, { domainRef: false })
-
-    const [items, total] = await queryBuilder.getManyAndCount()
+    const [items, total] = await getQueryBuilderFromListParams({
+      params,
+      repository: getRepository(Privilege),
+      searchables: ['name', 'category']
+    }).getManyAndCount()
 
     return { items, total }
   }
 
+  @Query(returns => Boolean, { description: 'To query whether I have the given permission' })
+  async hasPrivilege(
+    @Arg('name') name: string,
+    @Arg('category') category: string,
+    @Ctx() context: ResolverContext
+  ): Promise<Boolean> {
+    const { domain, user } = context.state
+    return await User.hasPrivilege(name, category, domain, user)
+  }
+
   @FieldResolver(type => String)
   async description(@Root() privilege: Privilege, @Ctx() context: ResolverContext) {
     const { t } = context

package/server/service/user/user.ts

@@ -5,7 +5,6 @@ import {
   Column,
   CreateDateColumn,
   Entity,
-  getRepository,
   Index,
   JoinTable,
   ManyToMany,
@@ -16,7 +15,7 @@ import {
 } from 'typeorm'
 
 import { config } from '@things-factory/env'
-import { Domain } from '@things-factory/shell'
+import { Domain, getRepository } from '@things-factory/shell'
 
 import { validatePasswordByRule } from '../../controllers/utils/password-rule'
 import { AuthError } from '../../errors/auth-error'
@@ -248,4 +247,23 @@ export class User {
       return user
     }
   }
+
+  static async hasPrivilege(name: string, category: string, domain: Domain, user: User) {
+    const result = await getRepository(User).query(
+      `SELECT COUNT(1) AS has_privilege FROM privileges
+       WHERE category = '${category}'
+        AND name = '${name}'
+        AND id IN (
+          SELECT RP.privileges_id
+          FROM users_roles UR
+          INNER JOIN roles_privileges RP ON UR.roles_id = RP.roles_id
+          LEFT JOIN roles R ON R.id = UR.roles_id
+          WHERE UR.users_id = '${user?.id}'
+          AND R.domain_id = '${domain?.id}'
+        )
+      `
+    )
+
+    return result[0].has_privilege > 0
+  }
 }