@universis/janitor 2.4.4 → 2.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@universis/janitor",
-  "version": "2.4.4",
+  "version": "2.5.0",
   "description": "Universis api plugin for handling user authorization and rate limiting",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/EnableReadAccessScope.d.ts

@@ -0,0 +1,6 @@
+import {ApplicationService} from '@themost/common';
+
+export declare class EnableReadAccessScope extends ApplicationService {
+    readonly clientScopes: string[];
+    protected enable(clientScope: string): void;
+}

package/src/EnableReadAccessScope.js

@@ -0,0 +1,133 @@
+import {ApplicationService, TraceUtils} from '@themost/common';
+import {SchemaLoaderStrategy} from '@themost/data';
+import {ScopeAccessConfiguration} from './ScopeAccessConfiguration';
+
+class EnableReadAccessScope extends ApplicationService {
+    /**
+     *
+     * @param {import('@themost/express').ExpressDataApplication|import('@themost/common').ApplicationBase} app
+     */
+    constructor(app) {
+        super(app);
+        /**
+         * @type {import('rxjs').Observable<import('express').Application>}
+         */
+        const container = app && app.container;
+        if (container) {
+            container.subscribe((container) => {
+                if (container) {
+                    for (const scope of this.clientScopes) {
+                        this.enable(scope);
+                    }
+                }
+            });
+        }
+    }
+
+    get clientScopes() {
+        return [
+            'students',
+            'teachers',
+            'registrar'
+        ];
+    }
+
+    /**
+     * @protected
+     * @param {string} scope
+     */
+    enable(scope) {
+        const searchScope = scope;
+        const targetScope = scope + ':read';
+        // get schema loader strategy for enumerating models
+        const schemaLoader = this.getApplication().getConfiguration().getStrategy(SchemaLoaderStrategy)
+        if (schemaLoader) {
+            const models = schemaLoader.getModels();
+            let updated = 0;
+            // enumerate models that includes scope based privileges
+            // where mask is 1 (read)
+            for (const model of models) {
+                /**
+                 * @type {import('@themost/common').DataModelProperties}
+                 */
+                const definition = schemaLoader.getModelDefinition(model);
+                if (Array.isArray(definition.privileges)) {
+                    const privileges = definition.privileges.filter((item) => {
+                        return item.mask === 1 && Array.isArray(item.scope) && item.scope.includes(searchScope);
+                    });
+                    let shouldUpdate = false;
+                    if (privileges.length > 0) {
+                        shouldUpdate = true;
+                        // add target scope to privileges
+                        for (const privilege of privileges) {
+                            if (!privilege.scope.includes((targetScope))) {
+                                privilege.scope.push(targetScope);
+                            }
+                        }
+                    }
+                    // get fields that includes scope based privileges
+                    const fields = definition.fields.filter((item) => {
+                        return Array.isArray(item.privileges);
+                    }).filter((item => {
+                        const privileges = item.privileges.filter((privilege) => {
+                            return privilege.mask === 1 && Array.isArray(privilege.scope) && privilege.scope.includes(searchScope);
+                        });
+                        return privileges.length > 0;
+                    }));
+                    if (fields.length > 0) {
+                        shouldUpdate = true;
+                        for (const field of fields) {
+                            const privileges = field.privileges.filter((privilege) => {
+                                return privilege.mask === 1 && Array.isArray(privilege.scope) && privilege.scope.includes(searchScope);
+                            });
+                            for (const privilege of privileges) {
+                                if (!privilege.scope.includes((targetScope))) {
+                                    privilege.scope.push(targetScope);
+                                }
+                            }
+                        }
+                    }
+                    if (shouldUpdate) {
+                        updated++;
+                        // update model definition
+                        schemaLoader.setModelDefinition(definition);
+                    }
+                }
+            }
+            if (updated > 0) {
+                TraceUtils.log(`${this.constructor.name}: Updated ${updated} model definition(s) to include scope "${targetScope}"`);
+            }
+        }
+
+        const scopeConfiguration = this.getApplication().getConfiguration().getStrategy(ScopeAccessConfiguration);
+        if (scopeConfiguration) {
+            const elements= scopeConfiguration.elements
+                .filter((item) => item.scope.includes(searchScope))
+                .filter((item) => item.access.includes('read'));
+            if (elements.length > 0) {
+                const insertElements = [];
+                for (const element of elements) {
+                    insertElements.push({
+                        insertAfter: element,
+                        resource: element.resource,
+                        scope: [targetScope],
+                        access: ['read']
+                    });
+                }
+                for (const { insertAfter, resource, scope, access } of insertElements) {
+                    const index = scopeConfiguration.elements.findIndex((element) => element === insertAfter);
+                    scopeConfiguration.elements.splice(index + 1, 0, {
+                        resource,
+                        scope,
+                        access
+                    });
+                }
+                TraceUtils.log(`${this.constructor.name}: Updated ${elements.length} scope access configuration(s) to include scope "${targetScope}"`);
+            }
+        }
+    }
+}
+
+export {
+    EnableReadAccessScope
+}

package/src/index.d.ts

@@ -13,4 +13,5 @@ export * from './outputCacheRouter';
 export * from './OutputCachingService';
 export * from './VerifyUserClientScope';
 export * from './UserWithNetworkAddress';
-export * from './NetworkRestrictAccess';
+export * from './NetworkRestrictAccess';
+export * from './EnableReadAccessScope';

package/src/index.js

@@ -15,3 +15,4 @@ export * from './OutputCachingService';
 export * from './VerifyUserClientScope';
 export * from './UserWithNetworkAddress';
 export * from './NetworkRestrictAccess';
+export * from './EnableReadAccessScope';