@universis/janitor 2.4.4 → 2.5.1

package/dist/index.js

@@ -1931,12 +1931,163 @@ class DisableNetworkRestrictAccess extends NetworkRestrictAccess {
   }
 }
 
+class EnableReadAccessScope extends common.ApplicationService {
+  /**
+   *
+   * @param {import('@themost/express').ExpressDataApplication|import('@themost/common').ApplicationBase} app
+   */
+  constructor(app) {
+    super(app);
+    /**
+     * @type {import('rxjs').Observable<import('express').Application>}
+     */
+    const container = app && app.container;
+    if (container) {
+      container.subscribe((container) => {
+        if (container) {
+          for (const scope of this.clientScopes) {
+            this.enable(scope);
+          }
+        }
+      });
+    }
+  }
+
+  get clientScopes() {
+    return [
+    'students',
+    'teachers',
+    'registrar'];
+
+  }
+
+  /**
+   * @protected
+   * @param {string} scope
+   */
+  enable(scope) {
+    const searchScope = scope;
+    const targetScope = scope + ':read';
+    // get schema loader strategy for enumerating models
+    const schemaLoader = this.getApplication().getConfiguration().getStrategy(data.SchemaLoaderStrategy);
+    if (schemaLoader) {
+      const models = schemaLoader.getModels();
+      let updated = 0;
+      // enumerate models that includes scope based privileges
+      // where mask is 1 (read)
+      for (const model of models) {
+        /**
+         * @type {import('@themost/common').DataModelProperties}
+         */
+        const definition = schemaLoader.getModelDefinition(model);
+        if (Array.isArray(definition.privileges)) {
+          const privileges = definition.privileges.filter((item) => {
+            return item.mask === 1 && Array.isArray(item.scope) && item.scope.includes(searchScope);
+          });
+          let shouldUpdate = false;
+          if (privileges.length > 0) {
+            shouldUpdate = true;
+            // add target scope to privileges
+            for (const privilege of privileges) {
+              if (!privilege.scope.includes(targetScope)) {
+                privilege.scope.push(targetScope);
+              }
+            }
+          }
+          // get fields that includes scope based privileges
+          const fields = definition.fields.filter((item) => {
+            return Array.isArray(item.privileges);
+          }).filter((item) => {
+            const privileges = item.privileges.filter((privilege) => {
+              return privilege.mask === 1 && Array.isArray(privilege.scope) && privilege.scope.includes(searchScope);
+            });
+            return privileges.length > 0;
+          });
+          if (fields.length > 0) {
+            shouldUpdate = true;
+            for (const field of fields) {
+              const privileges = field.privileges.filter((privilege) => {
+                return privilege.mask === 1 && Array.isArray(privilege.scope) && privilege.scope.includes(searchScope);
+              });
+              for (const privilege of privileges) {
+                if (!privilege.scope.includes(targetScope)) {
+                  privilege.scope.push(targetScope);
+                }
+              }
+            }
+          }
+
+          // get views with scope based privileges
+          // noinspection JSUnresolvedReference
+          if (Array.isArray(definition.views)) {
+            // noinspection JSUnresolvedReference
+            const views = definition.views.filter((item) => {
+              return Array.isArray(item.privileges);
+            });
+            for (const view of views) {
+              const privileges = view.privileges.filter((privilege) => {
+                return privilege.mask === 1 && Array.isArray(privilege.scope) && privilege.scope.includes(searchScope);
+              });
+              if (privileges.length > 0) {
+                shouldUpdate = true;
+                for (const privilege of privileges) {
+                  if (!privilege.scope.includes(targetScope)) {
+                    privilege.scope.push(targetScope);
+                  }
+                }
+              }
+            }
+          }
+
+
+          if (shouldUpdate) {
+            updated++;
+            // update model definition
+            schemaLoader.setModelDefinition(definition);
+          }
+        }
+      }
+      if (updated > 0) {
+        common.TraceUtils.log(`${this.constructor.name}: Updated ${updated} model definition(s) to include scope "${targetScope}"`);
+      }
+    }
+
+    const scopeConfiguration = this.getApplication().getConfiguration().getStrategy(ScopeAccessConfiguration);
+    if (scopeConfiguration) {
+      const elements = scopeConfiguration.elements.
+      filter((item) => item.scope.includes(searchScope)).
+      filter((item) => item.access.includes('read'));
+      if (elements.length > 0) {
+        const insertElements = [];
+        for (const element of elements) {
+          insertElements.push({
+            insertAfter: element,
+            resource: element.resource,
+            scope: [targetScope],
+            access: ['read']
+          });
+        }
+        for (const { insertAfter, resource, scope, access } of insertElements) {
+          const index = scopeConfiguration.elements.findIndex((element) => element === insertAfter);
+          scopeConfiguration.elements.splice(index + 1, 0, {
+            resource,
+            scope,
+            access
+          });
+        }
+        common.TraceUtils.log(`${this.constructor.name}: Updated ${elements.length} scope access configuration(s) to include scope "${targetScope}"`);
+      }
+    }
+  }
+}
+
 exports.AppRateLimitService = AppRateLimitService;
 exports.AppSpeedLimitService = AppSpeedLimitService;
 exports.DefaultScopeAccessConfiguration = DefaultScopeAccessConfiguration;
 exports.DisableNetworkRestrictAccess = DisableNetworkRestrictAccess;
 exports.DisableUserClientScopeVerification = DisableUserClientScopeVerification;
 exports.EnableNetworkRestrictAccess = EnableNetworkRestrictAccess;
+exports.EnableReadAccessScope = EnableReadAccessScope;
 exports.EnableScopeAccessConfiguration = EnableScopeAccessConfiguration;
 exports.ExtendScopeAccessConfiguration = ExtendScopeAccessConfiguration;
 exports.HttpAccountDisabled = HttpAccountDisabled;