@voxgig/build 4.4.0 → 4.11.0

package/tm/web/backend/srv/ent/cmd_list.ts.frag

@@ -0,0 +1,86 @@
+import {
+  principalOf, validCanon, scopeOf, myProjectIds, ownerFor, asOwner, asSystem,
+  publicUser,
+} from './access'
+
+// aim:ent,cmd:list  { ent:'zone/name', q?:{...} }
+//
+// Rows are filtered by @seneca/owner, not here: each list runs on a
+// delegate whose custom.sysowner names the project, and owner refines the
+// query by the tenant axis. The membership JOIN is the one thing owner
+// cannot express (it scopes to ONE tenant, not "every project I belong
+// to"), so listing across projects fans out over the member rows.
+module.exports = function make_cmd_list() {
+  return async function cmd_list(this: any, msg: any, meta: any) {
+    const seneca = this
+    const model = seneca.context.model
+    const canon = String(msg.ent || '')
+    if (!validCanon(model, canon)) {
+      return { ok: false, why: 'unknown-entity' }
+    }
+    const user = principalOf(meta)
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+
+    const scope = scopeOf(model, canon)
+    const q = Object.assign({}, msg.q)
+
+    // sys/user: public projection, for reference pickers.
+    if ('open' === scope.kind) {
+      const list = await asSystem(seneca).entity(canon).list$(q)
+      return { ok: true, list: list.map(publicUser) }
+    }
+
+    // Not project data: owner scopes it to the acting user alone.
+    if ('user' === scope.kind) {
+      const owner = ownerFor(user, null)
+      return { ok: true, list: await asOwner(seneca, owner).entity(canon).list$(q) }
+    }
+
+    // Every id below came OUT of the member table, so membership is
+    // already established - ownerFor, not ownerOf, or each one costs a
+    // redundant round trip re-proving what this list just read.
+    const myIds = await myProjectIds(seneca, user.id)
+
+    // The projects themselves: one load per membership row.
+    if ('project' === scope.kind) {
+      const projects: any[] = []
+      for (const id of myIds) {
+        const p = await asOwner(seneca, ownerFor(user, id)).entity(canon).load$(id)
+        if (p && matches(p, q)) {
+          projects.push(p)
+        }
+      }
+      return { ok: true, list: projects }
+    }
+
+    // 'scoped': one project asked for, or a union across all of mine.
+    const via = (scope as any).via
+    const ids = null != q[via] ? [q[via]] : myIds
+    if (null != q[via] && myIds.indexOf(q[via]) < 0) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    let all: any[] = []
+    for (const pid of ids) {
+      const sub = Object.assign({}, q)
+      sub[via] = pid
+      all = all.concat(
+        await asOwner(seneca, ownerFor(user, pid)).entity(canon).list$(sub))
+    }
+    return { ok: true, list: all }
+  }
+}
+
+// Simple exact-match filter (the membership-scoped project list is loaded
+// by id, so the query can't go through list$).
+function matches(item: any, q: any) {
+  for (const k of Object.keys(q || {})) {
+    if (item[k] !== q[k]) {
+      return false
+    }
+  }
+  return true
+}
+

package/tm/web/backend/srv/ent/cmd_load.ts.frag

@@ -0,0 +1,56 @@
+import {
+  principalOf, validCanon, scopeOf, ownerOf, asOwner, asSystem, publicUser,
+} from './access'
+
+// aim:ent,cmd:load  { ent:'zone/name', id }
+//
+// A load addresses a row by id, so which project it belongs to is not
+// known from the message. Resolve that first (system read), then re-load
+// as the caller so @seneca/owner is the thing that actually decides - a
+// row outside the caller's project comes back null.
+module.exports = function make_cmd_load() {
+  return async function cmd_load(this: any, msg: any, meta: any) {
+    const seneca = this
+    const model = seneca.context.model
+    const canon = String(msg.ent || '')
+    if (!validCanon(model, canon)) {
+      return { ok: false, why: 'unknown-entity' }
+    }
+    const user = principalOf(meta)
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+
+    const scope = scopeOf(model, canon)
+
+    // sys/user: public projection, not project data.
+    if ('open' === scope.kind) {
+      const item = await asSystem(seneca).entity(canon).load$(msg.id)
+      return { ok: true, item: publicUser(item) }
+    }
+
+    const found = await asSystem(seneca).entity(canon).load$(msg.id)
+    if (!found) {
+      return { ok: true, item: null }
+    }
+
+    const projectId = 'project' === scope.kind
+      ? found.id
+      : found[(scope as any).via]
+
+    // A scoped row with no stored tenant is an anomaly, not user-scoped
+    // data - refuse it rather than let ownerOf downgrade to owner-only.
+    if ('scoped' === scope.kind && null == projectId) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    const owner = await ownerOf(seneca, user, projectId)
+    if (null == owner) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    const item = await asOwner(seneca, owner).entity(canon).load$(msg.id)
+    return null == item ? { ok: false, why: 'forbidden' } : { ok: true, item }
+  }
+}
+

package/tm/web/backend/srv/ent/cmd_remove.ts.frag

@@ -0,0 +1,60 @@
+import {
+  principalOf, validCanon, scopeOf, ownerOf, asOwner, asSystem,
+} from './access'
+
+// aim:ent,cmd:remove  { ent:'zone/name', id }
+//
+// Same shape as cmd_load: discover the row's project, then delete as the
+// caller so @seneca/owner refines the query - a row outside the caller's
+// project is simply not matched.
+module.exports = function make_cmd_remove() {
+  return async function cmd_remove(this: any, msg: any, meta: any) {
+    const seneca = this
+    const model = seneca.context.model
+    const canon = String(msg.ent || '')
+    if (!validCanon(model, canon)) {
+      return { ok: false, why: 'unknown-entity' }
+    }
+    const user = principalOf(meta)
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+
+    const scope = scopeOf(model, canon)
+    if ('open' === scope.kind) {
+      return { ok: false, why: 'read-only' }
+    }
+
+    const found = await asSystem(seneca).entity(canon).load$(msg.id)
+    if (!found) {
+      return { ok: true }
+    }
+
+    const projectId = 'project' === scope.kind
+      ? found.id
+      : found[(scope as any).via]
+
+    // A scoped row with no stored tenant is an anomaly, not user-scoped
+    // data - refuse it rather than let ownerOf downgrade to owner-only.
+    if ('scoped' === scope.kind && null == projectId) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    const owner = await ownerOf(seneca, user, projectId)
+    if (null == owner) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    // Owner treats a denied remove as a silent no-op, which would report
+    // success for a row the caller cannot see. Read it back as the caller
+    // first, so remove answers like load does.
+    const mine = asOwner(seneca, owner).entity(canon)
+    if (null == await mine.load$(msg.id)) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    await mine.remove$(msg.id)
+    return { ok: true }
+  }
+}
+

package/tm/web/backend/srv/ent/cmd_save.ts.frag

@@ -0,0 +1,141 @@
+import {
+  principalOf, validCanon, scopeOf, projectOf, ownerOf, asOwner, asSystem,
+  stripOwned, isDenied, OWNER_FIELDS,
+} from './access'
+
+// aim:ent,cmd:save  { ent:'zone/name', item:{...} }
+//
+// Create or update. Row-level access is NOT enforced here: the save runs on
+// a delegate carrying custom.sysowner, and @seneca/owner injects the
+// ownership axes on create and refines the query on update - so an update
+// naming a row outside the caller's project simply does not find it.
+// Timestamps (t_c/t_m) are maintained by @seneca/entity-util.
+//
+// What this action must get right is WHICH TENANT the save acts in. On
+// create the payload names it (there is no row to contradict). On update
+// the tenant is read from the STORED row, and the payload's project field
+// is pinned to it. Taking the tenant from the payload would let a caller
+// name a project they DO belong to, pass the membership check, and have
+// owner refine the query by that same project - overwriting someone else's
+// row. This surface therefore does not move rows between projects.
+module.exports = function make_cmd_save() {
+  return async function cmd_save(this: any, msg: any, meta: any) {
+    const seneca = this
+    const model = seneca.context.model
+    const canon = String(msg.ent || '')
+    if (!validCanon(model, canon)) {
+      return { ok: false, why: 'unknown-entity' }
+    }
+    const user = principalOf(meta)
+    if (!user) {
+      return { ok: false, why: 'not-authenticated' }
+    }
+
+    const scope = scopeOf(model, canon)
+    if ('open' === scope.kind) {
+      return { ok: false, why: 'read-only' }
+    }
+
+    const data = Object.assign({}, msg.item)
+
+    // An id naming no existing row is a create with a client-chosen id, not
+    // an update: there is no stored tenant, and nothing to hijack.
+    const found = null == data.id
+      ? null
+      : await asSystem(seneca).entity(canon).load$(data.id)
+
+    let projectId: string | null = null
+
+    if (null == found) {
+      projectId = projectOf(model, canon, msg)
+      if ('scoped' === scope.kind && null == projectId) {
+        return { ok: false, why: 'project-required' }
+      }
+
+      // A client-chosen id must move to `id$`. @seneca/owner takes the
+      // create path only when ent.id is null - with a plain id it treats
+      // the save as an update, finds no row, and fails save-not-found.
+      // `id$` is seneca-entity's "create with this id", so the row still
+      // goes through owner's create path and gets its axes injected.
+      if (null != data.id) {
+        data.id$ = data.id
+        delete data.id
+      }
+    }
+    else if ('project' === scope.kind) {
+      // The project IS the tenant, so updating one acts within itself.
+      projectId = found.id
+    }
+    else if ('scoped' === scope.kind) {
+      const via = (scope as any).via
+      projectId = found[via]
+
+      // A scoped row with no stored tenant is an anomaly (orphaned or
+      // legacy data), NOT user-scoped data. Refuse it rather than let
+      // ownerOf fall back to owner-only scoping, which would hand its
+      // creator access outside any project.
+      if (null == projectId) {
+        return { ok: false, why: 'forbidden' }
+      }
+
+      // Pin the tenant to the stored row. `via` is whatever field the
+      // model points at proj/project, so it is NOT necessarily one of the
+      // owner fields stripOwned removes - overwrite it explicitly, or a
+      // model naming it anything but project_id lets the payload move the
+      // row to another project.
+      data[via] = projectId
+    }
+
+    const owner = await ownerOf(seneca, user, projectId)
+    if (null == owner) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    // The ownership axes come from the delegate, never the payload - a row
+    // loaded by the client carries them, and re-sending them unchanged
+    // would otherwise be read as a claim.
+    stripOwned(data)
+
+    // An update keeps the row's STORED ownership. stripOwned has just
+    // removed the client's copy, and owner injects any axis it finds
+    // null - so without this, one member editing another member's row
+    // silently transfers its owner_id to the editor (the `member` role
+    // relaxes writes on that axis, so the plugin raises no objection).
+    if (null != found) {
+      for (const f of OWNER_FIELDS) {
+        if (null != found[f]) {
+          data[f] = found[f]
+        }
+      }
+    }
+
+    let item: any
+    try {
+      item = await asOwner(seneca, owner).entity(canon).data$(data).save$()
+    }
+    catch (err: any) {
+      if (isDenied(err)) {
+        return { ok: false, why: 'forbidden' }
+      }
+      throw err
+    }
+    if (null == item) {
+      return { ok: false, why: 'forbidden' }
+    }
+
+    // Creating a project makes the creator its first (owner) member. This
+    // is bookkeeping for a project the caller is not yet a member of, so
+    // it cannot run as `member` - see the `system` role in basic.ts.
+    if ('project' === scope.kind && null == found) {
+      await asSystem(seneca).entity('proj/member').data$({
+        project_id: item.id,
+        user_id: user.id,
+        role: 'owner',
+        owner_id: user.id,
+      }).save$()
+    }
+
+    return { ok: true, item }
+  }
+}
+

package/tm/web/backend/srv/ent/ent-srv.ts.frag

@@ -0,0 +1,4 @@
+import { MakeSrv } from '@voxgig/system'
+
+module.exports = MakeSrv('ent', require)
+

package/tm/web/backend/srv/ent/get_info.ts.frag

@@ -0,0 +1,6 @@
+module.exports = function make_get_info() {
+  return async function get_info(this: any, _msg: any) {
+    return { ok: true, srv: 'ent' }
+  }
+}
+

package/tm/web/backend/srv/ent/web_cmd_list.ts.frag

@@ -0,0 +1,17 @@
+// Browser proxy: aim:web,on:ent,cmd:list -> aim:ent,cmd:list
+//
+// aim:web is the only namespace the gateway accepts from a browser, so
+// every entity operation a browser may perform is declared as one of
+// these proxies. The principal the gateway resolved travels with the
+// message (meta.custom), so the real action scopes by membership.
+module.exports = function make_web_cmd_list() {
+  return async function web_cmd_list(this: any, msg: any) {
+    return this.post('aim:ent,cmd:list', {
+      ent: msg.ent,
+      id: msg.id,
+      q: msg.q,
+      item: msg.item,
+    })
+  }
+}
+

package/tm/web/backend/srv/ent/web_cmd_load.ts.frag

@@ -0,0 +1,17 @@
+// Browser proxy: aim:web,on:ent,cmd:load -> aim:ent,cmd:load
+//
+// aim:web is the only namespace the gateway accepts from a browser, so
+// every entity operation a browser may perform is declared as one of
+// these proxies. The principal the gateway resolved travels with the
+// message (meta.custom), so the real action scopes by membership.
+module.exports = function make_web_cmd_load() {
+  return async function web_cmd_load(this: any, msg: any) {
+    return this.post('aim:ent,cmd:load', {
+      ent: msg.ent,
+      id: msg.id,
+      q: msg.q,
+      item: msg.item,
+    })
+  }
+}
+

package/tm/web/backend/srv/ent/web_cmd_remove.ts.frag

@@ -0,0 +1,17 @@
+// Browser proxy: aim:web,on:ent,cmd:remove -> aim:ent,cmd:remove
+//
+// aim:web is the only namespace the gateway accepts from a browser, so
+// every entity operation a browser may perform is declared as one of
+// these proxies. The principal the gateway resolved travels with the
+// message (meta.custom), so the real action scopes by membership.
+module.exports = function make_web_cmd_remove() {
+  return async function web_cmd_remove(this: any, msg: any) {
+    return this.post('aim:ent,cmd:remove', {
+      ent: msg.ent,
+      id: msg.id,
+      q: msg.q,
+      item: msg.item,
+    })
+  }
+}
+

package/tm/web/backend/srv/ent/web_cmd_save.ts.frag

@@ -0,0 +1,17 @@
+// Browser proxy: aim:web,on:ent,cmd:save -> aim:ent,cmd:save
+//
+// aim:web is the only namespace the gateway accepts from a browser, so
+// every entity operation a browser may perform is declared as one of
+// these proxies. The principal the gateway resolved travels with the
+// message (meta.custom), so the real action scopes by membership.
+module.exports = function make_web_cmd_save() {
+  return async function web_cmd_save(this: any, msg: any) {
+    return this.post('aim:ent,cmd:save', {
+      ent: msg.ent,
+      id: msg.id,
+      q: msg.q,
+      item: msg.item,
+    })
+  }
+}
+