@webiny/api-headless-cms 0.0.0-unstable.99666aeb00 → 0.0.0-unstable.9bd236cf5e

package/crud/contentModel.crud.js

@@ -5,9 +5,6 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.createModelsCrud = void 0;
-var _objectWithoutProperties2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutProperties"));
-var _objectSpread2 = _interopRequireDefault(require("@babel/runtime/helpers/objectSpread2"));
-var _dataloader = _interopRequireDefault(require("dataloader"));
 var _error = _interopRequireDefault(require("@webiny/error"));
 var _handlerGraphql = require("@webiny/handler-graphql");
 var _contentModelManagerFactory = require("./contentModel/contentModelManagerFactory");
@@ -15,65 +12,31 @@ var _pubsub = require("@webiny/pubsub");
 var _beforeCreate = require("./contentModel/beforeCreate");
 var _beforeUpdate = require("./contentModel/beforeUpdate");
 var _beforeDelete = require("./contentModel/beforeDelete");
-var _afterCreate = require("./contentModel/afterCreate");
-var _afterUpdate = require("./contentModel/afterUpdate");
-var _afterDelete = require("./contentModel/afterDelete");
-var _afterCreateFrom = require("./contentModel/afterCreateFrom");
 var _CmsModelPlugin = require("../plugins/CmsModelPlugin");
-var _filterAsync = require("../utils/filterAsync");
 var _validation = require("./contentModel/validation");
 var _utils = require("@webiny/utils");
 var _defaultFields = require("./contentModel/defaultFields");
-var _modelApiName = require("./contentModel/compatibility/modelApiName");
-const _excluded = ["defaultFields"];
-/**
- * Given a model, return an array of tags ensuring the `type` tag is set.
- */
-const ensureTypeTag = model => {
-  // Let's make sure we have a `type` tag assigned.
-  // If `type` tag is not set, set it to a default one (`model`).
-  const tags = model.tags || [];
-  if (!tags.some(tag => tag.startsWith("type:"))) {
-    tags.push("type:model");
-  }
-  return tags;
-};
+var _utils2 = require("../utils");
+var _ensureTypeTag = require("./contentModel/ensureTypeTag");
+var _listModelsFromDatabase = require("./contentModel/listModelsFromDatabase");
+var _filterAsync = require("../utils/filterAsync");
+var _contentModelAst = require("../utils/contentModelAst");
+var _modelManager = require("../modelManager");
 const createModelsCrud = params => {
   const {
     getTenant,
     getIdentity,
     getLocale,
     storageOperations,
-    modelsPermissions,
+    accessControl,
     context
   } = params;
-  const loaders = {
-    listModels: new _dataloader.default(async () => {
-      const models = await storageOperations.models.list({
-        where: {
-          tenant: getTenant().id,
-          locale: getLocale().code
-        }
-      });
-      return [models.map(model => {
-        return (0, _objectSpread2.default)((0, _objectSpread2.default)({}, model), {}, {
-          tags: ensureTypeTag(model),
-          tenant: model.tenant || getTenant().id,
-          locale: model.locale || getLocale().code,
-          /**
-           * TODO: remove in v5.36.0
-           * This is for backward compatibility while migrations are not yet executed.
-           */
-          singularApiName: (0, _modelApiName.ensureSingularApiName)(model),
-          pluralApiName: (0, _modelApiName.ensurePluralApiName)(model)
-        });
-      })];
-    })
-  };
+  const listPluginModelsCache = (0, _utils2.createMemoryCache)();
+  const listFilteredModelsCache = (0, _utils2.createMemoryCache)();
+  const listDatabaseModelsCache = (0, _utils2.createMemoryCache)();
   const clearModelsCache = () => {
-    for (const loader of Object.values(loaders)) {
-      loader.clearAll();
-    }
+    listDatabaseModelsCache.clear();
+    listFilteredModelsCache.clear();
   };
   const managers = new Map();
   const updateManager = async (context, model) => {
@@ -81,107 +44,145 @@ const createModelsCrud = params => {
     managers.set(model.modelId, manager);
     return manager;
   };
-  const checkModelPermissions = rwd => {
-    return modelsPermissions.ensure({
-      rwd
-    });
+  const fieldTypePlugins = context.plugins.byType("cms-model-field-to-graphql");
+  const getModelToAstConverter = () => {
+    return new _contentModelAst.CmsModelToAstConverter(new _contentModelAst.CmsModelFieldToAstConverterFromPlugins(fieldTypePlugins));
   };
-  const getModelsAsPlugins = () => {
-    const tenant = getTenant().id;
-    const locale = getLocale().code;
-    return context.plugins.byType(_CmsModelPlugin.CmsModelPlugin.type)
-    /**
-     * We need to filter out models that are not for this tenant or locale.
-     * If it does not have tenant or locale define, it is for every locale and tenant
-     */.filter(plugin => {
-      const {
-        tenant: modelTenant,
-        locale: modelLocale
-      } = plugin.contentModel;
-      if (modelTenant && modelTenant !== tenant) {
-        return false;
-      } else if (modelLocale && modelLocale !== locale) {
-        return false;
-      }
-      return true;
-    }).map(plugin => {
-      return (0, _objectSpread2.default)((0, _objectSpread2.default)({}, plugin.contentModel), {}, {
-        tags: ensureTypeTag(plugin.contentModel),
-        tenant,
-        locale,
-        webinyVersion: context.WEBINY_VERSION
+  const listPluginModels = async (tenant, locale) => {
+    const modelPlugins = context.plugins.byType(_CmsModelPlugin.CmsModelPlugin.type);
+    const cacheKey = (0, _utils2.createCacheKey)({
+      tenant,
+      locale,
+      models: modelPlugins.map(({
+        contentModel: model
+      }) => {
+        return `${model.modelId}#${model.pluralApiName}#${model.singularApiName}#${model.savedOn || "savedOn:plugin"}`;
+      }).join("/"),
+      identity: context.security.isAuthorizationEnabled() ? getIdentity()?.id : undefined
+    });
+    return listPluginModelsCache.getOrSet(cacheKey, async () => {
+      const models = modelPlugins
+      /**
+       * We need to filter out models that are not for this tenant or locale.
+       * If it does not have tenant or locale define, it is for every locale and tenant
+       */.filter(plugin => {
+        const {
+          tenant: modelTenant,
+          locale: modelLocale
+        } = plugin.contentModel;
+        if (modelTenant && modelTenant !== tenant) {
+          return false;
+        } else if (modelLocale && modelLocale !== locale) {
+          return false;
+        }
+        return true;
+      }).map(plugin => {
+        return {
+          ...plugin.contentModel,
+          tags: (0, _ensureTypeTag.ensureTypeTag)(plugin.contentModel),
+          tenant,
+          locale,
+          webinyVersion: context.WEBINY_VERSION
+        };
+      });
+      return (0, _filterAsync.filterAsync)(models, async model => {
+        return accessControl.canAccessModel({
+          model
+        });
       });
     });
   };
-  const modelsGet = async modelId => {
-    const pluginModel = getModelsAsPlugins().find(model => model.modelId === modelId);
-    if (pluginModel) {
-      return pluginModel;
-    }
-    const model = await storageOperations.models.get({
-      tenant: getTenant().id,
-      locale: getLocale().code,
-      modelId
-    });
+  const getModelFromCache = async modelId => {
+    const models = await listModels();
+    const model = models.find(m => m.modelId === modelId);
     if (!model) {
       throw new _handlerGraphql.NotFoundError(`Content model "${modelId}" was not found!`);
     }
-    return (0, _objectSpread2.default)((0, _objectSpread2.default)({}, model), {}, {
-      tags: ensureTypeTag(model),
+    return {
+      ...model,
+      tags: (0, _ensureTypeTag.ensureTypeTag)(model),
       tenant: model.tenant || getTenant().id,
       locale: model.locale || getLocale().code
-    });
-  };
-  const modelsList = async () => {
-    const databaseModels = await loaders.listModels.load("listModels");
-    const pluginsModels = getModelsAsPlugins();
-    return databaseModels.concat(pluginsModels);
+    };
   };
-  const listModels = async () => {
+
+  /**
+   * The list models cache is a key -> Promise pair so it the listModels() can be called multiple times but executed only once.
+   *
+   * We always fetch the plugins and database models separately.
+   * Then we combine them and run access filtering on them
+   */
+  const listModels = async input => {
     return context.benchmark.measure("headlessCms.crud.models.listModels", async () => {
-      const models = await modelsList();
-      return (0, _filterAsync.filterAsync)(models, async model => {
-        const ownsModel = await modelsPermissions.ensure({
-          owns: model.createdBy
-        }, {
-          throw: false
-        });
-        if (!ownsModel) {
-          return false;
-        }
-        return modelsPermissions.canAccessModel({
-          model,
-          locale: getLocale().code
+      /**
+       * Maybe we can cache based on permissions, not the identity id?
+       *
+       * TODO: @adrian please check if possible.
+       */
+      const tenant = getTenant().id;
+      const locale = getLocale().code;
+      let pluginModels = await listPluginModels(tenant, locale);
+      const dbCacheKey = (0, _utils2.createCacheKey)({
+        tenant,
+        locale
+      });
+      const databaseModels = await listDatabaseModelsCache.getOrSet(dbCacheKey, async () => {
+        return await (0, _listModelsFromDatabase.listModelsFromDatabase)(params);
+      });
+      const filteredCacheKey = (0, _utils2.createCacheKey)({
+        dbCacheKey: dbCacheKey.get(),
+        identity: context.security.isAuthorizationEnabled() ? getIdentity()?.id : undefined
+      });
+      let filteredModels = await listFilteredModelsCache.getOrSet(filteredCacheKey, async () => {
+        return (0, _filterAsync.filterAsync)(databaseModels, async model => {
+          return accessControl.canAccessModel({
+            model
+          });
         });
       });
+      /**
+       * Do we need to hide private models?
+       */
+      if (input?.includePrivate === false) {
+        filteredModels = filteredModels.filter(model => !model.isPrivate);
+        pluginModels = pluginModels.filter(model => !model.isPrivate);
+      }
+      /**
+       * Do we need to hide plugin models?
+       */
+      if (input?.includePlugins === false) {
+        return filteredModels;
+      }
+      return filteredModels.concat(pluginModels);
     });
   };
   const getModel = async modelId => {
     return context.benchmark.measure("headlessCms.crud.models.getModel", async () => {
-      await checkModelPermissions("r");
-      const model = await modelsGet(modelId);
-      await modelsPermissions.ensure({
-        owns: model.createdBy
+      const model = await context.security.withoutAuthorization(async () => {
+        return await getModelFromCache(modelId);
       });
-      await modelsPermissions.ensureCanAccessModel({
-        model,
-        locale: getLocale().code
+      if (!model) {
+        throw new _handlerGraphql.NotFoundError(`Content model "${modelId}" was not found!`);
+      }
+      await accessControl.ensureCanAccessModel({
+        model
       });
       return model;
     });
   };
-  const getModelManager = async target => {
+  const getEntryManager = async target => {
     const modelId = typeof target === "string" ? target : target.modelId;
     if (managers.has(modelId)) {
       return managers.get(modelId);
     }
-    const models = await modelsList();
-    const model = models.find(m => m.modelId === modelId);
-    if (!model) {
-      throw new _handlerGraphql.NotFoundError(`There is no content model "${modelId}".`);
-    }
+    const model = await getModelFromCache(modelId);
     return await updateManager(context, model);
   };
+  const getSingletonEntryManager = async input => {
+    const model = typeof input === "string" ? await getModel(input) : input;
+    const manager = await getEntryManager(model);
+    return _modelManager.SingletonModelManager.create(manager);
+  };
 
   /**
    * Create
@@ -220,37 +221,22 @@ const createModelsCrud = params => {
     context,
     storageOperations
   });
-  (0, _afterCreate.assignModelAfterCreate)({
-    context,
-    onModelAfterCreate
-  });
   (0, _beforeUpdate.assignModelBeforeUpdate)({
     onModelBeforeUpdate,
     context
   });
-  (0, _afterUpdate.assignModelAfterUpdate)({
-    context,
-    onModelAfterUpdate
-  });
-  (0, _afterCreateFrom.assignModelAfterCreateFrom)({
-    context,
-    onModelAfterCreateFrom
-  });
   (0, _beforeDelete.assignModelBeforeDelete)({
     onModelBeforeDelete,
-    plugins: context.plugins,
-    storageOperations
-  });
-  (0, _afterDelete.assignModelAfterDelete)({
-    context,
-    onModelAfterDelete
+    context
   });
 
   /**
    * CRUD methods
    */
   const createModel = async input => {
-    await checkModelPermissions("w");
+    await accessControl.ensureCanAccessModel({
+      rwd: "w"
+    });
     const result = await (0, _validation.createModelCreateValidation)().safeParseAsync(input);
     if (!result.success) {
       throw (0, _utils.createZodError)(result.error);
@@ -258,22 +244,17 @@ const createModelsCrud = params => {
     /**
      * We need to extract the defaultFields because it is not for the CmsModel object.
      */
-    const _removeUndefinedValue = (0, _utils.removeUndefinedValues)(result.data),
-      {
-        defaultFields
-      } = _removeUndefinedValue,
-      data = (0, _objectWithoutProperties2.default)(_removeUndefinedValue, _excluded);
+    const {
+      defaultFields,
+      ...data
+    } = (0, _utils.removeUndefinedValues)(result.data);
     if (defaultFields) {
       (0, _defaultFields.assignModelDefaultFields)(data);
     }
-    const group = await context.security.withoutAuthorization(async () => {
-      return context.cms.getGroup(data.group);
-    });
-    if (!group) {
-      throw new _handlerGraphql.NotFoundError(`There is no group "${data.group}".`);
-    }
+    const group = await context.cms.getGroup(data.group);
     const identity = getIdentity();
-    const model = (0, _objectSpread2.default)((0, _objectSpread2.default)({}, data), {}, {
+    const model = {
+      ...data,
       modelId: data.modelId || "",
       singularApiName: data.singularApiName,
       pluralApiName: data.pluralApiName,
@@ -296,8 +277,12 @@ const createModelsCrud = params => {
       savedOn: new Date().toISOString(),
       lockedFields: [],
       webinyVersion: context.WEBINY_VERSION
+    };
+    model.tags = (0, _ensureTypeTag.ensureTypeTag)(model);
+    await accessControl.ensureCanAccessModel({
+      model,
+      rwd: "w"
     });
-    model.tags = ensureTypeTag(model);
     try {
       await onModelBeforeCreate.publish({
         input: data,
@@ -306,7 +291,7 @@ const createModelsCrud = params => {
       const createdModel = await storageOperations.models.create({
         model
       });
-      loaders.listModels.clearAll();
+      clearModelsCache();
       await updateManager(context, model);
       await onModelAfterCreate.publish({
         input: data,
@@ -323,7 +308,9 @@ const createModelsCrud = params => {
     }
   };
   const updateModel = async (modelId, input) => {
-    await checkModelPermissions("w");
+    await accessControl.ensureCanAccessModel({
+      rwd: "w"
+    });
 
     // Get a model record; this will also perform ownership validation.
     const original = await getModel(modelId);
@@ -344,18 +331,15 @@ const createModelsCrud = params => {
     };
     const groupId = data.group;
     if (groupId) {
-      const groupData = await context.security.withoutAuthorization(async () => {
-        return context.cms.getGroup(groupId);
-      });
-      if (!groupData) {
-        throw new _handlerGraphql.NotFoundError(`There is no group "${groupId}".`);
-      }
+      const groupData = await context.cms.getGroup(groupId);
       group = {
         id: groupData.id,
         name: groupData.name
       };
     }
-    const model = (0, _objectSpread2.default)((0, _objectSpread2.default)((0, _objectSpread2.default)({}, original), data), {}, {
+    const model = {
+      ...original,
+      ...data,
       titleFieldId: data.titleFieldId === undefined ? original.titleFieldId : data.titleFieldId,
       descriptionFieldId: data.descriptionFieldId === undefined ? original.descriptionFieldId : data.descriptionFieldId,
       imageFieldId: data.imageFieldId === undefined ? original.imageFieldId : data.imageFieldId,
@@ -365,8 +349,12 @@ const createModelsCrud = params => {
       locale: original.locale || getLocale().code,
       webinyVersion: context.WEBINY_VERSION,
       savedOn: new Date().toISOString()
+    };
+    await accessControl.ensureCanAccessModel({
+      model,
+      rwd: "w"
     });
-    model.tags = ensureTypeTag(model);
+    model.tags = (0, _ensureTypeTag.ensureTypeTag)(model);
     try {
       await onModelBeforeUpdate.publish({
         input: data,
@@ -398,11 +386,12 @@ const createModelsCrud = params => {
       model: initialModel,
       original
     } = params;
-    const model = (0, _objectSpread2.default)((0, _objectSpread2.default)({}, initialModel), {}, {
+    const model = {
+      ...initialModel,
       tenant: initialModel.tenant || getTenant().id,
       locale: initialModel.locale || getLocale().code,
       webinyVersion: context.WEBINY_VERSION
-    });
+    };
     try {
       await onModelBeforeUpdate.publish({
         input: {},
@@ -413,7 +402,7 @@ const createModelsCrud = params => {
         model
       });
       await updateManager(context, resultModel);
-      loaders.listModels.clearAll();
+      clearModelsCache();
       await onModelAfterUpdate.publish({
         input: {},
         original,
@@ -431,14 +420,18 @@ const createModelsCrud = params => {
     }
   };
   const createModelFrom = async (modelId, input) => {
-    await checkModelPermissions("w");
+    await accessControl.ensureCanAccessModel({
+      rwd: "w"
+    });
+
     /**
      * Get a model record; this will also perform ownership validation.
      */
     const original = await getModel(modelId);
-    const result = await (0, _validation.createModelCreateFromValidation)().safeParseAsync((0, _objectSpread2.default)((0, _objectSpread2.default)({}, input), {}, {
+    const result = await (0, _validation.createModelCreateFromValidation)().safeParseAsync({
+      ...input,
       description: input.description || original.description
-    }));
+    });
     if (!result.success) {
       throw (0, _utils.createZodError)(result.error);
     }
@@ -459,7 +452,8 @@ const createModelsCrud = params => {
       throw new _handlerGraphql.NotFoundError(`There is no group "${data.group}".`);
     }
     const identity = getIdentity();
-    const model = (0, _objectSpread2.default)((0, _objectSpread2.default)({}, original), {}, {
+    const model = {
+      ...original,
       singularApiName: data.singularApiName,
       pluralApiName: data.pluralApiName,
       locale: locale.code,
@@ -480,6 +474,10 @@ const createModelsCrud = params => {
       savedOn: new Date().toISOString(),
       lockedFields: [],
       webinyVersion: context.WEBINY_VERSION
+    };
+    await accessControl.ensureCanAccessModel({
+      model,
+      rwd: "w"
     });
     try {
       await onModelBeforeCreateFrom.publish({
@@ -490,7 +488,7 @@ const createModelsCrud = params => {
       const createdModel = await storageOperations.models.create({
         model
       });
-      loaders.listModels.clearAll();
+      clearModelsCache();
       await updateManager(context, model);
       await onModelAfterCreateFrom.publish({
         input: data,
@@ -509,8 +507,14 @@ const createModelsCrud = params => {
     }
   };
   const deleteModel = async modelId => {
-    await checkModelPermissions("d");
+    await accessControl.ensureCanAccessModel({
+      rwd: "d"
+    });
     const model = await getModel(modelId);
+    await accessControl.ensureCanAccessModel({
+      model,
+      rwd: "d"
+    });
     try {
       await onModelBeforeDelete.publish({
         model
@@ -525,6 +529,7 @@ const createModelsCrud = params => {
           modelId: model.modelId
         });
       }
+      clearModelsCache();
       await onModelAfterDelete.publish({
         model
       });
@@ -542,8 +547,11 @@ const createModelsCrud = params => {
      * We require that users have write permissions to initialize models.
      * Maybe introduce another permission for it?
      */
-    await checkModelPermissions("w");
     const model = await getModel(modelId);
+    await accessControl.ensureCanAccessModel({
+      model,
+      rwd: "w"
+    });
     await onModelInitialize.publish({
       model,
       data
@@ -551,20 +559,6 @@ const createModelsCrud = params => {
     return true;
   };
   return {
-    /**
-     * Deprecated - will be removed in 5.36.0
-     */
-    onBeforeModelCreate: onModelBeforeCreate,
-    onAfterModelCreate: onModelAfterCreate,
-    onBeforeModelCreateFrom: onModelBeforeCreateFrom,
-    onAfterModelCreateFrom: onModelAfterCreateFrom,
-    onBeforeModelUpdate: onModelBeforeUpdate,
-    onAfterModelUpdate: onModelAfterUpdate,
-    onBeforeModelDelete: onModelBeforeDelete,
-    onAfterModelDelete: onModelAfterDelete,
-    /**
-     * Released in 5.34.0
-     */
     onModelBeforeCreate,
     onModelAfterCreate,
     onModelCreateError,
@@ -580,6 +574,7 @@ const createModelsCrud = params => {
     onModelInitialize,
     clearModelsCache,
     getModel,
+    getModelToAstConverter,
     listModels,
     async createModel(input) {
       return context.benchmark.measure("headlessCms.crud.models.createModel", async () => {
@@ -615,12 +610,11 @@ const createModelsCrud = params => {
         return initializeModel(modelId, data);
       });
     },
-    getModelManager,
-    getEntryManager: async model => {
-      return getModelManager(model);
-    },
-    getManagers: () => managers,
-    getEntryManagers: () => managers
+    getEntryManager,
+    getEntryManagers: () => managers,
+    getSingletonEntryManager
   };
 };
-exports.createModelsCrud = createModelsCrud;
+exports.createModelsCrud = createModelsCrud;
+
+//# sourceMappingURL=contentModel.crud.js.map