@yunsoft/yuncms-core 0.1.3 → 0.1.6

package/src/services/users-service.js

@@ -63,6 +63,13 @@ async function assertRoleAssignable(database, role, accountability) {
   if (targetRole.admin && accountability.admin !== true && accountability.system !== true) {
     throw forbidden('Only an administrator can assign the administrator role');
   }
+  if (
+    accountability.admin !== true
+    && accountability.system !== true
+    && role !== accountability.role
+  ) {
+    throw forbidden('Delegated user managers may assign only their own role');
+  }
 }
 
 async function assertTargetManageable(database, id, accountability) {
@@ -84,6 +91,15 @@ async function assertTargetManageable(database, id, accountability) {
 }
 
 export class UsersService extends BaseService {
+  async action(event, payload) {
+    if (!this.emitter) return;
+    await this.emitter.action(event, payload, {
+      accountability: this.accountability,
+      requestId: this.requestId,
+      collection: 'yuncms_users',
+    });
+  }
+
   async #readOneUnsafe(id) {
     const [rows] = await this.database.query(
       `SELECT id, email, role, status, email_verified_at, last_access, created_at, updated_at
@@ -133,7 +149,9 @@ export class UsersService extends BaseService {
       ],
     );
 
-    return this.#readOneUnsafe(id);
+    const user = await this.#readOneUnsafe(id);
+    await this.action('users.create', { key: id, item: user });
+    return user;
   }
 
   async updateOne(id, patch = {}) {
@@ -163,7 +181,7 @@ export class UsersService extends BaseService {
       await assertRoleAssignable(this.database, patch.role, this.accountability);
     }
 
-    return withTransaction(this.database, async (connection) => {
+    const user = await withTransaction(this.database, async (connection) => {
       const assignments = [];
       const params = [];
 
@@ -202,6 +220,8 @@ export class UsersService extends BaseService {
       );
       return rows[0] ?? null;
     });
+    await this.action('users.update', { key: id, item: user, changes: patch });
+    return user;
   }
 
   async deleteOne(id) {
@@ -212,12 +232,14 @@ export class UsersService extends BaseService {
       error.code = 'SELF_ADMIN_MUTATION_FORBIDDEN';
       throw error;
     }
+    const before = this.emitter ? await this.#readOneUnsafe(id) : null;
     const [result] = await this.database.query('DELETE FROM yuncms_users WHERE id = ?', [id]);
     if (result.affectedRows !== 1) {
       const error = new Error(`Unknown user: ${id}`);
       error.code = 'USER_NOT_FOUND';
       throw error;
     }
+    await this.action('users.delete', { key: id, before });
     return true;
   }
 
@@ -241,7 +263,6 @@ export class UsersService extends BaseService {
       }
       await connection.query('DELETE FROM yuncms_sessions WHERE user = ?', [id]);
       await connection.commit();
-      return true;
     } catch (error) {
       try {
         await connection.rollback();
@@ -252,6 +273,9 @@ export class UsersService extends BaseService {
     } finally {
       connection.release();
     }
+
+    await this.action('users.password.update', { key: id });
+    return true;
   }
 }
 

package/src/system-permissions.js

@@ -1,4 +1,5 @@
 const ALL_ACTIONS = Object.freeze(['read', 'create', 'update', 'delete']);
+const PERMISSION_MODES = new Set(['action-only', 'filter-read']);
 
 function parseMetadata(value) {
   if (value == null) return {};
@@ -14,16 +15,28 @@ function isEnabledFlag(value) {
   return value === true || value === 1;
 }
 
+function advancedUnsupported(collectionSchema, message) {
+  const error = new Error(message ?? `System resource ${collectionSchema.collection} does not support this advanced permission rule`);
+  error.code = 'SYSTEM_PERMISSION_ADVANCED_UNSUPPORTED';
+  throw error;
+}
+
 export function systemPermissionConfig(collectionSchema) {
   if (!collectionSchema?.system) return null;
   const metadata = parseMetadata(collectionSchema.metadata);
   if (!isEnabledFlag(metadata.permissionManaged)) return null;
+  const mode = metadata.permissionMode ?? 'action-only';
+  if (!PERMISSION_MODES.has(mode)) {
+    const error = new Error(`Unsupported system permission mode for ${collectionSchema.collection}: ${mode}`);
+    error.code = 'SYSTEM_PERMISSION_MODE_UNSUPPORTED';
+    throw error;
+  }
   const allowedActions = Array.isArray(metadata.allowedActions)
     ? metadata.allowedActions.filter((action) => ALL_ACTIONS.includes(action))
     : [];
   return Object.freeze({
     resource: metadata.resource ?? collectionSchema.collection,
-    mode: metadata.permissionMode ?? 'action-only',
+    mode,
     allowedActions: Object.freeze([...new Set(allowedActions)]),
   });
 }
@@ -43,12 +56,42 @@ export function assertSystemResourceAction(collectionSchema, action) {
   return config;
 }
 
-export function assertActionOnlyPermissionPayload(collectionSchema, { fields, filter, validation } = {}) {
+export function assertSystemPermissionPayload(
+  collectionSchema,
+  action,
+  { fields, filter, validation } = {},
+) {
   const config = systemPermissionConfig(collectionSchema);
-  if (!config || config.mode !== 'action-only') return;
-  if (fields != null || filter != null || validation != null) {
-    const error = new Error(`System resource ${collectionSchema.collection} supports action-level permissions only`);
-    error.code = 'SYSTEM_PERMISSION_ADVANCED_UNSUPPORTED';
-    throw error;
+  if (!config) return;
+
+  if (config.mode === 'action-only') {
+    if (fields != null || filter != null || validation != null) {
+      advancedUnsupported(
+        collectionSchema,
+        `System resource ${collectionSchema.collection} supports action-level permissions only`,
+      );
+    }
+    return;
   }
+
+  if (config.mode === 'filter-read') {
+    if (fields != null || validation != null) {
+      advancedUnsupported(
+        collectionSchema,
+        `System resource ${collectionSchema.collection} supports only a row filter on read permissions`,
+      );
+    }
+    if (filter != null && action !== 'read') {
+      advancedUnsupported(
+        collectionSchema,
+        `System resource ${collectionSchema.collection} permits row filters only for read`,
+      );
+    }
+  }
+}
+
+export function assertActionOnlyPermissionPayload(collectionSchema, payload = {}) {
+  const config = systemPermissionConfig(collectionSchema);
+  if (!config || config.mode !== 'action-only') return;
+  return assertSystemPermissionPayload(collectionSchema, 'read', payload);
 }