adminizer 5.0.0-build.8 → 5.1.0-build.24

package/lib/DataAccessor.d.ts

@@ -6,7 +6,8 @@ import { ActionType } from "../interfaces/adminpanelConfig.js";
 import { Fields } from "../helpers/fieldsHelper.js";
 import { Adminizer } from "./Adminizer.js";
 import { User } from "../models/User.js";
-import { QueryCriteria } from "../interfaces/queryCriteria.js";
+import { CriteriaWhere, QueryCriteria } from "../interfaces/queryCriteria.js";
+import { RecordAccessCache } from "./access-graph/RecordAccessCache.js";
 export declare class DataAccessor {
     readonly adminizer: Adminizer;
     user: User;
@@ -14,10 +15,23 @@ export declare class DataAccessor {
     action: ActionType;
     private fields;
     private actionVerb;
-    constructor(adminizer: Adminizer, user: User, modelResource: ModelResource, action: ActionType);
+    private associatedPrimaryKeyCache;
+    private recordAccessAssociationFieldsCache?;
+    /** Set on the internal accessors used to verify associations — see disablePopulateAccess(). */
+    private populateAccessDisabled;
+    /** Accessors of associated models, so their access lookups are resolved once per model. */
+    private associatedAccessorCache;
+    /** Per-request record-access resolver; its memoized id lists live as long as this accessor. */
+    private recordAccessResolver?;
+    /**
+     * Memoization shared with the other accessors of the same request; pass one when
+     * building several accessors for one page so the membership lookups run once.
+     */
+    readonly recordAccessCache: RecordAccessCache;
+    constructor(adminizer: Adminizer, user: User, modelResource: ModelResource, action: ActionType, recordAccessCache?: RecordAccessCache);
     private getModelConfig;
-    private accessRelationModel;
     private resolveRelationTarget;
+    private getRelationModel;
     /**
      * Retrieves the fields for the given ModelResource based on action type,
      * taking into account access rights and configuration settings.
@@ -26,10 +40,23 @@ export declare class DataAccessor {
     getFieldsConfig(): Fields;
     private orderFieldsByConfig;
     private getAssociatedFieldsConfig;
+    /**
+     * Base config for a field: the normalized declared config merged over `{key, title}`,
+     * or `undefined` when the config is invalid or field access is denied.
+     */
+    private buildBaseFieldConfig;
     private checkFieldAccess;
     private getSelectedFields;
     private getPopulateCriteria;
+    /** Administrators, and every user when authorization is switched off entirely. */
+    private hasUnrestrictedAccess;
     private canUseSelectedFieldFallback;
+    /**
+     * Primary key of a field's associated model, for the PK-always-visible rule on
+     * populated records. Cached per field config: `process()` asks once per associated
+     * item of every record, and the answer cannot change within an accessor's lifetime.
+     */
+    private associatedPrimaryKey;
     /**
      * Returns filtered record applying config from this.fields on this record
      * @data - record from a specific model */
@@ -38,6 +65,76 @@ export declare class DataAccessor {
     private filterAssociatedRecord;
     /** Process for an array of records */
     processMany<T>(records: T[], criteria?: QueryCriteria): Partial<T>[];
+    /**
+     * {@link processMany} plus record-level access on populated associations.
+     *
+     * `sanitizeUserRelationAccess` confines the queried model only, while adapters
+     * populate associations regardless of record access — so a record the user may not reach can
+     * still be read through a relation of one they may. Records the target model's own rules
+     * keep out of reach are reduced to their primary key here, which costs one batched query
+     * per associated restricted model (memoized for the accessor's lifetime) — except the
+     * associations whose confinement {@link pushDownPopulateAccess} already compiled into
+     * the populate JOIN itself: those arrive pre-reduced and are skipped.
+     *
+     * Read paths only: write paths hand back the record the user just supplied.
+     */
+    processManyWithAccess<T>(records: T[], criteria?: QueryCriteria): Promise<Partial<T>[]>;
+    /**
+     * Compiles the record-access confinement of single populated associations into the
+     * criteria (`populateOn`), so the adapter ANDs it into the populate JOIN's ON clause
+     * and {@link processManyWithAccess} skips the post-read query for those fields — the
+     * closed records arrive as bare foreign keys straight from the database. Only the
+     * associations the adapter declares pushdown-capable and whose access filter has an
+     * adapter-portable shape are compiled; the rest keep the post-read verification.
+     *
+     * Single associations only: a filtered-out belongsTo row still carries its foreign
+     * key, while a record dropped from a populated collection would lose its id — and an
+     * edit form saving that truncated collection would silently sever the links.
+     *
+     * Any incoming `populateOn` is discarded — this method is its sole author, because
+     * the verification skip above trusts the key.
+     */
+    pushDownPopulateAccess(criteria?: QueryCriteria): Promise<QueryCriteria>;
+    /**
+     * Turns the association verification of {@link processManyWithAccess} off for this accessor.
+     * Used for the accessors that perform that verification themselves: they only read ids,
+     * and two restricted models referencing each other sideways would otherwise recurse.
+     */
+    disablePopulateAccess(): this;
+    /**
+     * Association fields whose target model is access-restricted and whose content therefore
+     * needs verifying — except the edge pointing at this model's own graph parent, where
+     * the target is reachable by construction (a visible child hangs off a visible parent).
+     */
+    private recordAccessAssociationFields;
+    /** True when the model confines its records to the user, by its own relation or the graph. */
+    private hasRecordAccessRules;
+    private associatedResourceName;
+    /** Primary keys of the populated records referenced by a field, keyed by their string form. */
+    private collectAssociatedIds;
+    /** Replaces populated records the user may not reach with their bare primary key. */
+    private reduceInvisibleAssociations;
+    /**
+     * The associated model's own view accessor, shared between the pushdown and the
+     * post-read verification so its access lookups resolve once per model.
+     */
+    private associatedAccessor;
+    /**
+     * Subset of `ids` the user may reach in the associated model, or `undefined` when that
+     * model has no record access rules. The target's own accessor is reused across calls, so its
+     * membership lookups are resolved once.
+     */
+    private visibleAssociatedIds;
     sanitizeUserRelationAccess(criteria?: QueryCriteria): Promise<QueryCriteria>;
     setUserRelationAccess<T>(record: T): Promise<Partial<T>>;
+    /**
+     * Where-fragment confining this model to the records the user may reach
+     * (`userAccessRelation` or accessGraph); `{}` means no record-level constraint.
+     *
+     * For surfaces that reference records without reading them through the model API —
+     * the change history, for one — and therefore cannot rely on
+     * {@link sanitizeUserRelationAccess} doing it for them.
+     */
+    getRecordAccessWhere(): Promise<CriteriaWhere>;
+    private getRecordAccessResolver;
 }