easy-psql-rbac 1.0.0

package/dist/rbac.js

@@ -0,0 +1,745 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EasyPSQLRBAC = void 0;
+const badrequest_1 = require("./badrequest");
+const forbidden_1 = require("./forbidden");
+const types_1 = require("./types");
+const easy_validation_service_1 = __importDefault(require("easy-validation-service"));
+const easy_psql_1 = require("easy-psql");
+const roleRegistry_1 = require("./roleRegistry");
+class EasyPSQLRBAC extends roleRegistry_1.RoleRegistry {
+    constructor(options) {
+        super();
+        this.options = options || {};
+        if (!this.options.userIdentityKey) {
+            this.options.userIdentityKey = "id";
+        }
+        this.assertUserIdentityKey();
+    }
+    assertUserIdentityKey() {
+        if (typeof this.options.userIdentityKey !== "string" ||
+            !this.options.userIdentityKey.trim().length) {
+            throw new Error(`Please provide a userIdentityKey in options`);
+        }
+    }
+    model({ schema, table, connection, }) {
+        return new easy_psql_1.DB.modelFactory[schema][table](connection);
+    }
+    roleBasedModel({ table, schema, connection, apiAccessType, bypass, input, user, }) {
+        if (bypass) {
+            return this.model({ schema, table, connection });
+        }
+        const entityPermissions = this.getRolePermissions(user === null || user === void 0 ? void 0 : user.roleId)
+            .schema(schema)
+            .table(table)[apiAccessType]();
+        const { columns = [] } = entityPermissions;
+        if (!(columns === null || columns === void 0 ? void 0 : columns.length)) {
+            throw new forbidden_1.ForbiddenError(`${schema}.${table}: operation ${apiAccessType} is not allowed`);
+        }
+        const model = this.model({ table, schema, connection });
+        switch (apiAccessType) {
+            case types_1.AllowedEngineApiAccessTypes.findMany:
+            case types_1.AllowedEngineApiAccessTypes.findOne:
+            case types_1.AllowedEngineApiAccessTypes.aggregate:
+                this.roleBasedSelectSanitization({
+                    user,
+                    model,
+                    input,
+                    entityPermissions,
+                    apiAccessType,
+                });
+                break;
+            case types_1.AllowedEngineApiAccessTypes.createOne:
+            case types_1.AllowedEngineApiAccessTypes.createMany:
+                this.roleBasedInsertSanitization({
+                    user,
+                    model,
+                    input,
+                    apiAccessType,
+                    entityPermissions,
+                });
+                break;
+            case types_1.AllowedEngineApiAccessTypes.updateOne:
+            case types_1.AllowedEngineApiAccessTypes.updateMany:
+                this.roleBasedUpdateSanitization({
+                    user,
+                    model,
+                    input,
+                    apiAccessType,
+                    entityPermissions,
+                });
+                break;
+            case types_1.AllowedEngineApiAccessTypes.deleteOne:
+            case types_1.AllowedEngineApiAccessTypes.deleteMany:
+                this.roleBasedDeleteSanitization({
+                    user,
+                    model,
+                    input,
+                    apiAccessType,
+                    entityPermissions,
+                });
+                break;
+            default:
+                throw new forbidden_1.ForbiddenError(`${schema}.${table}: operation ${apiAccessType}  is not allowed`);
+        }
+        return model;
+    }
+    getUserRolePermissionsForEntity({ schema, table, user, apiAccessType, }) {
+        return this.getRolePermissions(user === null || user === void 0 ? void 0 : user.roleId)
+            .schema(schema)
+            .table(table)[apiAccessType]();
+    }
+    roleBasedSelectSanitization({ model, input, apiAccessType, user, entityPermissions, }) {
+        var _a, _b, _c;
+        if (!easy_validation_service_1.default.isObject(input)) {
+            throw new badrequest_1.BadRequest(`query must be an object for operation ${apiAccessType}`);
+        }
+        const { columns, ownership, preConditions } = entityPermissions;
+        if (!Array.isArray(columns) || !columns.length) {
+            throw new forbidden_1.ForbiddenError(`${model.schema}.${model.table}: operation ${apiAccessType} is not allowed`);
+        }
+        if (easy_validation_service_1.default.isObject(input.select) &&
+            Object.keys(input.select).length > 0) {
+            for (const key of Object.keys(input.select)) {
+                if (!input.select[key] || !columns.includes(key)) {
+                    delete input.select[key];
+                }
+            }
+        }
+        else {
+            input.select = (columns || []).reduce((acc, col) => {
+                acc[col] = true;
+                return acc;
+            }, {});
+        }
+        //sanitize order by
+        if (easy_validation_service_1.default.isObject(input.orderBy)) {
+            const iter = Object.entries(input.orderBy);
+            for (const [key, value] of iter) {
+                if (model.columns[key] && !columns.includes(key)) {
+                    throw new forbidden_1.ForbiddenError(`Operation orderBy.${key} is not allowed`);
+                }
+                else if (easy_psql_1.DB.getIsAggregate(key)) {
+                    const relation = model.relations[easy_psql_1.DB.getRelationNameWithoutAggregate(key)];
+                    if (!relation ||
+                        !columns.some((col) => this.isColumnInRelationColumns({ relation, column: col }))) {
+                        throw new forbidden_1.ForbiddenError(`operation orderBy.${key} is not allowed`);
+                    }
+                    const relatedModel = easy_psql_1.DB.getRelatedModel(relation);
+                    if (!relatedModel) {
+                        throw new forbidden_1.ForbiddenError(`operation ${apiAccessType} is not allowed`);
+                    }
+                    const relatedEntityPermissions = this.getUserRolePermissionsForEntity({
+                        schema: relatedModel.schema || easy_psql_1.DB.database,
+                        table: relatedModel.table,
+                        user,
+                        apiAccessType,
+                    });
+                    if (!((_a = relatedEntityPermissions.columns) === null || _a === void 0 ? void 0 : _a.length)) {
+                        throw new forbidden_1.ForbiddenError(`${relatedModel.schema}.${relatedModel.table}: operation ${apiAccessType} is not allowed`);
+                    }
+                    for (const [aggregationKey, config] of Object.entries(value)) {
+                        if (aggregationKey === "_count") {
+                            continue;
+                        }
+                        if (!easy_validation_service_1.default.isObject(config)) {
+                            throw new badrequest_1.BadRequest(`invalid aggregation at orderBy.${key}.${aggregationKey}`);
+                        }
+                        let column;
+                        if (!Object.keys(config).every((col) => {
+                            var _a, _b;
+                            const exists = (_b = (_a = relatedEntityPermissions.columns) === null || _a === void 0 ? void 0 : _a.includes) === null || _b === void 0 ? void 0 : _b.call(_a, col);
+                            if (!exists) {
+                                column = col;
+                            }
+                            return exists;
+                        })) {
+                            throw new forbidden_1.ForbiddenError(`invalid aggregation at orderBy.${key}.${aggregationKey}.${column}`);
+                        }
+                    }
+                }
+            }
+        }
+        if (!input.where) {
+            input.where = {};
+        }
+        input.where = this.mergeWhereWithPreConditions({
+            where: input.where || {},
+            preConditions: preConditions || {},
+        });
+        // sanitize where
+        this.roleBasedWhereSanitization({
+            model,
+            where: input.where,
+            user,
+            apiAccessType,
+            entityPermissions,
+        });
+        if ((ownership === null || ownership === void 0 ? void 0 : ownership.enabled) &&
+            Array.isArray(ownership === null || ownership === void 0 ? void 0 : ownership.columns) &&
+            ownership.columns.length) {
+            if (!user) {
+                throw new forbidden_1.ForbiddenError(`${model.schema}.${model.table}: operation ${apiAccessType} is not allowed`);
+            }
+            if (!(ownership === null || ownership === void 0 ? void 0 : ownership.columns.every((x) => columns.includes(x)))) {
+                throw new forbidden_1.ForbiddenError(`${model.schema}.${model.table}: operation ${apiAccessType} is not allowed`);
+            }
+            if (!easy_validation_service_1.default.isObject(input.where)) {
+                input.where = {};
+            }
+            input.where = {
+                _and: Object.entries(input.where)
+                    .map(([key, value]) => ({
+                    [key]: value,
+                }))
+                    .concat(ownership === null || ownership === void 0 ? void 0 : ownership.columns.map((col) => {
+                    return this.toUserOwnershipColumnNameMapper(user, col, ownership.columnToUserFieldMapper);
+                }, {})),
+            };
+        }
+        //sanitize relations
+        const include = input.include || {};
+        const iter = Object.entries(include);
+        for (let [alias, relationConfig] of iter) {
+            if (!easy_validation_service_1.default.isObject(relationConfig)) {
+                include[alias] = {};
+                relationConfig = include[alias];
+            }
+            if (easy_psql_1.DB.getIsAggregate(alias)) {
+                const relation = model.relations[easy_psql_1.DB.getRelationNameWithoutAggregate(alias)];
+                if (!relation ||
+                    (!Array.isArray(relation.from_column) &&
+                        !input.select[relation.from_column]) ||
+                    (Array.isArray(relation.from_column) &&
+                        !relation.from_column.some((col) => input.select[col]))) {
+                    throw new forbidden_1.ForbiddenError(`operation ${model.schema}.${model.table}.${alias} is not allowed`);
+                }
+                const relatedModel = easy_psql_1.DB.getRelatedModel(relation);
+                if (!relatedModel) {
+                    throw new forbidden_1.ForbiddenError(`aggregate operation ${apiAccessType} is not allowed`);
+                }
+                const relatedEntityPermissions = this.getUserRolePermissionsForEntity({
+                    schema: relatedModel.schema || easy_psql_1.DB.database,
+                    table: relatedModel.table,
+                    user,
+                    apiAccessType,
+                });
+                if (!((_b = relatedEntityPermissions.columns) === null || _b === void 0 ? void 0 : _b.length)) {
+                    throw new forbidden_1.ForbiddenError(`${relatedModel.schema}.${relatedModel.table}: aggregate operation ${apiAccessType} is not allowed`);
+                }
+                const { where, limit, offset, orderBy, groupBy, distinct, ...rest } = relationConfig;
+                for (const [aggregationKey, config] of Object.entries(rest)) {
+                    if (aggregationKey === "_count") {
+                        continue;
+                    }
+                    if (!easy_validation_service_1.default.isObject(config)) {
+                        throw new badrequest_1.BadRequest(`invalid aggregation at ${relatedModel.schema}.${relatedModel.table}.${alias}.${aggregationKey}`);
+                    }
+                    let column;
+                    if (!Object.keys(config).every((col) => {
+                        var _a, _b;
+                        const exists = (_b = (_a = relatedEntityPermissions.columns) === null || _a === void 0 ? void 0 : _a.includes) === null || _b === void 0 ? void 0 : _b.call(_a, col);
+                        if (!exists) {
+                            column = col;
+                        }
+                        return exists;
+                    })) {
+                        throw new forbidden_1.ForbiddenError(`aggregation at ${relatedModel.schema}.${relatedModel.table}.${alias}.${aggregationKey}.${column} is not allowed`);
+                    }
+                }
+                continue;
+            }
+            const relation = (_c = model.relations) === null || _c === void 0 ? void 0 : _c[alias];
+            // e.g relation is from id -> product_id. If id is excluded from the current model the join will fail, so force it to fail...
+            if (!relation ||
+                (!Array.isArray(relation.from_column) &&
+                    !input.select[relation.from_column]) ||
+                (Array.isArray(relation.from_column) &&
+                    !relation.from_column.some((col) => input.select[col]))) {
+                throw new forbidden_1.ForbiddenError(`${model.schema}.${model.table}.${alias}: operation ${apiAccessType} is not allowed`);
+            }
+            const relatedModel = easy_psql_1.DB.getRelatedModel(relation);
+            if (!relatedModel) {
+                throw new forbidden_1.ForbiddenError(`operation ${apiAccessType} is not allowed`);
+            }
+            const relatedEntityPermissions = this.getUserRolePermissionsForEntity({
+                schema: relatedModel.schema || easy_psql_1.DB.database,
+                table: relatedModel.table,
+                user,
+                apiAccessType,
+            });
+            this.roleBasedSelectSanitization({
+                user,
+                model: relatedModel,
+                input: relationConfig,
+                apiAccessType,
+                entityPermissions: relatedEntityPermissions,
+            });
+        }
+        // sanitize group by
+        if (Array.isArray(input.groupBy) && input.groupBy.length > 0) {
+            let column;
+            if (!input.groupBy.every((col) => {
+                const exists = columns.some((x) => x === col);
+                if (!exists) {
+                    column = col;
+                }
+                return exists;
+            })) {
+                throw new forbidden_1.ForbiddenError(`${model.schema}.${model.table}.groupBy.${column}: operation ${apiAccessType} is not allowed`);
+            }
+        }
+        // sanitize distinct
+        if (Array.isArray(input.distinct) && input.distinct.length > 0) {
+            let column;
+            if (!input.distinct.every((col) => {
+                const exists = columns.some((x) => x === col);
+                if (!exists) {
+                    column = col;
+                }
+                return exists;
+            })) {
+                throw new forbidden_1.ForbiddenError(`${model.schema}.${model.table}.distinct.${column}: operation ${apiAccessType} is not allowed`);
+            }
+        }
+    }
+    roleBasedInsertSanitization({ model, input, apiAccessType, user, entityPermissions, }) {
+        var _a;
+        const { columns, ownership, preConditions } = entityPermissions;
+        if (!Array.isArray(columns) || !columns.length) {
+            throw new forbidden_1.ForbiddenError();
+        }
+        const allowedColumnsMap = columns.reduce((acc, col) => {
+            acc[col] = true;
+            return acc;
+        }, {});
+        if (input == null) {
+            throw new badrequest_1.BadRequest(`body must not be null for operation ${apiAccessType}`);
+        }
+        const iter = Array.isArray(input) ? input : [input];
+        for (let i = 0; i < iter.length; i++) {
+            if (!easy_validation_service_1.default.isObject(iter[i])) {
+                throw new badrequest_1.BadRequest(`each row must be an object for operation ${apiAccessType}`);
+            }
+            Object.assign(iter[i], this.fastDeepClone(preConditions === null || preConditions === void 0 ? void 0 : preConditions.input));
+            let entry = iter[i];
+            const entryPropsIter = Object.keys(entry);
+            for (const key of entryPropsIter) {
+                if (key === "onConflict") {
+                    continue;
+                }
+                else if ((_a = model.relations) === null || _a === void 0 ? void 0 : _a[key]) {
+                    const relatedModel = easy_psql_1.DB.getRelatedModel(model.relations[key]);
+                    const relatedModelEntityPermissions = this.getUserRolePermissionsForEntity({
+                        schema: relatedModel.schema || easy_psql_1.DB.database,
+                        table: relatedModel.table,
+                        user,
+                        apiAccessType,
+                    });
+                    this.roleBasedInsertSanitization({
+                        model: relatedModel,
+                        input: entry[key],
+                        apiAccessType,
+                        user,
+                        entityPermissions: relatedModelEntityPermissions,
+                    });
+                }
+                else {
+                    if (!allowedColumnsMap[key]) {
+                        throw new forbidden_1.ForbiddenError(`column ${key} is not allowed for operation ${apiAccessType}`);
+                    }
+                }
+            }
+            if ((ownership === null || ownership === void 0 ? void 0 : ownership.enabled) &&
+                Array.isArray(ownership.columns) &&
+                ownership.columns.length) {
+                if (!user) {
+                    throw new forbidden_1.ForbiddenError();
+                }
+                if (!(ownership === null || ownership === void 0 ? void 0 : ownership.columns.every((x) => allowedColumnsMap[x]))) {
+                    throw new forbidden_1.ForbiddenError();
+                }
+                for (const col of ownership.columns) {
+                    Object.assign(entry, this.toUserOwnershipColumnNameMapper(user, col, ownership.columnToUserFieldMapper, false));
+                }
+            }
+        }
+    }
+    roleBasedUpdateSanitization({ model, input, apiAccessType, user, entityPermissions, }) {
+        const { columns, ownership, preConditions } = entityPermissions;
+        if (!Array.isArray(columns) || !columns.length) {
+            throw new forbidden_1.ForbiddenError();
+        }
+        if (!easy_validation_service_1.default.isObject(input === null || input === void 0 ? void 0 : input.update)) {
+            throw new badrequest_1.BadRequest(`input.update must be an object for operation ${apiAccessType}`);
+        }
+        if (preConditions === null || preConditions === void 0 ? void 0 : preConditions.input) {
+            Object.assign(input.update, this.fastDeepClone(preConditions.input));
+        }
+        for (const column of Object.keys(input.update)) {
+            if (!columns.some((x) => x === column)) {
+                throw new forbidden_1.ForbiddenError(`column ${column} is not allowed for operation ${apiAccessType}`);
+            }
+        }
+        if (!input.where) {
+            input.where = {};
+        }
+        input.where = this.mergeWhereWithPreConditions({
+            where: input.where || {},
+            preConditions: preConditions || {},
+        });
+        // sanitize where
+        this.roleBasedWhereSanitization({
+            model,
+            where: input.where,
+            user,
+            apiAccessType,
+            entityPermissions,
+        });
+        if ((ownership === null || ownership === void 0 ? void 0 : ownership.enabled) &&
+            Array.isArray(ownership === null || ownership === void 0 ? void 0 : ownership.columns) &&
+            ownership.columns.length) {
+            if (!user) {
+                throw new forbidden_1.ForbiddenError();
+            }
+            if (!(ownership === null || ownership === void 0 ? void 0 : ownership.columns.every((x) => columns.includes(x)))) {
+                throw new forbidden_1.ForbiddenError();
+            }
+            if (!easy_validation_service_1.default.isObject(input.where)) {
+                input.where = {};
+            }
+            input.where = {
+                _and: Object.entries(input.where)
+                    .map(([key, value]) => ({
+                    [key]: value,
+                }))
+                    .concat(ownership === null || ownership === void 0 ? void 0 : ownership.columns.map((col) => {
+                    return this.toUserOwnershipColumnNameMapper(user, col, ownership.columnToUserFieldMapper);
+                }, {})),
+            };
+        }
+    }
+    roleBasedWhereSanitization({ model, where, apiAccessType, user, entityPermissions, }) {
+        var _a, _b;
+        if (!Array.isArray(entityPermissions === null || entityPermissions === void 0 ? void 0 : entityPermissions.columns) ||
+            !((_a = entityPermissions === null || entityPermissions === void 0 ? void 0 : entityPermissions.columns) === null || _a === void 0 ? void 0 : _a.length)) {
+            throw new forbidden_1.ForbiddenError();
+        }
+        if (!easy_validation_service_1.default.isObject(where) && !Array.isArray(where)) {
+            return;
+        }
+        if (Array.isArray(where)) {
+            for (const operation of where) {
+                this.roleBasedWhereSanitization({
+                    model,
+                    where: operation,
+                    apiAccessType,
+                    user,
+                    entityPermissions,
+                });
+            }
+            return;
+        }
+        const iter = Object.entries(where);
+        for (const [key, value] of iter) {
+            if (key === "_and" || key === "_or") {
+                if (!Array.isArray(value)) {
+                    throw new badrequest_1.BadRequest(`invalid value for operation ${key}`);
+                }
+                this.roleBasedWhereSanitization({
+                    model,
+                    where: value,
+                    apiAccessType,
+                    user,
+                    entityPermissions,
+                });
+            }
+            else if (model.columns[key]) {
+                if (!entityPermissions.columns.some((c) => c === key)) {
+                    throw new forbidden_1.ForbiddenError();
+                }
+            }
+            else if (easy_psql_1.DB.getIsAggregate(key)) {
+                const relationKey = easy_psql_1.DB.getRelationNameWithoutAggregate(key);
+                const relation = model.relations[relationKey];
+                if (!relation ||
+                    !entityPermissions.columns.some((col) => this.isColumnInRelationColumns({ relation, column: col }))) {
+                    throw new forbidden_1.ForbiddenError();
+                }
+                const relatedModel = easy_psql_1.DB.getRelatedModel(relation);
+                if (!relatedModel) {
+                    throw new forbidden_1.ForbiddenError();
+                }
+                const relatedEntityPermissions = this.getUserRolePermissionsForEntity({
+                    schema: relatedModel.schema || easy_psql_1.DB.database,
+                    table: relatedModel.table,
+                    user,
+                    apiAccessType,
+                });
+                if (!((_b = relatedEntityPermissions.columns) === null || _b === void 0 ? void 0 : _b.length)) {
+                    throw new forbidden_1.ForbiddenError();
+                }
+                const valueEntries = easy_validation_service_1.default.isObject(value)
+                    ? Object.entries(value)
+                    : [];
+                const [_, config] = valueEntries[0] || [null, {}];
+                const configEntries = easy_validation_service_1.default.isObject(config)
+                    ? Object.entries(config)
+                    : [];
+                const [aggregationKey, aggregationConfig] = configEntries[0] || [
+                    "",
+                    {},
+                ];
+                if (!aggregationKey) {
+                    throw new badrequest_1.BadRequest();
+                }
+                if (aggregationKey === "_count") {
+                    continue;
+                }
+                else {
+                    const aggregationColumns = Object.keys(aggregationConfig);
+                    if (!aggregationColumns.every((aggColumn) => { var _a, _b; return (_b = (_a = relatedEntityPermissions === null || relatedEntityPermissions === void 0 ? void 0 : relatedEntityPermissions.columns) === null || _a === void 0 ? void 0 : _a.includes) === null || _b === void 0 ? void 0 : _b.call(_a, aggColumn); })) {
+                        throw new forbidden_1.ForbiddenError();
+                    }
+                }
+            }
+            else if (model.relations[key]) {
+                const relation = model.relations[key];
+                if (!relation ||
+                    !entityPermissions.columns.some((col) => this.isColumnInRelationColumns({ relation, column: col }))) {
+                    throw new forbidden_1.ForbiddenError();
+                }
+                const relatedModel = easy_psql_1.DB.getRelatedModel(relation);
+                if (!relatedModel) {
+                    throw new forbidden_1.ForbiddenError();
+                }
+                const relatedEntityPermissions = this.getUserRolePermissionsForEntity({
+                    schema: relatedModel.schema || easy_psql_1.DB.database,
+                    table: relatedModel.table,
+                    user,
+                    apiAccessType,
+                });
+                where[key] = this.mergeWhereWithPreConditions({
+                    where: value || {},
+                    preConditions: relatedEntityPermissions === null || relatedEntityPermissions === void 0 ? void 0 : relatedEntityPermissions.preConditions,
+                });
+                this.roleBasedWhereSanitization({
+                    user,
+                    model: relatedModel,
+                    entityPermissions: relatedEntityPermissions,
+                    where: where[key],
+                    apiAccessType,
+                });
+            }
+        }
+    }
+    roleBasedDeleteSanitization({ model, input, apiAccessType, user, entityPermissions, }) {
+        const { columns, ownership, preConditions } = entityPermissions;
+        if (!Array.isArray(columns) || !columns.length) {
+            throw new forbidden_1.ForbiddenError();
+        }
+        if (!input.where) {
+            input.where = {};
+        }
+        input.where = this.mergeWhereWithPreConditions({
+            where: input.where || {},
+            preConditions: preConditions || {},
+        });
+        // sanitize where
+        this.roleBasedWhereSanitization({
+            model,
+            where: input.where,
+            user,
+            apiAccessType,
+            entityPermissions,
+        });
+        if (easy_validation_service_1.default.isObject(ownership) &&
+            (ownership === null || ownership === void 0 ? void 0 : ownership.enabled) &&
+            Array.isArray(ownership === null || ownership === void 0 ? void 0 : ownership.columns) &&
+            (ownership === null || ownership === void 0 ? void 0 : ownership.columns.length)) {
+            if (!user) {
+                throw new forbidden_1.ForbiddenError();
+            }
+            if (!ownership.columns.every((x) => columns.includes(x))) {
+                throw new forbidden_1.ForbiddenError();
+            }
+            input.where = {
+                _and: Object.entries(input.where)
+                    .map(([key, value]) => ({
+                    [key]: value,
+                }))
+                    .concat(ownership.columns.map((col) => {
+                    return this.toUserOwnershipColumnNameMapper(user, col, ownership.columnToUserFieldMapper);
+                }, {})),
+            };
+        }
+    }
+    isColumnInRelationColumns({ relation, column, }) {
+        if (Array.isArray(relation.from_column)) {
+            return relation.from_column.includes(column);
+        }
+        else {
+            return relation.from_column === column;
+        }
+    }
+    fastDeepClone(obj) {
+        if (obj === null || typeof obj !== "object") {
+            return obj;
+        }
+        if (Array.isArray(obj)) {
+            const copy = new Array(obj.length);
+            for (let i = 0; i < obj.length; i++) {
+                copy[i] = this.fastDeepClone(obj[i]);
+            }
+            return copy;
+        }
+        const copy = {};
+        for (const key in obj) {
+            if (Object.prototype.hasOwnProperty.call(obj, key)) {
+                copy[key] = this.fastDeepClone(obj[key]);
+            }
+        }
+        return copy;
+    }
+    mergeWhereWithPreConditions({ where, preConditions, }) {
+        if (!easy_validation_service_1.default.isObject(where)) {
+            where = {};
+        }
+        const conditionsToMerge = preConditions === null || preConditions === void 0 ? void 0 : preConditions.where;
+        if (easy_validation_service_1.default.isObject(conditionsToMerge)) {
+            const conditions = this.fastDeepClone(conditionsToMerge);
+            const { _and, _or, ...rest } = conditions;
+            where = { ...where, ...rest };
+            if (Array.isArray(_and)) {
+                where._and = [...(where._and || []), ..._and];
+            }
+            if (Array.isArray(_or)) {
+                where._or = [...(where._or || []), ..._or];
+            }
+        }
+        return where;
+    }
+    findManyModel({ schema, table, connection, bypass, query, user, }) {
+        const model = this.roleBasedModel({
+            schema,
+            table,
+            connection,
+            apiAccessType: types_1.AllowedEngineApiAccessTypes.findMany,
+            bypass,
+            input: query,
+            user,
+        });
+        return model;
+    }
+    findOneModel({ schema, table, connection, bypass, query, user, }) {
+        const model = this.roleBasedModel({
+            schema,
+            table,
+            connection,
+            apiAccessType: types_1.AllowedEngineApiAccessTypes.findOne,
+            bypass,
+            input: query,
+            user,
+        });
+        return model;
+    }
+    aggregateModel({ schema, table, connection, bypass, query, user, }) {
+        const model = this.roleBasedModel({
+            schema,
+            table,
+            connection,
+            apiAccessType: types_1.AllowedEngineApiAccessTypes.aggregate,
+            bypass,
+            input: query,
+            user,
+        });
+        return model;
+    }
+    createManyModel({ schema, table, connection, bypass, body, user, }) {
+        const model = this.roleBasedModel({
+            schema,
+            table,
+            connection,
+            apiAccessType: types_1.AllowedEngineApiAccessTypes.createMany,
+            bypass,
+            input: body,
+            user,
+        });
+        return model;
+    }
+    createOneModel({ schema, table, connection, bypass, body, user, }) {
+        const model = this.roleBasedModel({
+            schema,
+            table,
+            connection,
+            apiAccessType: types_1.AllowedEngineApiAccessTypes.createOne,
+            bypass,
+            input: body,
+            user,
+        });
+        return model;
+    }
+    updateManyModel({ schema, table, connection, bypass, input, user, }) {
+        const model = this.roleBasedModel({
+            schema,
+            table,
+            connection,
+            apiAccessType: types_1.AllowedEngineApiAccessTypes.updateMany,
+            bypass,
+            input,
+            user,
+        });
+        return model;
+    }
+    updateOneModel({ schema, table, connection, bypass, input, user, }) {
+        const model = this.roleBasedModel({
+            schema,
+            table,
+            connection,
+            apiAccessType: types_1.AllowedEngineApiAccessTypes.updateOne,
+            bypass,
+            input,
+            user,
+        });
+        return model;
+    }
+    deleteManyModel({ schema, table, connection, bypass, input, user, }) {
+        const model = this.roleBasedModel({
+            schema,
+            table,
+            connection,
+            apiAccessType: types_1.AllowedEngineApiAccessTypes.deleteMany,
+            bypass,
+            input,
+            user,
+        });
+        return model;
+    }
+    deleteOneModel({ schema, table, connection, bypass, input, user, }) {
+        const model = this.roleBasedModel({
+            schema,
+            table,
+            connection,
+            apiAccessType: types_1.AllowedEngineApiAccessTypes.deleteOne,
+            bypass,
+            input,
+            user,
+        });
+        return model;
+    }
+    toUserOwnershipColumnValueDefault(user) {
+        return user === null || user === void 0 ? void 0 : user[this.options.userIdentityKey || "id"];
+    }
+    toUserOwnershipColumnNameMapper(user, col, columnToUserFieldMapper, isComparison = true) {
+        const userField = columnToUserFieldMapper === null || columnToUserFieldMapper === void 0 ? void 0 : columnToUserFieldMapper[col];
+        const value = userField && user && userField in user
+            ? user[userField]
+            : this.toUserOwnershipColumnValueDefault(user);
+        return isComparison ? { [col]: { _eq: value } } : { [col]: value };
+    }
+}
+exports.EasyPSQLRBAC = EasyPSQLRBAC;
+//# sourceMappingURL=rbac.js.map