identity-admin 1.10.0 → 1.12.0

package/lib/controllers/DashboardController.js

@@ -23,18 +23,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 var DashboardController_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 const inversify_express_utils_1 = require("inversify-express-utils");
-const mongoose_1 = require("mongoose");
 const ResponseUtils_1 = __importDefault(require("../utils/ResponseUtils"));
 const express_validator_1 = require("express-validator");
 const ResourceGenerator_1 = __importDefault(require("../helpers/ResourceGenerator"));
 const ResourceHelper_1 = __importDefault(require("../helpers/ResourceHelper"));
 const StringUtils_1 = __importDefault(require("../utils/StringUtils"));
-const mongoose_2 = __importDefault(require("mongoose"));
+const mongoose_1 = __importDefault(require("mongoose"));
 const inversify_1 = require("inversify");
 const Repository_1 = __importDefault(require("../repositories/Repository"));
 const ResourceUtils_1 = require("../utils/ResourceUtils");
 const FiltersHelper_1 = __importDefault(require("../helpers/FiltersHelper"));
 const LocalizedStringHelper_1 = __importDefault(require("../helpers/LocalizedStringHelper"));
+const ActionsGenerator_1 = __importDefault(require("../helpers/ActionsGenerator"));
 let DashboardController = DashboardController_1 = class DashboardController {
     constructor(resource, repository, resources) {
         this.resource = resource;
@@ -61,7 +61,7 @@ let DashboardController = DashboardController_1 = class DashboardController {
         const schema = resource.properties.resource.schema.paths;
         const searchBy = ResourceHelper_1.default.getSchemaTitle(schema, this.resource);
         if (searchBy === '_id') {
-            if (!mongoose_2.default.isValidObjectId(subString.source)) {
+            if (!mongoose_1.default.isValidObjectId(subString.source)) {
                 return filter;
             }
             filter[searchBy] = subString.source;
@@ -127,8 +127,15 @@ let DashboardController = DashboardController_1 = class DashboardController {
             if (!resource) {
                 return ResponseUtils_1.default.notFound(res, 'Resource not found', []);
             }
+            if (!currentUser) {
+                return ResponseUtils_1.default.unauthorized(res);
+            }
+            const permissionCheck = resource.properties.isAllowed ? yield resource.properties.isAllowed(currentUser) : true;
+            if (!permissionCheck) {
+                return ResponseUtils_1.default.forbidden(res);
+            }
             const repository = (_c = this.repository) !== null && _c !== void 0 ? _c : new Repository_1.default(resource.properties.resource);
-            const modifiedResource = ResourceGenerator_1.default.generate(resource);
+            const modifiedResource = ResourceGenerator_1.default.generate(resource, currentUser);
             const sort = req.query.order;
             const sortBy = req.query.orderBy;
             const sortQuery = {};
@@ -207,13 +214,24 @@ let DashboardController = DashboardController_1 = class DashboardController {
             }
             const modelName = req.params.resource;
             const resource = (_a = this.resource) !== null && _a !== void 0 ? _a : (0, ResourceUtils_1.getResource)(modelName, (_b = this.resources) !== null && _b !== void 0 ? _b : []);
+            const currentUser = req.user;
             if (!resource) {
                 return ResponseUtils_1.default.notFound(res, 'Resource not found', []);
             }
+            if (!currentUser) {
+                return ResponseUtils_1.default.unauthorized(res);
+            }
+            const permissionCheck = resource.properties.isAllowed ? yield resource.properties.isAllowed(currentUser) : true;
+            if (!permissionCheck) {
+                return ResponseUtils_1.default.forbidden(res);
+            }
+            const actions = ActionsGenerator_1.default.generateActions(resource.properties.actions, resource, currentUser);
+            const createPermission = actions.new.isAccessible;
+            if (!createPermission) {
+                return ResponseUtils_1.default.forbidden(res);
+            }
             const repository = (_c = this.repository) !== null && _c !== void 0 ? _c : new Repository_1.default(resource.properties.resource);
-            const modifiedResource = ResourceGenerator_1.default.generate(resource);
             var recordParams = req.body;
-            const currentUser = req.user;
             recordParams = LocalizedStringHelper_1.default.mapLocalizableString(recordParams, resource);
             const crudOperations = resource.properties.crudOperations;
             if (crudOperations && crudOperations.create && crudOperations.create.before) {
@@ -221,7 +239,8 @@ let DashboardController = DashboardController_1 = class DashboardController {
             }
             var record;
             if (recordParams.password) {
-                const user = new mongoose_1.Mongoose.prototype.model(modifiedResource.properties.modelName)(recordParams);
+                //const user = new Mongoose.prototype.model(modifiedResource.properties.modelName)(recordParams);
+                const user = new resource.properties.resource(recordParams);
                 const set = yield user.setPassword(recordParams.password);
                 record = yield repository.saveInstance(user);
             }
@@ -232,7 +251,7 @@ let DashboardController = DashboardController_1 = class DashboardController {
                 return ResponseUtils_1.default.unprocessable(res, 'Invalid Data', record.getErrors());
             }
             if (crudOperations && crudOperations.create && crudOperations.create.after) {
-                record = yield crudOperations.create.after(req, record, currentUser);
+                record = yield crudOperations.create.after(req, record, currentUser, recordParams);
             }
             return ResponseUtils_1.default.created(res, {
                 record
@@ -250,10 +269,22 @@ let DashboardController = DashboardController_1 = class DashboardController {
             if (!resource) {
                 return ResponseUtils_1.default.notFound(res, 'Resource not found', []);
             }
-            const repository = (_c = this.repository) !== null && _c !== void 0 ? _c : new Repository_1.default(resource.properties.resource);
-            const recordId = req.params.id;
             var recordParams = req.body;
             const currentUser = req.user;
+            if (!currentUser) {
+                return ResponseUtils_1.default.unauthorized(res);
+            }
+            const permissionCheck = resource.properties.isAllowed ? yield resource.properties.isAllowed(currentUser) : true;
+            if (!permissionCheck) {
+                return ResponseUtils_1.default.forbidden(res);
+            }
+            const actions = ActionsGenerator_1.default.generateActions(resource.properties.actions, resource, currentUser);
+            const editPermission = actions.edit.isAccessible;
+            if (!editPermission) {
+                return ResponseUtils_1.default.forbidden(res);
+            }
+            const repository = (_c = this.repository) !== null && _c !== void 0 ? _c : new Repository_1.default(resource.properties.resource);
+            const recordId = req.params.id;
             var record = yield repository.findById(recordId);
             if (!record) {
                 return ResponseUtils_1.default.send(res, 404, 'record Not Found');
@@ -286,11 +317,19 @@ let DashboardController = DashboardController_1 = class DashboardController {
             const modelName = req.params.resource;
             const recordId = req.params.id;
             const resource = (_a = this.resource) !== null && _a !== void 0 ? _a : (0, ResourceUtils_1.getResource)(modelName, (_b = this.resources) !== null && _b !== void 0 ? _b : []);
+            const currentUser = req.user;
             if (!resource) {
                 return ResponseUtils_1.default.notFound(res, 'Resource not found', []);
             }
+            if (!currentUser) {
+                return ResponseUtils_1.default.unauthorized(res);
+            }
+            const permissionCheck = resource.properties.isAllowed ? yield resource.properties.isAllowed(currentUser) : true;
+            if (!permissionCheck) {
+                return ResponseUtils_1.default.forbidden(res);
+            }
             const repository = (_c = this.repository) !== null && _c !== void 0 ? _c : new Repository_1.default(resource.properties.resource);
-            const modifiedResource = ResourceGenerator_1.default.generate(resource);
+            const modifiedResource = ResourceGenerator_1.default.generate(resource, currentUser);
             var record = yield repository.findOne({
                 filter: {
                     _id: recordId
@@ -323,6 +362,19 @@ let DashboardController = DashboardController_1 = class DashboardController {
             if (!resource) {
                 return ResponseUtils_1.default.notFound(res, 'Resource not found', []);
             }
+            const currentUser = req.user;
+            if (!currentUser) {
+                return ResponseUtils_1.default.unauthorized(res);
+            }
+            const permissionCheck = resource.properties.isAllowed ? yield resource.properties.isAllowed(currentUser) : true;
+            if (!permissionCheck) {
+                return ResponseUtils_1.default.forbidden(res);
+            }
+            const actions = ActionsGenerator_1.default.generateActions(resource.properties.actions, resource, currentUser);
+            const bulkDeletePermission = actions.bulkDelete.isAccessible;
+            if (!bulkDeletePermission) {
+                return ResponseUtils_1.default.forbidden(res);
+            }
             const repository = (_c = this.repository) !== null && _c !== void 0 ? _c : new Repository_1.default(resource.properties.resource);
             for (var i = 0; i < recordIds.length; i++) {
                 const recordId = recordIds[i];
@@ -347,6 +399,19 @@ let DashboardController = DashboardController_1 = class DashboardController {
             if (!resource) {
                 return ResponseUtils_1.default.notFound(res, 'Resource not found', []);
             }
+            const currentUser = req.user;
+            if (!currentUser) {
+                return ResponseUtils_1.default.unauthorized(res);
+            }
+            const permissionCheck = resource.properties.isAllowed ? yield resource.properties.isAllowed(currentUser) : true;
+            if (!permissionCheck) {
+                return ResponseUtils_1.default.forbidden(res);
+            }
+            const actions = ActionsGenerator_1.default.generateActions(resource.properties.actions, resource, currentUser);
+            const deletePermission = actions.delete.isAccessible;
+            if (!deletePermission) {
+                return ResponseUtils_1.default.forbidden(res);
+            }
             const repository = (_c = this.repository) !== null && _c !== void 0 ? _c : new Repository_1.default(resource.properties.resource);
             const record = yield repository.findById(recordId);
             if (!record) {

package/lib/controllers/ResourceController.js

@@ -58,20 +58,24 @@ let ResourceController = class ResourceController {
         return __awaiter(this, void 0, void 0, function* () {
             var modifiedResource = {};
             modifiedResource.modelParents = {};
+            const currentUser = req.user;
             if (this.configurations) {
                 modifiedResource.appConfigurations = this.configurations;
             }
             for (var i = 0; i < this.resourceFiles.length; i++) {
                 const resource = this.resourceFiles[i];
-                const adaptedResource = ResourceGenerator_1.default.generate(resource);
-                const modelName = StringUtils_1.default.lowerCaseFirstLetter(adaptedResource.properties.modelName);
-                modifiedResource[modelName] = adaptedResource;
-                if (modifiedResource.modelParents[adaptedResource.properties.parent.name]) {
-                    modifiedResource.modelParents[adaptedResource.properties.parent.name].push(modelName);
-                }
-                else {
-                    modifiedResource.modelParents[adaptedResource.properties.parent.name] = [];
-                    modifiedResource.modelParents[adaptedResource.properties.parent.name].push(modelName);
+                const visibiltyCheck = resource.properties.isAllowed ? yield resource.properties.isAllowed(currentUser) : true;
+                if (visibiltyCheck) {
+                    const adaptedResource = ResourceGenerator_1.default.generate(resource, currentUser);
+                    const modelName = StringUtils_1.default.lowerCaseFirstLetter(adaptedResource.properties.modelName);
+                    modifiedResource[modelName] = adaptedResource;
+                    if (modifiedResource.modelParents[adaptedResource.properties.parent.name]) {
+                        modifiedResource.modelParents[adaptedResource.properties.parent.name].push(modelName);
+                    }
+                    else {
+                        modifiedResource.modelParents[adaptedResource.properties.parent.name] = [];
+                        modifiedResource.modelParents[adaptedResource.properties.parent.name].push(modelName);
+                    }
                 }
             }
             return ResponseUtils_1.default.send(res, 200, 'OK', {
@@ -85,8 +89,9 @@ let ResourceController = class ResourceController {
             const resourceName = modelName + 'Resource';
             const resourceFilePath = '@pbb/materialUi/' + resourceName;
             const resource = yield Promise.resolve().then(() => __importStar(require(resourceFilePath)));
+            const currentUser = req.user;
             return ResponseUtils_1.default.send(res, 200, 'OK', {
-                options: ResourceGenerator_1.default.generate(resource[resourceName])
+                options: ResourceGenerator_1.default.generate(resource[resourceName], currentUser)
             });
         });
     }

package/lib/helpers/ActionsGenerator.d.ts

@@ -1,6 +1,7 @@
+import { Document } from "mongoose";
 import { IResourceFile } from "../types/IResourceFile";
 export default class ActionsGenerator {
-    static generateActions(actionsCheck: any, resource: IResourceFile): {
+    static generateActions(actionsCheck: any, resource: IResourceFile, currentUser: Document): {
         [key: string]: any;
     };
     private static addExtraActions;

package/lib/helpers/ActionsGenerator.js

@@ -30,8 +30,8 @@ const i18n_1 = __importStar(require("i18n"));
 const ResourceHelper_1 = __importDefault(require("./ResourceHelper"));
 var pluralize = require('pluralize');
 class ActionsGenerator {
-    static generateActions(actionsCheck, resource) {
-        const actions = this.getActions(actionsCheck ? JSON.parse(JSON.stringify(resource.properties.actions)) : undefined); //resource.properties.actions? ResourcesHelper.getActions(JSON.parse(JSON.stringify(resource.properties.actions))): ResourcesHelper.getActions(undefined) 
+    static generateActions(actionsCheck, resource, currentUser) {
+        const actions = this.getActions(actionsCheck ? resource.properties.actions : undefined, currentUser); //resource.properties.actions? ResourcesHelper.getActions(JSON.parse(JSON.stringify(resource.properties.actions))): ResourcesHelper.getActions(undefined) 
         for (const key in actions) {
             if (key === 'extras') {
                 actions.extras = actions.extras ? this.addExtraActions(JSON.parse(JSON.stringify(resource.properties.actions.extras))) : actions.extras;
@@ -54,7 +54,7 @@ class ActionsGenerator {
         });
         return extraActionsObject;
     }
-    static getActions(actions) {
+    static getActions(actions, currentUser) {
         var actionObject = {
             show: { isAccessible: true },
             new: { isAccessible: true },
@@ -66,7 +66,15 @@ class ActionsGenerator {
             return actionObject;
         }
         for (const key in actions) {
-            if (actions[key].hasOwnProperty('isAccessible') || key === 'extras') {
+            if (actions[key].hasOwnProperty('isAccessible') && key !== 'extras') {
+                actionObject[key] = actions[key];
+            }
+            else if (actions[key].isAllowed && key !== 'extras') {
+                actionObject[key] = {
+                    isAccessible: actions[key].isAllowed(currentUser)
+                };
+            }
+            else if (key === 'extras') {
                 actionObject[key] = actions[key];
             }
         }

package/lib/helpers/ResourceGenerator.d.ts

@@ -1,4 +1,5 @@
+import { Document } from "mongoose";
 import { IResourceFile } from "../types/IResourceFile";
 export default class ResourceGenerator {
-    static generate(resource: IResourceFile): any;
+    static generate(resource: IResourceFile, currentUser: Document): any;
 }

package/lib/helpers/ResourceGenerator.js

@@ -37,7 +37,7 @@ const SetupParent = {
     //value: __({phrase: "Setup", locale: i18n.getLocale()})
 };
 class ResourceGenerator {
-    static generate(resource) {
+    static generate(resource, currentUser) {
         var _a, _b, _c, _d, _e, _f, _g;
         const SetupParent = {
             name: 'Setup',
@@ -102,7 +102,7 @@ class ResourceGenerator {
             const options = ((_b = (_a = resource.properties.filters) === null || _a === void 0 ? void 0 : _a.scopes) === null || _b === void 0 ? void 0 : _b.auto) ? (_d = (_c = resource.properties.filters) === null || _c === void 0 ? void 0 : _c.scopes) === null || _d === void 0 ? void 0 : _d.auto.options : (_g = (_f = (_e = resource.properties.filters) === null || _e === void 0 ? void 0 : _e.scopes) === null || _f === void 0 ? void 0 : _f.manual) === null || _g === void 0 ? void 0 : _g.options;
             modifiedResource.properties.filters.scopes.options = ResourceHelper_1.default.setScopeFilterOptions(modelName, options);
         }
-        const actions = ActionsGenerator_1.default.generateActions(actionsCheck, resource);
+        const actions = ActionsGenerator_1.default.generateActions(actionsCheck, resource, currentUser);
         modifiedResource.properties.actions = actions;
         return modifiedResource;
     }

package/lib/helpers/SchemaGenerator.js

@@ -33,6 +33,9 @@ class SchemaGenerator {
                 model = modelAndPopulatedString[0];
                 populatedString = modelAndPopulatedString[1];
             }
+            if (fieldType === helpers_1.FieldTypes.DATE) {
+                model[field].withTime = model[field].withTime ? model[field].withTime : false;
+            }
             else if (fieldType === helpers_1.FieldTypes.ARRAY) {
                 model[field].required = schema[field].caster.isRequired;
                 if (schema[field].schema) {

package/lib/types/IResourceFile.d.ts

@@ -25,6 +25,13 @@ interface Action {
      *  You can ovveride any of these values here.
      */
     isAccessible?: boolean;
+    /**
+     * The property that manages which admin role can use this action.
+     * This function's result alters the isAccessible value. So no need to use both properties.
+     * If both are used then isAccessible has the higher priority.
+     * @default 'Same as isAccessible'
+     */
+    isAllowed?: (currentUser: Document) => boolean;
 }
 interface ICrudOperations {
     index?: {
@@ -55,7 +62,7 @@ interface ICrudOperations {
          * After handler that gives you the access to the saved document.
          * @returns the saved document
          */
-        after?: (req: IRequest, document: Document, currentUser: Document) => Promise<Document>;
+        after?: (req: IRequest, document: Document, currentUser: Document, params: any) => Promise<Document>;
     };
     update?: {
         /**
@@ -195,6 +202,11 @@ export interface IFieldValue {
      * @default image
      */
     fileType?: FileTypes;
+    /**
+     * Specify if the date is shown with time or not. Only used if the field type is Date
+     * @default false
+     */
+    withTime?: boolean;
 }
 export interface IVirtualValue {
     /**
@@ -325,6 +337,12 @@ export interface IResourceFile {
          * @default 'The schema title'
          */
         defaultOrderBy?: string;
+        /**
+         * The property that controls the permission of this model according to the current user role.
+         * Specify either this user is allowed to see this model or not.
+         * @default true
+         */
+        isAllowed?: (currentUser: Document) => Promise<boolean>;
         /**
          * The default order
          * @default asc

package/lib/utils/ResponseUtils.d.ts

@@ -5,6 +5,7 @@ export default class ResponseUtils {
     static created(res: Response, data: object): void;
     static ok(res: Response, data: object): void;
     static unauthorized(res: Response): void;
+    static forbidden(res: Response): void;
     static unprocessable(res: Response, message: string, errors: ISaveError[]): void;
     static notFound(res: Response, message: string, errors: ISaveError[]): void;
 }

package/lib/utils/ResponseUtils.js

@@ -28,6 +28,9 @@ class ResponseUtils {
     static unauthorized(res) {
         this.send(res, 401, 'Unauthenticated');
     }
+    static forbidden(res) {
+        this.send(res, 403, 'Not allowed to access this resource');
+    }
     static unprocessable(res, message, errors) {
         this.send(res, 422, message, {}, errors);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "identity-admin",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "description": "",
   "main": "lib/Dashboard.js",
   "types": "lib/Dashbord.d.ts",