oak-domain 3.0.0 → 3.0.1

package/lib/store/CascadeStore.js

@@ -381,19 +381,21 @@ var CascadeStore = /** @class */ (function (_super) {
                         }));
                         var dealWithSubRows = function (subRows) {
                             (0, assert_1.default)(subRows.length <= entityIds.length);
-                            if (context instanceof AsyncRowStore_1.AsyncContext && subRows.length < entityIds.length && !toModi) {
+                            if (subRows.length < entityIds.length && !toModi) {
                                 // 后台不允许数据不一致
-                                throw new types_1.OakRowUnexistedException([{
-                                        entity: attr,
-                                        selection: {
-                                            data: projection2[attr],
-                                            filter: {
-                                                id: {
-                                                    $in: entityIds
+                                if (context instanceof AsyncRowStore_1.AsyncContext || !option.ignoreForeignKeyMiss) {
+                                    throw new types_1.OakRowUnexistedException([{
+                                            entity: attr,
+                                            selection: {
+                                                data: projection2[attr],
+                                                filter: {
+                                                    id: {
+                                                        $in: entityIds
+                                                    },
                                                 },
                                             },
-                                        },
-                                    }]);
+                                        }]);
+                                }
                             }
                             result.forEach(function (ele) {
                                 var _a, _b;
@@ -470,18 +472,20 @@ var CascadeStore = /** @class */ (function (_super) {
                         var ids = (0, lodash_1.uniq)(result.filter(function (ele) { return !!(ele["".concat(attr, "Id")]); }).map(function (ele) { return ele["".concat(attr, "Id")]; }));
                         var dealWithSubRows = function (subRows) {
                             (0, assert_1.default)(subRows.length <= ids.length);
-                            if (context instanceof AsyncRowStore_1.AsyncContext && subRows.length < ids.length && !toModi) {
-                                throw new types_1.OakRowUnexistedException([{
-                                        entity: relation,
-                                        selection: {
-                                            data: projection2[attr],
-                                            filter: {
-                                                id: {
-                                                    $in: ids
+                            if (subRows.length < ids.length && !toModi) {
+                                if (context instanceof AsyncRowStore_1.AsyncContext || !option.ignoreForeignKeyMiss) {
+                                    throw new types_1.OakRowUnexistedException([{
+                                            entity: relation,
+                                            selection: {
+                                                data: projection2[attr],
+                                                filter: {
+                                                    id: {
+                                                        $in: ids
+                                                    },
                                                 },
-                                            },
-                                        }
-                                    }]);
+                                            }
+                                        }]);
+                                }
                             }
                             result.forEach(function (ele) {
                                 var _a, _b, _c;

package/lib/store/RelationAuth.d.ts

@@ -40,12 +40,12 @@ export declare class RelationAuth<ED extends EntityDict & BaseEntityDict> {
      */
     private destructOperation;
     /**
-     * 定位到了当前用户所有可能的actionAuth，对单条actionAuth加以判断，找到可以满足当前操作的actionAuth
+     * 对所有满足操作要求的actionAuth加以判断，找到可以满足当前用户身份的actionAuth
      * @param entity
      * @param filter
      * @param actionAuths
      * @param context
-     * @return  string代表用户获得授权的relationId，空字符串代表通过userId赋权，false代表失败
+     * @return
      */
     private filterActionAuths;
     /**
@@ -58,8 +58,15 @@ export declare class RelationAuth<ED extends EntityDict & BaseEntityDict> {
      */
     private checkActionAuthInGroup;
     private checkSelection;
+    /**
+     * 此函数判定一个结点是否能通过权限检测，同时寻找该结点本身对象上成立的actionAuth，用于本结点子孙结点的快速检测
+     * 如果结点因其deduce的对象通过了检测，其被推断对象的actionAuth无法用于更低对象的权限检测
+     * @param node
+     * @param context
+     * @returns
+     */
     private findActionAuthsOnNode;
-    private checkOperationTree;
+    private checkOperationTree2;
     private checkOperation;
     /**
      * 检查一个operation是否能被通过权限测试

package/lib/store/RelationAuth.js

@@ -7,7 +7,6 @@ var types_1 = require("../types");
 var AsyncRowStore_1 = require("./AsyncRowStore");
 var filter_1 = require("./filter");
 var relation_1 = require("./relation");
-var SyncRowStore_1 = require("./SyncRowStore");
 var action_1 = require("../actions/action");
 var lodash_1 = require("../utils/lodash");
 var env_1 = require("../compiler/env");
@@ -217,10 +216,11 @@ var RelationAuth = /** @class */ (function () {
             var getRecursiveDeducedFilters_1 = function (deduceEntity, deduceFilter) {
                 var excludeActions = action_1.readOnlyActions.concat([ /* 'create', 'remove' */]);
                 var updateActions = _this.schema[deduceEntity].actions.filter(function (a) { return !excludeActions.includes(a); });
-                if (!RelationAuth.SPECIAL_ENTITIES.includes(deduceEntity)) {
-                    return _this.getDeducedEntityFilters(deduceEntity, deduceFilter, actions[0] === 'select' ? actions : updateActions, context);
+                /* if (!RelationAuth.SPECIAL_ENTITIES.includes(deduceEntity as string)) {
+                    return this.getDeducedEntityFilters(deduceEntity, deduceFilter, actions[0] === 'select' ? actions : updateActions, context);
                 }
-                return [];
+                return []; */
+                return _this.getDeducedEntityFilters(deduceEntity, deduceFilter, actions[0] === 'select' ? actions : updateActions, context);
             };
             if (deduceEntity && deduceFilter) {
                 var deducedSelections = getRecursiveDeducedFilters_1(deduceEntity, deduceFilter);
@@ -467,15 +467,15 @@ var RelationAuth = /** @class */ (function () {
         return destructInner(entity2, (0, lodash_1.cloneDeep)(operation2));
     };
     /**
-     * 定位到了当前用户所有可能的actionAuth，对单条actionAuth加以判断，找到可以满足当前操作的actionAuth
+     * 对所有满足操作要求的actionAuth加以判断，找到可以满足当前用户身份的actionAuth
      * @param entity
      * @param filter
      * @param actionAuths
      * @param context
-     * @return  string代表用户获得授权的relationId，空字符串代表通过userId赋权，false代表失败
+     * @return
      */
-    RelationAuth.prototype.filterActionAuths = function (entity, filter, actionAuths, context, actions) {
-        return actionAuths.map(function (ele) {
+    RelationAuth.prototype.filterActionAuths = function (entity, filter, actionAuths, context) {
+        var result = actionAuths.map(function (ele) {
             var paths = ele.paths, relation = ele.relation, relationId = ele.relationId;
             // 在cache中，可能出现relation外键指向的对象为null的情况，要容错
             if (relationId) {
@@ -532,6 +532,10 @@ var RelationAuth = /** @class */ (function () {
                 return ele;
             }
         });
+        if (result.find(function (ele) { return ele instanceof Promise; })) {
+            return Promise.all(result).then(function (r2) { return r2.filter(function (ele) { return !!ele; }); });
+        }
+        return result.filter(function (ele) { return !!ele; });
     };
     /**
      * 对于有些特殊的查询（带很多$or的查询，多发生在系统级别），单个actionAuth无法满足，需要共同加以判定
@@ -648,7 +652,7 @@ var RelationAuth = /** @class */ (function () {
                         }
                     ]
                 }
-            }, { dontCollect: true });
+            }, { dontCollect: true, ignoreForeignKeyMiss: true });
             /**
              * 返回的结果中，第一层为leafNode，必须全通过，第二层为单个leafNode上的deduce，通过一个就可以
              * @param result
@@ -690,169 +694,152 @@ var RelationAuth = /** @class */ (function () {
         }
         return checkDeducedLeafSelections(deducedLeafSelections);
     };
+    /**
+     * 此函数判定一个结点是否能通过权限检测，同时寻找该结点本身对象上成立的actionAuth，用于本结点子孙结点的快速检测
+     * 如果结点因其deduce的对象通过了检测，其被推断对象的actionAuth无法用于更低对象的权限检测
+     * @param node
+     * @param context
+     * @returns
+     */
     RelationAuth.prototype.findActionAuthsOnNode = function (node, context) {
         var _this = this;
         var entity = node.entity, filter = node.filter, action = node.action, userRelations = node.userRelations;
-        if (RelationAuth.SPECIAL_ENTITIES.includes(entity)) {
-            // 特殊对象不用查询
-            return [];
-        }
         var deducedEntityFilters2 = this.getDeducedEntityFilters(entity, filter, [action], context);
+        /**
+         * 搜索判定是否允许自建对象，自建的条件是 path = ''，destEntity === entity
+         * @param actionAuths
+         * @returns
+         */
+        var findOwnCreateUserRelation = function (actionAuths) {
+            if (userRelations && userRelations.length > 0) {
+                (0, assert_1.default)(action === 'create');
+                var ars = actionAuths.filter(function (ar) { return !!userRelations.find(function (ur) { return ur.relationId === ar.relationId; }) && ar.paths.includes('') && ar.destEntity === entity; });
+                if (ars.length > 0) {
+                    return ars;
+                }
+            }
+        };
+        var actionAuthOnEntities = [];
         var dealWithDeducedEntityFilters = function (deducedEntityFilters) {
-            var allEntities = deducedEntityFilters.map(function (ele) { return ele.entity; });
-            var allActions = (0, lodash_1.uniq)(deducedEntityFilters.map(function (ele) { return ele.actions; }).flat());
-            var actionAuths = context.select('actionAuth', {
-                data: {
-                    id: 1,
-                    paths: 1,
-                    destEntity: 1,
-                    deActions: 1,
-                    relation: {
+            var specialEntities = deducedEntityFilters.filter(function (ele) { return RelationAuth.SPECIAL_ENTITIES.includes(ele.entity); });
+            var unspecicalEntities = deducedEntityFilters.filter(function (ele) { return !RelationAuth.SPECIAL_ENTITIES.includes(ele.entity); });
+            var result = [];
+            if (specialEntities.length > 0) {
+                // 对special对象，直接判定create应该问题不大，否则写起来太烦琐
+                result.push.apply(result, tslib_1.__spreadArray([], tslib_1.__read(specialEntities.map(function (ele) { return _this.checkOperateSpecialEntities2(ele.entity, 'create', ele.filter, context); })), false));
+            }
+            if (unspecicalEntities.length > 0) {
+                var allEntities = unspecicalEntities.map(function (ele) { return ele.entity; });
+                var allActions = (0, lodash_1.uniq)(unspecicalEntities.map(function (ele) { return ele.actions; }).flat());
+                var actionAuths2 = context.select('actionAuth', {
+                    data: {
                         id: 1,
-                        userRelation$relation: {
-                            $entity: 'userRelation',
-                            data: {
-                                id: 1,
-                                entity: 1,
-                                entityId: 1,
-                            },
-                            filter: {
-                                userId: context.getCurrentUserId(),
+                        paths: 1,
+                        destEntity: 1,
+                        deActions: 1,
+                        relation: {
+                            id: 1,
+                            userRelation$relation: {
+                                $entity: 'userRelation',
+                                data: {
+                                    id: 1,
+                                    entity: 1,
+                                    entityId: 1,
+                                },
+                                filter: {
+                                    userId: context.getCurrentUserId(),
+                                },
                             },
                         },
                     },
-                },
-                filter: {
-                    destEntity: {
-                        $in: allEntities,
-                    },
-                    deActions: {
-                        $overlaps: allActions,
-                    },
-                }
-            }, { dontCollect: true });
-            var getActionAuths = function (result) {
-                var aas = [];
-                result.forEach(function (ele) { return ele.forEach(function (ele2) {
-                    if (!!ele2) {
-                        aas.push(ele2);
-                    }
-                }); });
-                return aas;
-            };
-            /**
-             * 搜索判定是否允许自建对象，自建的条件是 path = ''，destEntity === entity
-             * @param actionAuths
-             * @returns
-             */
-            var findOwnCreateUserRelation = function (actionAuths) {
-                if (userRelations) {
-                    (0, assert_1.default)(action === 'create');
-                    var ars = actionAuths.filter(function (ar) { return !!userRelations.find(function (ur) { return ur.relationId === ar.relationId; }) && ar.paths.includes('') && ar.destEntity === entity; });
-                    if (ars.length > 0) {
-                        return ars;
+                    filter: {
+                        destEntity: {
+                            $in: allEntities,
+                        },
+                        deActions: {
+                            $overlaps: allActions,
+                        },
                     }
-                }
-            };
-            if (actionAuths instanceof Promise) {
-                return actionAuths.then(function (ars) {
-                    var created = findOwnCreateUserRelation(ars);
+                }, { dontCollect: true, ignoreForeignKeyMiss: true });
+                var checkActionAuths_1 = function (actionAuths) {
+                    var created = findOwnCreateUserRelation(actionAuths);
                     if (created) {
-                        return created;
+                        actionAuthOnEntities.push.apply(actionAuthOnEntities, tslib_1.__spreadArray([], tslib_1.__read(created), false));
+                        return true;
                     }
-                    return Promise.all(deducedEntityFilters.map(function (ele) {
-                        var ars2 = ars.filter(function (ele2) { return ele2.destEntity === ele.entity && (0, lodash_1.intersection)(ele2.deActions, ele.actions).length > 0; } // 这里只要overlap就可以了
+                    var result = deducedEntityFilters.map(function (ele) {
+                        var ars2 = actionAuths.filter(function (ele2) { return ele2.destEntity === ele.entity && (0, lodash_1.intersection)(ele2.deActions, ele.actions).length > 0; } // 这里只要overlap就可以了
                         );
-                        return Promise.all(_this.filterActionAuths(ele.entity, ele.filter, ars2, context, ele.actions));
-                    })).then(function (result) { return getActionAuths(result); });
+                        var ars3 = _this.filterActionAuths(ele.entity, ele.filter, ars2, context);
+                        var checkFilteredArs = function (actionAuths2) {
+                            if (actionAuths2.length > 0) {
+                                if (ele.entity === entity) {
+                                    actionAuthOnEntities.push.apply(actionAuthOnEntities, tslib_1.__spreadArray([], tslib_1.__read(actionAuths2), false));
+                                }
+                                return true;
+                            }
+                            return false;
+                        };
+                        if (ars3 instanceof Promise) {
+                            return ars3.then(function (ars4) { return checkFilteredArs(ars4); });
+                        }
+                        return checkFilteredArs(ars3);
+                    });
+                    if (result.find(function (ele) { return ele instanceof Promise; })) {
+                        return Promise.all(result).then(function (r2) { return r2.includes(true); });
+                    }
+                    return result.includes(true);
+                };
+                if (actionAuths2 instanceof Promise) {
+                    result.push(actionAuths2.then(function (ars2) { return checkActionAuths_1(ars2); }));
+                }
+                else {
+                    result.push(checkActionAuths_1(actionAuths2));
+                }
+            }
+            if (result.find(function (ele) { return ele instanceof Promise; })) {
+                return Promise.all(result).then(function (r2) {
+                    // r2中只有一个通过就能通过
+                    if (r2.includes(true)) {
+                        return actionAuthOnEntities;
+                    }
+                    return false;
                 });
             }
-            (0, assert_1.default)(context instanceof SyncRowStore_1.SyncContext);
-            var created = findOwnCreateUserRelation(actionAuths);
-            if (created) {
-                return created;
+            if (result.includes(true)) {
+                return actionAuthOnEntities;
             }
-            return getActionAuths(deducedEntityFilters.map(function (ele) {
-                var ars2 = actionAuths.filter(function (ele2) { return ele2.destEntity === ele.entity && (0, lodash_1.intersection)(ele2.deActions, ele.actions).length > 0; } // 这里只要overlap就可以了
-                );
-                return _this.filterActionAuths(ele.entity, ele.filter, ars2, context, ele.actions);
-            }));
+            return false;
         };
         if (deducedEntityFilters2 instanceof Promise) {
             return deducedEntityFilters2.then(function (def2) { return dealWithDeducedEntityFilters(def2); });
         }
         return dealWithDeducedEntityFilters(deducedEntityFilters2);
     };
-    RelationAuth.prototype.checkOperationTree = function (tree, context) {
+    RelationAuth.prototype.checkOperationTree2 = function (tree, context) {
         var _this = this;
-        var actionAuths2 = this.findActionAuthsOnNode(tree, context);
-        var checkChildNode = function (actionAuths, node) {
-            var checkChildNodeInner = function (legalAuths) {
-                // 因为如果children是数组的话，会把数组中所有的action并起来查询，所以在这里还要再确认一次
-                var realLegalPaths = legalAuths.filter(function (ele) {
-                    if (ele.destEntity === node.entity && ele.deActions.includes(node.action)) {
-                        return true;
-                    }
-                    // 有一种例外情况，是在tree的根结点findActionAuthsOnNode时，deduce出了另外一个对象的权限，此时肯定可以通过，但不能再使用这条路径对children进行进一步判断了
-                    if (node === tree) {
-                        return true;
-                    }
-                    return false;
-                });
-                var checkChildren = function () {
-                    var children = node.children;
-                    var childPath = Object.keys(children);
-                    if (childPath.length === 0) {
-                        return true;
-                    }
-                    var selfLegalPaths = realLegalPaths.filter(function (ele) {
-                        if (ele.destEntity === node.entity && ele.deActions.includes(node.action)) {
+        var checkNode = function (node, actionAuths) {
+            var checkChildren = function (legalPaths) {
+                var children = node.children;
+                var childPath = Object.keys(children);
+                if (childPath.length === 0) {
+                    return true;
+                }
+                var childResult = childPath.map(function (childPath) {
+                    var child = children[childPath];
+                    var childEntity = child instanceof Array ? child[0].entity : child.entity;
+                    // 这里如果该子结点能deduce到父，则直接通过
+                    if (_this.authDeduceRelationMap[childEntity]) {
+                        (0, assert_1.default)(_this.authDeduceRelationMap[childEntity] === 'entity');
+                        var rel = (0, relation_1.judgeRelation)(_this.schema, childEntity, childPath);
+                        if (rel === 2) {
                             return true;
                         }
-                        return false;
-                    });
-                    // assert(selfLegalPaths.length > 0, `对象${node.entity as string}的权限检查是用deduce的对象通过的，无法再进一步对子对象加以判断`);
-                    var childResult = childPath.map(function (childPath) {
-                        var child = children[childPath];
-                        var childEntity = child instanceof Array ? child[0].entity : child.entity;
-                        // 这里如果该子结点能deduce到父，则直接通过
-                        if (_this.authDeduceRelationMap[childEntity]) {
-                            (0, assert_1.default)(_this.authDeduceRelationMap[childEntity] === 'entity');
-                            var rel = (0, relation_1.judgeRelation)(_this.schema, childEntity, childPath);
-                            if (rel === 2) {
-                                return true;
-                            }
-                        }
-                        var pathToParent = childPath.endsWith('$entity') ? node.entity : childPath.split('$')[1];
-                        if (child instanceof Array) {
-                            var childActions_1 = child.map(function (ele) { return ele.action; });
-                            var childLegalAuths_1 = selfLegalPaths.map(function (ele) {
-                                var paths = ele.paths, relationId = ele.relationId;
-                                var paths2 = paths.map(function (path) { return path ? "".concat(pathToParent, ".").concat(path) : pathToParent; });
-                                return context.select('actionAuth', {
-                                    data: {
-                                        id: 1,
-                                    },
-                                    filter: {
-                                        paths: {
-                                            $overlaps: paths2,
-                                        },
-                                        destEntity: childEntity,
-                                        deActions: {
-                                            $overlaps: childActions_1,
-                                        },
-                                        relationId: relationId || {
-                                            $exists: false,
-                                        },
-                                    }
-                                }, { dontCollect: true });
-                            }).flat();
-                            if (childLegalAuths_1[0] instanceof Promise) {
-                                return Promise.all(childLegalAuths_1).then(function (clas) { return child.map(function (c) { return checkChildNode(clas, c); }); });
-                            }
-                            return child.map(function (c) { return checkChildNode(childLegalAuths_1, c); });
-                        }
-                        var childLegalAuths = realLegalPaths.map(function (ele) {
+                    }
+                    var pathToParent = childPath.endsWith('$entity') ? node.entity : childPath.split('$')[1];
+                    if (child instanceof Array) {
+                        var childActions_1 = child.map(function (ele) { return ele.action; });
+                        var childLegalAuths_1 = legalPaths.map(function (ele) {
                             var paths = ele.paths, relationId = ele.relationId;
                             var paths2 = paths.map(function (path) { return path ? "".concat(pathToParent, ".").concat(path) : pathToParent; });
                             return context.select('actionAuth', {
@@ -865,7 +852,7 @@ var RelationAuth = /** @class */ (function () {
                                     },
                                     destEntity: childEntity,
                                     deActions: {
-                                        $overlaps: child.action,
+                                        $overlaps: childActions_1,
                                     },
                                     relationId: relationId || {
                                         $exists: false,
@@ -873,32 +860,224 @@ var RelationAuth = /** @class */ (function () {
                                 }
                             }, { dontCollect: true });
                         }).flat();
-                        if (childLegalAuths[0] instanceof Promise) {
-                            return Promise.all(childLegalAuths).then(function (clas) { return checkChildNode(clas.flat(), child); });
+                        if (childLegalAuths_1[0] instanceof Promise) {
+                            return Promise.all(childLegalAuths_1).then(function (clas) { return child.map(function (c) { return checkNode(c, clas); }); });
                         }
-                        return checkChildNode(childLegalAuths, child);
+                        return child.map(function (c) { return checkNode(c, childLegalAuths_1); });
+                    }
+                    var childLegalAuths = legalPaths.map(function (ele) {
+                        var paths = ele.paths, relationId = ele.relationId;
+                        var paths2 = paths.map(function (path) { return path ? "".concat(pathToParent, ".").concat(path) : pathToParent; });
+                        return context.select('actionAuth', {
+                            data: {
+                                id: 1,
+                            },
+                            filter: {
+                                paths: {
+                                    $overlaps: paths2,
+                                },
+                                destEntity: childEntity,
+                                deActions: {
+                                    $overlaps: child.action,
+                                },
+                                relationId: relationId || {
+                                    $exists: false,
+                                },
+                            }
+                        }, { dontCollect: true });
                     }).flat();
+                    if (childLegalAuths[0] instanceof Promise) {
+                        return Promise.all(childLegalAuths).then(function (clas) { return checkNode(child, clas.flat()); });
+                    }
+                    return checkNode(child, childLegalAuths);
+                }).flat();
+                if (childResult[0] instanceof Promise) {
+                    return Promise.all(childResult).then(function (r) { return !r.includes(false); });
+                }
+                return !childResult.includes(false);
+            };
+            // 先根据parent传下来的合法auths来搜寻，只需要查找actionAuth，降低开销
+            // 这里有可能父结点根据actionAuths能通过，但子结点需要重新搜索父结点上的新actionAuths才能通过吗？应该不存在这种情况。 by Xc 20230824
+            if (actionAuths && actionAuths.length > 0) {
+                return checkChildren(actionAuths);
+            }
+            // 没有能根据父亲传下来的actionAuth判定，只能自己找
+            var result = _this.findActionAuthsOnNode(node, context);
+            var checkResult = function (result2) {
+                if (result2 === false) {
+                    return false;
+                }
+                // 如果是对user对象操作通过，需要增添一条虚假的的actionAuth
+                if (node.entity === 'user') {
+                    result2.push({
+                        id: 'temp',
+                        paths: [''],
+                        $$createAt$$: 1,
+                        $$updateAt$$: 1,
+                        $$seq$$: 'temp',
+                        destEntity: 'user',
+                        deActions: [node.action],
+                    });
+                }
+                return checkChildren(result2);
+            };
+            if (result instanceof Promise) {
+                return result.then(function (r2) { return checkResult(r2); });
+            }
+            return checkResult(result);
+        };
+        return checkNode(tree);
+    };
+    /* private checkOperationTree<Cxt extends AsyncContext<ED> | SyncContext<ED>>(tree: OperationTree<ED>, context: Cxt) {
+        const actionAuths2 = this.findActionAuthsOnNode(tree, context);
+
+        const checkChildNode = (actionAuths: ED['actionAuth']['Schema'][] | Promise<ED['actionAuth']['Schema'][]>, node: OperationTree<ED>): boolean | Promise<boolean> => {
+            const checkChildNodeInner = (legalAuths: ED['actionAuth']['Schema'][]) => {
+                // 因为如果children是数组的话，会把数组中所有的action并起来查询，所以在这里还要再确认一次
+
+                const realLegalPaths = legalAuths.filter(
+                    (ele) => {
+                        if (ele.destEntity === node.entity && ele.deActions.includes(node.action)) {
+                            return true;
+                        }
+                        // 有一种例外情况，是在tree的根结点findActionAuthsOnNode时，deduce出了另外一个对象的权限，此时肯定可以通过，但不能再使用这条路径对children进行进一步判断了
+                        if (node === tree) {
+                            return true;
+                        }
+                        return false;
+                    }
+                );
+                const checkChildren = () => {
+                    const { children } = node;
+                    const childPath = Object.keys(children);
+                    if (childPath.length === 0) {
+                        return true;
+                    }
+
+                    const selfLegalPaths = realLegalPaths.filter(
+                        (ele) => {
+                            if (ele.destEntity === node.entity && ele.deActions.includes(node.action)) {
+                                return true;
+                            }
+                            return false;
+                        }
+                    );
+                    // assert(selfLegalPaths.length > 0, `对象${node.entity as string}的权限检查是用deduce的对象通过的，无法再进一步对子对象加以判断`);
+                    const childResult = childPath.map(
+                        (childPath) => {
+                            const child = children[childPath];
+                            const childEntity = child instanceof Array ? child[0].entity : child.entity;
+                            // 这里如果该子结点能deduce到父，则直接通过
+                            if (this.authDeduceRelationMap[childEntity]) {
+                                assert(this.authDeduceRelationMap[childEntity] === 'entity');
+                                const rel = judgeRelation(this.schema, childEntity, childPath);
+                                if (rel === 2) {
+                                    return true;
+                                }
+                            }
+
+                            const pathToParent = childPath.endsWith('$entity') ? node.entity as string : childPath.split('$')[1];
+                            if (child instanceof Array) {
+                                const childActions = child.map(ele => ele.action);
+                                const childLegalAuths = selfLegalPaths.map(
+                                    (ele) => {
+                                        const { paths, relationId } = ele;
+                                        const paths2 = paths.map(
+                                            (path) => path ? `${pathToParent}.${path}` : pathToParent
+                                        );
+                                        return context.select('actionAuth', {
+                                            data: {
+                                                id: 1,
+                                            },
+                                            filter: {
+                                                paths: {
+                                                    $overlaps: paths2,
+                                                },
+                                                destEntity: childEntity as string,
+                                                deActions: {
+                                                    $overlaps: childActions,
+                                                },
+                                                relationId: relationId || {
+                                                    $exists: false,
+                                                },
+                                            }
+                                        }, { dontCollect: true })
+                                    }
+                                ).flat() as ED['actionAuth']['Schema'][] | Promise<ED['actionAuth']['Schema']>[];
+                                if (childLegalAuths[0] instanceof Promise) {
+                                    return Promise.all(childLegalAuths).then(
+                                        (clas) => child.map(
+                                            (c) => checkChildNode(clas, c)
+                                        )
+                                    )
+                                }
+                                return child.map(
+                                    (c) => checkChildNode(childLegalAuths as ED['actionAuth']['Schema'][], c)
+                                );
+                            }
+
+                            const childLegalAuths = realLegalPaths.map(
+                                (ele) => {
+                                    const { paths, relationId } = ele;
+                                    const paths2 = paths.map(
+                                        (path) => path ? `${pathToParent}.${path}` : pathToParent
+                                    );
+                                    return context.select('actionAuth', {
+                                        data: {
+                                            id: 1,
+                                        },
+                                        filter: {
+                                            paths: {
+                                                $overlaps: paths2,
+                                            },
+                                            destEntity: childEntity as string,
+                                            deActions: {
+                                                $overlaps: child.action,
+                                            },
+                                            relationId: relationId || {
+                                                $exists: false,
+                                            },
+                                        }
+                                    }, { dontCollect: true })
+                                }
+                            ).flat() as ED['actionAuth']['Schema'][] | Promise<ED['actionAuth']['Schema']>[];
+
+                            if (childLegalAuths[0] instanceof Promise) {
+                                return Promise.all(childLegalAuths).then(
+                                    (clas) => checkChildNode(clas.flat(), child)
+                                );
+                            }
+                            return checkChildNode(childLegalAuths as ED['actionAuth']['Schema'][], child);
+                        }
+                    ).flat();
+
                     if (childResult[0] instanceof Promise) {
-                        return Promise.all(childResult).then(function (r) { return !r.includes(false); });
+                        return Promise.all(childResult).then(
+                            (r) => !r.includes(false)
+                        );
                     }
                     return !childResult.includes(false);
                 };
-                if (RelationAuth.SPECIAL_ENTITIES.includes(node.entity)) {
+
+                if (RelationAuth.SPECIAL_ENTITIES.includes(node.entity as string)) {
                     // 特殊entity走特别的路径判断
-                    var result = _this.checkOperateSpecialEntities2(node.entity, node.action, node.filter, context);
+                    const result = this.checkOperateSpecialEntities2(node.entity, node.action, node.filter, context);
+
                     if (result instanceof Promise) {
-                        return result.then(function (r) {
-                            if (r) {
-                                return checkChildren();
+                        return result.then(
+                            (r) => {
+                                if (r) {
+                                    return checkChildren();
+                                }
+                                return false;
                             }
-                            return false;
-                        });
+                        );
                     }
                     if (result) {
                         if (node.entity === 'user') {
                             // 如果当前是对user对象操作，需要加上一个指向它自身的actionAuth，否则剩下的子对象会判定不过
                             // user的操作权限由应用自己决定，如果user的操作最终过不去，这里放过也没关系
-                            (0, assert_1.default)(node === tree && realLegalPaths.length === 0); // user不可能是非根结点
+                            assert(node === tree && realLegalPaths.length === 0);  // user不可能是非根结点
                             realLegalPaths.push({
                                 id: 'temp',
                                 paths: [''],
@@ -916,6 +1095,7 @@ var RelationAuth = /** @class */ (function () {
                     }
                     return false;
                 }
+
                 if (realLegalPaths.length === 0) {
                     if (node === tree) {
                         if (process.env.NODE_ENV === 'development') {
@@ -924,17 +1104,22 @@ var RelationAuth = /** @class */ (function () {
                         return false;
                     }
                     // 如果不是tree的根结点，相对路径上的actionAuth找不到，还可以尝试从自身的filter去重试其它路径
-                    return _this.checkOperationTree(node, context);
+                    return this.checkOperationTree(node, context);
                 }
+
                 return checkChildren();
             };
+
             if (actionAuths instanceof Promise) {
-                return actionAuths.then(function (aars) { return checkChildNodeInner(aars); });
+                return actionAuths.then(
+                    (aars) => checkChildNodeInner(aars)
+                );
             }
             return checkChildNodeInner(actionAuths);
         };
+
         return checkChildNode(actionAuths2, tree);
-    };
+    } */
     RelationAuth.prototype.checkOperation = function (entity, operation, context) {
         var action = operation.action, filter = operation.filter, data = operation.data;
         if (action === 'create' && this.createFreeEntities.includes(entity)) {
@@ -954,7 +1139,7 @@ var RelationAuth = /** @class */ (function () {
             return false;
         }
         var updateTree = this.destructOperation(entity, operation, userId);
-        return this.checkOperationTree(updateTree, context);
+        return this.checkOperationTree2(updateTree, context);
     };
     /**
      * 检查一个operation是否能被通过权限测试

package/lib/store/filter.js

@@ -111,7 +111,7 @@ function addFilterSegment(entity, schema) {
         addSingleAttr(attr, combined);
     }
     var _loop_1 = function (attr) {
-        var _a;
+        var _a, _b;
         var filters2 = oneToManyFilters[attr].map(function (ele) { return ele[1]; });
         var sqpOps = filters2.map(function (ele) { return ele['#sqp'] || 'in'; });
         // 只有全部是同一个子查询算子才能实施合并
@@ -124,10 +124,21 @@ function addFilterSegment(entity, schema) {
             });
         }
         else {
-            var unioned = unionFilterSegment.apply(void 0, tslib_1.__spreadArray([oneToManyFilters[attr][0][0], schema], tslib_1.__read(filters2), false));
-            addSingleAttr(attr, Object.assign(unioned, (_a = {},
-                _a['#sqp'] = sqpOps[0],
-                _a)));
+            var sqpOp = sqpOps[0];
+            if (sqpOp === 'not in') {
+                // not in 在此变成or查询
+                var unioned = unionFilterSegment.apply(void 0, tslib_1.__spreadArray([oneToManyFilters[attr][0][0], schema], tslib_1.__read(filters2), false));
+                addSingleAttr(attr, Object.assign(unioned, (_a = {},
+                    _a['#sqp'] = sqpOp,
+                    _a)));
+            }
+            else {
+                (0, assert_1.default)(sqpOp === 'in'); // all 和 not all暂时不会出现
+                var combined = addFilterSegment.apply(void 0, tslib_1.__spreadArray([oneToManyFilters[attr][0][0], schema], tslib_1.__read(filters2), false));
+                addSingleAttr(attr, Object.assign(combined, (_b = {},
+                    _b['#sqp'] = sqpOp,
+                    _b)));
+            }
         }
     };
     for (var attr in oneToManyFilters) {
@@ -268,12 +279,12 @@ function unionFilterSegment(entity, schema) {
      * @returns
      */
     var tryMergeFilters = function (f1, f2, justTry) {
-        var e_3, _a, e_4, _b, e_5, _c, e_6, _d, e_7, _e, e_8, _f, e_9, _g, _h, _j, _k, _l, _m;
+        var e_3, _a, e_4, _b, e_5, _c, e_6, _d, e_7, _e, e_8, _f, e_9, _g, _h, _j, _k, _l, _m, _o, _p;
         var pcaResult = possibleCombiningAttrs(f1, f2);
         if (!pcaResult) {
             return false;
         }
-        var _o = tslib_1.__read(pcaResult, 2), pca1 = _o[0], pca2 = _o[1];
+        var _q = tslib_1.__read(pcaResult, 2), pca1 = _q[0], pca2 = _q[1];
         if (pca1 === '$or' && pca2 === '$or') {
             try {
                 // 如果双方都是or，有可能可以交叉合并，如：
@@ -303,12 +314,12 @@ function unionFilterSegment(entity, schema) {
                         ]
                     }
                  */
-                for (var _p = tslib_1.__values(f2[pca2]), _q = _p.next(); !_q.done; _q = _p.next()) {
-                    var f21 = _q.value;
+                for (var _r = tslib_1.__values(f2[pca2]), _s = _r.next(); !_s.done; _s = _r.next()) {
+                    var f21 = _s.value;
                     var success = false;
                     try {
-                        for (var _r = (e_4 = void 0, tslib_1.__values(f1[pca2])), _s = _r.next(); !_s.done; _s = _r.next()) {
-                            var f11 = _s.value;
+                        for (var _t = (e_4 = void 0, tslib_1.__values(f1[pca2])), _u = _t.next(); !_u.done; _u = _t.next()) {
+                            var f11 = _u.value;
                             if (tryMergeFilters(f11, f21, true)) {
                                 success = true;
                                 break;
@@ -318,7 +329,7 @@ function unionFilterSegment(entity, schema) {
                     catch (e_4_1) { e_4 = { error: e_4_1 }; }
                     finally {
                         try {
-                            if (_s && !_s.done && (_b = _r.return)) _b.call(_r);
+                            if (_u && !_u.done && (_b = _t.return)) _b.call(_t);
                         }
                         finally { if (e_4) throw e_4.error; }
                     }
@@ -330,7 +341,7 @@ function unionFilterSegment(entity, schema) {
             catch (e_3_1) { e_3 = { error: e_3_1 }; }
             finally {
                 try {
-                    if (_q && !_q.done && (_a = _p.return)) _a.call(_p);
+                    if (_s && !_s.done && (_a = _r.return)) _a.call(_r);
                 }
                 finally { if (e_3) throw e_3.error; }
             }
@@ -338,11 +349,11 @@ function unionFilterSegment(entity, schema) {
                 return true;
             }
             try {
-                for (var _t = tslib_1.__values(f2[pca2]), _u = _t.next(); !_u.done; _u = _t.next()) {
-                    var f21 = _u.value;
+                for (var _v = tslib_1.__values(f2[pca2]), _w = _v.next(); !_w.done; _w = _v.next()) {
+                    var f21 = _w.value;
                     try {
-                        for (var _v = (e_6 = void 0, tslib_1.__values(f1[pca2])), _w = _v.next(); !_w.done; _w = _v.next()) {
-                            var f11 = _w.value;
+                        for (var _x = (e_6 = void 0, tslib_1.__values(f1[pca2])), _y = _x.next(); !_y.done; _y = _x.next()) {
+                            var f11 = _y.value;
                             if (tryMergeFilters(f11, f21)) {
                                 break;
                             }
@@ -351,7 +362,7 @@ function unionFilterSegment(entity, schema) {
                     catch (e_6_1) { e_6 = { error: e_6_1 }; }
                     finally {
                         try {
-                            if (_w && !_w.done && (_d = _v.return)) _d.call(_v);
+                            if (_y && !_y.done && (_d = _x.return)) _d.call(_x);
                         }
                         finally { if (e_6) throw e_6.error; }
                     }
@@ -360,7 +371,7 @@ function unionFilterSegment(entity, schema) {
             catch (e_5_1) { e_5 = { error: e_5_1 }; }
             finally {
                 try {
-                    if (_u && !_u.done && (_c = _t.return)) _c.call(_t);
+                    if (_w && !_w.done && (_c = _v.return)) _c.call(_v);
                 }
                 finally { if (e_5) throw e_5.error; }
             }
@@ -368,8 +379,8 @@ function unionFilterSegment(entity, schema) {
         }
         else if (pca1 === '$or') {
             try {
-                for (var _x = tslib_1.__values(f1[pca1]), _y = _x.next(); !_y.done; _y = _x.next()) {
-                    var f11 = _y.value;
+                for (var _z = tslib_1.__values(f1[pca1]), _0 = _z.next(); !_0.done; _0 = _z.next()) {
+                    var f11 = _0.value;
                     if (tryMergeFilters(f11, f2, justTry)) {
                         return true;
                     }
@@ -378,7 +389,7 @@ function unionFilterSegment(entity, schema) {
             catch (e_7_1) { e_7 = { error: e_7_1 }; }
             finally {
                 try {
-                    if (_y && !_y.done && (_e = _x.return)) _e.call(_x);
+                    if (_0 && !_0.done && (_e = _z.return)) _e.call(_z);
                 }
                 finally { if (e_7) throw e_7.error; }
             }
@@ -386,8 +397,8 @@ function unionFilterSegment(entity, schema) {
         }
         else if (pca2 === '$or') {
             try {
-                for (var _z = tslib_1.__values(f2[pca2]), _0 = _z.next(); !_0.done; _0 = _z.next()) {
-                    var f21 = _0.value;
+                for (var _1 = tslib_1.__values(f2[pca2]), _2 = _1.next(); !_2.done; _2 = _1.next()) {
+                    var f21 = _2.value;
                     if (!tryMergeFilters(f1, f21, true)) {
                         return false;
                     }
@@ -396,7 +407,7 @@ function unionFilterSegment(entity, schema) {
             catch (e_8_1) { e_8 = { error: e_8_1 }; }
             finally {
                 try {
-                    if (_0 && !_0.done && (_f = _z.return)) _f.call(_z);
+                    if (_2 && !_2.done && (_f = _1.return)) _f.call(_1);
                 }
                 finally { if (e_8) throw e_8.error; }
             }
@@ -404,15 +415,15 @@ function unionFilterSegment(entity, schema) {
                 return true;
             }
             try {
-                for (var _1 = tslib_1.__values(f2[pca2]), _2 = _1.next(); !_2.done; _2 = _1.next()) {
-                    var f12 = _2.value;
+                for (var _3 = tslib_1.__values(f2[pca2]), _4 = _3.next(); !_4.done; _4 = _3.next()) {
+                    var f12 = _4.value;
                     tryMergeFilters(f1, f12);
                 }
             }
             catch (e_9_1) { e_9 = { error: e_9_1 }; }
             finally {
                 try {
-                    if (_2 && !_2.done && (_g = _1.return)) _g.call(_1);
+                    if (_4 && !_4.done && (_g = _3.return)) _g.call(_3);
                 }
                 finally { if (e_9) throw e_9.error; }
             }
@@ -470,11 +481,22 @@ function unionFilterSegment(entity, schema) {
                     if (justTry) {
                         return true;
                     }
-                    Object.assign(f1, (_l = {},
-                        _l[pca1] = Object.assign(addFilterSegment(rel[0], schema, f1[pca1], f2[pca2]), (_m = {},
-                            _m['#sqp'] = sqpOp1,
-                            _m)),
-                        _l));
+                    if (sqpOp1 === 'in') {
+                        Object.assign(f1, (_l = {},
+                            _l[pca1] = Object.assign(unionFilterSegment(rel[0], schema, f1[pca1], f2[pca2]), (_m = {},
+                                _m['#sqp'] = sqpOp1,
+                                _m)),
+                            _l));
+                    }
+                    else {
+                        // not in情况子查询变成and
+                        (0, assert_1.default)(sqpOp1 === 'not in'); // all和not all暂时不支持
+                        Object.assign(f1, (_o = {},
+                            _o[pca1] = Object.assign(addFilterSegment(rel[0], schema, f1[pca1], f2[pca2]), (_p = {},
+                                _p['#sqp'] = sqpOp1,
+                                _p)),
+                            _o));
+                    }
                 }
             }
         }

package/lib/types/Entity.d.ts

@@ -27,6 +27,7 @@ export declare type SelectOption = {
     obscure?: boolean;
     forUpdate?: true;
     includedDeleted?: true;
+    ignoreForeignKeyMiss?: true;
     dummy?: 1;
 };
 export declare type OperateOption = {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "oak-domain",
-    "version": "3.0.0",
+    "version": "3.0.1",
     "author": {
         "name": "XuChang"
     },