oak-domain 3.0.2 → 3.0.4

package/lib/store/RelationAuth.js

@@ -1,139 +1,145 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserRelationsByActions = exports.RelationAuth = void 0;
-var tslib_1 = require("tslib");
-var assert_1 = tslib_1.__importDefault(require("assert"));
-var types_1 = require("../types");
-var AsyncRowStore_1 = require("./AsyncRowStore");
-var filter_1 = require("./filter");
-var relation_1 = require("./relation");
-var action_1 = require("../actions/action");
-var lodash_1 = require("../utils/lodash");
-var env_1 = require("../compiler/env");
-var RelationAuth = /** @class */ (function () {
-    function RelationAuth(schema, actionCascadePathGraph, relationCascadePathGraph, authDeduceRelationMap, selectFreeEntities, createFreeEntities, updateFreeEntities) {
-        this.actionCascadePathGraph = actionCascadePathGraph;
-        this.relationCascadePathGraph = relationCascadePathGraph;
+const tslib_1 = require("tslib");
+const assert_1 = tslib_1.__importDefault(require("assert"));
+const types_1 = require("../types");
+const AsyncRowStore_1 = require("./AsyncRowStore");
+const filter_1 = require("./filter");
+const relation_1 = require("./relation");
+const action_1 = require("../actions/action");
+const lodash_1 = require("../utils/lodash");
+const env_1 = require("../compiler/env");
+class RelationAuth {
+    authDeduceRelationMap;
+    schema;
+    static SPECIAL_ENTITIES = env_1.SYSTEM_RESERVE_ENTITIES;
+    selectFreeEntities;
+    updateFreeDict;
+    constructor(schema, authDeduceRelationMap, selectFreeEntities, updateFreeDict) {
         this.schema = schema;
         this.selectFreeEntities = selectFreeEntities || [];
-        this.createFreeEntities = createFreeEntities || [];
-        this.updateFreeEntities = updateFreeEntities || [];
+        this.updateFreeDict = updateFreeDict || {};
         this.authDeduceRelationMap = Object.assign({}, authDeduceRelationMap, {
             modi: 'entity',
         });
     }
     // 前台检查filter是否满足relation约束
-    RelationAuth.prototype.checkRelationSync = function (entity, operation, context) {
+    checkRelationSync(entity, operation, context) {
         if (context.isRoot()) {
             return;
         }
         this.checkActions2(entity, operation, context);
-    };
-    /**
-     * 查询当前用户在对应entity上可以操作的relationIds
-     * @param entity
-     * @param entityId
-     * @param context
-     * @returns
-     */
-    RelationAuth.prototype.getGrantedRelationIds = function (entity, entityId, context) {
-        var result = context.select('relationAuth', {
+    }
+    // 后台检查filter是否满足relation约束
+    async checkRelationAsync(entity, operation, context) {
+        if (context.isRoot()) {
+            return;
+        }
+        await this.checkActions2(entity, operation, context);
+    }
+    checkUserRelation(context, action, filter) {
+        const userId = context.getCurrentUserId();
+        let filter2 = {
+            destRelation: {
+                userRelation$relation: filter,
+            },
+        };
+        if (action === 'create') {
+            const { entity, entityId, relationId } = filter;
+            if (relationId) {
+                // 如果指定relation，则测试该relation上是否可行
+                filter2 = {
+                    destRelationId: relationId,
+                };
+            }
+            else {
+                // 否则为测试“能否”有权限管理的资格，此时只要有一个就可以
+                (0, assert_1.default)(entity);
+                filter2 = {
+                    destRelation: {
+                        entity,
+                    }
+                };
+            }
+        }
+        else {
+            (0, assert_1.default)(action === 'remove');
+            // 如果一次删除多个userRelation,接下来的流程判断是只有一个relationAuth满足就会通过，这样可能会有错判 by Xc 20231019
+            (0, assert_1.default)(typeof filter.id === 'string', '当前只支持指定id的用户关系删除');
+        }
+        const relationAuths = context.select('relationAuth', {
             data: {
                 id: 1,
+                path: {
+                    id: 1,
+                    sourceEntity: 1,
+                    destEntity: 1,
+                    value: 1,
+                    recursive: 1,
+                },
+                sourceRelationId: 1,
+                sourceRelation: {
+                    id: 1,
+                    entity: 1,
+                    entityId: 1,
+                },
                 destRelationId: 1,
                 destRelation: {
                     id: 1,
-                    name: 1,
                     entity: 1,
                     entityId: 1,
-                    display: 1,
                 },
             },
-            filter: {
-                sourceRelation: {
-                    userRelation$relation: {
-                        userId: context.getCurrentUserId(),
-                    }
-                },
-                destRelation: {
-                    entity: entity,
-                    $or: [
-                        {
-                            entityId: entityId,
-                        },
-                        {
-                            entityId: {
-                                $exists: false,
-                            },
-                        }
-                    ],
+            filter: filter2,
+        }, { dontCollect: true });
+        const checkRelationAuth = (relationAuth) => {
+            const { destRelation, sourceRelationId, path } = relationAuth;
+            let destEntityFilter = this.makePathFilter(destRelation.entity, path, this.schema, {
+                userRelation$entity: {
+                    userId,
+                    relationId: sourceRelationId,
                 },
-            },
-        }, {});
-        if (result instanceof Promise) {
-            return result.then(function (r2) { return r2.map(function (ele) { return ele.destRelation; }); });
-        }
-        return result.map(function (ele) { return ele.destRelation; });
-    };
-    // 后台检查filter是否满足relation约束
-    RelationAuth.prototype.checkRelationAsync = function (entity, operation, context) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        if (context.isRoot()) {
-                            return [2 /*return*/];
-                        }
-                        return [4 /*yield*/, this.checkActions2(entity, operation, context)];
-                    case 1:
-                        _a.sent();
-                        return [2 /*return*/];
-                }
             });
-        });
-    };
-    RelationAuth.prototype.checkOperateSpecialEntities2 = function (entity2, action, filter, context) {
-        switch (entity2) {
-            case 'userRelation': {
-                (0, assert_1.default)(!(filter instanceof Array));
-                (0, assert_1.default)(['create', 'remove'].includes(action));
-                if (action === 'create') {
-                    (0, assert_1.default)(!(filter instanceof Array));
-                    var _a = filter, entity = _a.entity, entityId = _a.entityId, relationId_1 = _a.relationId;
-                    // 创建userRelation如果是领取动作，先暂使用root身份通过
-                    var destRelations = this.getGrantedRelationIds(entity, entityId, context);
-                    if (destRelations instanceof Promise) {
-                        return destRelations.then(function (r2) {
-                            if (relationId_1 && !r2.find(function (ele) { return ele.id === relationId_1; }) || r2.length === 0) {
-                                return false;
-                            }
-                            return true;
-                        });
-                    }
-                    // 若指定了要create的relation，则必须有该relationId存在，否则只要有任意可授权的relation即可
-                    if (relationId_1 && !destRelations.find(function (ele) { return ele.id === relationId_1; }) || destRelations.length === 0) {
-                        return false;
-                    }
-                    return true;
+            if (action === 'create') {
+                const { entity, entityId } = filter;
+                (0, assert_1.default)(entity && typeof entity === 'string');
+                if (entityId) {
+                    Object.assign(destEntityFilter, {
+                        id: entityId,
+                    });
                 }
                 else {
-                    (0, assert_1.default)(action === 'remove');
-                    var userId = context.getCurrentUserId();
-                    (0, assert_1.default)(filter);
-                    var contained = {
-                        relation: {
-                            relationAuth$destRelation: {
-                                sourceRelation: {
-                                    userRelation$relation: {
-                                        userId: userId,
-                                    },
-                                },
-                            },
-                        },
-                    };
-                    return (0, filter_1.checkFilterContains)(entity2, context, contained, filter, true);
+                    // userEntityGrant会有这种情况，限定某个对象的范围进行授权
+                    const { [entity]: entityFilter } = filter;
+                    (0, assert_1.default)(entityFilter);
+                    destEntityFilter = (0, filter_1.combineFilters)(entity, this.schema, [destEntityFilter, entityFilter]);
                 }
             }
+            else {
+                destEntityFilter = (0, filter_1.combineFilters)(destRelation.entity, this.schema, [destEntityFilter, {
+                        userRelation$entity: filter,
+                    }]);
+            }
+            return context.count(destRelation.entity, {
+                filter: destEntityFilter,
+            }, { ignoreAttrMiss: true });
+        };
+        if (relationAuths instanceof Promise) {
+            return relationAuths.then((ras) => Promise.all(ras.map(ra => checkRelationAuth(ra)))).then((result) => !!result.find(ele => {
+                (0, assert_1.default)(typeof ele === 'number');
+                return ele > 0;
+            }));
+        }
+        const result = relationAuths.map(ra => checkRelationAuth(ra));
+        return !!result.find(ele => ele > 0);
+    }
+    checkOperateSpecialEntities2(entity2, action, filter, context) {
+        switch (entity2) {
+            case 'userRelation': {
+                (0, assert_1.default)(!(filter instanceof Array));
+                return this.checkUserRelation(context, action, filter);
+            }
             case 'user': {
                 // 对用户的操作由应用自己去管理权限，这里只检查grant/revoke
                 if (['grant', 'revoke'].includes(action)) {
@@ -147,8 +153,19 @@ var RelationAuth = /** @class */ (function () {
                 }
             }
             case 'modi': {
-                // modi的操作权限都是由触发器触发，不用再检测了
-                return true;
+                /**  正常情况下对modi的生成是在触发器下openRootMode，不会走到这里
+                 * 但是有些例外，如extraFile如果在modi中创建，上传成功之后需要显式生成一条modi，这时对modi的
+                 * 检查可以转化为对其父entity的update权限检查
+                */
+                (0, assert_1.default)(action === 'create');
+                const { entity, entityId } = filter;
+                return this.checkOperation(entity, {
+                    action: 'update',
+                    data: {},
+                    filter: {
+                        id: entityId,
+                    },
+                }, context);
             }
             case 'relation': {
                 // 创建relation目前不支持，以后再说
@@ -158,7 +175,14 @@ var RelationAuth = /** @class */ (function () {
                 // userEntityGrant的创建相当于授权，领取相当于赋权
                 if (['create', 'update', 'remove'].includes(action)) {
                     if (action === 'create') {
-                        return this.checkOperateSpecialEntities2('userRelation', 'create', filter, context);
+                        const { relationEntity, relationEntityFilter, relationIds } = filter;
+                        return this.checkOperateSpecialEntities2('userRelation', 'create', {
+                            entity: relationEntity,
+                            [relationEntity]: relationEntityFilter,
+                            relationId: {
+                                $in: relationIds,
+                            },
+                        }, context);
                     }
                     return this.checkOperateSpecialEntities2('userRelation', 'action', {
                         relation: {
@@ -166,71 +190,58 @@ var RelationAuth = /** @class */ (function () {
                         },
                     }, context);
                 }
-                // 领取和读取动作公开
                 return true;
             }
             default: {
-                (0, assert_1.default)(false, "\u5BF9\u8C61".concat(entity2, "\u7684\u6743\u9650\u63A7\u5236\u6CA1\u6709\u52A0\u4EE5\u63A7\u5236"));
+                (0, assert_1.default)(false, `对象${entity2}的权限控制没有加以控制`);
             }
         }
-    };
-    RelationAuth.prototype.getDeducedEntityFilters = function (entity, filter, actions, context) {
-        var e_1, _a;
-        var _this = this;
-        var entityFilters = [
+    }
+    getDeducedEntityFilters(entity, filter, actions, context) {
+        const entityFilters = [
             {
-                entity: entity,
-                filter: filter,
-                actions: actions,
+                entity,
+                filter,
+                actions,
             }
         ];
         if (this.authDeduceRelationMap[entity]) {
             (0, assert_1.default)(this.authDeduceRelationMap[entity] === 'entity');
-            var _b = filter, deduceEntity = _b.entity, deduceEntityId_1 = _b.entityId;
-            var deduceFilter = {};
-            if (deduceEntity && deduceEntityId_1) {
-                deduceFilter = { id: deduceEntityId_1 };
+            let { entity: deduceEntity, entityId: deduceEntityId } = filter;
+            let deduceFilter = {};
+            if (deduceEntity && deduceEntityId) {
+                deduceFilter = { id: deduceEntityId };
             }
             else {
                 // 也可能是用cascade方式进行查找，这里有时候filter上会带有两个不同的entity目标，尚未处理（todo!）
-                var ref = this.schema[entity].attributes.entity.ref;
+                const { ref } = this.schema[entity].attributes.entity;
                 (0, assert_1.default)(ref instanceof Array);
-                try {
-                    for (var ref_1 = tslib_1.__values(ref), ref_1_1 = ref_1.next(); !ref_1_1.done; ref_1_1 = ref_1.next()) {
-                        var refEntity = ref_1_1.value;
-                        if (filter[refEntity]) {
-                            deduceEntity = refEntity;
-                            deduceFilter = filter[refEntity];
-                            break;
-                        }
-                    }
-                }
-                catch (e_1_1) { e_1 = { error: e_1_1 }; }
-                finally {
-                    try {
-                        if (ref_1_1 && !ref_1_1.done && (_a = ref_1.return)) _a.call(ref_1);
+                for (const refEntity of ref) {
+                    if (filter[refEntity]) {
+                        deduceEntity = refEntity;
+                        deduceFilter = filter[refEntity];
+                        break;
                     }
-                    finally { if (e_1) throw e_1.error; }
                 }
             }
-            var getRecursiveDeducedFilters_1 = function (deduceEntity, deduceFilter) {
-                var excludeActions = action_1.readOnlyActions.concat([ /* 'create', 'remove' */]);
-                var updateActions = _this.schema[deduceEntity].actions.filter(function (a) { return !excludeActions.includes(a); });
+            const getRecursiveDeducedFilters = (deduceEntity, deduceFilter) => {
+                const excludeActions = action_1.readOnlyActions.concat([ /* 'create', 'remove' */]);
+                const updateActions = this.schema[deduceEntity].actions.filter((a) => !excludeActions.includes(a));
                 /* if (!RelationAuth.SPECIAL_ENTITIES.includes(deduceEntity as string)) {
                     return this.getDeducedEntityFilters(deduceEntity, deduceFilter, actions[0] === 'select' ? actions : updateActions, context);
                 }
                 return []; */
-                return _this.getDeducedEntityFilters(deduceEntity, deduceFilter, actions[0] === 'select' ? actions : updateActions, context);
+                return this.getDeducedEntityFilters(deduceEntity, deduceFilter, actions[0] === 'select' ? actions : updateActions, context);
             };
             if (deduceEntity && deduceFilter) {
-                var deducedSelections = getRecursiveDeducedFilters_1(deduceEntity, deduceFilter);
+                const deducedSelections = getRecursiveDeducedFilters(deduceEntity, deduceFilter);
                 if (deducedSelections instanceof Promise) {
-                    return deducedSelections.then(function (ds) {
-                        entityFilters.push.apply(entityFilters, tslib_1.__spreadArray([], tslib_1.__read(ds), false));
+                    return deducedSelections.then((ds) => {
+                        entityFilters.push(...ds);
                         return entityFilters;
                     });
                 }
-                entityFilters.push.apply(entityFilters, tslib_1.__spreadArray([], tslib_1.__read(deducedSelections), false));
+                entityFilters.push(...deducedSelections);
                 return entityFilters;
             }
             else {
@@ -239,89 +250,87 @@ var RelationAuth = /** @class */ (function () {
                  * 这种情况一般发生在entity1 -> entity2上，此时entity2应该是一个固定id查询的filter
                  * 在这里先假设如果碰到了list类型的filter，直接不使用deduce路径上的对象来推导
                  */
-                var rows2 = context.select(entity, {
+                const rows2 = context.select(entity, {
                     data: {
                         id: 1,
                         entity: 1,
                         entityId: 1,
                     },
-                    filter: filter,
+                    filter,
                     indexFrom: 0,
                     count: 10,
                 }, { dontCollect: true, blockTrigger: true });
-                var dealWithData_1 = function (rows) {
+                const dealWithData = (rows) => {
                     // 这里如果entity指向不同的实体，一般出现这样的查询，则其权限应当不由这条deduce路径处理
                     // 同上，如果找到的行数大于1行，说明deduce路径上的对象不确定，也暂不处理  by Xc 20230725
                     if (rows.length > 1 || rows.length === 0) {
                         if (process.env.NODE_ENV === 'development') {
-                            console.warn("\u8FDB\u884Cdeduce\u63A8\u5BFC\u65F6\u627E\u5230\u4E86".concat(rows.length, "\u884C").concat(entity, "\u6570\u636E"));
+                            console.warn(`进行deduce推导时找到了${rows.length}行${entity}数据`);
                         }
                         return entityFilters;
                     }
-                    var _a = rows[0], deducedEntity = _a.entity, deducedEntityId = _a.entityId;
+                    const { entity: deducedEntity, entityId: deducedEntityId } = rows[0];
                     if (!deducedEntity || !deducedEntityId) {
                         // 这种情况会出现在前台缓存里
                         return entityFilters;
                     }
-                    var result = getRecursiveDeducedFilters_1(deducedEntity, {
-                        id: deduceEntityId_1,
+                    const result = getRecursiveDeducedFilters(deducedEntity, {
+                        id: deducedEntityId,
                     });
                     if (result instanceof Promise) {
-                        return result.then(function (r2) {
-                            entityFilters.push.apply(entityFilters, tslib_1.__spreadArray([], tslib_1.__read(r2), false));
+                        return result.then((r2) => {
+                            entityFilters.push(...r2);
                             return entityFilters;
                         });
                     }
-                    entityFilters.push.apply(entityFilters, tslib_1.__spreadArray([], tslib_1.__read(result), false));
+                    entityFilters.push(...result);
                     return entityFilters;
                 };
                 if (rows2 instanceof Promise) {
-                    return rows2.then(function (r2) { return dealWithData_1(r2); });
+                    return rows2.then((r2) => dealWithData(r2));
                 }
-                return dealWithData_1(rows2);
+                return dealWithData(rows2);
             }
         }
         return entityFilters;
-    };
+    }
     /**
      * 对于selection，解构出最底层的对象，如果最底层的对象可以被访问，则父对象一定可以
      * 但对于deduce的子对象，不必再向底层查看（假设deduce对象一般都位于树的最底层附近）
      * @param entity
      * @param operation
      */
-    RelationAuth.prototype.destructSelection = function (entity, selection) {
-        var _this = this;
-        var leafSelections = [];
-        var destructInner = function (entity2, selection2) {
-            var _a, _b;
-            var data = selection2.data, filter = selection2.filter;
-            var hasOneToMany = false;
-            for (var attr in data) {
-                var rel = (0, relation_1.judgeRelation)(_this.schema, entity2, attr);
+    destructSelection(entity, selection) {
+        const leafSelections = [];
+        const destructInner = (entity2, selection2) => {
+            const { data, filter } = selection2;
+            let hasOneToMany = false;
+            for (const attr in data) {
+                const rel = (0, relation_1.judgeRelation)(this.schema, entity2, attr);
                 if (rel instanceof Array) {
-                    var _c = tslib_1.__read(rel, 2), e = _c[0], foreignKey = _c[1];
+                    const [e, foreignKey] = rel;
                     if (foreignKey) {
-                        (0, assert_1.default)(!_this.authDeduceRelationMap[e]);
+                        (0, assert_1.default)(!this.authDeduceRelationMap[e]);
                         hasOneToMany = true;
                         destructInner(e, {
                             data: data[attr].data,
-                            filter: (0, filter_1.combineFilters)(e, _this.schema, [(_a = {},
-                                    _a[foreignKey.slice(0, foreignKey.length - 2)] = filter,
-                                    _a), data[attr].filter || {}]),
+                            filter: (0, filter_1.combineFilters)(e, this.schema, [{
+                                    [foreignKey.slice(0, foreignKey.length - 2)]: filter,
+                                }, data[attr].filter || {}]),
                         });
                     }
                     else {
-                        if (!_this.authDeduceRelationMap[e]) {
+                        if (!this.authDeduceRelationMap[e]) {
                             hasOneToMany = true;
                             destructInner(e, {
                                 data: data[attr].data,
-                                filter: (0, filter_1.combineFilters)(e, _this.schema, [(_b = {},
-                                        _b[entity2] = filter,
-                                        _b), data[attr].filter || {}]),
+                                filter: (0, filter_1.combineFilters)(e, this.schema, [{
+                                        [entity2]: filter,
+                                    }, data[attr].filter || {}]),
                             });
                         }
                         else {
-                            (0, assert_1.default)(_this.authDeduceRelationMap[e] === 'entity');
+                            (0, assert_1.default)(this.authDeduceRelationMap[e] === 'entity');
                         }
                     }
                 }
@@ -329,37 +338,39 @@ var RelationAuth = /** @class */ (function () {
             if (!hasOneToMany) {
                 leafSelections.push({
                     entity: entity2,
-                    filter: filter,
+                    filter,
                 });
             }
         };
         destructInner(entity, (0, lodash_1.cloneDeep)(selection));
         return leafSelections;
-    };
+    }
     /**
      * 对于operation，解构出一个树形结构，以方便自顶向下的进行访问
      * 但对于deduce的子对象，不必再向底层查看
      * @param entity
      * @param selection
      */
-    RelationAuth.prototype.destructOperation = function (entity2, operation2, userId) {
-        var _this = this;
+    destructOperation(entity2, operation2, userId) {
         /**
          * 对create动作，把data中的cascade部分剔除后作为filter参与后续的检验
          * @param operation
          * @returns
          */
-        var makeCreateFilter = function (entity, operation) {
-            var _a;
-            var data = operation.data, filter = operation.filter;
+        const makeCreateFilter = (entity, operation) => {
+            const { data, filter } = operation;
             (0, assert_1.default)(!(data instanceof Array));
             if (data) {
-                var data2 = {};
-                for (var attr in data) {
-                    var rel = (0, relation_1.judgeRelation)(_this.schema, entity, attr);
+                const data2 = {};
+                for (const attr in data) {
+                    const rel = (0, relation_1.judgeRelation)(this.schema, entity, attr);
                     if (rel === 1) {
                         // 只需要记住id和各种外键属性，不这样处理有些古怪的属性比如coordinate，其作为createdata和作为filter并不同构
-                        if ((['id', 'entity', 'entityId'].includes(attr) || ((_a = _this.schema[entity].attributes[attr]) === null || _a === void 0 ? void 0 : _a.type) === 'ref') && typeof data[attr] === 'string') {
+                        /* if ((['id', 'entity', 'entityId'].includes(attr) || this.schema[entity].attributes[attr as any]?.type === 'ref') && typeof data[attr] === 'string') {
+                            data2[attr] = data[attr];
+                        } */
+                        // 假设不再成立，userEntityGrant需要relationEntity这样的属性
+                        if (!['geometry', 'geography', 'st_geometry', 'st_point'].includes(this.schema[entity].attributes[attr]?.type)) {
                             data2[attr] = data[attr];
                         }
                     }
@@ -368,12 +379,11 @@ var RelationAuth = /** @class */ (function () {
             }
             return filter;
         };
-        var addChild = function (node, path, child) {
-            var _a;
+        const addChild = (node, path, child) => {
             // 在这里要把可以被node deduce出来的child处理掉
-            var paths = path.split('$');
+            const paths = path.split('$');
             (0, assert_1.default)(paths.length >= 2);
-            if (_this.authDeduceRelationMap[child.entity] === paths[1]) {
+            if (this.authDeduceRelationMap[child.entity] === paths[1]) {
                 (0, assert_1.default)(paths[1] === 'entity', '当前只支持entity外键上的deduce');
                 return false;
             }
@@ -386,86 +396,152 @@ var RelationAuth = /** @class */ (function () {
                 }
             }
             else {
-                Object.assign(node.children, (_a = {},
-                    _a[path] = child,
-                    _a));
+                Object.assign(node.children, {
+                    [path]: child,
+                });
             }
             return true;
         };
-        var destructInner = function (entity, operation, 
+        const destructInner = (entity, operation, 
         // extraFilter?: ED[T2]['Selection']['filter'],
-        path, child, hasParent) {
-            var action = operation.action, data = operation.data, filter = operation.filter;
-            var filter2 = action === 'create' ? makeCreateFilter(entity, operation) : filter;
+        path, child, hasParent, extraFilter) => {
+            const { action, data, filter } = operation;
+            const filter2 = action === 'create' ? makeCreateFilter(entity, operation) : (0, lodash_1.cloneDeep)(filter);
             (0, assert_1.default)(filter2);
+            if (extraFilter) {
+                Object.assign(filter2, extraFilter);
+            }
             // const filter3 = extraFilter ? combineFilters(entity, schema, [filter2, extraFilter]) : filter2;
-            var me = {
+            const me = {
                 entity: entity,
                 filter: filter2,
                 children: {},
-                action: action,
+                action,
             };
-            var root = me;
+            let root = me;
             // 如果当前对象是一个toModi的，意味着它的cascadeUpdate会全部被变为modi去缓存，因此不需要再向下检查了
             // modi被apply时，这些modi产生的更新才会被实际检查
-            var isModiUpdate = _this.schema[entity].toModi && action !== 'remove';
+            // 这里可能有问题，再思考思考 by Xc 20231111
+            const isModiUpdate = this.schema[entity].toModi && action !== 'remove';
             if (child) {
                 (0, assert_1.default)(path);
                 addChild(me, path, child);
             }
-            var _loop_1 = function (attr) {
-                var rel = (0, relation_1.judgeRelation)(_this.schema, entity, attr);
+            (0, assert_1.default)(!(data instanceof Array));
+            for (const attr in data) {
+                const rel = (0, relation_1.judgeRelation)(this.schema, entity, attr);
                 if (rel === 2 && !isModiUpdate) {
                     (0, assert_1.default)(root === me && !hasParent, 'cascadeUpdate必须是树结构，避免森林');
-                    root = destructInner(attr, data[attr], "".concat(entity, "$entity"), me);
+                    const mtoOperation = data[attr];
+                    root = destructInner(attr, mtoOperation, `${entity}$entity`, me);
                 }
                 else if (typeof rel === 'string' && !isModiUpdate) {
                     (0, assert_1.default)(root === me && !hasParent, 'cascadeUpdate必须是树结构，避免森林');
-                    root = destructInner(rel, data[attr], "".concat(entity, "$").concat(attr), me);
+                    root = destructInner(rel, data[attr], `${entity}$${attr}`, me);
                 }
                 else if (rel instanceof Array && !isModiUpdate) {
-                    var _a = tslib_1.__read(rel, 2), e_2 = _a[0], f = _a[1];
-                    var otmOperations = data[attr];
-                    if (e_2 === 'userRelation' && entity !== 'user') {
+                    const [e, f] = rel;
+                    const otmOperations = data[attr];
+                    /**
+                    * 这里目前在cascadeUpdate的过程中，只有当一对多个userRelation的操作需要将entity和entityId复制到子对象上
+                    * 因为对userRelation的判断是走的特殊路径，无法利用父对象的actionAuth
+                    * 其它对象情况不需要复制，因为应用中必须要能保证（前台传来的）父对象的filter不依赖于子对象的条件
+                    */
+                    let extraFilter = undefined;
+                    if (e === 'userRelation' && entity !== 'user') {
                         me.userRelations = [];
-                        var dealWithUserRelation_1 = function (userRelation) {
-                            var _a;
-                            var action = userRelation.action, data = userRelation.data;
-                            (0, assert_1.default)(action === 'create', 'cascade更新中只允许创建userRelation');
-                            var attrs = Object.keys(data);
-                            (0, assert_1.default)((0, lodash_1.difference)(attrs, Object.keys(_this.schema.userRelation.attributes).concat('id')).length === 0);
-                            if (data.userId === userId) {
-                                (_a = me.userRelations) === null || _a === void 0 ? void 0 : _a.push(data);
+                        extraFilter = {
+                            entity,
+                            entityId: filter2.id,
+                        };
+                        const dealWithUserRelation = (userRelation) => {
+                            const { action, data } = userRelation;
+                            if (action === 'create') {
+                                const attrs = Object.keys(data);
+                                (0, assert_1.default)((0, lodash_1.difference)(attrs, Object.keys(this.schema.userRelation.attributes).concat('id')).length === 0);
+                                if (data.userId === userId) {
+                                    me.userRelations?.push(data);
+                                }
+                                (0, assert_1.default)(filter2.id);
                             }
                         };
                         if (otmOperations instanceof Array) {
-                            otmOperations.forEach(function (otmOperation) { return dealWithUserRelation_1(otmOperation); });
+                            otmOperations.forEach((otmOperation) => dealWithUserRelation(otmOperation));
                         }
                         else {
-                            dealWithUserRelation_1(otmOperations);
+                            dealWithUserRelation(otmOperations);
                         }
                     }
-                    else {
-                        if (otmOperations instanceof Array) {
-                            otmOperations.forEach(function (otmOperation) {
-                                var son = destructInner(e_2, otmOperation, undefined, undefined, true);
-                                addChild(me, attr, son);
-                            });
-                        }
-                        else {
-                            var son = destructInner(e_2, otmOperations, undefined, undefined, true);
+                    if (otmOperations instanceof Array) {
+                        otmOperations.forEach((otmOperation) => {
+                            const son = destructInner(e, otmOperation, undefined, undefined, true, extraFilter);
                             addChild(me, attr, son);
-                        }
+                        });
+                    }
+                    else {
+                        const son = destructInner(e, otmOperations, undefined, undefined, true, extraFilter);
+                        addChild(me, attr, son);
                     }
                 }
-            };
-            for (var attr in data) {
-                _loop_1(attr);
             }
             return root;
         };
-        return destructInner(entity2, (0, lodash_1.cloneDeep)(operation2));
-    };
+        return destructInner(entity2, operation2);
+    }
+    makePathFilter(entity, path, schema, filter) {
+        const { value, recursive } = path;
+        if (value === '') {
+            (0, assert_1.default)(!recursive);
+            return filter;
+        }
+        const paths = value.split('.');
+        const makeRecursiveFilter = (recursiveDepth) => {
+            if (recursiveDepth > 0) {
+                return {
+                    $or: [
+                        filter,
+                        {
+                            parent: makeRecursiveFilter(recursiveDepth - 1)
+                        }
+                    ]
+                };
+            }
+            return filter;
+        };
+        const makeInner = (idx, e2) => {
+            const attr = paths[idx];
+            if (idx === paths.length) {
+                if (!recursive) {
+                    return filter;
+                }
+                else {
+                    // 在最后一个对象上存在递归，用or连接处理
+                    const { recursiveDepth } = schema[e2];
+                    (0, assert_1.default)(recursiveDepth > 0);
+                    return makeRecursiveFilter(recursiveDepth);
+                }
+            }
+            else {
+                const rel = (0, relation_1.judgeRelation)(schema, e2, attr);
+                let e3;
+                if (rel === 2) {
+                    e3 = attr;
+                }
+                else if (typeof rel === 'string') {
+                    e3 = rel;
+                }
+                else {
+                    (0, assert_1.default)(rel instanceof Array);
+                    e3 = rel[0];
+                }
+                const f = makeInner(idx + 1, e3);
+                return {
+                    [attr]: f,
+                };
+            }
+        };
+        return makeInner(0, entity);
+    }
     /**
      * 对所有满足操作要求的actionAuth加以判断，找到可以满足当前用户身份的actionAuth
      * @param entity
@@ -474,41 +550,30 @@ var RelationAuth = /** @class */ (function () {
      * @param context
      * @return
      */
-    RelationAuth.prototype.filterActionAuths = function (entity, filter, actionAuths, context) {
-        var result = actionAuths.map(function (ele) {
-            var paths = ele.paths, relation = ele.relation, relationId = ele.relationId;
+    filterActionAuths(entity, filter, actionAuths, context) {
+        const result = actionAuths.map((ele) => {
+            const { path, relation, relationId } = ele;
             // 在cache中，可能出现relation外键指向的对象为null的情况，要容错
             if (relationId) {
                 if (relation) {
-                    var userRelations = relation.userRelation$relation;
+                    const { userRelation$relation: userRelations } = relation;
                     if (userRelations.length > 0) {
-                        var entityIds = (0, lodash_1.uniq)(userRelations.map(function (ele) { return ele.entityId; }));
-                        var idFilter_1 = entityIds.length > 1 ? {
-                            $in: entityIds,
-                        } : entityIds[0];
-                        (0, assert_1.default)(idFilter_1);
-                        var pathFilters_1 = paths.map(function (path) {
-                            if (path) {
-                                return (0, lodash_1.set)({}, path, {
-                                    id: idFilter_1,
-                                });
-                            }
-                            return {
-                                id: idFilter_1,
-                            };
+                        const entityIds = (0, lodash_1.uniq)(userRelations.map(ele => ele.entityId));
+                        const pathFilter = this.makePathFilter(entity, path, this.schema, {
+                            id: entityIds.length > 0 ? {
+                                $in: entityIds,
+                            } : entityIds[0],
                         });
-                        // 这里是或关系，只要对象落在任意一条路径上就可以
-                        var contained_1 = (0, filter_1.combineFilters)(entity, context.getSchema(), pathFilters_1, true);
-                        var contains_1 = (0, filter_1.checkFilterContains)(entity, context, contained_1, filter, true);
-                        if (contains_1 instanceof Promise) {
-                            return contains_1.then(function (c) {
+                        const contains = (0, filter_1.checkFilterContains)(entity, context, pathFilter, filter, true);
+                        if (contains instanceof Promise) {
+                            return contains.then((c) => {
                                 if (c) {
                                     return ele;
                                 }
                                 return;
                             });
                         }
-                        if (contains_1) {
+                        if (contains) {
                             return ele;
                         }
                         return;
@@ -517,11 +582,12 @@ var RelationAuth = /** @class */ (function () {
                 return;
             }
             // 说明是通过userId关联
-            var pathFilters = paths.map(function (path) { return (0, lodash_1.set)({}, "".concat(path, ".id"), context.getCurrentUserId()); });
-            var contained = (0, filter_1.combineFilters)(entity, context.getSchema(), pathFilters, true);
-            var contains = (0, filter_1.checkFilterContains)(entity, context, contained, filter, true);
+            const pathFilter = this.makePathFilter(entity, path, this.schema, {
+                id: context.getCurrentUserId(),
+            });
+            const contains = (0, filter_1.checkFilterContains)(entity, context, pathFilter, filter, true);
             if (contains instanceof Promise) {
-                return contains.then(function (c) {
+                return contains.then((c) => {
                     if (c) {
                         return ele;
                     }
@@ -532,11 +598,11 @@ var RelationAuth = /** @class */ (function () {
                 return ele;
             }
         });
-        if (result.find(function (ele) { return ele instanceof Promise; })) {
-            return Promise.all(result).then(function (r2) { return r2.filter(function (ele) { return !!ele; }); });
+        if (result.find(ele => ele instanceof Promise)) {
+            return Promise.all(result).then((r2) => r2.filter(ele => !!ele));
         }
-        return result.filter(function (ele) { return !!ele; });
-    };
+        return result.filter(ele => !!ele);
+    }
     /**
      * 对于有些特殊的查询（带很多$or的查询，多发生在系统级别），单个actionAuth无法满足，需要共同加以判定
      * @param entity
@@ -545,51 +611,40 @@ var RelationAuth = /** @class */ (function () {
      * @param context
      * @param actions
      */
-    RelationAuth.prototype.checkActionAuthInGroup = function (entity, filter, actionAuths, context) {
-        var filters = actionAuths.filter(function (ele) { return ele.destEntity === entity; }).map(function (ele) {
-            var paths = ele.paths, relation = ele.relation, relationId = ele.relationId;
+    checkActionAuthInGroup(entity, filter, actionAuths, context) {
+        const filters = actionAuths.filter(ele => ele.path.destEntity === entity).map((ele) => {
+            const { path, relation, relationId } = ele;
             if (relationId) {
                 (0, assert_1.default)(relation);
-                var userRelations = relation.userRelation$relation;
+                const { userRelation$relation: userRelations } = relation;
                 (0, assert_1.default)(userRelations.length > 0);
-                var entityIds = (0, lodash_1.uniq)(userRelations.map(function (ele) { return ele.entityId; }));
-                var idFilter_2 = entityIds.length > 1 ? {
-                    $in: entityIds,
-                } : entityIds[0];
-                (0, assert_1.default)(idFilter_2);
-                var pathFilters = paths.map(function (path) {
-                    if (path) {
-                        return (0, lodash_1.set)({}, path, {
-                            id: idFilter_2,
-                        });
-                    }
-                    return {
-                        id: idFilter_2
-                    };
+                const entityIds = (0, lodash_1.uniq)(userRelations.map(ele => ele.entityId));
+                const pathFilter = this.makePathFilter(entity, path, this.schema, {
+                    id: entityIds.length > 0 ? {
+                        $in: entityIds,
+                    } : entityIds[0],
                 });
-                return pathFilters;
+                return pathFilter;
             }
             // 说明是通过userId关联
-            return paths.map(function (path) { return (0, lodash_1.set)({}, "".concat(path, ".id"), context.getCurrentUserId()); });
+            return this.makePathFilter(entity, path, this.schema, {
+                id: context.getCurrentUserId(),
+            });
         });
-        var groupFilter = (0, filter_1.combineFilters)(entity, this.schema, filters.flat(), true);
+        const groupFilter = (0, filter_1.combineFilters)(entity, this.schema, filters, true);
         if (groupFilter) {
             return (0, filter_1.checkFilterContains)(entity, context, groupFilter, filter, true);
         }
         return false;
-    };
-    RelationAuth.prototype.checkSelection = function (entity, selection, context) {
-        var _this = this;
-        var leafSelections = this.destructSelection(entity, selection);
-        var deducedLeafSelections = leafSelections.map(function (_a) {
-            var entity = _a.entity, filter = _a.filter;
-            return _this.getDeducedEntityFilters(entity, filter, ['select'], context);
-        });
-        var checkDeducedLeafSelections = function (dlSelections2) {
-            var dlSelections = dlSelections2.filter(function (ele) {
-                var entities = ele.map(function (ele2) { return ele2.entity; });
+    }
+    checkSelection(entity, selection, context) {
+        const leafSelections = this.destructSelection(entity, selection);
+        const deducedLeafSelections = leafSelections.map(({ entity, filter }) => this.getDeducedEntityFilters(entity, filter, ['select'], context));
+        const checkDeducedLeafSelections = (dlSelections2) => {
+            const dlSelections = dlSelections2.filter((ele) => {
+                const entities = ele.map(ele2 => ele2.entity);
                 // 同一个leaf的deducedSelections中只要有一个能通过就足够了
-                if ((0, lodash_1.intersection)(_this.selectFreeEntities, entities).length > 0) {
+                if ((0, lodash_1.intersection)(this.selectFreeEntities, entities).length > 0) {
                     return false;
                 }
                 if ((0, lodash_1.intersection)(RelationAuth.SPECIAL_ENTITIES, entities).length > 0) {
@@ -604,16 +659,20 @@ var RelationAuth = /** @class */ (function () {
             if (!context.getCurrentUserId()) {
                 throw new types_1.OakUnloggedInException();
             }
-            var allEntities = [];
-            dlSelections.forEach(function (ele) { return ele.forEach(function (_a) {
-                var entity = _a.entity;
+            const allEntities = [];
+            dlSelections.forEach((ele) => ele.forEach(({ entity }) => {
                 allEntities.push(entity);
-            }); });
-            var actionAuths = context.select('actionAuth', {
+            }));
+            const actionAuths = context.select('actionAuth', {
                 data: {
                     id: 1,
-                    paths: 1,
-                    destEntity: 1,
+                    path: {
+                        id: 1,
+                        value: 1,
+                        sourceEntity: 1,
+                        destEntity: 1,
+                        recursive: 1,
+                    },
                     deActions: 1,
                     relation: {
                         id: 1,
@@ -634,8 +693,10 @@ var RelationAuth = /** @class */ (function () {
                     deActions: {
                         $contains: 'select',
                     },
-                    destEntity: {
-                        $in: allEntities,
+                    path: {
+                        destEntity: {
+                            $in: allEntities,
+                        },
                     },
                     $or: [
                         {
@@ -652,48 +713,37 @@ var RelationAuth = /** @class */ (function () {
                         }
                     ]
                 }
-            }, { dontCollect: true, ignoreForeignKeyMiss: true });
+            }, { dontCollect: true, ignoreAttrMiss: true });
             /**
              * 返回的结果中，第一层为leafNode，必须全通过，第二层为单个leafNode上的deduce，通过一个就可以
              * @param result
              * @returns
              */
-            var checkResult = function (result) {
-                var e_3, _a;
-                var idx = 0;
-                try {
-                    for (var result_1 = tslib_1.__values(result), result_1_1 = result_1.next(); !result_1_1.done; result_1_1 = result_1.next()) {
-                        var r1 = result_1_1.value;
-                        var r2 = r1.find(function (ele) { return ele === true; });
-                        if (!r2) {
-                            if (process.env.NODE_ENV === 'development') {
-                                console.warn('对象的select权限被否决，请检查', dlSelections[idx]);
-                            }
-                            return false;
+            const checkResult = (result) => {
+                let idx = 0;
+                for (const r1 of result) {
+                    const r2 = r1.find(ele => ele === true);
+                    if (!r2) {
+                        if (process.env.NODE_ENV === 'development') {
+                            console.warn('对象的select权限被否决，请检查', dlSelections[idx]);
                         }
+                        return false;
                     }
                 }
-                catch (e_3_1) { e_3 = { error: e_3_1 }; }
-                finally {
-                    try {
-                        if (result_1_1 && !result_1_1.done && (_a = result_1.return)) _a.call(result_1);
-                    }
-                    finally { if (e_3) throw e_3.error; }
-                }
                 return true;
             };
             if (actionAuths instanceof Promise) {
                 (0, assert_1.default)(context instanceof AsyncRowStore_1.AsyncContext);
-                return actionAuths.then(function (aas) { return Promise.all(dlSelections.map(function (ele) { return Promise.all(ele.map(function (ele2) { return _this.checkActionAuthInGroup(ele2.entity, ele2.filter, aas, context); })); })).then(function (result) { return checkResult(result); }); });
+                return actionAuths.then((aas) => Promise.all(dlSelections.map((ele) => Promise.all(ele.map((ele2) => this.checkActionAuthInGroup(ele2.entity, ele2.filter, aas, context))))).then((result) => checkResult(result)));
             }
-            return checkResult(dlSelections.map(function (ele) { return ele.map(function (ele2) { return _this.checkActionAuthInGroup(ele2.entity, ele2.filter, actionAuths, context); }); }));
+            return checkResult(dlSelections.map(ele => ele.map(ele2 => this.checkActionAuthInGroup(ele2.entity, ele2.filter, actionAuths, context))));
         };
         if (deducedLeafSelections[0] instanceof Promise) {
             return Promise.all(deducedLeafSelections)
-                .then(function (dls) { return checkDeducedLeafSelections(dls); });
+                .then((dls) => checkDeducedLeafSelections(dls));
         }
         return checkDeducedLeafSelections(deducedLeafSelections);
-    };
+    }
     /**
      * 此函数判定一个结点是否能通过权限检测，同时寻找该结点本身对象上成立的actionAuth，用于本结点子孙结点的快速检测
      * 如果结点因其deduce的对象通过了检测，其被推断对象的actionAuth无法用于更低对象的权限检测
@@ -701,41 +751,44 @@ var RelationAuth = /** @class */ (function () {
      * @param context
      * @returns
      */
-    RelationAuth.prototype.findActionAuthsOnNode = function (node, context) {
-        var _this = this;
-        var entity = node.entity, filter = node.filter, action = node.action, userRelations = node.userRelations;
-        var deducedEntityFilters2 = this.getDeducedEntityFilters(entity, filter, [action], context);
+    findActionAuthsOnNode(node, context) {
+        const { entity, filter, action, userRelations } = node;
+        const deducedEntityFilters2 = this.getDeducedEntityFilters(entity, filter, [action], context);
         /**
          * 搜索判定是否允许自建对象，自建的条件是 path = ''，destEntity === entity
          * @param actionAuths
          * @returns
          */
-        var findOwnCreateUserRelation = function (actionAuths) {
+        const findOwnCreateUserRelation = (actionAuths) => {
             if (userRelations && userRelations.length > 0) {
-                (0, assert_1.default)(action === 'create');
-                var ars = actionAuths.filter(function (ar) { return !!userRelations.find(function (ur) { return ur.relationId === ar.relationId; }) && ar.paths.includes('') && ar.destEntity === entity; });
+                const ars = actionAuths.filter((ar) => !!userRelations.find((ur) => ur.relationId === ar.relationId) && ar.path.value === '' && ar.path.destEntity === entity);
                 if (ars.length > 0) {
                     return ars;
                 }
             }
         };
-        var actionAuthOnEntities = [];
-        var dealWithDeducedEntityFilters = function (deducedEntityFilters) {
-            var specialEntities = deducedEntityFilters.filter(function (ele) { return RelationAuth.SPECIAL_ENTITIES.includes(ele.entity); });
-            var unspecicalEntities = deducedEntityFilters.filter(function (ele) { return !RelationAuth.SPECIAL_ENTITIES.includes(ele.entity); });
-            var result = [];
+        const actionAuthOnEntities = [];
+        const dealWithDeducedEntityFilters = (deducedEntityFilters) => {
+            const specialEntities = deducedEntityFilters.filter(ele => RelationAuth.SPECIAL_ENTITIES.includes(ele.entity));
+            const unspecicalEntities = deducedEntityFilters.filter(ele => !RelationAuth.SPECIAL_ENTITIES.includes(ele.entity));
+            const result = [];
             if (specialEntities.length > 0) {
                 // 对于deduce出来的special对象，直接判定create应该问题不大，否则写起来太烦琐（具体情况遇到了再调试）
-                result.push.apply(result, tslib_1.__spreadArray([], tslib_1.__read(specialEntities.map(function (ele) { return _this.checkOperateSpecialEntities2(ele.entity, ele.entity === entity ? node.action : 'create', ele.filter, context); })), false));
+                result.push(...specialEntities.map(ele => this.checkOperateSpecialEntities2(ele.entity, ele.entity === entity ? node.action : 'create', ele.filter, context)));
             }
             if (unspecicalEntities.length > 0) {
-                var allEntities = unspecicalEntities.map(function (ele) { return ele.entity; });
-                var allActions = (0, lodash_1.uniq)(unspecicalEntities.map(function (ele) { return ele.actions; }).flat());
-                var actionAuths2 = context.select('actionAuth', {
+                const allEntities = unspecicalEntities.map(ele => ele.entity);
+                const allActions = (0, lodash_1.uniq)(unspecicalEntities.map(ele => ele.actions).flat());
+                const actionAuths2 = context.select('actionAuth', {
                     data: {
                         id: 1,
-                        paths: 1,
-                        destEntity: 1,
+                        path: {
+                            id: 1,
+                            destEntity: 1,
+                            sourceEntity: 1,
+                            value: 1,
+                            recursive: 1,
+                        },
                         deActions: 1,
                         relation: {
                             id: 1,
@@ -753,52 +806,54 @@ var RelationAuth = /** @class */ (function () {
                         },
                     },
                     filter: {
-                        destEntity: {
-                            $in: allEntities,
+                        path: {
+                            destEntity: {
+                                $in: allEntities,
+                            }
                         },
                         deActions: {
                             $overlaps: allActions,
                         },
                     }
-                }, { dontCollect: true, ignoreForeignKeyMiss: true });
-                var checkActionAuths_1 = function (actionAuths) {
-                    var created = findOwnCreateUserRelation(actionAuths);
+                }, { dontCollect: true, ignoreAttrMiss: true });
+                const checkActionAuths = (actionAuths) => {
+                    const created = findOwnCreateUserRelation(actionAuths);
                     if (created) {
-                        actionAuthOnEntities.push.apply(actionAuthOnEntities, tslib_1.__spreadArray([], tslib_1.__read(created), false));
+                        actionAuthOnEntities.push(...created);
                         return true;
                     }
-                    var result = deducedEntityFilters.map(function (ele) {
-                        var ars2 = actionAuths.filter(function (ele2) { return ele2.destEntity === ele.entity && (0, lodash_1.intersection)(ele2.deActions, ele.actions).length > 0; } // 这里只要overlap就可以了
+                    const result = deducedEntityFilters.map((ele) => {
+                        const ars2 = actionAuths.filter(ele2 => ele2.path.destEntity === ele.entity && (0, lodash_1.intersection)(ele2.deActions, ele.actions).length > 0 // 这里只要overlap就可以了
                         );
-                        var ars3 = _this.filterActionAuths(ele.entity, ele.filter, ars2, context);
-                        var checkFilteredArs = function (actionAuths2) {
+                        const ars3 = this.filterActionAuths(ele.entity, ele.filter, ars2, context);
+                        const checkFilteredArs = (actionAuths2) => {
                             if (actionAuths2.length > 0) {
                                 if (ele.entity === entity) {
-                                    actionAuthOnEntities.push.apply(actionAuthOnEntities, tslib_1.__spreadArray([], tslib_1.__read(actionAuths2), false));
+                                    actionAuthOnEntities.push(...actionAuths2);
                                 }
                                 return true;
                             }
                             return false;
                         };
                         if (ars3 instanceof Promise) {
-                            return ars3.then(function (ars4) { return checkFilteredArs(ars4); });
+                            return ars3.then((ars4) => checkFilteredArs(ars4));
                         }
                         return checkFilteredArs(ars3);
                     });
-                    if (result.find(function (ele) { return ele instanceof Promise; })) {
-                        return Promise.all(result).then(function (r2) { return r2.includes(true); });
+                    if (result.find(ele => ele instanceof Promise)) {
+                        return Promise.all(result).then((r2) => r2.includes(true));
                     }
                     return result.includes(true);
                 };
                 if (actionAuths2 instanceof Promise) {
-                    result.push(actionAuths2.then(function (ars2) { return checkActionAuths_1(ars2); }));
+                    result.push(actionAuths2.then((ars2) => checkActionAuths(ars2)));
                 }
                 else {
-                    result.push(checkActionAuths_1(actionAuths2));
+                    result.push(checkActionAuths(actionAuths2));
                 }
             }
-            if (result.find(function (ele) { return ele instanceof Promise; })) {
-                return Promise.all(result).then(function (r2) {
+            if (result.find(ele => ele instanceof Promise)) {
+                return Promise.all(result).then((r2) => {
                     // r2中只有一个通过就能通过
                     if (r2.includes(true)) {
                         return actionAuthOnEntities;
@@ -812,47 +867,46 @@ var RelationAuth = /** @class */ (function () {
             return false;
         };
         if (deducedEntityFilters2 instanceof Promise) {
-            return deducedEntityFilters2.then(function (def2) { return dealWithDeducedEntityFilters(def2); });
+            return deducedEntityFilters2.then((def2) => dealWithDeducedEntityFilters(def2));
         }
         return dealWithDeducedEntityFilters(deducedEntityFilters2);
-    };
-    RelationAuth.prototype.checkOperationTree2 = function (tree, context) {
-        var _this = this;
-        var checkNode = function (node, actionAuths) {
-            var checkChildren = function (legalPaths) {
-                var children = node.children;
-                var childPath = Object.keys(children);
+    }
+    checkOperationTree2(tree, context) {
+        const checkNode = (node, actionAuths) => {
+            const checkChildren = (legalPaths) => {
+                const { children } = node;
+                const childPath = Object.keys(children);
                 if (childPath.length === 0) {
                     return true;
                 }
-                var childResult = childPath.map(function (childPath) {
-                    var child = children[childPath];
-                    var childEntity = child instanceof Array ? child[0].entity : child.entity;
+                const childResult = childPath.map((childPath) => {
+                    const child = children[childPath];
+                    const childEntity = child instanceof Array ? child[0].entity : child.entity;
                     // 这里如果该子结点能deduce到父，则直接通过
-                    if (_this.authDeduceRelationMap[childEntity]) {
-                        (0, assert_1.default)(_this.authDeduceRelationMap[childEntity] === 'entity');
-                        var rel = (0, relation_1.judgeRelation)(_this.schema, childEntity, childPath);
+                    if (this.authDeduceRelationMap[childEntity]) {
+                        (0, assert_1.default)(this.authDeduceRelationMap[childEntity] === 'entity');
+                        const rel = (0, relation_1.judgeRelation)(this.schema, childEntity, childPath);
                         if (rel === 2) {
                             return true;
                         }
                     }
-                    var pathToParent = childPath.endsWith('$entity') ? node.entity : childPath.split('$')[1];
+                    const pathToParent = childPath.endsWith('$entity') ? node.entity : childPath.split('$')[1];
                     if (child instanceof Array) {
-                        var childActions_1 = child.map(function (ele) { return ele.action; });
-                        var childLegalAuths_1 = legalPaths.map(function (ele) {
-                            var paths = ele.paths, relationId = ele.relationId;
-                            var paths2 = paths.map(function (path) { return path ? "".concat(pathToParent, ".").concat(path) : pathToParent; });
+                        const childActions = child.map(ele => ele.action);
+                        const childLegalAuths = legalPaths.map((ele) => {
+                            const { path: { value: pv }, relationId } = ele;
+                            const pv2 = pv ? `${pathToParent}.${pv}` : pathToParent;
                             return context.select('actionAuth', {
                                 data: {
                                     id: 1,
                                 },
                                 filter: {
-                                    paths: {
-                                        $overlaps: paths2,
+                                    path: {
+                                        value: pv2,
+                                        destEntity: childEntity,
                                     },
-                                    destEntity: childEntity,
                                     deActions: {
-                                        $overlaps: childActions_1,
+                                        $overlaps: childActions,
                                     },
                                     relationId: relationId || {
                                         $exists: false,
@@ -860,23 +914,23 @@ var RelationAuth = /** @class */ (function () {
                                 }
                             }, { dontCollect: true });
                         }).flat();
-                        if (childLegalAuths_1[0] instanceof Promise) {
-                            return Promise.all(childLegalAuths_1).then(function (clas) { return child.map(function (c) { return checkNode(c, clas); }); });
+                        if (childLegalAuths[0] instanceof Promise) {
+                            return Promise.all(childLegalAuths).then((clas) => child.map((c) => checkNode(c, clas)));
                         }
-                        return child.map(function (c) { return checkNode(c, childLegalAuths_1); });
+                        return child.map((c) => checkNode(c, childLegalAuths));
                     }
-                    var childLegalAuths = legalPaths.map(function (ele) {
-                        var paths = ele.paths, relationId = ele.relationId;
-                        var paths2 = paths.map(function (path) { return path ? "".concat(pathToParent, ".").concat(path) : pathToParent; });
+                    const childLegalAuths = legalPaths.map((ele) => {
+                        const { path: { value: pv }, relationId } = ele;
+                        const pv2 = pv ? `${pathToParent}.${pv}` : pathToParent;
                         return context.select('actionAuth', {
                             data: {
                                 id: 1,
                             },
                             filter: {
-                                paths: {
-                                    $overlaps: paths2,
+                                path: {
+                                    value: pv2,
+                                    destEntity: childEntity,
                                 },
-                                destEntity: childEntity,
                                 deActions: {
                                     $overlaps: child.action,
                                 },
@@ -887,12 +941,12 @@ var RelationAuth = /** @class */ (function () {
                         }, { dontCollect: true });
                     }).flat();
                     if (childLegalAuths[0] instanceof Promise) {
-                        return Promise.all(childLegalAuths).then(function (clas) { return checkNode(child, clas.flat()); });
+                        return Promise.all(childLegalAuths).then((clas) => checkNode(child, clas.flat()));
                     }
                     return checkNode(child, childLegalAuths);
                 }).flat();
                 if (childResult[0] instanceof Promise) {
-                    return Promise.all(childResult).then(function (r) { return !r.includes(false); });
+                    return Promise.all(childResult).then((r) => !r.includes(false));
                 }
                 return !childResult.includes(false);
             };
@@ -902,8 +956,8 @@ var RelationAuth = /** @class */ (function () {
                 return checkChildren(actionAuths);
             }
             // 没有能根据父亲传下来的actionAuth判定，只能自己找
-            var result = _this.findActionAuthsOnNode(node, context);
-            var checkResult = function (result2) {
+            const result = this.findActionAuthsOnNode(node, context);
+            const checkResult = (result2) => {
                 if (result2 === false) {
                     return false;
                 }
@@ -911,224 +965,38 @@ var RelationAuth = /** @class */ (function () {
                 if (node.entity === 'user') {
                     result2.push({
                         id: 'temp',
-                        paths: [''],
+                        pathId: 'path_temp',
+                        path: {
+                            id: 'path_temp',
+                            destEntity: 'user',
+                            sourceEntity: 'any',
+                            value: '',
+                            $$createAt$$: 1,
+                            $$updateAt$$: 1,
+                            $$seq$$: 'temp',
+                            recursive: false,
+                        },
                         $$createAt$$: 1,
                         $$updateAt$$: 1,
                         $$seq$$: 'temp',
-                        destEntity: 'user',
                         deActions: [node.action],
                     });
                 }
                 return checkChildren(result2);
             };
             if (result instanceof Promise) {
-                return result.then(function (r2) { return checkResult(r2); });
+                return result.then((r2) => checkResult(r2));
             }
             return checkResult(result);
         };
         return checkNode(tree);
-    };
-    /* private checkOperationTree<Cxt extends AsyncContext<ED> | SyncContext<ED>>(tree: OperationTree<ED>, context: Cxt) {
-        const actionAuths2 = this.findActionAuthsOnNode(tree, context);
-
-        const checkChildNode = (actionAuths: ED['actionAuth']['Schema'][] | Promise<ED['actionAuth']['Schema'][]>, node: OperationTree<ED>): boolean | Promise<boolean> => {
-            const checkChildNodeInner = (legalAuths: ED['actionAuth']['Schema'][]) => {
-                // 因为如果children是数组的话，会把数组中所有的action并起来查询，所以在这里还要再确认一次
-
-                const realLegalPaths = legalAuths.filter(
-                    (ele) => {
-                        if (ele.destEntity === node.entity && ele.deActions.includes(node.action)) {
-                            return true;
-                        }
-                        // 有一种例外情况，是在tree的根结点findActionAuthsOnNode时，deduce出了另外一个对象的权限，此时肯定可以通过，但不能再使用这条路径对children进行进一步判断了
-                        if (node === tree) {
-                            return true;
-                        }
-                        return false;
-                    }
-                );
-                const checkChildren = () => {
-                    const { children } = node;
-                    const childPath = Object.keys(children);
-                    if (childPath.length === 0) {
-                        return true;
-                    }
-
-                    const selfLegalPaths = realLegalPaths.filter(
-                        (ele) => {
-                            if (ele.destEntity === node.entity && ele.deActions.includes(node.action)) {
-                                return true;
-                            }
-                            return false;
-                        }
-                    );
-                    // assert(selfLegalPaths.length > 0, `对象${node.entity as string}的权限检查是用deduce的对象通过的，无法再进一步对子对象加以判断`);
-                    const childResult = childPath.map(
-                        (childPath) => {
-                            const child = children[childPath];
-                            const childEntity = child instanceof Array ? child[0].entity : child.entity;
-                            // 这里如果该子结点能deduce到父，则直接通过
-                            if (this.authDeduceRelationMap[childEntity]) {
-                                assert(this.authDeduceRelationMap[childEntity] === 'entity');
-                                const rel = judgeRelation(this.schema, childEntity, childPath);
-                                if (rel === 2) {
-                                    return true;
-                                }
-                            }
-
-                            const pathToParent = childPath.endsWith('$entity') ? node.entity as string : childPath.split('$')[1];
-                            if (child instanceof Array) {
-                                const childActions = child.map(ele => ele.action);
-                                const childLegalAuths = selfLegalPaths.map(
-                                    (ele) => {
-                                        const { paths, relationId } = ele;
-                                        const paths2 = paths.map(
-                                            (path) => path ? `${pathToParent}.${path}` : pathToParent
-                                        );
-                                        return context.select('actionAuth', {
-                                            data: {
-                                                id: 1,
-                                            },
-                                            filter: {
-                                                paths: {
-                                                    $overlaps: paths2,
-                                                },
-                                                destEntity: childEntity as string,
-                                                deActions: {
-                                                    $overlaps: childActions,
-                                                },
-                                                relationId: relationId || {
-                                                    $exists: false,
-                                                },
-                                            }
-                                        }, { dontCollect: true })
-                                    }
-                                ).flat() as ED['actionAuth']['Schema'][] | Promise<ED['actionAuth']['Schema']>[];
-                                if (childLegalAuths[0] instanceof Promise) {
-                                    return Promise.all(childLegalAuths).then(
-                                        (clas) => child.map(
-                                            (c) => checkChildNode(clas, c)
-                                        )
-                                    )
-                                }
-                                return child.map(
-                                    (c) => checkChildNode(childLegalAuths as ED['actionAuth']['Schema'][], c)
-                                );
-                            }
-
-                            const childLegalAuths = realLegalPaths.map(
-                                (ele) => {
-                                    const { paths, relationId } = ele;
-                                    const paths2 = paths.map(
-                                        (path) => path ? `${pathToParent}.${path}` : pathToParent
-                                    );
-                                    return context.select('actionAuth', {
-                                        data: {
-                                            id: 1,
-                                        },
-                                        filter: {
-                                            paths: {
-                                                $overlaps: paths2,
-                                            },
-                                            destEntity: childEntity as string,
-                                            deActions: {
-                                                $overlaps: child.action,
-                                            },
-                                            relationId: relationId || {
-                                                $exists: false,
-                                            },
-                                        }
-                                    }, { dontCollect: true })
-                                }
-                            ).flat() as ED['actionAuth']['Schema'][] | Promise<ED['actionAuth']['Schema']>[];
-
-                            if (childLegalAuths[0] instanceof Promise) {
-                                return Promise.all(childLegalAuths).then(
-                                    (clas) => checkChildNode(clas.flat(), child)
-                                );
-                            }
-                            return checkChildNode(childLegalAuths as ED['actionAuth']['Schema'][], child);
-                        }
-                    ).flat();
-
-                    if (childResult[0] instanceof Promise) {
-                        return Promise.all(childResult).then(
-                            (r) => !r.includes(false)
-                        );
-                    }
-                    return !childResult.includes(false);
-                };
-
-                if (RelationAuth.SPECIAL_ENTITIES.includes(node.entity as string)) {
-                    // 特殊entity走特别的路径判断
-                    const result = this.checkOperateSpecialEntities2(node.entity, node.action, node.filter, context);
-
-                    if (result instanceof Promise) {
-                        return result.then(
-                            (r) => {
-                                if (r) {
-                                    return checkChildren();
-                                }
-                                return false;
-                            }
-                        );
-                    }
-                    if (result) {
-                        if (node.entity === 'user') {
-                            // 如果当前是对user对象操作，需要加上一个指向它自身的actionAuth，否则剩下的子对象会判定不过
-                            // user的操作权限由应用自己决定，如果user的操作最终过不去，这里放过也没关系
-                            assert(node === tree && realLegalPaths.length === 0);  // user不可能是非根结点
-                            realLegalPaths.push({
-                                id: 'temp',
-                                paths: [''],
-                                $$createAt$$: 1,
-                                $$updateAt$$: 1,
-                                $$seq$$: 'temp',
-                                destEntity: 'user',
-                                deActions: [node.action],
-                            });
-                        }
-                        return checkChildren();
-                    }
-                    if (process.env.NODE_ENV === 'development') {
-                        console.warn('对象operate权限检查不通过', node);
-                    }
-                    return false;
-                }
-
-                if (realLegalPaths.length === 0) {
-                    if (node === tree) {
-                        if (process.env.NODE_ENV === 'development') {
-                            console.warn('对象operate权限检查不通过', node);
-                        }
-                        return false;
-                    }
-                    // 如果不是tree的根结点，相对路径上的actionAuth找不到，还可以尝试从自身的filter去重试其它路径
-                    return this.checkOperationTree(node, context);
-                }
-
-                return checkChildren();
-            };
-
-            if (actionAuths instanceof Promise) {
-                return actionAuths.then(
-                    (aars) => checkChildNodeInner(aars)
-                );
-            }
-            return checkChildNodeInner(actionAuths);
-        };
-
-        return checkChildNode(actionAuths2, tree);
-    } */
-    RelationAuth.prototype.checkOperation = function (entity, operation, context) {
-        var action = operation.action, filter = operation.filter, data = operation.data;
-        if (action === 'create' && this.createFreeEntities.includes(entity)) {
-            return true;
-        }
-        else if (action === 'update' && this.updateFreeEntities.includes(entity)) {
+    }
+    checkOperation(entity, operation, context) {
+        const { action, filter, data } = operation;
+        if (this.updateFreeDict[entity] && this.updateFreeDict[entity].includes(action)) {
             return true;
         }
-        var userId = context.getCurrentUserId();
+        const userId = context.getCurrentUserId();
         if (!userId) {
             throw new types_1.OakUnloggedInException();
         }
@@ -1138,9 +1006,9 @@ var RelationAuth = /** @class */ (function () {
             }
             return false;
         }
-        var updateTree = this.destructOperation(entity, operation, userId);
+        const updateTree = this.destructOperation(entity, operation, userId);
         return this.checkOperationTree2(updateTree, context);
-    };
+    }
     /**
      * 检查一个operation是否能被通过权限测试
      * 一个cascadeOperation是一棵树形结构：
@@ -1153,25 +1021,25 @@ var RelationAuth = /** @class */ (function () {
      * @param actions
      * @returns
      */
-    RelationAuth.prototype.checkActions2 = function (entity, operation, context, actions) {
-        var action = operation.action;
+    checkActions2(entity, operation, context, actions) {
+        const { action } = operation;
         if (!action || action_1.readOnlyActions.includes(action)) {
-            var result = this.checkSelection(entity, operation, context);
+            const result = this.checkSelection(entity, operation, context);
             if (result instanceof Promise) {
-                return result.then(function (r) {
+                return result.then((r) => {
                     if (!r) {
-                        throw new types_1.OakUserUnpermittedException();
+                        throw new types_1.OakUserInvisibleException();
                     }
                 });
             }
             if (!result) {
-                throw new types_1.OakUserUnpermittedException();
+                throw new types_1.OakUserInvisibleException();
             }
         }
         else {
-            var result = this.checkOperation(entity, operation, context);
+            const result = this.checkOperation(entity, operation, context);
             if (result instanceof Promise) {
-                return result.then(function (r) {
+                return result.then((r) => {
                     if (!r) {
                         throw new types_1.OakUserUnpermittedException();
                     }
@@ -1181,10 +1049,8 @@ var RelationAuth = /** @class */ (function () {
                 throw new types_1.OakUserUnpermittedException();
             }
         }
-    };
-    RelationAuth.SPECIAL_ENTITIES = env_1.SYSTEM_RESERVE_ENTITIES;
-    return RelationAuth;
-}());
+    }
+}
 exports.RelationAuth = RelationAuth;
 ;
 /**
@@ -1193,300 +1059,276 @@ exports.RelationAuth = RelationAuth;
  * @param context
  * todo paths改成复数以后这里还未充分测试过
  */
-function getUserRelationsByActions(params, context) {
-    return tslib_1.__awaiter(this, void 0, void 0, function () {
-        var entity, filter, actions, overlap, actionAuthfilter, actionAuths, getUserRelations, getDirectUserEntities, urAuths2, directAuths2, _a, userRelations, userEntities;
-        var _this = this;
-        return tslib_1.__generator(this, function (_b) {
-            switch (_b.label) {
-                case 0:
-                    entity = params.entity, filter = params.filter, actions = params.actions, overlap = params.overlap;
-                    actionAuthfilter = {
-                        destEntity: entity,
-                    };
-                    if (overlap) {
-                        Object.assign(actionAuthfilter, {
-                            deActions: {
-                                $overlaps: actions,
-                            },
-                        });
-                    }
-                    else {
-                        Object.assign(actionAuthfilter, {
-                            deActions: {
-                                $contains: actions,
-                            },
-                        });
-                    }
-                    return [4 /*yield*/, context.select('actionAuth', {
+async function getUserRelationsByActions(params, context) {
+    const { entity, filter, actions, overlap } = params;
+    const actionAuthfilter = {
+        path: {
+            destEntity: entity,
+        },
+    };
+    if (overlap) {
+        Object.assign(actionAuthfilter, {
+            deActions: {
+                $overlaps: actions,
+            },
+        });
+    }
+    else {
+        Object.assign(actionAuthfilter, {
+            deActions: {
+                $contains: actions,
+            },
+        });
+    }
+    const actionAuths = await context.select('actionAuth', {
+        data: {
+            id: 1,
+            path: {
+                id: 1,
+                value: 1,
+                destEntity: 1,
+                recursive: 1,
+            },
+            relationId: 1,
+            relation: {
+                id: 1,
+                entity: 1,
+            },
+        },
+        filter: actionAuthfilter,
+    }, { dontCollect: true });
+    const getUserRelations = async (urAuths) => {
+        const makeRelationIterator = (path, relationIds, recursive) => {
+            (0, assert_1.default)(!recursive, 'recursive的情况还没处理，等跑出来再说， by Xc');
+            if (path === '') {
+                return {
+                    projection: {
+                        id: 1,
+                        userRelation$entity: {
+                            $entity: 'userRelation',
                             data: {
                                 id: 1,
-                                paths: 1,
                                 relationId: 1,
                                 relation: {
                                     id: 1,
-                                    entity: 1,
+                                    name: 1,
                                 },
+                                entity: 1,
+                                entityId: 1,
+                                userId: 1,
                             },
-                            filter: actionAuthfilter,
-                        }, { dontCollect: true })];
-                case 1:
-                    actionAuths = _b.sent();
-                    getUserRelations = function (urAuths) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-                        var makeRelationIterator, urAuthDict2, userRelations;
-                        var _this = this;
-                        return tslib_1.__generator(this, function (_a) {
-                            switch (_a.label) {
-                                case 0:
-                                    makeRelationIterator = function (path, relationIds) {
-                                        var paths = path.split('.');
-                                        var makeIter = function (e, idx) {
-                                            var _a, _b, _c;
-                                            if (idx === paths.length) {
-                                                return {
-                                                    projection: {
-                                                        id: 1,
-                                                        userRelation$entity: {
-                                                            $entity: 'userRelation',
-                                                            data: {
-                                                                id: 1,
-                                                                relationId: 1,
-                                                                relation: {
-                                                                    id: 1,
-                                                                    name: 1,
-                                                                },
-                                                                entity: 1,
-                                                                entityId: 1,
-                                                                userId: 1,
-                                                            },
-                                                            filter: {
-                                                                relationId: {
-                                                                    $in: relationIds,
-                                                                },
-                                                            },
-                                                        }
-                                                    },
-                                                    getData: function (d) {
-                                                        return d.userRelation$entity;
-                                                    },
-                                                };
-                                            }
-                                            var attr = paths[idx];
-                                            var rel = (0, relation_1.judgeRelation)(context.getSchema(), e, attr);
-                                            if (rel === 2) {
-                                                var _d = makeIter(attr, idx + 1), projection = _d.projection, getData_1 = _d.getData;
-                                                return {
-                                                    projection: (_a = {
-                                                            id: 1
-                                                        },
-                                                        _a[attr] = projection,
-                                                        _a),
-                                                    getData: function (d) { return d[attr] && getData_1(d[attr]); },
-                                                };
-                                            }
-                                            else if (typeof rel === 'string') {
-                                                var _e = makeIter(rel, idx + 1), projection = _e.projection, getData_2 = _e.getData;
-                                                return {
-                                                    projection: (_b = {
-                                                            id: 1
-                                                        },
-                                                        _b[attr] = projection,
-                                                        _b),
-                                                    getData: function (d) { return d[attr] && getData_2(d[attr]); },
-                                                };
-                                            }
-                                            else {
-                                                (0, assert_1.default)(rel instanceof Array);
-                                                var _f = tslib_1.__read(rel, 2), e2 = _f[0], fk = _f[1];
-                                                var _g = makeIter(e2, idx + 1), projection = _g.projection, getData_3 = _g.getData;
-                                                return {
-                                                    projection: (_c = {
-                                                            id: 1
-                                                        },
-                                                        _c[attr] = {
-                                                            $entity: e2,
-                                                            data: projection,
-                                                        },
-                                                        _c),
-                                                    getData: function (d) { return d[attr] && d[attr].map(function (ele) { return getData_3(ele); }); },
-                                                };
-                                            }
-                                        };
-                                        return makeIter(entity, 0);
-                                    };
-                                    urAuthDict2 = {};
-                                    urAuths.forEach(function (auth) {
-                                        var paths = auth.paths, relationId = auth.relationId;
-                                        paths.forEach(function (path) {
-                                            if (!urAuthDict2[path]) {
-                                                urAuthDict2[path] = [relationId];
-                                            }
-                                            else if (!urAuthDict2[path].includes(relationId)) {
-                                                urAuthDict2[path].push(relationId);
-                                            }
-                                        });
-                                    });
-                                    return [4 /*yield*/, Promise.all(Object.keys(urAuthDict2).map(function (path) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-                                            var relationIds, _a, projection, getData, rows, urs;
-                                            return tslib_1.__generator(this, function (_b) {
-                                                switch (_b.label) {
-                                                    case 0:
-                                                        relationIds = urAuthDict2[path];
-                                                        _a = makeRelationIterator(path, relationIds), projection = _a.projection, getData = _a.getData;
-                                                        return [4 /*yield*/, context.select(entity, {
-                                                                data: projection,
-                                                                filter: filter,
-                                                            }, { dontCollect: true })];
-                                                    case 1:
-                                                        rows = _b.sent();
-                                                        urs = rows.map(function (ele) { return getData(ele); }).flat().filter(function (ele) { return !!ele; });
-                                                        return [2 /*return*/, urs];
-                                                }
-                                            });
-                                        }); }))];
-                                case 1:
-                                    userRelations = _a.sent();
-                                    return [2 /*return*/, userRelations.flat()];
-                            }
-                        });
-                    }); };
-                    getDirectUserEntities = function (directAuths) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-                        var makeRelationIterator, userEntities;
-                        var _this = this;
-                        return tslib_1.__generator(this, function (_a) {
-                            switch (_a.label) {
-                                case 0:
-                                    makeRelationIterator = function (path) {
-                                        var paths = path.split('.');
-                                        var makeIter = function (e, idx) {
-                                            var _a, _b, _c, _d;
-                                            var attr = paths[idx];
-                                            var rel = (0, relation_1.judgeRelation)(context.getSchema(), e, attr);
-                                            if (idx === paths.length - 1) {
-                                                if (rel === 2) {
-                                                    (0, assert_1.default)(attr === 'user');
-                                                    return {
-                                                        projection: {
-                                                            id: 1,
-                                                            entity: 1,
-                                                            entityId: 1,
-                                                        },
-                                                        getData: function (d) {
-                                                            if (d) {
-                                                                return {
-                                                                    entity: e,
-                                                                    entityId: d.id,
-                                                                    userId: d.entityId,
-                                                                };
-                                                            }
-                                                        },
-                                                    };
-                                                }
-                                                else {
-                                                    (0, assert_1.default)(rel === 'user');
-                                                    return {
-                                                        projection: (_a = {
-                                                                id: 1
-                                                            },
-                                                            _a["".concat(attr, "Id")] = 1,
-                                                            _a),
-                                                        getData: function (d) {
-                                                            if (d) {
-                                                                return {
-                                                                    entity: e,
-                                                                    entityId: d.id,
-                                                                    userId: d["".concat(attr, "Id")]
-                                                                };
-                                                            }
-                                                        },
-                                                    };
-                                                }
-                                            }
-                                            if (rel === 2) {
-                                                var _e = makeIter(attr, idx + 1), projection = _e.projection, getData_4 = _e.getData;
-                                                return {
-                                                    projection: (_b = {
-                                                            id: 1
-                                                        },
-                                                        _b[attr] = projection,
-                                                        _b),
-                                                    getData: function (d) { return d[attr] && getData_4(d[attr]); },
-                                                };
-                                            }
-                                            else if (typeof rel === 'string') {
-                                                var _f = makeIter(rel, idx + 1), projection = _f.projection, getData_5 = _f.getData;
-                                                return {
-                                                    projection: (_c = {
-                                                            id: 1
-                                                        },
-                                                        _c[attr] = projection,
-                                                        _c),
-                                                    getData: function (d) { return d[attr] && getData_5(d[attr]); },
-                                                };
-                                            }
-                                            else {
-                                                (0, assert_1.default)(rel instanceof Array);
-                                                var _g = tslib_1.__read(rel, 2), e2 = _g[0], fk = _g[1];
-                                                var _h = makeIter(e2, idx + 1), projection = _h.projection, getData_6 = _h.getData;
-                                                return {
-                                                    projection: (_d = {
-                                                            id: 1
-                                                        },
-                                                        _d[attr] = {
-                                                            $entity: e2,
-                                                            data: projection,
-                                                        },
-                                                        _d),
-                                                    getData: function (d) { return d[attr] && d[attr].map(function (ele) { return getData_6(ele); }); },
-                                                };
-                                            }
-                                        };
-                                        return makeIter(entity, 0);
-                                    };
-                                    return [4 /*yield*/, Promise.all(directAuths.map(function (_a) {
-                                            var paths = _a.paths;
-                                            return tslib_1.__awaiter(_this, void 0, void 0, function () {
-                                                var _this = this;
-                                                return tslib_1.__generator(this, function (_b) {
-                                                    return [2 /*return*/, paths.map(function (path) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-                                                            var _a, getData, projection, rows, userEntities;
-                                                            return tslib_1.__generator(this, function (_b) {
-                                                                switch (_b.label) {
-                                                                    case 0:
-                                                                        _a = makeRelationIterator(path), getData = _a.getData, projection = _a.projection;
-                                                                        return [4 /*yield*/, context.select(entity, {
-                                                                                data: projection,
-                                                                                filter: filter,
-                                                                            }, { dontCollect: true })];
-                                                                    case 1:
-                                                                        rows = _b.sent();
-                                                                        userEntities = rows.map(function (ele) { return getData(ele); }).flat().filter(function (ele) { return !!ele; });
-                                                                        return [2 /*return*/, userEntities];
-                                                                }
-                                                            });
-                                                        }); })];
-                                                });
-                                            });
-                                        }))];
-                                case 1:
-                                    userEntities = _a.sent();
-                                    return [2 /*return*/, userEntities.flat()];
+                            filter: {
+                                relationId: {
+                                    $in: relationIds,
+                                },
+                            },
+                        },
+                    },
+                    getData: (d) => {
+                        return d.userRelation$entity;
+                    },
+                };
+            }
+            const paths = path.split('.');
+            const makeIter = (e, idx) => {
+                if (idx === paths.length) {
+                    return {
+                        projection: {
+                            id: 1,
+                            userRelation$entity: {
+                                $entity: 'userRelation',
+                                data: {
+                                    id: 1,
+                                    relationId: 1,
+                                    relation: {
+                                        id: 1,
+                                        name: 1,
+                                    },
+                                    entity: 1,
+                                    entityId: 1,
+                                    userId: 1,
+                                },
+                                filter: {
+                                    relationId: {
+                                        $in: relationIds,
+                                    },
+                                },
                             }
-                        });
-                    }); };
-                    urAuths2 = actionAuths.filter(function (ele) { return !!ele.relationId; } // 有relation说明通过userRelation关联
-                    );
-                    directAuths2 = actionAuths.filter(function (ele) { return !ele.relationId; } // 没relation说明通过user关联
-                    );
-                    return [4 /*yield*/, Promise.all([getUserRelations(urAuths2), getDirectUserEntities(directAuths2)])];
-                case 2:
-                    _a = tslib_1.__read.apply(void 0, [_b.sent(), 2]), userRelations = _a[0], userEntities = _a[1];
-                    return [2 /*return*/, {
-                            userRelations: userRelations,
-                            userEntities: userEntities,
-                        }];
+                        },
+                        getData: (d) => {
+                            return d.userRelation$entity;
+                        },
+                    };
+                }
+                const attr = paths[idx];
+                const rel = (0, relation_1.judgeRelation)(context.getSchema(), e, attr);
+                if (rel === 2) {
+                    const { projection, getData } = makeIter(attr, idx + 1);
+                    return {
+                        projection: {
+                            id: 1,
+                            [attr]: projection,
+                        },
+                        getData: (d) => d[attr] && getData(d[attr]),
+                    };
+                }
+                else if (typeof rel === 'string') {
+                    const { projection, getData } = makeIter(rel, idx + 1);
+                    return {
+                        projection: {
+                            id: 1,
+                            [attr]: projection,
+                        },
+                        getData: (d) => d[attr] && getData(d[attr]),
+                    };
+                }
+                else {
+                    (0, assert_1.default)(rel instanceof Array);
+                    const [e2, fk] = rel;
+                    const { projection, getData } = makeIter(e2, idx + 1);
+                    return {
+                        projection: {
+                            id: 1,
+                            [attr]: {
+                                $entity: e2,
+                                data: projection,
+                            },
+                        },
+                        getData: (d) => d[attr] && d[attr].map((ele) => getData(ele)),
+                    };
+                }
+            };
+            return makeIter(entity, 0);
+        };
+        // 相同的path可以groupBy掉
+        const urAuthDict2 = {};
+        urAuths.forEach((auth) => {
+            const { path, relationId } = auth;
+            const { value, recursive } = path;
+            if (!urAuthDict2[value]) {
+                urAuthDict2[value] = [[relationId], recursive];
+            }
+            else if (!urAuthDict2[value][0].includes(relationId)) {
+                (0, assert_1.default)(urAuthDict2[value][1] === recursive);
+                urAuthDict2[value][0].push(relationId);
             }
         });
-    });
+        const userRelations = await Promise.all(Object.keys(urAuthDict2).map(async (path) => {
+            const [relationIds, recursive] = urAuthDict2[path];
+            const { projection, getData } = makeRelationIterator(path, relationIds, recursive);
+            const rows = await context.select(entity, {
+                data: projection,
+                filter,
+            }, { dontCollect: true });
+            const urs = rows.map(ele => getData(ele)).flat().filter(ele => !!ele);
+            return urs;
+        }));
+        return userRelations.flat();
+    };
+    const getDirectUserEntities = async (directAuths) => {
+        const makeRelationIterator = (path) => {
+            const paths = path.split('.');
+            const makeIter = (e, idx) => {
+                const attr = paths[idx];
+                const rel = (0, relation_1.judgeRelation)(context.getSchema(), e, attr);
+                if (idx === paths.length - 1) {
+                    if (rel === 2) {
+                        (0, assert_1.default)(attr === 'user');
+                        return {
+                            projection: {
+                                id: 1,
+                                entity: 1,
+                                entityId: 1,
+                            },
+                            getData: (d) => {
+                                if (d) {
+                                    return {
+                                        entity: e,
+                                        entityId: d.id,
+                                        userId: d.entityId,
+                                    };
+                                }
+                            },
+                        };
+                    }
+                    else {
+                        (0, assert_1.default)(rel === 'user');
+                        return {
+                            projection: {
+                                id: 1,
+                                [`${attr}Id`]: 1,
+                            },
+                            getData: (d) => {
+                                if (d) {
+                                    return {
+                                        entity: e,
+                                        entityId: d.id,
+                                        userId: d[`${attr}Id`]
+                                    };
+                                }
+                            },
+                        };
+                    }
+                }
+                if (rel === 2) {
+                    const { projection, getData } = makeIter(attr, idx + 1);
+                    return {
+                        projection: {
+                            id: 1,
+                            [attr]: projection,
+                        },
+                        getData: (d) => d[attr] && getData(d[attr]),
+                    };
+                }
+                else if (typeof rel === 'string') {
+                    const { projection, getData } = makeIter(rel, idx + 1);
+                    return {
+                        projection: {
+                            id: 1,
+                            [attr]: projection,
+                        },
+                        getData: (d) => d[attr] && getData(d[attr]),
+                    };
+                }
+                else {
+                    (0, assert_1.default)(rel instanceof Array);
+                    const [e2, fk] = rel;
+                    const { projection, getData } = makeIter(e2, idx + 1);
+                    return {
+                        projection: {
+                            id: 1,
+                            [attr]: {
+                                $entity: e2,
+                                data: projection,
+                            },
+                        },
+                        getData: (d) => d[attr] && d[attr].map((ele) => getData(ele)),
+                    };
+                }
+            };
+            return makeIter(entity, 0);
+        };
+        const userEntities = await Promise.all(directAuths.map(async ({ path }) => {
+            const { value, recursive } = path;
+            (0, assert_1.default)(!recursive);
+            const { getData, projection } = makeRelationIterator(value);
+            const rows = await context.select(entity, {
+                data: projection,
+                filter,
+            }, { dontCollect: true });
+            const userEntities = rows.map(ele => getData(ele)).flat().filter(ele => !!ele);
+            return userEntities;
+        }));
+        return userEntities.flat();
+    };
+    const urAuths2 = actionAuths.filter(ele => !!ele.relationId // 有relation说明通过userRelation关联
+    );
+    const directAuths2 = actionAuths.filter(ele => !ele.relationId // 没relation说明通过user关联
+    );
+    const [userRelations, userEntities] = await Promise.all([getUserRelations(urAuths2), getDirectUserEntities(directAuths2)]);
+    return {
+        userRelations,
+        userEntities,
+    };
 }
 exports.getUserRelationsByActions = getUserRelationsByActions;