roboto-js 1.7.4 → 1.8.1

package/dist/esm/rbt_object.js

@@ -292,6 +292,343 @@ export default class RbtObject {
       throw e;
     }
   }
+
+  /**
+   * Grants access to this object for specific users and/or user groups.
+   * Updates the IAC (Identity and Access Control) permissions.
+   * 
+   * @param {Object} options - Access grant options
+   * @param {string[]} [options.userIds=[]] - Array of user IDs to grant read access
+   * @param {string[]} [options.groupIds=[]] - Array of user group IDs to grant read access
+   * @param {boolean} [options.write=false] - If true, grants write access instead of read access
+   * @param {boolean} [options.replace=false] - If true, replaces existing grants; if false, merges with existing
+   * @param {boolean} [options.save=true] - If true, automatically saves the object after updating permissions
+   * @returns {Promise<RbtObject>} - Returns this object (saved if options.save is true)
+   * 
+   * @example
+   * // Grant read access to specific users
+   * await myObject.grantAccess({ 
+   *   userIds: ['user123', 'user456'] 
+   * });
+   * 
+   * @example
+   * // Grant read access to user groups
+   * await myObject.grantAccess({ 
+   *   groupIds: ['grpRngAccount', 'grpAdmins'] 
+   * });
+   * 
+   * @example
+   * // Grant write access to users and groups
+   * await myObject.grantAccess({ 
+   *   userIds: ['user123'],
+   *   groupIds: ['grpAdmins'],
+   *   write: true 
+   * });
+   * 
+   * @example
+   * // Replace existing permissions instead of merging
+   * await myObject.grantAccess({ 
+   *   userIds: ['user123'],
+   *   replace: true 
+   * });
+   * 
+   * @example
+   * // Update permissions without auto-saving
+   * await myObject.grantAccess({ 
+   *   userIds: ['user123'],
+   *   save: false 
+   * });
+   * // ... make other changes ...
+   * await myObject.save();
+   */
+  async grantAccess(options = {}) {
+    const {
+      userIds = [],
+      groupIds = [],
+      write = false,
+      replace = false,
+      save = true
+    } = options;
+
+    // Validate inputs
+    if (!Array.isArray(userIds)) {
+      throw new Error('userIds must be an array');
+    }
+    if (!Array.isArray(groupIds)) {
+      throw new Error('groupIds must be an array');
+    }
+
+    // Get current IAC settings
+    const iac = this.get('iac') || {};
+
+    // Determine which grant type to update (read or write)
+    const grantType = write ? 'writeGrants' : 'readGrants';
+
+    // Initialize grants if they don't exist
+    if (!iac[grantType]) {
+      iac[grantType] = {};
+    }
+
+    // Handle users
+    if (userIds.length > 0) {
+      if (replace) {
+        // Replace existing users
+        iac[grantType].users = [...userIds];
+      } else {
+        // Merge with existing users (avoiding duplicates)
+        const existingUsers = iac[grantType].users || [];
+        const mergedUsers = [...new Set([...existingUsers, ...userIds])];
+        iac[grantType].users = mergedUsers;
+      }
+    }
+
+    // Handle user groups
+    if (groupIds.length > 0) {
+      if (replace) {
+        // Replace existing groups
+        iac[grantType].userGroups = [...groupIds];
+      } else {
+        // Merge with existing groups (avoiding duplicates)
+        const existingGroups = iac[grantType].userGroups || [];
+        const mergedGroups = [...new Set([...existingGroups, ...groupIds])];
+        iac[grantType].userGroups = mergedGroups;
+      }
+    }
+
+    // Update the object
+    this.set('iac', iac);
+
+    // Save if requested
+    if (save) {
+      return await this.save();
+    }
+    return this;
+  }
+
+  /**
+   * Publishes this object to make it publicly accessible (or unpublishes it).
+   * Adds or removes 'public_user' from the IAC read permissions.
+   * 
+   * @param {Object} options - Publishing options
+   * @param {boolean} [options.publish=true] - If true, publishes the object; if false, unpublishes it
+   * @param {boolean} [options.save=true] - If true, automatically saves the object after updating permissions
+   * @returns {Promise<RbtObject>} - Returns this object (saved if options.save is true)
+   * 
+   * @example
+   * // Publish an object (make it public)
+   * await myObject.publishObject();
+   * 
+   * @example
+   * // Unpublish an object (make it private)
+   * await myObject.publishObject({ publish: false });
+   * 
+   * @example
+   * // Publish without auto-saving
+   * await myObject.publishObject({ save: false });
+   * // ... make other changes ...
+   * await myObject.save();
+   */
+  async publishObject(options = {}) {
+    const {
+      publish = true,
+      save = true
+    } = options;
+
+    // Get current IAC settings
+    const iac = this.get('iac') || {};
+
+    // Initialize readGrants if it doesn't exist
+    if (!iac.readGrants) {
+      iac.readGrants = {};
+    }
+
+    // Initialize users array if it doesn't exist
+    if (!Array.isArray(iac.readGrants.users)) {
+      iac.readGrants.users = [];
+    }
+    if (publish) {
+      // Add public_user if not already present
+      if (!iac.readGrants.users.includes('public_user')) {
+        iac.readGrants.users.push('public_user');
+      }
+    } else {
+      // Remove public_user
+      iac.readGrants.users = iac.readGrants.users.filter(userId => userId !== 'public_user');
+    }
+
+    // Update the object
+    this.set('iac', iac);
+
+    // Save if requested
+    if (save) {
+      return await this.save();
+    }
+    return this;
+  }
+
+  /**
+   * Unpublishes this object to remove public access.
+   * Removes 'public_user' from the IAC read permissions.
+   * This is an alias for publishObject({ publish: false }) for better code clarity.
+   * 
+   * @param {Object} options - Unpublishing options
+   * @param {boolean} [options.save=true] - If true, automatically saves the object after updating permissions
+   * @returns {Promise<RbtObject>} - Returns this object (saved if options.save is true)
+   * 
+   * @example
+   * // Unpublish an object (remove public access)
+   * await myObject.unpublishObject();
+   * 
+   * @example
+   * // Unpublish without auto-saving
+   * await myObject.unpublishObject({ save: false });
+   * // ... make other changes ...
+   * await myObject.save();
+   */
+  async unpublishObject(options = {}) {
+    return await this.publishObject({
+      publish: false,
+      save: options.save !== undefined ? options.save : true
+    });
+  }
+
+  /**
+   * Revokes access from specific users and/or user groups.
+   * 
+   * @param {Object} options - Access revocation options
+   * @param {string[]} [options.userIds=[]] - Array of user IDs to remove from read or write access
+   * @param {string[]} [options.groupIds=[]] - Array of group IDs to remove from read or write access
+   * @param {boolean} [options.write=false] - If true, removes write access; if false, removes read access
+   * @param {boolean} [options.save=true] - If true, automatically saves the object after updating permissions
+   * @returns {Promise<RbtObject>} - Returns this object (saved if options.save is true)
+   * 
+   * @example
+   * // Revoke read access from specific users
+   * await myObject.revokeAccess({ 
+   *   userIds: ['user_123', 'user_456'] 
+   * });
+   * 
+   * @example
+   * // Revoke write access from specific groups
+   * await myObject.revokeAccess({ 
+   *   groupIds: ['grpEditors'],
+   *   write: true 
+   * });
+   * 
+   * @example
+   * // Revoke access from users and groups
+   * await myObject.revokeAccess({ 
+   *   userIds: ['user_123'],
+   *   groupIds: ['grpViewers']
+   * });
+   * 
+   * @example
+   * // Revoke without auto-saving
+   * await myObject.revokeAccess({ 
+   *   userIds: ['user_123'],
+   *   save: false 
+   * });
+   */
+  async revokeAccess(options = {}) {
+    const {
+      userIds = [],
+      groupIds = [],
+      write = false,
+      save = true
+    } = options;
+
+    // Validate inputs
+    if (!Array.isArray(userIds)) {
+      throw new Error('userIds must be an array');
+    }
+    if (!Array.isArray(groupIds)) {
+      throw new Error('groupIds must be an array');
+    }
+
+    // Get current IAC settings
+    const iac = this.get('iac') || {};
+
+    // Determine which grant type to update (read or write)
+    const grantType = write ? 'writeGrants' : 'readGrants';
+
+    // Initialize grants if they don't exist
+    if (!iac[grantType]) {
+      iac[grantType] = {};
+    }
+
+    // Remove specified users
+    if (userIds.length > 0 && Array.isArray(iac[grantType].users)) {
+      iac[grantType].users = iac[grantType].users.filter(userId => !userIds.includes(userId));
+    }
+
+    // Remove specified groups
+    if (groupIds.length > 0 && Array.isArray(iac[grantType].userGroups)) {
+      iac[grantType].userGroups = iac[grantType].userGroups.filter(groupId => !groupIds.includes(groupId));
+    }
+
+    // Update the object
+    this.set('iac', iac);
+
+    // Save if requested
+    if (save) {
+      return await this.save();
+    }
+    return this;
+  }
+
+  /**
+   * Checks if this object is currently published (publicly accessible).
+   * 
+   * @returns {boolean} - True if 'public_user' is in the read grants, false otherwise
+   * 
+   * @example
+   * if (myObject.isPublished()) {
+   *   console.log('Object is public');
+   * }
+   */
+  isPublished() {
+    const iac = this.get('iac');
+    if (!iac || !iac.readGrants || !Array.isArray(iac.readGrants.users)) {
+      return false;
+    }
+    return iac.readGrants.users.includes('public_user');
+  }
+
+  /**
+   * Gets the current sharing permissions for this object.
+   * 
+   * @returns {Object} - Object containing read and write grants
+   * @returns {Object} returns.readGrants - Read access grants
+   * @returns {string[]} returns.readGrants.users - Array of user IDs with read access
+   * @returns {string[]} returns.readGrants.userGroups - Array of group IDs with read access
+   * @returns {string[]} returns.readGrants.organizations - Array of organization IDs with read access
+   * @returns {Object} returns.writeGrants - Write access grants
+   * @returns {string[]} returns.writeGrants.users - Array of user IDs with write access
+   * @returns {string[]} returns.writeGrants.userGroups - Array of group IDs with write access
+   * @returns {string[]} returns.writeGrants.organizations - Array of organization IDs with write access
+   * 
+   * @example
+   * const permissions = myObject.getSharing();
+   * console.log('Read users:', permissions.readGrants.users);
+   * console.log('Read groups:', permissions.readGrants.userGroups);
+   */
+  getSharing() {
+    const iac = this.get('iac') || {};
+    return {
+      readGrants: {
+        users: iac.readGrants?.users || [],
+        userGroups: iac.readGrants?.userGroups || [],
+        organizations: iac.readGrants?.organizations || [],
+        userSegments: iac.readGrants?.userSegments || []
+      },
+      writeGrants: {
+        users: iac.writeGrants?.users || [],
+        userGroups: iac.writeGrants?.userGroups || [],
+        organizations: iac.writeGrants?.organizations || [],
+        userSegments: iac.writeGrants?.userSegments || []
+      }
+    };
+  }
   async delete() {
     if (!this._internalData.type) {
       throw new Error('Cannot delete object without type');

package/dist/rbt_api.js

@@ -1,4 +1,8 @@
+var _excluded = ["enableRealtime"],
+  _excluded2 = ["enableRealtime"];
 function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
+function _objectWithoutProperties(e, t) { if (null == e) return {}; var o, r, i = _objectWithoutPropertiesLoose(e, t); if (Object.getOwnPropertySymbols) { var n = Object.getOwnPropertySymbols(e); for (r = 0; r < n.length; r++) o = n[r], -1 === t.indexOf(o) && {}.propertyIsEnumerable.call(e, o) && (i[o] = e[o]); } return i; }
+function _objectWithoutPropertiesLoose(r, e) { if (null == r) return {}; var t = {}; for (var n in r) if ({}.hasOwnProperty.call(r, n)) { if (-1 !== e.indexOf(n)) continue; t[n] = r[n]; } return t; }
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function _defineProperty(e, r, t) { return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
@@ -1119,6 +1123,10 @@ var RbtApi = /*#__PURE__*/function () {
      * - limit: An object to control the pagination of results. It includes:
      *    - offset: The starting point from where to fetch the results.
      *    - results: The maximum number of results to return.
+     * - requestAttrs: An array of attribute paths to include in the response (e.g., ['id', 'configs.title', 'configs.description']).
+     *                 If not provided, all attributes are returned.
+     * - excludeAttrs: An array of attribute paths to exclude from the response (e.g., ['details.log', 'internalData']).
+     *                 Excludes the specified paths and all their subpaths.
      * - resolveReferences: An array of attribute names whose references should be resolved in the returned objects.
      * - timeout: A numerical value in milliseconds to set a maximum time limit for the query execution.
      *
@@ -1127,6 +1135,8 @@ var RbtApi = /*#__PURE__*/function () {
      *     where: 'email="tom@pospa.com"',
      *     orderBy: { column: 'timeCreated', direction: 'DESC' },
      *     limit: { offset: 0, results: 50 },
+     *     requestAttrs: ['id', 'configs.title'],
+     *     excludeAttrs: ['details.log'],
      *     resolveReferences: ['translatableContent']
      *   });
      *
@@ -1140,6 +1150,8 @@ var RbtApi = /*#__PURE__*/function () {
         var _this6 = this;
         var params,
           paramsKey,
+          validParams,
+          invalidParams,
           defaultOrderBy,
           defaultLimit,
           mergedParams,
@@ -1155,6 +1167,21 @@ var RbtApi = /*#__PURE__*/function () {
               params = _args20.length > 1 && _args20[1] !== undefined ? _args20[1] : {};
               _context20.p = 1;
               //console.log('RBTAPI.query INIT', type, params);
+              // Validate parameters - reject invalid parameter names
+              validParams = ['type', 'where', 'orderBy', 'limit', 'resolveReferences', 'requestAttrs', 'excludeAttrs', 'timeout', 'enableRealtime'];
+              invalidParams = Object.keys(params).filter(function (key) {
+                return !validParams.includes(key);
+              });
+              if (!(invalidParams.length > 0)) {
+                _context20.n = 2;
+                break;
+              }
+              throw new Error("Invalid query parameter(s): ".concat(invalidParams.join(', '), ". Valid parameters are: ").concat(validParams.join(', ')));
+            case 2:
+              // Warn if enableRealtime is passed to query() - it should only be used by load()
+              if (params.enableRealtime) {
+                console.warn('[roboto-js] enableRealtime should not be passed to query(), only to load(). This parameter will be ignored.');
+              }
               params.type = type;
 
               // Default ordering and pagination
@@ -1175,11 +1202,11 @@ var RbtApi = /*#__PURE__*/function () {
               paramsKey = JSON.stringify(mergedParams);
               cacheEntry = this.requestCache[paramsKey];
               if (!(cacheEntry && currentTime - cacheEntry.time < 10000)) {
-                _context20.n = 2;
+                _context20.n = 3;
                 break;
               }
               return _context20.a(2, cacheEntry.val);
-            case 2:
+            case 3:
               // Create the response promise
               responsePromise = this.axios.post('/object_service/queryObjects', [mergedParams]); // Cache the promise of processing data, not just the raw response
               processingPromise = responsePromise.then(function (response) {
@@ -1195,18 +1222,18 @@ var RbtApi = /*#__PURE__*/function () {
               };
 
               // Await the processing promise for this call to get processed data
-              _context20.n = 3;
+              _context20.n = 4;
               return processingPromise;
-            case 3:
-              return _context20.a(2, _context20.v);
             case 4:
-              _context20.p = 4;
+              return _context20.a(2, _context20.v);
+            case 5:
+              _context20.p = 5;
               _t15 = _context20.v;
               delete this.requestCache[paramsKey]; // Ensure cache cleanup on error
               //console.log('RBTAPI.query ERROR', paramsKey, e);
               return _context20.a(2, this._handleError(_t15));
           }
-        }, _callee20, this, [[1, 4]]);
+        }, _callee20, this, [[1, 5]]);
       }));
       function query(_x11) {
         return _query.apply(this, arguments);
@@ -1272,6 +1299,8 @@ var RbtApi = /*#__PURE__*/function () {
           hitLogKey,
           loadedObjects,
           bulkMissLogKey,
+          enableRealtime,
+          queryParams,
           _iterator4,
           _step4,
           obj,
@@ -1359,7 +1388,10 @@ var RbtApi = /*#__PURE__*/function () {
                 });
                 this._loggedCacheEvents.add(bulkMissLogKey);
               }
-              mergedParams = _objectSpread(_objectSpread({}, params), {}, {
+
+              // Remove load-specific params that shouldn't be passed to query
+              enableRealtime = params.enableRealtime, queryParams = _objectWithoutProperties(params, _excluded);
+              mergedParams = _objectSpread(_objectSpread({}, queryParams), {}, {
                 where: "id IN (\"".concat(missingIds.join("\",\""), "\")")
               });
               _context22.n = 2;
@@ -1464,12 +1496,14 @@ var RbtApi = /*#__PURE__*/function () {
 
               // Create the loading promise and store it to prevent duplicate requests
               loadPromise = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee21() {
-                var res, _obj2, _setLogKey;
+                var _enableRealtime, _queryParams, res, _obj2, _setLogKey;
                 return _regenerator().w(function (_context21) {
                   while (1) switch (_context21.p = _context21.n) {
                     case 0:
                       _context21.p = 0;
-                      mergedParams = _objectSpread(_objectSpread({}, params), {}, {
+                      // Remove load-specific params that shouldn't be passed to query
+                      _enableRealtime = params.enableRealtime, _queryParams = _objectWithoutProperties(params, _excluded2);
+                      mergedParams = _objectSpread(_objectSpread({}, _queryParams), {}, {
                         where: "id=\"".concat(ids, "\"")
                       });
                       _context21.n = 1;